@bongos/core 1.19.578 → 1.19.579

package/.bongos-core.json

@@ -2,22 +2,22 @@
   "artifact": "bongos-core",
   "manifest_schema": 1,
   "generator": "scripts/gds/package-core.js",
-  "core_version": "1.19.578",
-  "core_contract": "1.19.578",
-  "source_commit": "a3f42dff6ab98712306ee86eaedf8191cafa3340",
+  "core_version": "1.19.579",
+  "core_contract": "1.19.579",
+  "source_commit": "8b206e9f473df316fc1981854a479d1ba509d76e",
   "source_ref": "HEAD",
-  "built_at": "2026-09-07T17:15:54.070Z",
+  "built_at": "2026-09-07T17:52:17.407Z",
   "redaction": {
     "model": "docs-redacted+functional-verbatim",
-    "docs_redacted": 451,
+    "docs_redacted": 452,
     "agent_docs_stubbed": 24,
     "functional_verbatim": 2047,
     "rules": 3,
     "gate_literals": 3,
     "gate": "passed"
   },
-  "file_count": 2522,
-  "tree_sha256": "96be19d76442ed1b3e663525652a70c6ef60434e80d4ad907df8e294be5f38fe",
+  "file_count": 2523,
+  "tree_sha256": "bd13bef2ae141fa766ed5c8a67894be21c62263079037e763bc1533ff500afdc",
   "files": [
     {
       "path": ".claude/skills/blocker-review/SKILL.md",
@@ -1792,7 +1792,7 @@
     {
       "path": "docs/adr/0255-a-public-lists-ordering-is-part-of-its-payload.md",
       "mode": "0000644",
-      "sha256": "2c82050a733a0a82dde5079bbc486fc3378b2be954817a811aab92b9e46c9c5b"
+      "sha256": "9240caa363815ca9bbd49993bd73ecda85c6f91280ac152f344f69c77928bd22"
     },
     {
       "path": "docs/adr/0256-the-visibility-ceiling-is-the-sign-in-gate-too-and-the-reader-moves-to-the-composer.md",
@@ -1809,10 +1809,15 @@
       "mode": "0000644",
       "sha256": "28f3644d3d9dcd2985b7e3f42cf2135af86203eee35b6e509d1ff98f630f1228"
     },
+    {
+      "path": "docs/adr/0259-a-projects-departure-from-the-public-list-is-public.md",
+      "mode": "0000644",
+      "sha256": "772b9153d882f6bbd5000ee90b83e05d550ee4f04d4f5392db36e223d9a58c59"
+    },
     {
       "path": "docs/adr/README.md",
       "mode": "0000644",
-      "sha256": "30bb35e65ebd2dc8c5eb0aad7e30d5875d0c764265f398547abd545b62ee7d7c"
+      "sha256": "bf52fa642d9a576a88f961b46fbb68352e3fd8dd79004440f5e4182e549039ed"
     },
     {
       "path": "docs/api-reference.md",
@@ -1847,12 +1852,12 @@
     {
       "path": "docs/copy-inventory.md",
       "mode": "0000644",
-      "sha256": "8bdf39ea0b8ed9583f9ef68b0edae767eec9c2825f8ef355d678b3db3d08b5e1"
+      "sha256": "da770863626202ff2566de7f0a152eebc086662c74d86423794d378fca2d83e6"
     },
     {
       "path": "docs/copy-registry.json",
       "mode": "0000644",
-      "sha256": "cd51497ccca735bf1f8178291b427f4166aff79870a080a4a9d036238f0ff90c"
+      "sha256": "423614f0519d1e94e605e439b53a2bac7a63c2ae8005b0021c71e6c81f38edfc"
     },
     {
       "path": "docs/design/apex-pass-2-direction.md",
@@ -2697,7 +2702,7 @@
     {
       "path": "docs/module-api-changelog.md",
       "mode": "0000644",
-      "sha256": "072128c45a7036c0d01bc029a1267bf34ff7bd175226e83d691b8001e4a8eefa"
+      "sha256": "cb7bb494b4b2ad905f1067b6f3c11e6331faa8beaad533c70d4a5009c456a807"
     },
     {
       "path": "docs/modules-contract.md",
@@ -6812,7 +6817,7 @@
     {
       "path": "modules/public-landing/public/projects.html",
       "mode": "0000644",
-      "sha256": "22201cd63fde334156b40954707d836f8c65a8380a3f346fe7c77abb03ed3b51"
+      "sha256": "0154fab4db489db2eb1955bffdd9b0585ff7fe28607897e75c26d83c7edfc3e0"
     },
     {
       "path": "modules/public-landing/public/projects.probes.json",
@@ -7557,12 +7562,12 @@
     {
       "path": "package-lock.json",
       "mode": "0000644",
-      "sha256": "e5249bc21a0842ce0e47203e1b7052aa146161702db57b1c50740d409a7347b2"
+      "sha256": "ce40726e213f4a94fd3983d81c5919e4cc435fda1d666e7cf598fc2f963b8741"
     },
     {
       "path": "package.json",
       "mode": "0000644",
-      "sha256": "d328d1b9a42a9003642815e8a17cc14f648d53a996c2c6db92a8d1250c570ea8"
+      "sha256": "6ce1fcd5c0378c8001b8249d8359d04ecfa5730e07dc3e21cda4952fcf1deeae"
     },
     {
       "path": "public-docs/index.html",
@@ -9267,7 +9272,7 @@
     {
       "path": "src/module-api.js",
       "mode": "0000644",
-      "sha256": "71207830c631f2604b55d9e2e6a2db08b0d129499249c4db009c00e871fc2fd7"
+      "sha256": "c1da85daf5425cfb3bbd7d8e29e6995e90ead6088565476973954ca366ef14f5"
     },
     {
       "path": "src/module-loader/catalog.js",
@@ -11647,7 +11652,7 @@
     {
       "path": "tests/projects_hub.mjs",
       "mode": "0000644",
-      "sha256": "ec536c7bcfe2c9ea29d0df8a0dcbbb5c2764b4f60e0d14218aa0a10bf6afb469"
+      "sha256": "d32fd31e368acdaaf1d4f31b775f62ef8e20ea4f5810a37fddb8ef1dba1487b6"
     },
     {
       "path": "tests/projects_hub_module_picker.mjs",

