@bongos/core 1.19.578 → 1.19.580

package/.bongos-core.json

@@ -2,22 +2,22 @@
   "artifact": "bongos-core",
   "manifest_schema": 1,
   "generator": "scripts/gds/package-core.js",
-  "core_version": "1.19.578",
-  "core_contract": "1.19.578",
-  "source_commit": "a3f42dff6ab98712306ee86eaedf8191cafa3340",
+  "core_version": "1.19.580",
+  "core_contract": "1.19.580",
+  "source_commit": "23d256818bb7470aa5d203825abed34ab13f6fcf",
   "source_ref": "HEAD",
-  "built_at": "2026-09-07T17:15:54.070Z",
+  "built_at": "2026-09-07T18:50:35.452Z",
   "redaction": {
     "model": "docs-redacted+functional-verbatim",
-    "docs_redacted": 451,
+    "docs_redacted": 453,
     "agent_docs_stubbed": 24,
-    "functional_verbatim": 2047,
+    "functional_verbatim": 2051,
     "rules": 3,
     "gate_literals": 3,
     "gate": "passed"
   },
-  "file_count": 2522,
-  "tree_sha256": "96be19d76442ed1b3e663525652a70c6ef60434e80d4ad907df8e294be5f38fe",
+  "file_count": 2528,
+  "tree_sha256": "293d3e0eb2f7b0d375fde65d1b6e75816035857c06a98f69f91d0e213a21f8ad",
   "files": [
     {
       "path": ".claude/skills/blocker-review/SKILL.md",
@@ -372,12 +372,12 @@
     {
       "path": "clients/bongos-client/README.md",
       "mode": "0000644",
-      "sha256": "f94a07e3c135a5d6c41a2d16f722e86b990362996042dc2a5e05b2020f8cf376"
+      "sha256": "48a76d533215b8c0885fa77f59fc0e8915262db6b57029f6850692882e6e7455"
     },
     {
       "path": "clients/bongos-client/bongos-client.global.js",
       "mode": "0000644",
-      "sha256": "06d1814637fe2898f0d93a3870726d53102d02feeae4611fcca80f195e2e26e4"
+      "sha256": "c7fe87ceb18e7e1c10e629d002fb6f322ee540606c3ec9f6d38741dac7a55e0f"
     },
     {
       "path": "clients/bongos-client/examples/hello-world.mjs",
@@ -387,17 +387,17 @@
     {
       "path": "clients/bongos-client/index.cjs",
       "mode": "0000644",
-      "sha256": "ee0e25848a938f675e7a2e6e0a48983308117ecafe93ca219f4f1df49cf7ea51"
+      "sha256": "d80b05be7a602fa825f5f45e5b7f2bc002473a4731e2530df19fa3043f0c07fc"
     },
     {
       "path": "clients/bongos-client/index.d.ts",
       "mode": "0000644",
-      "sha256": "adaa20c8ce6bee76dc289f10929014382aa89d7373f94ddafc84f4c87eeb0ed4"
+      "sha256": "e5cfa78c545e60771166ae4118e18f5c7bcf911db649c115c2831a028de3562b"
     },
     {
       "path": "clients/bongos-client/index.mjs",
       "mode": "0000644",
-      "sha256": "6a3e4df57180f3c182fbadabe94030d06f125373c9336a7a4160015f1df5b11e"
+      "sha256": "47ae66627693378c276031754aca717ecc01e8e5038c4cf98ed844e5c03ee524"
     },
     {
       "path": "clients/bongos-client/package.json",
@@ -1792,7 +1792,7 @@
     {
       "path": "docs/adr/0255-a-public-lists-ordering-is-part-of-its-payload.md",
       "mode": "0000644",
-      "sha256": "2c82050a733a0a82dde5079bbc486fc3378b2be954817a811aab92b9e46c9c5b"
+      "sha256": "9240caa363815ca9bbd49993bd73ecda85c6f91280ac152f344f69c77928bd22"
     },
     {
       "path": "docs/adr/0256-the-visibility-ceiling-is-the-sign-in-gate-too-and-the-reader-moves-to-the-composer.md",
@@ -1809,20 +1809,30 @@
       "mode": "0000644",
       "sha256": "28f3644d3d9dcd2985b7e3f42cf2135af86203eee35b6e509d1ff98f630f1228"
