@bongos/core 1.19.714 → 1.19.724

package/docs/adr/0192-a-category-orients-and-authorises-nothing.md

@@ -4,7 +4,7 @@
 - **Date:** 2026-08-25
 - **Tasks:** [#1003275](https://cloudbongos.com/builders#/task/1003275) (this decision + the storage/API), with the hall surfaces in [#1003276](https://cloudbongos.com/builders#/task/1003276) and the assignment path in [#1003277](https://cloudbongos.com/builders#/task/1003277).
 - **Goal:** [#1000072](https://cloudbongos.com/builders#/goal/1000072) — Human legibility, criterion `legibility-categories`.
-- **Constrains, does not amend:** [ADR 0086](<redacted>.md) — the real work hierarchy. This decision adds a label *beside* that hierarchy and forbids it from behaving like part of it.
+- **Constrains, does not amend:** [ADR 0086](0086-goal-scoped-work-hierarchy.md) — the real work hierarchy. This decision adds a label *beside* that hierarchy and forbids it from behaving like part of it.
 
 ## 1. The problem
 
@@ -22,7 +22,7 @@ twice: this organisation "has no hierarchical purpose", and these categories hav
 ## 2. Why the constraint needs a decision record and not a comment
 
 The system **already has** a hierarchy — Project → Version → Goal → Criteria →
-Task ([ADR 0086](<redacted>.md)) — and that one is
+Task ([ADR 0086](0086-goal-scoped-work-hierarchy.md)) — and that one is
 load-bearing: the `scope_modules` wall, per-task rank floors, and goal membership
 all refuse real work. Goal 1000072's own prose predicts what happens next: *"A
 second thing that LOOKS like a hierarchy will be mistaken for one within a

package/docs/adr/0193-pause-task-scoped-box-slices.md

@@ -3,7 +3,7 @@
 - **Status:** Accepted
 - **Date:** 2026-08-25
 - **Tasks:** [#1003285](https://cloudbongos.com/builders#/task/1003285) (the pause), from the owner's 2026-08-25 dev-box efficiency review; the review's other findings are [#1003286](https://cloudbongos.com/builders#/task/1003286)–[#1003291](https://cloudbongos.com/builders#/task/1003291) and shipped [#1003253](https://cloudbongos.com/builders#/task/1003253).
-- **Pauses, does not repeal:** [ADR 0148](<redacted>.md) / goal 1000051 — the claim-driven slice. The machinery stays; the default flips.
+- **Pauses, does not repeal:** [ADR 0148](0148-task-scoped-box-source-access.md) / goal 1000051 — the claim-driven slice. The machinery stays; the default flips.
 
 ## 1. The decision
 

package/docs/adr/0195-adr-numbers-are-checked-like-migration-numbers.md

@@ -14,7 +14,7 @@ Two ADRs could carry the same number and nothing flagged it. It happened for rea
 
 **Why it matters past tidiness.** An ADR number is a *citation target*. [Task 1000900](https://cloudbongos.com/builders#/task/1000900)'s close-rationale cited "ADR 0180" and, because of this collision, `0180` on `main` is *Dependency intake & drift policy* — an unrelated document. A reader following that citation lands nowhere near the ship gate it meant. ADRs cite each other by number throughout, and `docs/adr/README.md` is the index every agent is told to consult, so a duplicated number makes a citation ambiguous **forever**.
 
-**What building the check revealed.** The bug report described one collision. The live tree held **twenty**, plus fourteen index defects the same merge class had produced: two ADRs listed twice (`0116`, `0117` — a merge duplicated the rows verbatim) and twelve ADRs with no index row at all. Ten of those twelve were the *second file of a colliding pair* — which is the mechanism by which a collision hides, since the file that never gets indexed is the one nobody sees. The hand-written "known collision" paragraph under the index narrated eight collisions and had fallen twelve behind reality: a record nobody checked, the shape [ADR 0184](<redacted>.md) was written about.
+**What building the check revealed.** The bug report described one collision. The live tree held **twenty**, plus fourteen index defects the same merge class had produced: two ADRs listed twice (`0116`, `0117` — a merge duplicated the rows verbatim) and twelve ADRs with no index row at all. Ten of those twelve were the *second file of a colliding pair* — which is the mechanism by which a collision hides, since the file that never gets indexed is the one nobody sees. The hand-written "known collision" paragraph under the index narrated eight collisions and had fallen twelve behind reality: a record nobody checked, the shape [ADR 0184](0184-ship-requires-an-assurance.md) was written about.
 