package/docs/adr/0255-a-public-lists-ordering-is-part-of-its-payload.md

@@ -150,7 +150,10 @@ Stated plainly, because a privacy fix that oversells itself is worse than none:
    than the ordering one and it is untouched here: it is inherent in publishing a named list
    at all, and closing it needs a different mechanism (a delay, a decoy, or accepting that a
    project's *departure* from the public list is public). Filed separately rather than
-   silently implied to be fixed.
+   silently implied to be fixed — and **now decided**: the owner chose to accept it and say
+   so in the copy ([ADR 0259](<redacted>.md),
+   [task 1003672](https://cloudbongos.com/builders#/task/1003672)), which also carries the
+   §6.3 residual below.
 3. **Position is stable within one epoch.** Two snapshots taken the same day can still tell
    black holes apart, though not name them. The rotation bounds this to the epoch.
 

package/docs/adr/0259-a-projects-departure-from-the-public-list-is-public.md

@@ -0,0 +1,128 @@
+# ADR 0259 — A project's departure from the public list is public, and the copy says so
+
+- **Status:** accepted
+- **Date:** 2026-09-07
+- **Task:** [task 1003672](https://cloudbongos.com/builders#/task/1003672) (BONGOS-V1, goal 1000046 — *Project creation*)
+- **Deciders:** the owner (choosing between accept / delay / decoys), Claude
+- **Related:** [ADR 0255](<redacted>.md) §6.2 (which filed this leak rather than implying it fixed) · [ADR 0182](<redacted>.md) D2a (the stealth redaction and its `STEALTH_ANONYMOUS_KEEPS` allow-list) · [ADR 0253](<redacted>.md) (the `visibility_source` provenance this feed joins)
+
+---
+
+## 1. The channel
+
+The public projects feed publishes a named list plus a count of anonymous rows. When a
+project flips to stealth, its named row **leaves the identified block** and the anonymous
+count **rises by one**. An observer who keeps yesterday's feed and diffs it against today's
+reads that off directly:
+
+> *Mercury is gone, and there is one more black hole.*
+
+That names the project that went stealth, and the moment it happened, with no reference to
+ordering at all.
+
+**Everything ADR 0182 D2a does is defeated by it.** That ADR takes real trouble to keep any
+stable per-project key off an anonymous row — `STEALTH_ANONYMOUS_KEEPS = ['state', 'orb']`
+is an allow-list precisely so a column added next year is anonymous without anyone
+remembering to come back to it. But the identity was never carried *on* the anonymous row.
+It is carried by the **absence** of the named row that used to sit beside it.
+
+**It is larger than the leak [ADR 0255](<redacted>.md)
+closed.** The ordering channel needed repeated sampling and correlation to be useful. This
+one is a single diff of two snapshots and it is exact.
+
+## 2. Why no ordering fix reaches it
+
+It is not an ordering property, so no `ORDER BY` change touches it. It is inherent in
+publishing a named list at all: any list that names its members leaks a member's departure
+to anyone who read it twice. The three ways out are all product decisions with visible
+costs, which is why 0255 filed this rather than fixing it:
+
+| Option | Cost |
+|---|---|
+| **Accept it, and say so** | An observer archiving the list learns who went stealth, and when. |
+| **Delay** — keep the named row for a window | A privacy control that takes days to take effect, which is the wrong direction for a privacy control. |
+| **Decoys** — pad the anonymous block | The count stops being truthful. It is truthful today. |
+
+## 3. Decision
+
+**Accept it, and make the copy say so.**
+
+The promise stealth actually keeps is about the project's *contents*, not about the
+*transition*. An anonymous row stays anonymous: no name, no tagline, no art, no origin, no
+stable key, nothing that survives to the next snapshot. What is not private is the act of
+stepping off the named list, because the named list is published and readers may keep