     },
+    {
+      "path": "docs/adr/0259-a-projects-departure-from-the-public-list-is-public.md",
+      "mode": "0000644",
+      "sha256": "772b9153d882f6bbd5000ee90b83e05d550ee4f04d4f5392db36e223d9a58c59"
+    },
+    {
+      "path": "docs/adr/0260-the-application-is-the-consent-and-the-echo-is-the-gate.md",
+      "mode": "0000644",
+      "sha256": "fa04f8d71fff8186ae975a949c045ca7481bd0f22f395cb8c7397bbe03ddd449"
+    },
     {
       "path": "docs/adr/README.md",
       "mode": "0000644",
-      "sha256": "30bb35e65ebd2dc8c5eb0aad7e30d5875d0c764265f398547abd545b62ee7d7c"
+      "sha256": "1fa7dcf1456d26896e5cec77026ace0f08db8bed65527dee563cd7fdd2d07525"
     },
     {
       "path": "docs/api-reference.md",
       "mode": "0000644",
-      "sha256": "0a622847ab68980279beba2e1a54813b2393107144f88dd31228fe4dfd248b90"
+      "sha256": "450613589b6b480ba2d6789731003794749c0dd972fcd8636380fa5814d68807"
     },
     {
       "path": "docs/api/openapi.json",
       "mode": "0000644",
-      "sha256": "60ca0b131c661df16fb993182d2085d0b04ea15a4d91bec4318c3413fb8dc311"
+      "sha256": "c3a329219460b2508d51009ff8f77bdc4733f3a17ad2776553dc7bce483555c4"
     },
     {
       "path": "docs/architecture.md",
@@ -1847,12 +1857,12 @@
     {
       "path": "docs/copy-inventory.md",
       "mode": "0000644",
-      "sha256": "8bdf39ea0b8ed9583f9ef68b0edae767eec9c2825f8ef355d678b3db3d08b5e1"
+      "sha256": "c4b6557f79a876b18cfc020ea4d45b8dfa419c9c37cab3fb2c629d85939bd75d"
     },
     {
       "path": "docs/copy-registry.json",
       "mode": "0000644",
-      "sha256": "cd51497ccca735bf1f8178291b427f4166aff79870a080a4a9d036238f0ff90c"
+      "sha256": "867399ce0002d6a1f509969544ad9589db6769352597471b495c66749271bb3c"
     },
     {
       "path": "docs/design/apex-pass-2-direction.md",
@@ -2687,7 +2697,7 @@
     {
       "path": "docs/file-map.md",
       "mode": "0000644",
-      "sha256": "f43e8946ecb5c96dc7af0bcee49010245df577eee62381701d2aef1c67455662"
+      "sha256": "dd0684364a3ccd656f8201367e23775d578a84b385f49a901f7fc4205312b344"
     },
     {
       "path": "docs/handoff-template.md",
@@ -2697,7 +2707,7 @@
     {
       "path": "docs/module-api-changelog.md",
       "mode": "0000644",
-      "sha256": "072128c45a7036c0d01bc029a1267bf34ff7bd175226e83d691b8001e4a8eefa"
+      "sha256": "2237a99993338a480835d8cf8c62bc0925585d46d01a9859b5ba3afa108af5d1"
     },
     {
       "path": "docs/modules-contract.md",
@@ -4097,7 +4107,7 @@
     {
       "path": "modules/dev-box/app/src/vendor/bongos-client.cjs",
       "mode": "0000644",
-      "sha256": "ee0e25848a938f675e7a2e6e0a48983308117ecafe93ca219f4f1df49cf7ea51"
+      "sha256": "d80b05be7a602fa825f5f45e5b7f2bc002473a4731e2530df19fa3043f0c07fc"
     },
     {
       "path": "modules/dev-box/app/test/unit.mjs",
@@ -4987,7 +4997,7 @@
     {
       "path": "modules/hall-ui/public/oversight.css",
       "mode": "0000644",
-      "sha256": "9aa3fd3f662274571e049eb9931f8dd575eef527a624bc6a5d57102061f54936"
+      "sha256": "13d46f29e77ba9ca30ab52de2e0413f2fcb68bfec44de032730d4d135530e4ba"
     },
     {
       "path": "modules/hall-ui/public/pair.css",
