@bongos/core 1.19.567 → 1.19.569

package/.bongos-core.json

@@ -2,22 +2,22 @@
   "artifact": "bongos-core",
   "manifest_schema": 1,
   "generator": "scripts/gds/package-core.js",
-  "core_version": "1.19.567",
-  "core_contract": "1.19.567",
-  "source_commit": "086c24f62d0d594e3949cda82f35b6c73105e9c8",
+  "core_version": "1.19.569",
+  "core_contract": "1.19.569",
+  "source_commit": "5cdee5559949c616ec9d68e725884fb87424850e",
   "source_ref": "HEAD",
-  "built_at": "2026-09-06T20:18:34.727Z",
+  "built_at": "2026-09-06T20:34:30.476Z",
   "redaction": {
     "model": "docs-redacted+functional-verbatim",
-    "docs_redacted": 447,
+    "docs_redacted": 449,
     "agent_docs_stubbed": 24,
-    "functional_verbatim": 2037,
+    "functional_verbatim": 2038,
     "rules": 3,
     "gate_literals": 3,
     "gate": "passed"
   },
-  "file_count": 2508,
-  "tree_sha256": "0de4688c7206008f5e7ce542823b8efe4c438fc7debe1dffb116e3cfe63558d4",
+  "file_count": 2511,
+  "tree_sha256": "5c3c486ba0465ca763a11d15487bb2b540558af8430a93ea27a07323d75352e1",
   "files": [
     {
       "path": ".claude/skills/blocker-review/SKILL.md",
@@ -392,7 +392,7 @@
     {
       "path": "clients/bongos-client/index.d.ts",
       "mode": "0000644",
-      "sha256": "f7c16a633c0f5c3ba13421815d08f5fb935b8737433acffe72fef018adffbf25"
+      "sha256": "2b37686507b5ea701c19a1086352a2f0c84eae46510ef12b3a601c18812610c6"
     },
     {
       "path": "clients/bongos-client/index.mjs",
@@ -1789,10 +1789,20 @@
       "mode": "0000644",
       "sha256": "4e27106f8c9251b788d13bcfc64f29637bb0b009c18102c9b7dd9d70b80400dc"
     },
+    {
+      "path": "docs/adr/0255-a-public-lists-ordering-is-part-of-its-payload.md",
+      "mode": "0000644",
+      "sha256": "2c82050a733a0a82dde5079bbc486fc3378b2be954817a811aab92b9e46c9c5b"
+    },
+    {
+      "path": "docs/adr/0256-the-visibility-ceiling-is-the-sign-in-gate-too-and-the-reader-moves-to-the-composer.md",
+      "mode": "0000644",
+      "sha256": "4b7d5b4ca5ad92a128235a6c3407617f2d8b34c26ed6e1c8b2a72e63eed7adac"
+    },
     {
       "path": "docs/adr/README.md",
       "mode": "0000644",
-      "sha256": "2e2089caa50d1b7442fee96b14f758e6e29974490a8729cfa9401a59e70077b4"
+      "sha256": "52422b934d0b3245605ec0913049be65768a814a6f9aee5f7ad8149c4221a093"
     },
     {
       "path": "docs/api-reference.md",
@@ -1802,7 +1812,7 @@
     {
       "path": "docs/api/openapi.json",
       "mode": "0000644",
-      "sha256": "b4c2891985427587d5a065b6e7d69638c5cd554d42d5eb22572b9c82f898431f"
+      "sha256": "9148616a367b2f7486a8f14c0f7ecf9ed367bd552075b15c4f2b0f3dd40712db"
     },
     {
       "path": "docs/architecture.md",
@@ -2667,7 +2677,7 @@
     {
       "path": "docs/file-map.md",
       "mode": "0000644",
-      "sha256": "8b756e1acdec79324f026463292134b1e80613f207015d65fe5f1d158476c306"
+      "sha256": "dd40cd29025789ec5a9447aa44ec6c7d3bee6aaae183c65713a6a3ca8ed8275b"
     },
     {
       "path": "docs/handoff-template.md",
@@ -2677,7 +2687,7 @@
     {
       "path": "docs/module-api-changelog.md",
       "mode": "0000644",
-      "sha256": "cb50b3fb2a66dc2e8c4e69f97055192f33e21fb33089f2c77313f43ae6daea09"
+      "sha256": "5942f6c9fae093d6fbb85032ca496e5f0549cc5044d8ffa4ecb90c3c9d2695dd"
     },
     {
       "path": "docs/modules-contract.md",
@@ -6047,7 +6057,7 @@
     {
       "path": "modules/platform-identity/platform-identity.js",
       "mode": "0000644",
-      "sha256": "5cccd4a776abc25f0e57814963b1dc00b8a7a49b5024d2c0b88c85d8312091f1"
+      "sha256": "54f44f6292729e822083671913dc89de28ede760dc88028ce4a18219ce006ab3"