 ## Decision
 
@@ -26,7 +26,7 @@ Two ADRs could carry the same number and nothing flagged it. It happened for rea
 
 3. **The index is checked by link target, not by number**: every ADR file has exactly one row, and every row points at a file that exists. This is one invariant covering all three real defects — the dangling row, the duplicated row, and the unindexed file.
 
-4. **Row ordering warns, never blocks.** Ten legacy rows sit out of ascending order. Blocking would fail every PR for a mess nobody's diff created — the split [ADR 0189](<redacted>.md) draws between declaration rot (hard) and inherited drift (warn).
+4. **Row ordering warns, never blocks.** Ten legacy rows sit out of ascending order. Blocking would fail every PR for a mess nobody's diff created — the split [ADR 0189](0189-baseline-floors-and-the-freeze-detector.md) draws between declaration rot (hard) and inherited drift (warn).
 
 ## Alternatives considered
 

package/docs/adr/0196-chrome-world-token-contract-and-the-landing-sheets.md

@@ -3,7 +3,7 @@
 - **Status:** accepted
 - **Date:** 2026-08-27
 - **Task:** [task 1003298](https://cloudbongos.com/builders#/task/1003298) (goal 1000080 — Apex UI pass 2; criterion `apex-landing-built-design-recorded`)
-- **Relates to:** ADR 0062 §3/§7 (the branding contract; the core ↔ host split), ADR 0064 (the retired sunrise look), ADR 0081 (the tool-agnostic design layer: `config/design-tokens.*`), ADR 0095 (findability), task 1003296 (the world pick), task 1003297 (the composition pick and the light-mode decision), `docs/design/apex-pass-2-direction.md`, `docs/design/<redacted>.md`, `DESIGN.md` (written from the build this task lands)
+- **Relates to:** ADR 0062 §3/§7 (the branding contract; the core ↔ host split), ADR 0064 (the retired sunrise look), ADR 0081 (the tool-agnostic design layer: `config/design-tokens.*`), ADR 0095 (findability), task 1003296 (the world pick), task 1003297 (the composition pick and the light-mode decision), `docs/design/apex-pass-2-direction.md`, `docs/design/landing-page-direction-v2.md`, `DESIGN.md` (written from the build this task lands)
 
 ## Context
 
@@ -23,7 +23,7 @@ Three facts shaped the decision:
 4. **Plates ship in `public-landing/assets/world/` with provenance embedded.** The three black plates are verbatim JPEG copies (the prompt in the COM segment), the three cutouts are WebP with alpha at 1600px (85–170 KB against 1.1–2.4 MB PNG), each with a `<file>.json` sidecar naming the source render, the encoding and the mode it serves; `embed-prompt.mjs --scan` finds none missing. Plate URLs inside CSS custom properties are not covered by the server's `?v=` content stamp (it stamps `href`/`src` attributes), so a changed plate at the same path can be cached at the edge for four hours; plates change rarely and get a new filename when they do.
 5. **Live figures are baked inside apex-only sentinels and refreshed at render time.** The hero callouts, the ledger line and rows, and the featured orbs carry real values from the public feeds (dated in the page's head comment) as the no-JS state, wrapped in `<!--apex-only:start-->…<!--apex-only:end-->` so a child instance renders an empty figure rather than the platform's number until its own feed answers; the script then fills every instance live from `/public/progress`, `/public/cost-summary`, `/public/leaderboard`, `/public/recent-shipped` and `/projects/featured`, building DOM with `createElement`/`textContent` only, keeping the baked state on any failure. Definitions are fixed here so the numbers stay honest: *tasks shipped* is the sum of `shipped_count` over every version row; *credits of value* is `total_value_credits`; *builders holding credits* is the leaderboard count with `total_credits > 0` (the world round's "6" was the ninety-day active count, a different thing); the ledger line is the first `building` version. Live titles are quoted data: em and en dashes are normalised to a comma at render time and a trailing parenthetical is dropped, so the taste ban holds without editing the ledger.
 