+copies of it.
+
+Two reasons this is the right end of the trade, and not merely the cheapest:
+
+1. **It is already the honest reading of the existing promise.** ADR 0182 D2a made existence
+   and count public *by design* — the map shows that hidden projects are there. A count that
+   is public and truthful is a count whose changes are public. Delay and decoys both work by
+   making a currently-honest number less honest.
+
+2. **The alternatives damage the control they defend.** A delay means an owner clicks the
+   privacy setting and is not private yet, which is a worse failure than the one it fixes —
+   the owner believes they are hidden while they are not. Decoys spend the count's
+   truthfulness on a guarantee that is still only probabilistic.
+
+### 3.1 What "say so" means concretely
+
+The owner-facing copy for Stealth previously read:
+
+> The map shows only that something is there. Its name, and everything else about it, stay
+> yours — and nobody can ask to join.
+
+Every clause is true and the paragraph as a whole still oversells, because a reader takes
+"its name stays yours" to cover the switch itself. The copy now names the boundary in both
+places an owner meets this setting — the choice's blurb and the explanatory fold — in the
+plain register [ADR 0182](<redacted>.md)'s interview fixed for this
+card (the space metaphor belongs to the drawn orb, never to the words).
+
+**A privacy control that oversells is worse than one that admits a limit**, which is the
+same standard 0255 §6 set for itself.
+
+## 4. What a future fix must not do
+
+Recorded so a later attempt does not undo the two guarantees that *are* held:
+
+- **No stable per-project key on an anonymous row** — the `STEALTH_ANONYMOUS_KEEPS`
+  allow-list ([ADR 0182](<redacted>.md) D2a). A decoy scheme that
+  needs to tell its own padding apart from real rows is the classic way this gets
+  reintroduced.
+- **No anonymous ordering an observer can predict or correlate**
+  ([ADR 0255](<redacted>.md) §3) — the trailing
+  block's keyed, rotating permutation.
+
+## 5. The residual this does not address either
+
+Within one 24h epoch the anonymous block's permutation is stable, so two snapshots taken the
+same day can tell black holes apart — though not name them. Bounded by the rotation, and
+carried here from [ADR 0255](<redacted>.md) §6.3 so
+both residuals live in one place. Accepted on the same reasoning: the fix is a per-request
+permutation, which breaks pagination exactly the way `ORDER BY random()` was rejected for in
+0255.
+
+## 6. Consequences
+
+- No behaviour changes in `modules/platform-identity/projects-feed.js`. The feed, the
+  redaction allow-list and the permutation are all untouched — this ADR decides that they
+  are *finished*, not that they need more.
+- The Stealth copy carries the boundary in both surfaces, and
+  `tests/projects_hub.mjs` pins that it does, so the sentence cannot quietly drop out of a
+  future copy edit and leave the page overselling again.
+- [ADR 0255](<redacted>.md) §6.2's "filed
+  separately" is now resolved, and points here.
+
+## Alternatives rejected
+
+- **A delay window before the named row is dropped.** Rejected: the setting would not take
+  effect when the owner sets it, and the owner would not know that. It converts an
+  information leak into a false belief, which is worse.
+- **Decoy rows padding the anonymous block.** Rejected: it spends the count's honesty, and a
+  decoy scheme needs some way to distinguish padding from real rows — the exact stable key
+  D2a forbids.
+- **Dropping the named list.** Rejected: the map's whole purpose is showing what is being
+  built here; a list nobody can read protects a privacy nobody asked for at the cost of the
+  feature.
+- **Saying nothing and leaving the copy as it was.** Rejected: the copy would keep implying a
+  guarantee the system does not make. That is the failure mode this ADR exists to close.