     },
     {
       "path": "modules/platform-identity/pollers/code-sweep.js",
@@ -6072,7 +6082,7 @@
     {
       "path": "modules/platform-identity/projects-feed.js",
       "mode": "0000644",
-      "sha256": "fac8b2f750a5a9fb3c05290223292449b04a45c33b6976da285126616a8e9e91"
+      "sha256": "9a8a22d21089770ec80f709d27f798eab6101cfaead18942c439f7c8689ef041"
     },
     {
       "path": "modules/platform-identity/publish-gate.js",
@@ -6102,7 +6112,7 @@
     {
       "path": "modules/platform-identity/routes/projects.js",
       "mode": "0000644",
-      "sha256": "af098885cd3d7e83a9302c7eb8213c3448d73ab79be53b2b5ff1467fbab3685a"
+      "sha256": "7db130e5fe698bc133475d5c7ab90583fbe3683ac1d11b2542c56e76a7da4cfd"
     },
     {
       "path": "modules/platform-identity/routes/public-profile.js",
@@ -7527,12 +7537,12 @@
     {
       "path": "package-lock.json",
       "mode": "0000644",
-      "sha256": "88e992e7dc0acfb523d3c55d84184674c584a95ae5e9b9a7339e1ef8d39954c8"
+      "sha256": "e2279fd35b142a93a9037638445d5e6e616c69cd8322d05fad2aa228a5de3515"
     },
     {
       "path": "package.json",
       "mode": "0000644",
-      "sha256": "ef5db9f2e98f980f0eea7ee5409a29d544ac73edcf33a15f8ecde5863db87e8d"
+      "sha256": "1ba4dccdc1e8d591a783bdac3b0ac4f0d121ad687fef73347ac56e32e69524f7"
     },
     {
       "path": "public-docs/index.html",
@@ -7972,7 +7982,7 @@
     {
       "path": "scripts/gds/fitness.js",
       "mode": "0000644",
-      "sha256": "c825842ed0e4bf34fa9fa7bc7e711967d1aa0efdde4132253c51231c6ccbd22e"
+      "sha256": "a93e0d79fe1d557d09711e9b9bb62ffc7687b91ee2981b71eb89176eb0fc2ce6"
     },
     {
       "path": "scripts/gds/gate-review.js",
@@ -8942,7 +8952,7 @@
     {
       "path": "src/bongos/auth-admission.js",
       "mode": "0000644",
-      "sha256": "46dc4adc21f138b4d9fdfe06c85f71d591a81357050d48d72b6272ba86a09d3b"
+      "sha256": "8dc4cc0ab956d387b8044c22e83fce883f2f0129ed27c03503f7348e9d4f00bb"
     },
     {
       "path": "src/bongos/auth-config.js",
@@ -9077,7 +9087,7 @@
     {
       "path": "src/bongos/project-door.js",
       "mode": "0000644",
-      "sha256": "045c0edceb0f71c3b488471ffb3a1c20c58014d0592c9ac44572245a7eb08960"
+      "sha256": "60a342af5b1d4aaeb781faf5bfea75d69a32b9bba71d0740ccc4ca1a9af2bba4"
     },
     {
       "path": "src/bongos/project-settings.js",
@@ -9117,7 +9127,7 @@
     {
       "path": "src/bongos/routes/auth.js",
       "mode": "0000644",
-      "sha256": "4c26db2cae7070a44523053d369da83a41ed38677b46292da927b061a398a4eb"
+      "sha256": "f7e24d83d5fceceb33eacc7d82ee8136a2177bb190e5b912e5857ffc07090009"
     },
     {
       "path": "src/bongos/routes/backup.js",
@@ -9142,7 +9152,7 @@
     {
       "path": "src/bongos/routes/instance.js",
       "mode": "0000644",
-      "sha256": "5b85f187b94282cd1ec5ece022238c4b30048f999c4347f19081bbaed32795fb"
+      "sha256": "c3bfdf5f1242fe4bbbb51ea79401dd5ae09cca95adc475e0dc0e5c76055677c4"
     },
     {
       "path": "src/bongos/routes/live.js",
@@ -9212,7 +9222,7 @@
     {
       "path": "src/branding.js",
       "mode": "0000644",
-      "sha256": "8885ee12599cdfdaf9bdb073185c83a5532bdc46d07edaeab42e36ccdc12f8e1"
+      "sha256": "2bbb5774c9ae8659b4d5ce9b62cb558d28d036b2aa0075f9329ae85c15734a2d"
     },
     {
       "path": "src/build-info.js",
@@ -9232,7 +9242,7 @@
     {
       "path": "src/module-api.js",
       "mode": "0000644",
-      "sha256": "318a0b749a46e513641ebec57124282b811631fe0037a166f50abd28d3b63f40"