@@ -5307,7 +5317,7 @@
     {
       "path": "modules/hall-ui/public/watch.js",
       "mode": "0000644",
-      "sha256": "66a3fc7edf59112c1126c6c1c96244ac3cae1c0aea99f946c96b202d14f2cbac"
+      "sha256": "058f25fcef75b3db5410ea7fa6b09515b0b7fddc64a7698c1a1c44e753c8a651"
     },
     {
       "path": "modules/hall-ui/public/watch.states.json",
@@ -5912,7 +5922,7 @@
     {
       "path": "modules/onboarding/routes/access-requests.js",
       "mode": "0000644",
-      "sha256": "ebebd2ce84727de2dff8411a6279aefb3792de51577a5ba04dc7d565cbce5494"
+      "sha256": "3c66a404347ef1b93edcf5c63a902c9561b0a3f9bd9bc6c17e8a2a1f1b5f6707"
     },
     {
       "path": "modules/onboarding/routes/onboarding.js",
@@ -5929,10 +5939,15 @@
       "mode": "0000644",
       "sha256": "020279ae50f2f9e7a004fe571e5ca14493ad26bd22c395cc4805f759f5560b72"
     },
+    {
+      "path": "modules/platform-identity/applicant-profile.js",
+      "mode": "0000644",
+      "sha256": "12c1d00965d2d386480bdf94673ab6f140c8ee6ba44a5995a2d1b9593c012d20"
+    },
     {
       "path": "modules/platform-identity/application-echo.js",
       "mode": "0000644",
-      "sha256": "3793f588d62eaa96a74da6bceb55043e8a9de35bc120dbe63f26bcc2b7e904da"
+      "sha256": "8217660dc23b57ba0fb54d6375aca9aec190c7abb1d70f9d44d4e290da272c64"
     },
     {
       "path": "modules/platform-identity/canonical-profile.js",
@@ -6112,7 +6127,7 @@
     {
       "path": "modules/platform-identity/recruiter-sliver.js",
       "mode": "0000644",
-      "sha256": "e1385b83ac5bb82d13ffbe5070043c2fd0ca20385b3d62e8331ef917d9fca496"
+      "sha256": "4f6854050e3c7459f698c550577fa97958a573d7f1981c9de4d29417af2669c0"
     },
     {
       "path": "modules/platform-identity/routes/connections.js",
@@ -6147,7 +6162,7 @@
     {
       "path": "modules/platform-identity/routes/sso.js",
       "mode": "0000644",
-      "sha256": "dbc8eeab6b1911b7fdc8b29e3d10871d355d2dead926a0742e9a816a72215dba"
+      "sha256": "6921323c299eee14e2db75b2c1716e35c245f7c971e6aec57c2b339b106f4d87"
     },
     {
       "path": "modules/platform-identity/scouting-authz.js",
@@ -6812,7 +6827,7 @@
     {
       "path": "modules/public-landing/public/projects.html",
       "mode": "0000644",
-      "sha256": "22201cd63fde334156b40954707d836f8c65a8380a3f346fe7c77abb03ed3b51"
+      "sha256": "0154fab4db489db2eb1955bffdd9b0585ff7fe28607897e75c26d83c7edfc3e0"
     },
     {
       "path": "modules/public-landing/public/projects.probes.json",
@@ -7557,12 +7572,12 @@
     {
       "path": "package-lock.json",
       "mode": "0000644",
-      "sha256": "e5249bc21a0842ce0e47203e1b7052aa146161702db57b1c50740d409a7347b2"
+      "sha256": "28db9a2f030a69e041ee0c0d277238e7f5f7be0ba8a9bd370ffc2fc644a3c1d1"
     },
     {
       "path": "package.json",
       "mode": "0000644",
-      "sha256": "d328d1b9a42a9003642815e8a17cc14f648d53a996c2c6db92a8d1250c570ea8"
+      "sha256": "cbec2151e643d5ff302e5d98166488c6298669395eafe9e037a2f39ea23db5c9"
     },
     {
       "path": "public-docs/index.html",
@@ -8977,7 +8992,7 @@
     {
       "path": "src/bongos/auth-admission.js",
       "mode": "0000644",