package/docs/adr/README.md

@@ -350,3 +350,4 @@ This keeps the decision history honest and traceable.
 > ⚠️ **Numbering collisions are now machine-enforced, not narrated.** Twenty numbers are shared by two ADRs each — assigned in parallel sessions before anything checked. The files keep their filenames (renumbering would break every existing citation, and a number once assigned is never reused), and this table disambiguates each pair as `NNNN-a` / `NNNN-b`. The authoritative list is `LEGACY_DUPLICATE_ADRS` in [`scripts/gds/adr-namespace.js`](../../scripts/gds/adr-namespace.js), frozen by exact filename: a **new** collision — or a third file joining a legacy number, or a rename of either half — hard-fails the `unit` CI gate, as does an index row that points at no file or an ADR with no row. The list may only shrink. This paragraph used to narrate the collisions one by one and had fallen eight behind reality; see [ADR 0195](<redacted>.md) for why the check exists and why the pairs are grandfathered rather than renumbered.
 | 0257 | [**Auth resolves before the hall mounts anything, and a widget's boot read may never navigate** ([task 1003673](https://cloudbongos.com/builders#/task/1003673) · goal 1000063 — *The front door*). An invite-only instance could not admit its FIRST builder, and the symptom lied about where the fault was: an owner saw an empty Access-requests queue and no approve button, because **signing in does not file a request** — only the landing's *Request access* form does, and that form was unreachable. A signed-out visitor to `/builders` was bounced to GitHub, refused as a first-timer ("request access first"), and pointed back at `/builders` to be bounced again. Reproduced against `main`, not just an old pin. `builders.js` was already careful — `/me` is read `softAuth` and a 401 there renders the landing — but `DOMContentLoaded` called `mountHallWidgets()` FIRST, synchronously, and `goals.js`'s mount-time read of `/goals` goes through a `getJSON` with no `softAuth`, which answers 401 by NAVIGATING. The widget's read raced `renderLanding()` and won. **Decision: the front door settles which page this is before anything else runs** — `boot()` reads `/me` (soft), then either renders the landing and stops (nothing mounts, nothing else fetches) or mounts the hall, handing the resolved payload to `loadAll()` so the page still asks once. Widgets are member surfaces (`renderLanding` hid them all after the fact anyway), so not mounting them while signed out removes the CLASS rather than the one instance of it that was found; **a widget's own boot read may never navigate** is the belt beside it (`goals.js` reads soft and renders nothing without a session). A 401 during boot is not an instruction to go and sign in — only a user action is. `tests/hall_landing_boot.mjs` executes the real `builders.js` in a DOM stub and was confirmed to FAIL against the pre-fix file. Rejected: patching `goals.js` alone (it was merely first); making the 401 redirect soft everywhere (an expired session mid-visit SHOULD be sent to sign in — the line is boot vs user action); open enrollment as the cure (removes the gate [ADR 0050](<redacted>.md) chose deliberately instead of repairing the door).](<redacted>.md) | hall-ui / admission / front door |
 | 0258 | [**The public CLI is a generated client-only package, and its file list is proven by running it** ([task 1003679](https://cloudbongos.com/builders#/task/1003679) · goal 1000054 — *A newcomer can build without the UI*). The core ships private as `@bongos/core` ([ADR 0108](<redacted>.md)), so a newcomer with no credential can install NOTHING and the web hall is the only way in — the owner's words: "how am I supposed to easily take on tasks as a new builder? I should be able to do everything without the UI." Open task 1002025 proposed publishing the core, which ships the SERVER and bypasses [ADR 0099](<redacted>.md)'s redaction pipeline (dormant until ~2026-11). **Decision: generate a separate public `@cloudbongos/cli` from the core and do not publish the core.** Four load-bearing parts. (1) SCOPED NAME, because npm shares one namespace between org names and unscoped packages — the bare `cloudbongos` is unpublishable *precisely because the owner owns that org*, which npm reports as "invalid" and reads like the name is taken; and a package name cannot be created on the npm website at all (it exists on first publish, which is why "Add Existing Package" answered `Forbidden`). (2) THE FILE LIST IS DECLARED AND PROVEN BY BEHAVIOUR, never computed — a static require-closure CANNOT answer this, because `src/module-api.js` is the doorway a module may only import ([ADR 0083](<redacted>.md)) and it *names* every kernel capability, so a static walk sees 33 `src/` files from `start.js` alone where runtime resolves **one** (`api-prefix.js`, which imports nothing) — the same trap as task 1003677's unsatisfiable done-when. So the test packs the tarball, installs it into an empty dir with NO repo, and runs every verb: it may fail for want of a session, never for a missing file. That caught two real holes on its first strengthened run — `clients/bongos-client/index.mjs`, reached by a dynamic `import()` no `require()` walk can see, and a hand-listed `files` array that dropped `clients/` and produced a tarball which installed cleanly then died on first use; both are now build-time