+      "sha256": "6c1005562c9950b7cee858382e3cfd643f5c2be27918859de46927c2fbd29c06"
     },
     {
       "path": "src/module-loader/catalog.js",
@@ -9304,6 +9314,11 @@
       "mode": "0000644",
       "sha256": "f7434d510d656e5081f735d1f9356ecb11e8c3630a86a86137c3290134541c8d"
     },
+    {
+      "path": "tests/admission_ceiling_gate.mjs",
+      "mode": "0000644",
+      "sha256": "79c216e3ad3d91388a4a48f4ec5f3af9cf440d82791f05a1eb89860573be8dff"
+    },
     {
       "path": "tests/adopt_detect.mjs",
       "mode": "0000644",
@@ -11012,7 +11027,7 @@
     {
       "path": "tests/joinability_invite_only.mjs",
       "mode": "0000644",
-      "sha256": "5311e076e8a72b993a235e57ebc54c9ecd529ccd31b65609432677a12e15e85d"
+      "sha256": "0c2c540a794fcdafbdf4c496f2dd3efc508edfb9f30f88a6c0f977fc99bb75cc"
     },
     {
       "path": "tests/joinability_open.mjs",
@@ -12507,7 +12522,7 @@
     {
       "path": "tests/visible_projects_feed.mjs",
       "mode": "0000644",
-      "sha256": "c5d4a17ba9765069a7850fef5d3843e076fbd08edbc7d690a36e2ff4299d10c2"
+      "sha256": "a15bfe5f3b664a9daa4f45b80eb7a5bee2b2c630198439352c170fc44c4b2025"
     },
     {
       "path": "tests/wandering_prefs.mjs",

package/clients/bongos-client/index.d.ts

@@ -90,7 +90,7 @@ export interface GetMyProjectsResponse { owned: unknown; building: unknown; appl
 export interface GetOverrideRequestsResponse { requests: unknown }
 export interface GetProfilesHandleResponse { account: unknown; cross_project: unknown }
 export interface GetProjectSettingsResponse { rows: unknown }
-export interface GetProjectsFeaturedResponse { projects: unknown }
+export interface GetProjectsFeaturedResponse { projects: unknown; page: PageInfo }
 export interface GetProjectsResponse { projects: unknown }
 export interface GetProvisioningFleetResponse { instances: unknown }
 export interface GetProvisioningGithubAppStatusResponse { ok: boolean; status: unknown; ready: unknown; terminal: unknown; domain: unknown; instance_status: unknown; app_slug: unknown }

package/docs/adr/0255-a-public-lists-ordering-is-part-of-its-payload.md

@@ -0,0 +1,169 @@
+# ADR 0255 — A public list's ordering is part of its payload, so an anonymous row must be ordered by nothing
+
+- **Status:** accepted
+- **Date:** 2026-09-06
+- **Task:** [task 1003561](https://cloudbongos.com/builders#/task/1003561) (BONGOS-V1, goal 1000046 — *Project creation*), which absorbed [task 1003560](https://cloudbongos.com/builders#/task/1003560)
+- **Deciders:** Claude, building against ADR 0182 D2a
+- **Related:** [ADR 0182](<redacted>.md) D1/D2a/D3 (the join door, the stealth redaction, and `featured`'s remaining ranking job) · [ADR 0252](<redacted>.md) §5.3 (the per-IP ceiling on this route) · [ADR 0253](<redacted>.md) (`visibility_source` / `visibility_reported_at`, the `DOOR_KNOWN_SQL` predicate this feed joins) · [ADR 0119](0119-api-pagination-contract.md) (the `?limit=&offset=` contract this feed was the last public list to hold out on)
+
+---
+
+## 1. The leak
+
+`modules/platform-identity/projects-feed.js` takes considerable trouble over what a stealth
+project may say. `feedShapeFor()` rebuilds an anonymous row from an allow-list —
+`STEALTH_ANONYMOUS_KEEPS = ['state', 'orb']` — and the constant's own comment states the
+threat model it is defending against:
+
+> No stable per-project key appears here on purpose: an id, a slug or a hash of the origin
+> would each let an observer who kept yesterday's public feed name the project that went
+> stealth today. Black holes are interchangeable, which is the whole point of the metaphor.