-   > **Superseded in part, 2026-08-28 ([task 1003333](https://cloudbongos.com/builders#/task/1003333)).** The owner's review took the three hero callouts off the landing, so the figure definitions above (*tasks shipped*, *credits of value*, *builders holding credits*) no longer describe anything the page renders, and the page no longer reads `/public/cost-summary` or `/public/leaderboard`. The sentinel rule, the ledger line and rows, the featured orbs and the title normalisation stand as written. The callout grammar lives on the `/projects` poster card (task 1003301), whose two figures are defined in `docs/design/<redacted>.md` §10.
+   > **Superseded in part, 2026-08-28 ([task 1003333](https://cloudbongos.com/builders#/task/1003333)).** The owner's review took the three hero callouts off the landing, so the figure definitions above (*tasks shipped*, *credits of value*, *builders holding credits*) no longer describe anything the page renders, and the page no longer reads `/public/cost-summary` or `/public/leaderboard`. The sentinel rule, the ledger line and rows, the featured orbs and the title normalisation stand as written. The callout grammar lives on the `/projects` poster card (task 1003301), whose two figures are defined in `docs/design/projects-hub-direction-v2.md` §10.
 
 ## Consequences
 

package/docs/adr/0197-the-ui-design-module.md

@@ -3,7 +3,7 @@
 - **Status:** accepted
 - **Date:** 2026-08-28
 - **Task:** [task 1003324](https://cloudbongos.com/builders#/task/1003324) (goal 1000080 — Apex UI pass 2; the first of five tasks scoped with the owner on 2026-08-28: 1003320 the kit, 1003321 the skills, 1003322 the apex carve, 1003323 the style library)
-- **Relates to:** [ADR 0081](<redacted>.md) (the tool-agnostic design layer this module absorbs), [ADR 0083](<redacted>.md) (the module system + the one-way rule), [ADR 0062 §7](<redacted>.md) (the core ↔ host split), [ADR 0108 §1](<redacted>.md) (host content vs the core package), [ADR 0196](<redacted>.md) (the chrome world as the token contract), ADR 0178 (the copy half), `modules/ui-design/CLAUDE.md`
+- **Relates to:** [ADR 0081](0081-tool-agnostic-design-layer.md) (the tool-agnostic design layer this module absorbs), [ADR 0083](0083-modular-architecture-strangler-build-plan.md) (the module system + the one-way rule), [ADR 0062 §7](0062-medusa-instance-model-decoupling.md) (the core ↔ host split), [ADR 0108 §1](0108-instance-composition-configurable-root.md) (host content vs the core package), [ADR 0196](0196-chrome-world-token-contract-and-the-landing-sheets.md) (the chrome world as the token contract), ADR 0178 (the copy half), `modules/ui-design/CLAUDE.md`
 
 ## Context
 

package/docs/adr/0198-third-party-skill-vendoring-policy.md

@@ -1,7 +1,7 @@
 # ADR 0198 — Third-party skill vendoring: a scan verdict the session cannot override, a licence allowlist, a provenance sidecar, one preamble block, and no auto-update
 
 - **Status:** Accepted (2026-08-28)
-- **Task:** [task 1003321](https://cloudbongos.com/builders#/task/1003321) (goal 1000080 — the second of the five ui-design tasks scoped with the owner on 2026-08-28; [ADR 0197](<redacted>.md) §7 pointed the vendoring policy at this ADR)
+- **Task:** [task 1003321](https://cloudbongos.com/builders#/task/1003321) (goal 1000080 — the second of the five ui-design tasks scoped with the owner on 2026-08-28; [ADR 0197](0197-the-ui-design-module.md) §7 pointed the vendoring policy at this ADR)
 - **Owner intent (2026-08-28):** every builder, on every instance, can produce good-looking, functional UIs in line with that instance's world and build on it. The skills that produced Cloud Bongos's world lived in one builder's `~/.agents/skills`; they were to become part of the `ui-design` module, materialised for every builder where the module is on.
 
 ## Context

package/docs/adr/0203-doorway-changelog-out-of-module-api.md

@@ -4,8 +4,8 @@
 - **Date:** 2026-08-28
 - **Deciders:** the owner (Archon) — decision made directly on the incident: move the changelog out permanently and repoint the carrier; explicitly rejected trimming entries in place and raising the fitness baseline. Claude implemented.
 - **Task:** task 1003335
-- **Amends:** [ADR 0161](<redacted>.md) §2 (the CI auto-patch carrier's write target)
-- **Interacts with:** [ADR 0083](<redacted>.md) (the doorway + `CORE_VERSION`), the `oversized_file_count` ratchet in `scripts/gds/fitness-ratchets.js` (task 1003129)
+- **Amends:** [ADR 0161](0161-publish-on-merge.md) §2 (the CI auto-patch carrier's write target)
+- **Interacts with:** [ADR 0083](0083-modular-architecture-strangler-build-plan.md) (the doorway + `CORE_VERSION`), the `oversized_file_count` ratchet in `scripts/gds/fitness-ratchets.js` (task 1003129)
 