-      "sha256": "8dc4cc0ab956d387b8044c22e83fce883f2f0129ed27c03503f7348e9d4f00bb"
+      "sha256": "aaa113f476a1d8196324379f8fd78aab22f577455fa0378bac3200b98e6a887f"
     },
     {
       "path": "src/bongos/auth-config.js",
@@ -9002,7 +9017,7 @@
     {
       "path": "src/bongos/auth.js",
       "mode": "0000644",
-      "sha256": "517e25a2ca9b9adafa993725802af9e7fc1708f0a5609102ddce593e82478ca2"
+      "sha256": "eeb1831ab3d033598e0bcd57c30589cac583a1259c98b2dd49fbd9bb7725e11b"
     },
     {
       "path": "src/bongos/cascade-dispatch.js",
@@ -9267,7 +9282,7 @@
     {
       "path": "src/module-api.js",
       "mode": "0000644",
-      "sha256": "71207830c631f2604b55d9e2e6a2db08b0d129499249c4db009c00e871fc2fd7"
+      "sha256": "a3e2c3a0b4099d54d8cd5c309186feb8a0c7073074095c4d10861f71e9f36ce4"
     },
     {
       "path": "src/module-loader/catalog.js",
@@ -9359,6 +9374,11 @@
       "mode": "0000644",
       "sha256": "125edcec8c7d7536365b9675daa1fceb9fe072a30e2a4a68ee2911cd258a8c10"
     },
+    {
+      "path": "tests/adr_renumber_integrity.mjs",
+      "mode": "0000644",
+      "sha256": "bdc9d3678e12dee3f3252785ca82e06071421762c7146cbc1591d3fc2ec72180"
+    },
     {
       "path": "tests/agents_spawn.mjs",
       "mode": "0000644",
@@ -9419,6 +9439,16 @@
       "mode": "0000644",
       "sha256": "ac84c8d8b1e2f54ef278506570ed657e68d2da4e136968b0df31b51f943af4bb"
     },
+    {
+      "path": "tests/applicant_profile_boundary.mjs",
+      "mode": "0000644",
+      "sha256": "beefe27f5f753185cf3513f6576e55ee44680760ff2d8eed4ced93d56ec92b77"
+    },
+    {
+      "path": "tests/applicant_profile_read_bounds.mjs",
+      "mode": "0000644",
+      "sha256": "185fed67d8b3e65121af637e37392c21d4bcd892bb2b305704479f42ff5987c7"
+    },
     {
       "path": "tests/application_echo.mjs",
       "mode": "0000644",
@@ -11287,7 +11317,7 @@
     {
       "path": "tests/module_api.mjs",
       "mode": "0000644",
-      "sha256": "39812c560bcd88e3b3a7938ed2447fbd4ab24b0f925e9662b375910bcbe7f1da"
+      "sha256": "157d551b9a99320198f22d32ce335fa4166414dc1818d11ef23a0ea05ac80a76"
     },
     {
       "path": "tests/module_api_lazy.mjs",
@@ -11647,7 +11677,7 @@
     {
       "path": "tests/projects_hub.mjs",
       "mode": "0000644",
-      "sha256": "ec536c7bcfe2c9ea29d0df8a0dcbbb5c2764b4f60e0d14218aa0a10bf6afb469"
+      "sha256": "d32fd31e368acdaaf1d4f31b775f62ef8e20ea4f5810a37fddb8ef1dba1487b6"
     },
     {
       "path": "tests/projects_hub_module_picker.mjs",
@@ -11852,7 +11882,7 @@
     {
       "path": "tests/recruiter_sliver_boundary.mjs",
       "mode": "0000644",
-      "sha256": "cad269f556293e0caa234561f5764f90998a5d133b1e0147a5bbf22403c55e3a"
+      "sha256": "a9ad552e7060898e5c94db8af29e63d7cad568294c240c48bef78859a0558ec6"
     },
     {
       "path": "tests/redteam_followup_kind.mjs",
@@ -12587,7 +12617,7 @@
     {
       "path": "tests/watch_applications_queue.mjs",
       "mode": "0000644",
-      "sha256": "b1f7df5aa40b89f8737c76d94def15c539514f7f439cca79a034bf37b922158d"
+      "sha256": "52c5c056c33b0b2ee91076b29e24ea5b650a0148c603fdde5136e60d6c6e926a"
     },
     {
       "path": "tests/web_admission_status.mjs",