+
+The feed then sorted `ORDER BY featured DESC, updated_at DESC` and handed the observer a
+stable per-project key anyway. **Ordering is a covert column.** Every row's position is the
+result of a comparison, and enough comparisons reconstruct the key the comparisons were made
+on. Three consequences followed, and the third is the one that matters:
+
+1. **`updated_at` was published despite being deliberately withheld.** The projection
+   excludes it on purpose — the same file notes that feature toggles and client
+   re-registration bump it, so as a public "last updated" it would lie. Sorting by it
+   published it anyway, one comparison at a time.
+2. **A black hole sat between named neighbours**, whose own relative order is visible. That
+   brackets the hidden row's `updated_at` between two rows an observer can identify by name,
+   which is a far narrower fact about it than "a project exists."
+3. **A black hole MOVED when its hidden project was touched.** This is the activity oracle.
+   Two fetches of a public, CORS-open, unauthenticated feed are enough to learn *that the
+   project behind this particular black hole was just active* — and correlating that with
+   anything happening in the open (a release, a post, a commit) is how an anonymous row gets
+   a name. Position was also stable enough between touches to follow one black hole across
+   snapshots, which is precisely the "stable per-project key" the payload refuses to carry.
+
+The redaction was doing its job. The `ORDER BY` was undoing it.
+
+## 2. Decision — the rule
+
+**A row may be ordered only by what it publishes.**
+
+- An **identified** row (`public` → planet, `private` → star) publishes `created_at` and
+  `origin`, so it is ordered by those, beneath `featured` — ADR 0182 D3's one remaining
+  job, ranking among rows already on the map. The resulting order is a **pure function of
+  the wire payload**: a reader holding nothing but the response can reproduce it. That is
+  the strongest available statement that a sort leaks nothing, and it is worth stating as
+  the positive form of the rule rather than as an absence of known leaks.
+- An **anonymous** row (`stealth`, and anything unrecognised) publishes nothing, so it is
+  ordered by nothing about itself. The black holes are collated into **one trailing block**,
+  permuted by a **keyed, rotating hash**.
+
+Concretely, four sort terms, of which the first partitions the two blocks so that no later
+term ever compares across them:
+
+```sql
+ORDER BY (visibility IN ('public','private')) DESC,
+         ((visibility IN ('public','private')) AND featured) DESC,
+         (CASE WHEN (visibility IN ('public','private')) THEN created_at END) DESC,
+         (CASE WHEN (visibility IN ('public','private')) THEN origin
+                                                        ELSE md5(origin || $1::text) END) ASC
+```
+
+Terms 2–4 are **guarded**, and that is the whole trick. Without the guards the trailing
+block would simply be re-sorted by `featured`, then `created_at`, then `origin` — none of
+which a black hole publishes, and `created_at` in particular would place it by its listing
+date, which narrows *which* project it is for anyone who watched the catalog fill up. The
+"anonymous rows go last" half without the "and are blanked" half is not a fix.
+
+The identified-state list is **derived from `ORB_BY_STATE`**, never re-typed, and is an
+**allow-list**: a state this file does not know sorts into the anonymous block, the same
+fail-closed direction `orbStateOf()` already takes for rendering. A deny-list would draw a
+future fourth enum value as a black hole and then sort it by its `created_at` — anonymous in
+the payload, identified in the ordering, which is the worst of both.
+
+## 3. Why the anonymous block is keyed, and why it rotates
+
+Two separate properties, both load-bearing:
+
+**Secret.** Origins are guessable — they are domain names. A permutation an observer could
+compute (`md5(origin)`, `md5(origin || today)`, or plain alphabetical order by `origin`)
+would let them hash their candidate origins, match the resulting ranks against the live
+block, and de-anonymise every black hole in one pass. The salt is therefore a random
+per-process key. Nothing persists it, compares it across restarts, or reads it back — it
+only ever *orders* rows — so there is no key to configure, distribute, rotate by hand, or
+leak from disk.
+
+**Rotating.** A permanently stable permutation would still make **position** a durable
+per-project handle: an observer could not name a black hole, but could follow one across
+months and watch it appear and disappear. The salt therefore also carries a coarse epoch
+(24h), so the whole block is re-dealt on a fixed period regardless of process lifetime.