 ## Context
 

package/docs/adr/0204-the-apex-is-dark-only.md

@@ -4,12 +4,12 @@
 - **Date:** 2026-08-29
 - **Deciders:** the owner (Archon), on the planets review of 2026-08-28: "only black or only white is a bit bland, frankly I am leaning towards only dark mode for this page and keep the dark/light mode to be solely for the builder hall. That way we could focus in on that style. This would also mean we could invest into a cool space themed backdrop for the blobs." Confirmed the same day as the WHOLE apex (landing, hub, legal pages), not the map alone. Claude implemented.
 - **Task:** task 1003336 (goal 1000080 — Apex UI pass 2)
-- **Supersedes in part:** [ADR 0196](<redacted>.md) — its Context ("light mode rebuilt to the dark standard") and the light-mode half of Decision 3 (world.css "the derived tier for both modes") no longer describe what the apex renders; the token contract, the sheet split, the plates and the sentinel rule stand. Also the landing direction's pick of option 3 in `docs/design/<redacted>.md` §5/§6 (2026-08-27): option 4, "dark-only landing", is the one taken after all, widened to every apex page.
+- **Supersedes in part:** [ADR 0196](0196-chrome-world-token-contract-and-the-landing-sheets.md) — its Context ("light mode rebuilt to the dark standard") and the light-mode half of Decision 3 (world.css "the derived tier for both modes") no longer describe what the apex renders; the token contract, the sheet split, the plates and the sentinel rule stand. Also the landing direction's pick of option 3 in `docs/design/landing-page-direction-v2.md` §5/§6 (2026-08-27): option 4, "dark-only landing", is the one taken after all, widened to every apex page.
 - **Interacts with:** ADR 0062 §3 (the pack's `theme.ui` is one-mode — light values — and is still spliced as the `:root`; the dark blocks override it exactly as before), the `ui-design` module's kit (ADR 0198 line; `modes` in a states file), the hall's own switch (`modules/hall-ui/public/shell.js`, `hall-theme`), the next task in the chain (1003337: a rendered space backdrop for the field — a black-ground plate, which is what a single mode makes possible).
 
 ## Context
 
-The apex shipped with a real, tested light mode: the world round's light landing was called weak, the landing round offered four answers (`<redacted>.md` §5), and on 2026-08-27 the owner picked "light rebuilt to the dark standard" — the chrome as alpha cutouts on paper — over "dark-only landing". The build made both modes real: every dark rule written twice (`:root[data-mode="dark"]` and its `prefers-color-scheme` twin), a pre-paint script on every apex page reading `?mode=`, the persisted `cb-color-mode` choice and the OS preference, a 44px moon/sun glyph in both bars, the kit rendering every state in both modes, and contrast measured in both.
+The apex shipped with a real, tested light mode: the world round's light landing was called weak, the landing round offered four answers (`landing-page-direction-v2.md` §5), and on 2026-08-27 the owner picked "light rebuilt to the dark standard" — the chrome as alpha cutouts on paper — over "dark-only landing". The build made both modes real: every dark rule written twice (`:root[data-mode="dark"]` and its `prefers-color-scheme` twin), a pre-paint script on every apex page reading `?mode=`, the persisted `cb-color-mode` choice and the OS preference, a 44px moon/sun glyph in both bars, the kit rendering every state in both modes, and contrast measured in both.
 
 Reviewing the planets (task 1003319), the owner saw the two grounds side by side and chose one: the apex commits to dark, so the field can carry a rendered space backdrop (a black-ground plate composites with nothing to hide; a pale ground would need a second, cut-out material for every plate), and the light/dark switch stays what it already is in the builders' hall — the hall's own, on its own key.
 

package/docs/adr/0205-federated-checkin-needs-the-hubs-own-signin-witness.md

@@ -28,7 +28,7 @@ And the instance sequences its calls: `src/bongos/auth-idp.js` runs the token ex
 
 ### D1 — The membership row carries `signin_verified_at`, and only the hub can stamp it
 
-`<redacted>.sql` adds one nullable `timestamptz` to `<redacted>`. It is written by exactly one domain function, `recordFederatedSignin({ clientId, githubId })`, called from exactly the two hub routes above. **No request-body field reaches the statement** — the `client_id` is the authenticated client and the `github_id` comes from the redeemed code or GitHub's own device answer.
+`platform_identity_014_membership_signin_proof.sql` adds one nullable `timestamptz` to `<redacted>`. It is written by exactly one domain function, `recordFederatedSignin({ clientId, githubId })`, called from exactly the two hub routes above. **No request-body field reaches the statement** — the `client_id` is the authenticated client and the `github_id` comes from the redeemed code or GitHub's own device answer.
 