refusals, and the `files` array is derived from the manifest. (3) `claim`/`ship`/`dev`/`serve`/`module`/`upgrade`/`onboard`/`doctor`/`exec`/`package-core` are ABSENT and the CLI says WHY plus the next step (`bongos shell` → a cloud box with the full CLI) — a bare `unknown command` teaches nothing, which is the exact failure being fixed. The supported journey is `login` → `start` → `shell`. (4) A REDACTION GATE fails the build closed on non-loopback IPv4 (RFC 5737 doc ranges exempt), token/key shapes, and every domain + owner login readable from the instance's own `config/branding.json` — needles come from host config so the core carries no instance identity ([ADR 0062 §7](<redacted>.md)); `cloudbongos.com` is allowlisted as public by design. No `repository` field while the core repo is private (it would 404 for every user and publish the owner's login for nothing). 31 files, one dependency (`undici`), version independent of the core's ([ADR 0161](<redacted>.md)). `@bongos/client` is VENDORED, not depended on — a public package depending on a private one is uninstallable. **The owner runs `npm publish`; a builder must not.** Task 1002025 is superseded. Rejected: publishing the core; deriving from a static closure (structurally impossible past the doorway); waiting for the mirror (dormant, and this is a build product not a source release); an unscoped name; depending on `@bongos/client`; a degraded `claim`; shipping all of `src/` to make lazy getters safe.](<redacted>.md) | cli / distribution / public surface |
+| 0259 | [**A project’s departure from the public list is public, and the copy says so** ([task 1003672](https://cloudbongos.com/builders#/task/1003672) · goal 1000046 — *Project creation*). Decides the leak [ADR 0255](<redacted>.md) §6.2 deliberately filed rather than implied fixed. The public projects feed publishes a named list plus a count of anonymous rows, so when a project flips to stealth its named row LEAVES the identified block while the count RISES BY ONE — *“Mercury is gone, and there is one more black hole”* names it, and the moment, from a single diff of two snapshots. **Everything [ADR 0182](<redacted>.md) D2a does is defeated by it**, because the identity was never carried ON the anonymous row (`STEALTH_ANONYMOUS_KEEPS` is an allow-list precisely so a column added next year is anonymous by default) — it is carried by the ABSENCE of the named row that used to sit beside it. **Larger than the channel 0255 closed**, which needed repeated sampling and correlation; this one is exact and needs two reads. No `ORDER BY` change touches it: it is inherent in publishing a named list at all, so every fix is a product decision with a visible cost and the owner’s call, not a builder’s. **Decision: accept it, and make the copy say so.** Two reasons it is the right end of the trade and not merely the cheapest — (1) it is ALREADY the honest reading of the existing promise, since D2a made existence and count public *by design*, and a count that is public and truthful is a count whose CHANGES are public; (2) both alternatives damage the control they defend. A **delay window** means the owner clicks the privacy setting and is not private yet *without knowing it*, converting an information leak into a false belief — strictly worse, and the wrong direction for a privacy control. **Decoys** spend the count’s truthfulness (it is truthful today) on a guarantee that is still only probabilistic, and a decoy scheme needs some way to tell padding from real rows — the exact stable per-project key D2a forbids. The promise stealth actually keeps is about the project’s CONTENTS, not the TRANSITION: an anonymous row stays anonymous (no name, tagline, art, origin, or key surviving to the next snapshot); what is not private is stepping off a published list readers may keep copies of. So the copy — which read *“its name, and everything else about it, stay yours”*, every clause true and the paragraph as a whole overselling, because a reader takes it to cover the switch — now names the boundary in BOTH places an owner meets the setting (the choice’s blurb and the what-changes fold), in the plain register 0182’s interview fixed for this card. **A privacy control that oversells is worse than one that admits a limit**, the same standard 0255 §6 set for itself. **No behaviour changes** in `projects-feed.js` — the feed, the redaction allow-list and the keyed rotating permutation are decided FINISHED, not insufficient. `tests/projects_hub.mjs` pins the sentence in both surfaces (the copy IS the fix, so a future edit tightening the blurb must not quietly drop it) and re-applies the no-space-metaphor ban to it. Carries 0255 §6.3’s smaller residual so both live in one place: within one 24h epoch the permutation is stable, so same-day snapshots tell black holes apart (not name them) — accepted on the same reasoning, since the fix is a per-request permutation, which breaks pagination exactly as `ORDER BY random()` was rejected for. Guards recorded for any future attempt: no stable per-project key on an anonymous row, and no anonymous ordering an observer can predict or correlate. Rejected: the delay; decoys; dropping the named list (protects a privacy nobody asked for at the cost of the feature); and saying nothing, which is the failure mode this closes.](<redacted>.md) | platform-identity / privacy boundary / copy honesty |