+Within one period the order is stable, which is what lets the pages of a single listing agree
+with each other.
+
+`md5` is a permutation here, not a security primitive; the unpredictability comes from the
+secret salt, and it is the most portable hash available without pgcrypto.
+
+## 4. Pagination is the same decision, not a neighbouring one
+
+Task 1003560 asked for a cap on an "unbounded" feed. **That premise was already stale:**
+`<redacted> = 500` shipped with the feed itself, and its own comment named the
+cap "the cheap half of that trade — the honest half is pagination, which is its own task."
+The surviving work was pagination only, and pagination edits the same single SQL statement
+this ADR rewrites — so the two tasks were built together and 1003560 was merged into 1003561.
+
+- **`?limit=&offset=`, per ADR 0119**, whose helper (`parsePagination` / `pageMeta`) this
+  route was the last public list not to use.
+- **No cursor, and that is a security property as much as a style one.** An opaque cursor
+  over this feed would have to encode a sort position, and the obvious encoding — the last
+  row's timestamp — is exactly the side-channel §2 exists to close. An offset encodes nothing
+  about any row.
+- **The default page size *is* the maximum (500), deliberately.** A caller that sends no
+  parameters gets byte-for-byte what it got before. One consumer of this feed is a static
+  orbs site in **another repository** that this commit cannot update; a smaller default would
+  have silently shrunk somebody else's map. `page` is added *beside* the existing `projects`
+  key rather than wrapping it, so the wire change is additive and every consumer that
+  destructures `data.projects` keeps working.
+- **Paging cannot aim more fan-out than one request already could.** `?limit=` only ever
+  shrinks a page. `?offset=` reaches deeper, and the cost of that is bounded not by the
+  request count but by `project-stats.js`'s 10-minute per-origin cache: a second page reaches
+  origins the cache would have covered anyway, and re-reading any page is free. The per-IP
+  limiter (120 reads/60s, ADR 0252 §5.3) is unchanged and still bounds how often.
+- **No `total`.** Counting is a second pass over the same predicate for a number nothing
+  reads today; `pageMeta()` makes it optional for that reason. A caller learns there is more
+  the standard way: `projects.length === page.limit` means ask for the next offset.
+
+## 5. Alternatives weighed
+
+| Option | Why not |
+|---|---|
+| Sort every row by `created_at DESC` | `created_at` is nulled on anonymous rows, so a black hole would be *positioned* by a date its own row refuses to carry — and its listing date is a strong hint at which project it is. Worse than the bug being fixed. |
+| Order the anonymous block alphabetically by `origin` | Deterministic and timing-free, but position then reveals the alphabetical rank of a hidden domain — an oracle against a candidate set. |
+| `ORDER BY random()` for the anonymous block | Kills both the timing signal and the durable handle, maximally. Rejected because it breaks pagination outright: a black hole could appear on two pages or none, and the count of black holes — which *is* public by design — would stop being stable within one listing. |
+| Drop the anonymous rows from the feed entirely | Contradicts ADR 0182 D2a, which exposes existence on purpose. A black hole is a deliberate feature of the map. |
+| Keep `updated_at` but bucket it coarsely (e.g. by week) | Still a timing channel, only quieter, and it would need a defensible bucket width nobody could justify. A sort key that must be blurred is a sort key that should not be there. |
+
+## 6. What this does NOT close
+
+Stated plainly, because a privacy fix that oversells itself is worse than none:
+
+1. **Existence and count are public by design.** The number of black holes on the map is
+   visible and always was — that is ADR 0182 D2a, not a defect.
+2. **The identified set still changes when a project goes stealth.** An observer diffing
+   yesterday's feed against today's sees a named project leave the identified block while
+   the black-hole count rises by one, and can name it that way. This is a **larger** channel
+   than the ordering one and it is untouched here: it is inherent in publishing a named list
+   at all, and closing it needs a different mechanism (a delay, a decoy, or accepting that a
+   project's *departure* from the public list is public). Filed separately rather than
+   silently implied to be fixed.
+3. **Position is stable within one epoch.** Two snapshots taken the same day can still tell
+   black holes apart, though not name them. The rotation bounds this to the epoch.
+
+## 7. Consequences
+
+- The map's identified rows now sort by **listing date**, not last-touched. The feed stops
+  churning on `updated_at` bumps that meant nothing to a reader anyway.
+- `<redacted>` is renamed `PUBLIC_FEED_MAX_PAGE_SIZE`, which is what it now is:
+  a per-request fan-out ceiling that doubles as the default page size.