 That is what makes it evidence rather than another self-report: it is a column the caller structurally cannot write.
 

package/docs/adr/0206-own-scoped-session-revocation-no-absolute-ceiling.md

@@ -4,7 +4,7 @@
 - **Date:** 2026-08-29
 - **Deciders:** Claude, building the own-scoped half of the session self-service. The ceiling question is the one the task named as "worth a decision either way".
 - **Task:** task 1003341 (goal 1000045 — public builder profiles + account security, criterion `i-control-my-own-access-and-exposure`)
-- **Interacts with:** [ADR 0016](<redacted>.md) (the DB enforces; a session is checked fresh per request, never cached), [ADR 0053](0053-scoped-dev-box-session.md) / [ADR 0151](<redacted>.md) §3 (the session-scope registry — scope is capability on the token, orthogonal to rank), migration `<redacted>.sql` (the 24h TTL + refresh-on-use it introduced, and the deliberate backfill grace that came with it).
+- **Interacts with:** [ADR 0016](0016-trust-boundary-server-enforced-permissions.md) (the DB enforces; a session is checked fresh per request, never cached), [ADR 0053](0053-scoped-dev-box-session.md) / [ADR 0151](0151-governance-permissions-as-atom-ranks-as-roles.md) §3 (the session-scope registry — scope is capability on the token, orthogonal to rank), migration `035_auth_token_hygiene.sql` (the 24h TTL + refresh-on-use it introduced, and the deliberate backfill grace that came with it).
 
 ## Context
 

package/docs/adr/0207-connections-implementation-departures-and-honest-limits.md

@@ -3,7 +3,7 @@
 - **Status:** accepted
 - **Date:** 2026-08-29
 - **Task:** [task 1002295](https://cloudbongos.com/builders#/task/1002295) (goal 1000045 — Public builder profiles, criterion C6)
-- **Amends:** [ADR 0202](<redacted>.md) (the design of record — this ADR does not replace any decision there, it records where the build had to choose and what the build cannot promise)
+- **Amends:** [ADR 0202](0202-connections-graph-and-bounded-degree.md) (the design of record — this ADR does not replace any decision there, it records where the build had to choose and what the build cannot promise)
 - **Relates to:** ADR 0016 (a connection is never authority), ADR 0171 D4 (the leak-by-subtraction ban), ADR 0182 (a predicate written once as JS and as a SQL fragment), ADR 0083 §5 (module-owned, namespaced migrations), ADR 0206 (the own-scope guard the connection surface joins)
 
 > ADR **0205** and **0206** were taken by sibling sessions in flight; this ADR takes 0207 rather than race them (the ADR 0199 / 0202 precedent).

package/docs/adr/0208-application-lifecycle-the-handle-waits-and-the-vouch-has-no-minter.md

@@ -3,13 +3,13 @@
 - **Status:** accepted
 - **Date:** 2026-08-29
 - **Task:** [task 1002284](https://cloudbongos.com/builders#/task/1002284) (R08, goal 1000045 — criteria C3/C4)
-- **Relates to:** [ADR 0201](<redacted>.md) (the design this builds — D1, D3.2, D4), [ADR 0016](<redacted>.md) (descriptive analytics are never authority), [ADR 0141](<redacted>.md) (identity federated, authority local), [ADR 0171](<redacted>.md) D2 (the non-numeric principal guard), [ADR 0116](<redacted>.md) (a refusal names the action available), [ADR 0202](<redacted>.md) D4 (the `account-visibility.js` "its own small file" precedent this reuses)
+- **Relates to:** [ADR 0201](0201-cross-project-application-vouched-row-live-record.md) (the design this builds — D1, D3.2, D4), [ADR 0016](0016-trust-boundary-server-enforced-permissions.md) (descriptive analytics are never authority), [ADR 0141](<redacted>.md) (identity federated, authority local), [ADR 0171](0171-profile-rollup-join-and-consent.md) D2 (the non-numeric principal guard), [ADR 0116](0116-api-error-envelope-and-code-taxonomy.md) (a refusal names the action available), [ADR 0202](0202-connections-graph-and-bounded-degree.md) D4 (the `account-visibility.js` "its own small file" precedent this reuses)
 