package/docs/copy-inventory.md

@@ -4,7 +4,7 @@
 > Deterministic on a given tree — regenerate and commit rather than hand-editing.
 > Machine-readable twin: [`copy-registry.json`](copy-registry.json).
 
-**1707 strings** across 3 surfaces · 1476 distinct pieces of copy · 1707 certain, 0 heuristic · 162 shown in more than one place.
+**1706 strings** across 3 surfaces · 1475 distinct pieces of copy · 1706 certain, 0 heuristic · 162 shown in more than one place.
 
 ## Surfaces
 
@@ -12,7 +12,7 @@
 |---|---|---|---|
 | `builders-hall` | `modules/hall-ui/public` | 78 | 1234 |
 | `status-dashboard` | `modules/status-ui/public` | 4 | 100 |
-| `landing` | `modules/public-landing/public` | 5 | 373 |
+| `landing` | `modules/public-landing/public` | 5 | 372 |
 
 ## Confidence, and why it is on every row
 
@@ -1422,7 +1422,7 @@ Identical copy within one surface. Sometimes right (a repeated button), sometime
 | `7667eb552781` | certain | {…}: {…}% ({…}/{…} checks) | `modules/status-ui/public/status.js:468` |
 | `6d0d64f10bd9` | certain | ‹ earlier page | `modules/status-ui/public/index.html:321` |
 