+- `listPublicProjects({ pool, limit, offset, now })` clamps its own window as well as the
+  route clamping it, because it is a module-public function and the ceiling is a fan-out
+  bound — it may not depend on every future caller remembering to pass one.
+- Proof lives in `tests/visible_projects_feed.mjs`, which now pins the guards structurally:
+  the first sort term partitions the blocks, every identified key is guarded, there is no
+  fifth unguarded term, `updated_at` appears nowhere in the query, and the salt is bound as
+  a parameter rather than interpolated.

package/docs/adr/0256-the-visibility-ceiling-is-the-sign-in-gate-too-and-the-reader-moves-to-the-composer.md

@@ -0,0 +1,204 @@
+# ADR 0256 — The visibility ceiling binds the SIGN-IN gate too, and the knob reader moves to the composer
+
+- **Status:** accepted
+- **Date:** 2026-09-06
+- **Task:** [task 1003579](https://cloudbongos.com/builders#/task/1003579) (BONGOS-V1, goal 1000046 — *Project creation*, criterion `proj-join-policy`)
+- **Deciders:** Claude, under the Archon's standing scope
+- **Closes:** [ADR 0247](<redacted>.md)'s written *KNOWN LIMIT* — *"the door narrows, the sign-in gate does not"*
+- **Implements:** [ADR 0182](<redacted>.md) D6's **Self-join** column (the half ADR 0247 enforced was the *Applications* column)
+- **Related:** [ADR 0194](<redacted>.md) (the one-reader move this repeats one level up; D2's fail-closed rule) · [ADR 0192](<redacted>.md) §2 (where that fail-closed rule comes from) · [ADR 0050](<redacted>.md) (the legacy `OPEN_XENOS_ENROLLMENT` flag) · [ADR 0190](<redacted>.md) (how a knob reaches the instance)
+
+---
+
+## Context
+
+ADR 0182 D6 gave the project plane a two-column table — who may **self-join**, and who
+may **apply** — and one composition rule: *visibility sets the ceiling; join policy may
+only narrow it.* ADR 0247 built that composition (`src/bongos/project-door.js`,
+`projectJoinDoor()`) and wired it to the **applications** column: the public
+`POST /access-requests`, and through it the hall's landing form, the CLI and the hub's
+join relay.
+
+It did not wire the **self-join** column, and said so in as many words:
+
+> **KNOWN LIMIT — the door narrows, the sign-in gate does not.** `openEnrollmentEnabled()`
+> is still `joinabilityMode() === 'open'` … Closing it means composing the ceiling into
+> `src/bongos/auth-admission.js`, a kernel admission surface this task was scoped out of
+> touching.
+
+So an owner who took their project off the map — `visibility: private`, or `stealth`, or
+`joinGrant: view` — while leaving `joinability: open` got two surfaces answering the same
+stranger differently: the application endpoint queued a request for review, and a
+first-time GitHub sign-in handed the same person a `xenos` account with no request and no
+invite. Half of D6's table held only where the owner had never explicitly opened enrolment.
+
+The gap's direction was safe — the door was *stricter* than the gate, never looser, so
+nobody was admitted whom `joinability` alone had not already admitted — which is why
+ADR 0247 shipped it as a written limit rather than halting.
+
+## Decision 1 — `openEnrollmentEnabled()` reads the composed door, and nothing else moves
+
+```js
+function openEnrollmentEnabled(deps = {}) {
+  return effectiveJoinDoor(deps) === 'open';
+}
+```
+
+That one expression is the whole behavioural change. It is deliberately the *same* SR-19
+move ADR 0194 D1 made when `joinabilityMode` replaced the raw env flag, one level further
+up: the four sign-in call sites (`auth-github.js` web + device, `auth-idp.js` federated
+twins), `firstTimeAdmissionBlocked`, `webAdmissionStatus` and the manifest's
+`admission.policy` all read this one function, so they follow without being touched. Two
+surfaces that ask the same function cannot answer one stranger differently; two surfaces
+that each read "the relevant knob" always eventually do.
+
+**Nothing changes for any existing project.** `src/branding.js` normalises an absent
+`visibility` to `public` and an absent `joinGrant` to `full` (ADR 0247 D1's "the default
+is the value that narrows nothing"), so `public` + `full` puts the ceiling at `open` and
+the composed door is `joinability` verbatim. Every live project is `public`; a self-hosted
+instance carrying the legacy `OPEN_XENOS_ENROLLMENT` flag (ADR 0050) still resolves to
+`open` through the same branch it always did.