package/clients/bongos-client/README.md

@@ -5,7 +5,7 @@ A **generated**, zero-dependency typed client for the Bongos API — produced fr
 by hand; it regenerates when the spec changes, so it can never drift from the routes.
 
 - API version: **v1** (served at `/api/bongos/v1`)
-- 358 operations across 55 resource groups
+- 359 operations across 55 resource groups
 
 ## Install
 

package/clients/bongos-client/bongos-client.global.js

@@ -793,6 +793,8 @@ function createClient(opts = {}) {
     "sso": {
       // POST /sso/activity/rollup — rank: public — POST /sso/activity/rollup
       postSsoActivityRollup: (args) => request("POST", "/sso/activity/rollup", { hasBody: true }, args),
+      // POST /sso/applicant-profile — rank: public — POST /sso/applicant-profile
+      postSsoApplicantProfile: (args) => request("POST", "/sso/applicant-profile", { hasBody: true }, args),
       // GET /sso/authorize — rank: public — GET /sso/authorize
       getSsoAuthorize: (args) => request("GET", "/sso/authorize", { hasBody: false }, args),
       // POST /sso/device/poll — rank: public — POST /sso/device/poll

package/clients/bongos-client/index.cjs

@@ -792,6 +792,8 @@ function createClient(opts = {}) {
     "sso": {
       // POST /sso/activity/rollup — rank: public — POST /sso/activity/rollup
       postSsoActivityRollup: (args) => request("POST", "/sso/activity/rollup", { hasBody: true }, args),
+      // POST /sso/applicant-profile — rank: public — POST /sso/applicant-profile
+      postSsoApplicantProfile: (args) => request("POST", "/sso/applicant-profile", { hasBody: true }, args),
       // GET /sso/authorize — rank: public — GET /sso/authorize
       getSsoAuthorize: (args) => request("GET", "/sso/authorize", { hasBody: false }, args),
       // POST /sso/device/poll — rank: public — POST /sso/device/poll

package/clients/bongos-client/index.d.ts

@@ -355,6 +355,8 @@ export interface PostSessionsRequest { session_id: string; task_ids?: number[];
 export interface PostSessionsResponse { skipped?: boolean; reason?: unknown; session?: unknown; token_reward?: unknown }
 export interface PostSsoActivityRollupRequest { client_id: string; client_secret: string; github_id: StringifiableId; credits?: number; tasks_shipped?: number; karma?: number; rank?: string; disciplines?: unknown; recent_ships?: unknown }
 export interface PostSsoActivityRollupResponse { ok: boolean }
+export interface PostSsoApplicantProfileRequest { client_id: string; client_secret: string; github_id: StringifiableId }
+export interface PostSsoApplicantProfileResponse { profile: unknown }
 export interface PostSsoDevicePollRequest { device_code: string }
 export interface PostSsoDeviceStartRequest { origin: string }
 export interface PostSsoMembershipCheckInRequest { client_id: string; client_secret: string; github_id: StringifiableId; github_login: string; display_name?: string; avatar_url?: string; membership_kind?: string; role?: string }
@@ -1119,6 +1121,8 @@ export interface BongosClient {
   "sso": {
     /** POST /sso/activity/rollup — rank: public */
     postSsoActivityRollup(args: RequestArgs & { body: PostSsoActivityRollupRequest }): Promise<PostSsoActivityRollupResponse>;
+    /** POST /sso/applicant-profile — rank: public */
+    postSsoApplicantProfile(args: RequestArgs & { body: PostSsoApplicantProfileRequest }): Promise<PostSsoApplicantProfileResponse>;
     /** GET /sso/authorize — rank: public */
     getSsoAuthorize(args?: RequestArgs): Promise<ApiResponse>;
     /** POST /sso/device/poll — rank: public */