-## `landing` — 373 strings
+## `landing` — 372 strings
 
 | id | conf | text | where |
 |---|---|---|---|
@@ -1788,7 +1788,6 @@ Identical copy within one surface. Sometimes right (a repeated button), sometime
 | `5becfcad07c3` | certain | — people ask from the project’s hall, you approve each one from the hall’s Watch page, and then they sign in. | `modules/public-landing/public/projects.html:809` |
 | `9ac56aa4e540` | certain | — projects hosted by the platform run on servers rented from DigitalOcean, with their web address and traffic  | `modules/public-landing/public/privacy.html:65` |
 | `39719e6e1d56` | certain | — shipped as | `modules/public-landing/public/projects.html:778` |
-| `78a1684630fa` | certain | — the map shows only that something is there; its name, and everything else about it, stay yours, and nobody c | `modules/public-landing/public/projects.html:828` |
 | `b5bac008ba11` | certain | — the project is on the map under its name, and anyone who finds it can join. | `modules/public-landing/public/projects.html:828` |
 | `728661ec4c4a` | certain | — when a shipped task is graded, the change it made (the code diff) is sent to the model the grader runs on, A | `modules/public-landing/public/privacy.html:64` |
 | `ff1318762145` | certain | — whoever signs in with GitHub becomes a member at once, at the newcomer rank. | `modules/public-landing/public/projects.html:809` |

package/docs/copy-registry.json

@@ -3,9 +3,9 @@
   "generator": "scripts/gds/copy-inventory.js",
   "goal": 1000074,
   "counts": {
-    "strings": 1707,
-    "unique_ids": 1476,
-    "certain": 1707,
+    "strings": 1706,
+    "unique_ids": 1475,
+    "certain": 1706,
     "heuristic": 0,
     "duplicate_ids": 162
   },
@@ -23,7 +23,7 @@
     "landing": {
       "at": "modules/public-landing/public",
       "files": 5,
-      "strings": 373
+      "strings": 372
     }
   },
   "blind_spots": [
@@ -16093,15 +16093,6 @@
       "origin": "html-text",
       "confidence": "certain"
     },
-    {
-      "id": "78a1684630fa",
-      "surface": "landing",
-      "text": "— the map shows only that something is there; its name, and everything else about it, stay yours, and nobody can ask to join. Whichever you pick, a project reaches the map only once it has a name and a description. This is separate from “Who can see it” above — that one is the door on the project’s own pages. Changing it restarts the project to pick it up.",
-      "file": "modules/public-landing/public/projects.html",
-      "line": 828,
-      "origin": "html-text",
-      "confidence": "certain"
-    },
     {
       "id": "b5bac008ba11",
       "surface": "landing",