+
+**The ceiling closes self-enrolment and nothing else.** An invited first-timer, an
+existing builder and the configured `firstAdmin` are all admitted to a `private` or
+`stealth` project exactly as before — `firstTimeAdmissionBlocked`'s other three terms are
+untouched. An owner taking their project off the map is closing the front door, not
+evicting the people they let in, and a `private` project that locked out its own founder
+would be the R62 bootstrap dead-end all over again.
+
+## Decision 2 — The manifest's `admission.policy` reports the GATE; `brand.project` keeps reporting the SETTING
+
+`GET /instance` carries both, and after this change they can differ: a `private` +
+`joinability: open` project reports `brand.project.joinability: "open"` and
+`admission.policy: "invite-only"`.
+
+That is not a contradiction, it is the two questions the manifest has always been
+answering — *what did the owner set?* and *what will the gate do?* — finally giving
+honest answers to both. Before this, `admission.policy` said `open` while the gate would
+have refused, and a CLI reading it to decide whether to offer `bongos login` believed it.
+
+**The narrowed value leaks no state.** `admission.policy` is binary and `invite-only` is
+already what every `apply` project reports, so `private`, `stealth`, a `view` grant and a
+plain `invite_only` project remain indistinguishable through it — ADR 0247 D3's rule that
+a refusal may never be read backwards into a state, preserved because the field had only
+two values to begin with. Keeping the read-back honest on `brand.project` is the other
+half of the same rule (ADR 0194 D1: the manage page's *"did my save take effect?"* must
+show the owner's own value, which is why the ceiling is composed on the instance rather
+than folded into what the platform pushes).
+
+## Decision 3 — The knob reader moves to the composer, because the alternative is a require cycle
+
+`joinabilityMode()` and its `legacyOpenEnrollmentFlag()` helper moved from
+`src/bongos/auth-admission.js` into `src/bongos/project-door.js`. `auth-admission`
+**re-exports** `joinabilityMode`, so `auth.js`, the doorway's `api.joinabilityMode` and
+every existing import keep resolving; the doorway surface is unchanged, so this needs no
+`module.json` floor bump (contrast ADR 0194 D7, which added an export).
+
+The reason is mechanical and worth writing down, because the obvious patch does not
+compile past the gate. `project-door.js` resolved its own `joinability` input with a lazy
+`require('./auth-admission')`. The moment the admission gate requires the door back, the
+two files point at each other — and `fitness-ratchets.js` counts require cycles from the
+**source text**, so a lazy require inside a function body is still an edge. The
+`require_cycle_count` ratchet is shrink-only at 4; adding a fifth is a hard build failure,
+and it would be right to fail: a cycle here is a real one, not a measurement artifact.
+
+Three ways out were considered:
+
+1. **Duplicate the composition in the gate.** Rejected on sight — it is the exact drift
+   SR-19, ADR 0194 and ADR 0247 were each written to prevent, and the ratchet would only
+   be measuring that we had hidden it.
+2. **Make `joinabilityMode` a required argument of `effectiveJoinDoor`, supplied by the
+   doorway.** Zero new files and no cycle, but it turns `effectiveJoinDoor()` — the
+   no-argument call ADR 0247 D2 published as *the* one call a door surface makes — into a
+   footgun that silently answers `invite_only` for any future caller who forgets.
+3. **Move the reader to the composer** (chosen). The file whose header already says it is
+   *"composed from every knob that can close it"* now owns the readers for all of them.
+   The dependency runs one way — gate → door → branding/env — `effectiveJoinDoor()` keeps
+   working with no arguments, and one lazy cross-require disappears rather than a second
+   appearing.
+
+`joinabilityMode` was only ever in the admission file because the admission gate was its
+first caller (ADR 0194); the layering was accidental, and this task is what surfaced it.
+Its `[auth]` log prefix is kept verbatim across the move — operators grep sign-in refusals
+by it, and the child logger's `src` field already says which file emitted the line.
+
+## Decision 4 — `locked` still cannot fire from the sign-in gate
+
+`openEnrollmentEnabled` passes **no** `publishable` verdict, so the tri-state stays `null`
+— *no verdict* — and the door is answered on the three stored knobs alone. ADR 0247 D4's
+finding has not changed: neither plane holds a live, correct dark-matter verdict, the
+instance's branding pack carries no `description`, and the hub's cached copy says every
+live project is dark matter. A gate that read that column would refuse every first sign-in
+on the platform. The `deps` object is forwarded verbatim, so wiring a verdict later is one
+argument at one call site, not a redesign.