package/clients/bongos-client/index.mjs

@@ -789,6 +789,8 @@ export function createClient(opts = {}) {
     "sso": {
       // POST /sso/activity/rollup — rank: public — POST /sso/activity/rollup
       postSsoActivityRollup: (args) => request("POST", "/sso/activity/rollup", { hasBody: true }, args),
+      // POST /sso/applicant-profile — rank: public — POST /sso/applicant-profile
+      postSsoApplicantProfile: (args) => request("POST", "/sso/applicant-profile", { hasBody: true }, args),
       // GET /sso/authorize — rank: public — GET /sso/authorize
       getSsoAuthorize: (args) => request("GET", "/sso/authorize", { hasBody: false }, args),
       // POST /sso/device/poll — rank: public — POST /sso/device/poll

package/docs/adr/0255-a-public-lists-ordering-is-part-of-its-payload.md

@@ -150,7 +150,10 @@ Stated plainly, because a privacy fix that oversells itself is worse than none:
    than the ordering one and it is untouched here: it is inherent in publishing a named list
    at all, and closing it needs a different mechanism (a delay, a decoy, or accepting that a
    project's *departure* from the public list is public). Filed separately rather than
-   silently implied to be fixed.
+   silently implied to be fixed — and **now decided**: the owner chose to accept it and say
+   so in the copy ([ADR 0259](<redacted>.md),
+   [task 1003672](https://cloudbongos.com/builders#/task/1003672)), which also carries the
+   §6.3 residual below.
 3. **Position is stable within one epoch.** Two snapshots taken the same day can still tell
    black holes apart, though not name them. The rotation bounds this to the epoch.
 