package/docs/module-api-changelog.md

@@ -1605,5 +1605,7 @@ is load-bearing: the script throws rather than guess if it is missing, and
         landed since 1.19.576 with no explicit bump. run 34142767912. (task 1002620)
   1.19.578 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
         landed since 1.19.577 with no explicit bump. run 34146835487. (task 1002620)
+  1.19.579 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+        landed since 1.19.578 with no explicit bump. run 34149317186. (task 1002620)
 ---------------------------------------------------------------------------
 ```

package/modules/public-landing/public/projects.html

@@ -825,7 +825,7 @@ summary{min-height:24px;padding:3px 0;}
         <div id="mDoor"><p class="finePrint">Reading the project’s settings…</p></div>
         <details class="finePrint" id="mDoorWhat">
           <summary>What each choice changes</summary>
-          <p><b>Public</b> — the project is on the map under its name, and anyone who finds it can join. <b>Private</b> — it is on the map under its name, but nobody joins on their own: people ask, and you decide. <b>Stealth</b> — the map shows only that something is there; its name, and everything else about it, stay yours, and nobody can ask to join. Whichever you pick, a project reaches the map only once it has a name and a description. This is separate from “Who can see it” above — that one is the door on the project’s own pages. Changing it restarts the project to pick it up.</p>
+          <p><b>Public</b> — the project is on the map under its name, and anyone who finds it can join. <b>Private</b> — it is on the map under its name, but nobody joins on their own: people ask, and you decide. <b>Stealth</b> — the map shows only that something is there; its name, and everything else about it, stay yours, and nobody can ask to join. Switching to Stealth is itself visible: someone comparing the map before and after can tell which project went quiet. Whichever you pick, a project reaches the map only once it has a name and a description. This is separate from “Who can see it” above — that one is the door on the project’s own pages. Changing it restarts the project to pick it up.</p>
         </details>
       </div>
 
@@ -6589,7 +6589,7 @@ summary{min-height:24px;padding:3px 0;}
   var DOOR_OPTIONS = {
     public: { label: 'Public', blurb: 'The project is on the map under its name, and anyone who finds it can join.' },
     private: { label: 'Private', blurb: 'On the map under its name, but nobody joins on their own — people ask, and you decide.' },
-    stealth: { label: 'Stealth', blurb: 'The map shows only that something is there. Its name, and everything else about it, stay yours — and nobody can ask to join.' }
+    stealth: { label: 'Stealth', blurb: 'The map shows only that something is there. Its name, and everything else about it, stay yours — and nobody can ask to join. Switching to Stealth is itself visible: someone comparing the map before and after can tell which project went quiet.' }
   };
   var mDoorSettings = null;  /* the platform row's last answer: { value, options } */
 

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.578",
+  "version": "1.19.579",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.19.578",
+      "version": "1.19.579",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.578",
+  "version": "1.19.579",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/src/module-api.js

@@ -55,7 +55,7 @@ const { buildInfo } = require('./build-info');
 // there. scripts/gds/bump-version.js still rewrites the literal below; it appends
 // the entry to that file. Look for a version's history there, not here.
 // ---------------------------------------------------------------------------
-const CORE_VERSION = '1.19.578'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
+const CORE_VERSION = '1.19.579'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('dev-box'); log.info('mounted');

package/tests/projects_hub.mjs

@@ -1543,6 +1543,30 @@ test('the join-door labels are PLAIN — the space metaphor is the orb’s, neve
   assert.doesNotMatch(options, /unlisted/i, 'dark matter is DERIVED — there is deliberately no way to choose it');
 });
 
+/* ADR 0259: the one thing Stealth does NOT hide is the switch itself. A project
+   leaving the named list while the anonymous count rises names it to anyone
+   holding yesterday's feed — inherent in publishing a named list, and the owner
+   chose to accept it and say so rather than pay for a delay or decoys. The
+   copy is the whole fix, so the copy is what gets pinned: without this, a
+   future edit tightening the blurb drops the caveat and the page goes back to
+   implying a guarantee the feed does not make. */
+test('the Stealth copy names its own limit — switching is visible, even though the project is not (ADR 0259)', () => {
+  const options = (SCRIPT.match(/var DOOR_OPTIONS = \{[\s\S]*?\n  \};/) || [''])[0];
+  const fold = (HUB.match(/<details class="finePrint" id="mDoorWhat">[\s\S]*?<\/details>/) || [''])[0];
+  assert.ok(options && fold, 'both the option table and the fold must be extractable');
+  for (const [where, text] of [['the choice’s blurb', options], ['the what-changes fold', fold]]) {
+    assert.match(text, /Switching to Stealth is itself visible/,
+      `${where} states the boundary — a privacy control that oversells is worse than one that admits a limit`);
+    assert.match(text, /comparing the map before and after can tell which project went quiet/,
+      `${where} says HOW it is visible, so the owner can judge it rather than take our word`);
+  }
+  /* the plain-register rule this card is held to still binds the new sentence
+     (the space metaphor is the drawn orb's, never the copy's) */
+  for (const word of ['planet', 'star', 'black hole', 'dark matter', 'feed', 'snapshot']) {
+    assert.doesNotMatch(options.toLowerCase(), new RegExp(`\\b${word}\\b`), `"${word}" must not reach a choice’s blurb`);
+  }
+});
+
 test('the join-door pick is a real radio group built from the server’s own options list', () => {
   const render = fnHub('renderDoor');
   assert.match(render, /\(s\.options \|\| \[\]\)\.filter\(function \(v\) \{ return !!DOOR_OPTIONS\[v\]; \}\)/,