+
+## Decision 5 — The sign-in refusal page tests the door, not the knob
+
+`routes/auth.js` chose between its two refusal pages on
+`joinabilityMode() === 'invite_only'`, which was equivalent to the door only while the
+knob *was* the door. Under Decision 1 the ceiling can close a project whose `joinability`
+still reads `apply` — `stealth`, or a `view` grant — and that page would have handed
+the stranger a "request access at the hall" form the application endpoint 403s. The test
+becomes `effectiveJoinDoor() !== 'apply'`: `apply` is the only door that accepts an
+application, so everything else lands on the invite-only page.
+
+**Both closed doors show the same sentence, and that is the point.** Distinguishing them
+would be the state read-out ADR 0247 D3 forbids; showing one honest "this project takes no
+applications, an invite is the way in" for all of them is the same indistinguishability
+the application endpoint already has. `open` cannot reach this branch (the gate would have
+admitted) and `locked` cannot fire at all (D4), so in practice it is `invite_only`.
+
+## What was deliberately not built
+
+- **No new refusal COPY.** The two existing pages are reused verbatim; only which one is
+  chosen changed (Decision 5). Saying *"this project is private"* would be the state
+  read-out ADR 0247 D3 forbids, and a sentence written for this case alone would make the
+  refusals distinguishable — the same leak by another route.
+- **The hall landing's door copy is left on the raw knob — a NAMED limit, in the same
+  shape ADR 0247 named this one.** `modules/hall-ui/public/hall-render.js` renders one
+  landing per `window.__BRANDING__.project.joinability`, and its own comment already calls
+  that *"cosmetic — the server refuses on its own terms either way"*. After this change
+  a `private` + `open` project's landing still reads "sign in and you're in" while the gate
+  refuses, so the visitor meets the truth one click later instead of on the page. Fixing it
+  properly means the server injecting the COMPOSED door into the pack the browser reads
+  — re-deriving the composition in browser JS is the drift this whole line of ADRs
+  exists to prevent — which is a public-field addition, not a side effect of this one.
+  It is reachable only on a project whose owner has taken it off the map, and every live
+  project is `public` (ADR 0247's own Consequences).
+- **No `webAdmissionStatus` special case.** It reads `openEnrollmentEnabled()` like the
+  gate does, and `tests/web_admission_status.mjs` already sweeps the input space asserting
+  the probe and the gate agree. The composition arrives there for free; a second code path
+  would be a second thing to keep in sync.
+- **No manage-page control for the grant.** Still a rendering task, unchanged from
+  ADR 0247's "what was deliberately not built".
+
+## Consequences
+
+- ADR 0182 D6's table is enforced in **both** columns, from one function, on every surface
+  that admits or refuses a stranger.
+- `tests/admission_ceiling_gate.mjs` boots a real instance on `visibility: private` +
+  `joinability: open` — the exact pair ADR 0247's limit paragraph named — through the
+  production channel (`<PREFIX>_VISIBILITY` / `<PREFIX>_JOINABILITY` in the environment,
+  read once through the memoized pack, as the provisioning runner writes them into
+  `web.env`). It then sweeps all 75 knob combinations asserting `openEnrollmentEnabled()`
+  equals *"the composed door is `open`"*, and that **exactly one** combination —
+  `public` / `full` / `open` — self-enrols.
+- `src/bongos/project-door.js` no longer imports `src/bongos/auth-admission.js`; the
+  `KERNEL_FILES` note in `fitness.js` that described that import is updated with it.
+  `require_cycle_count` stays at 4.
+- A surface that genuinely wants the owner's *setting* rather than the *door* — the
+  manifest read-back, the hall's door copy — still calls `joinabilityMode()`. The
+  distinction is now written on the function itself, because "read the knob" and "decide
+  admission" being the same call is what produced this bug.
+
+## Alternatives rejected
+
+- **Composing the ceiling into the `joinability` value the platform pushes**, so the
+  instance needs no second reader. Rejected here for the same reasons ADR 0247 rejected
+  it: stored and pushed values would disagree, the manage page's read-back would break,
+  and it cannot express `locked`. This task is additional evidence for that call — the
+  read-back is exactly what `tests/admission_ceiling_gate.mjs` now pins.
+- **Leaving the gap and documenting it harder.** It was already documented; a written
+  limit that survives two releases is a bug with good manners. The direction being safe
+  bought the deferral once, not indefinitely — and the owner-facing statement *"my project
+  is private"* is false while any stranger can still sign themselves in.