package/docs/adr/0259-a-projects-departure-from-the-public-list-is-public.md

@@ -0,0 +1,128 @@
+# ADR 0259 — A project's departure from the public list is public, and the copy says so
+
+- **Status:** accepted
+- **Date:** 2026-09-07
+- **Task:** [task 1003672](https://cloudbongos.com/builders#/task/1003672) (BONGOS-V1, goal 1000046 — *Project creation*)
+- **Deciders:** the owner (choosing between accept / delay / decoys), Claude
+- **Related:** [ADR 0255](<redacted>.md) §6.2 (which filed this leak rather than implying it fixed) · [ADR 0182](<redacted>.md) D2a (the stealth redaction and its `STEALTH_ANONYMOUS_KEEPS` allow-list) · [ADR 0253](<redacted>.md) (the `visibility_source` provenance this feed joins)
+
+---
+
+## 1. The channel
+
+The public projects feed publishes a named list plus a count of anonymous rows. When a
+project flips to stealth, its named row **leaves the identified block** and the anonymous
+count **rises by one**. An observer who keeps yesterday's feed and diffs it against today's
+reads that off directly:
+
+> *Mercury is gone, and there is one more black hole.*
+
+That names the project that went stealth, and the moment it happened, with no reference to
+ordering at all.
+
+**Everything ADR 0182 D2a does is defeated by it.** That ADR takes real trouble to keep any
+stable per-project key off an anonymous row — `STEALTH_ANONYMOUS_KEEPS = ['state', 'orb']`
+is an allow-list precisely so a column added next year is anonymous without anyone
+remembering to come back to it. But the identity was never carried *on* the anonymous row.
+It is carried by the **absence** of the named row that used to sit beside it.
+
+**It is larger than the leak [ADR 0255](<redacted>.md)
+closed.** The ordering channel needed repeated sampling and correlation to be useful. This
+one is a single diff of two snapshots and it is exact.
+
+## 2. Why no ordering fix reaches it
+
+It is not an ordering property, so no `ORDER BY` change touches it. It is inherent in
+publishing a named list at all: any list that names its members leaks a member's departure
+to anyone who read it twice. The three ways out are all product decisions with visible
+costs, which is why 0255 filed this rather than fixing it:
+
+| Option | Cost |
+|---|---|
+| **Accept it, and say so** | An observer archiving the list learns who went stealth, and when. |
+| **Delay** — keep the named row for a window | A privacy control that takes days to take effect, which is the wrong direction for a privacy control. |
+| **Decoys** — pad the anonymous block | The count stops being truthful. It is truthful today. |
+
+## 3. Decision
+
+**Accept it, and make the copy say so.**
+
+The promise stealth actually keeps is about the project's *contents*, not about the
+*transition*. An anonymous row stays anonymous: no name, no tagline, no art, no origin, no
+stable key, nothing that survives to the next snapshot. What is not private is the act of
+stepping off the named list, because the named list is published and readers may keep
+copies of it.
+
+Two reasons this is the right end of the trade, and not merely the cheapest:
+
+1. **It is already the honest reading of the existing promise.** ADR 0182 D2a made existence
+   and count public *by design* — the map shows that hidden projects are there. A count that
+   is public and truthful is a count whose changes are public. Delay and decoys both work by
+   making a currently-honest number less honest.
+
+2. **The alternatives damage the control they defend.** A delay means an owner clicks the
+   privacy setting and is not private yet, which is a worse failure than the one it fixes —
+   the owner believes they are hidden while they are not. Decoys spend the count's
+   truthfulness on a guarantee that is still only probabilistic.
+
+### 3.1 What "say so" means concretely
+
+The owner-facing copy for Stealth previously read:
+
+> The map shows only that something is there. Its name, and everything else about it, stay
+> yours — and nobody can ask to join.
+
+Every clause is true and the paragraph as a whole still oversells, because a reader takes
+"its name stays yours" to cover the switch itself. The copy now names the boundary in both
+places an owner meets this setting — the choice's blurb and the explanatory fold — in the
+plain register [ADR 0182](<redacted>.md)'s interview fixed for this
+card (the space metaphor belongs to the drawn orb, never to the words).
+
+**A privacy control that oversells is worse than one that admits a limit**, which is the
+same standard 0255 §6 set for itself.
+
+## 4. What a future fix must not do
+
+Recorded so a later attempt does not undo the two guarantees that *are* held:
+
+- **No stable per-project key on an anonymous row** — the `STEALTH_ANONYMOUS_KEEPS`
+  allow-list ([ADR 0182](<redacted>.md) D2a). A decoy scheme that
+  needs to tell its own padding apart from real rows is the classic way this gets
+  reintroduced.
+- **No anonymous ordering an observer can predict or correlate**
+  ([ADR 0255](<redacted>.md) §3) — the trailing
+  block's keyed, rotating permutation.
+
+## 5. The residual this does not address either
+
+Within one 24h epoch the anonymous block's permutation is stable, so two snapshots taken the
+same day can tell black holes apart — though not name them. Bounded by the rotation, and
+carried here from [ADR 0255](<redacted>.md) §6.3 so
+both residuals live in one place. Accepted on the same reasoning: the fix is a per-request
+permutation, which breaks pagination exactly the way `ORDER BY random()` was rejected for in
+0255.
+
+## 6. Consequences
+
+- No behaviour changes in `modules/platform-identity/projects-feed.js`. The feed, the
+  redaction allow-list and the permutation are all untouched — this ADR decides that they
+  are *finished*, not that they need more.
+- The Stealth copy carries the boundary in both surfaces, and
+  `tests/projects_hub.mjs` pins that it does, so the sentence cannot quietly drop out of a
+  future copy edit and leave the page overselling again.
+- [ADR 0255](<redacted>.md) §6.2's "filed
+  separately" is now resolved, and points here.
+
+## Alternatives rejected
+
+- **A delay window before the named row is dropped.** Rejected: the setting would not take
+  effect when the owner sets it, and the owner would not know that. It converts an
+  information leak into a false belief, which is worse.
+- **Decoy rows padding the anonymous block.** Rejected: it spends the count's honesty, and a
+  decoy scheme needs some way to distinguish padding from real rows — the exact stable key
+  D2a forbids.
+- **Dropping the named list.** Rejected: the map's whole purpose is showing what is being
+  built here; a list nobody can read protects a privacy nobody asked for at the cost of the
+  feature.
+- **Saying nothing and leaving the copy as it was.** Rejected: the copy would keep implying a
+  guarantee the system does not make. That is the failure mode this ADR exists to close.