 ## Context
 
 ADR 0201 decided the cross-project application: it is the target project's own `access_requests` row, vouched for by a hub-signed assertion in a header, with the applicant's record resolved live in the reviewer's browser and never stored. Its dependency table splits the build: **R08 (this task) owns D1 + D4 + D3.2** — the migration, the row, the lifecycle, the atom — and **R09 ([task 1002285](https://cloudbongos.com/builders#/task/1002285)) owns D2 wholesale**: the assertion, the header, the live browser read, and the handle.
 
-Building R08 surfaced one place where the ADR contradicts itself, one place where its central mechanism cannot be written as described against the code that exists, and a handful of small questions it simply did not reach. This ADR records those, in the shape [ADR 0207](<redacted>.md) set for the connections wave: departures first, then the limits the shipped code is honest about.
+Building R08 surfaced one place where the ADR contradicts itself, one place where its central mechanism cannot be written as described against the code that exists, and a handful of small questions it simply did not reach. This ADR records those, in the shape [ADR 0207](0207-connections-implementation-departures-and-honest-limits.md) set for the connections wave: departures first, then the limits the shipped code is honest about.
 
 ## Decision
 

package/docs/adr/0209-one-budget-for-the-account-existence-oracle.md

@@ -4,7 +4,7 @@
 - **Date:** 2026-08-29
 - **Deciders:** Claude, building the throttle half of the account-existence task. The task body named the collapse question as an owner/Archon decision and it is left as one.
 - **Task:** task 1003339 (goal 1000045 — public builder profiles + account security, criterion `i-control-my-own-access-and-exposure`)
-- **Interacts with:** [ADR 0016](<redacted>.md) (the trust boundary — these two routes are deliberately outside it), [ADR 0083](<redacted>.md) (the published doorway a module reaches core through), [ADR 0091](<redacted>.md) §1 (what belongs in the bounded kernel), [ADR 0116](<redacted>.md) (the 429's envelope), [ADR 0194](<redacted>.md) (the membership door these routes report on), [ADR 0206](<redacted>.md) (the sibling account-security decision in this goal)
+- **Interacts with:** [ADR 0016](0016-trust-boundary-server-enforced-permissions.md) (the trust boundary — these two routes are deliberately outside it), [ADR 0083](0083-modular-architecture-strangler-build-plan.md) (the published doorway a module reaches core through), [ADR 0091](0091-bounding-the-kernel-and-db-carve.md) §1 (what belongs in the bounded kernel), [ADR 0116](0116-api-error-envelope-and-code-taxonomy.md) (the 429's envelope), [ADR 0194](0194-joinability-one-door-decision.md) (the membership door these routes report on), [ADR 0206](0206-own-scoped-session-revocation-no-absolute-ceiling.md) (the sibling account-security decision in this goal)
 
 ## Context
 

package/docs/adr/0210-scouting-graduates-on-an-instance-asserted-owner-claim.md

@@ -3,7 +3,7 @@
 - **Status:** accepted
 - **Date:** 2026-08-29
 - **Task:** [task 1002290](https://cloudbongos.com/builders#/task/1002290) (R14, goal 1000045 — Public builder profiles, criterion C5)
-- **Relates to:** [ADR 0201](<redacted>.md) D3 (what "project owner" means, and the hub-held owner list it forbids as a gate), [ADR 0141](<redacted>.md) §3/§4 (federated identity; authority stays local), [ADR 0016](<redacted>.md) (cross-project numbers are descriptive, never authority), [ADR 0205](<redacted>.md) D1/D2/D4 (the hub's own sign-in witness), [ADR 0171](<redacted>.md) D2/D3 (consent in the query), [ADR 0157](<redacted>.md) (`project.curate` archon → metic), `docs/specs/<redacted>.md` D1/D2 (the recruiting opt-out), `docs/specs/<redacted>.md` D3 (leaderboards, which the opt-out must NOT touch)
+- **Relates to:** [ADR 0201](0201-cross-project-application-vouched-row-live-record.md) D3 (what "project owner" means, and the hub-held owner list it forbids as a gate), [ADR 0141](<redacted>.md) §3/§4 (federated identity; authority stays local), [ADR 0016](0016-trust-boundary-server-enforced-permissions.md) (cross-project numbers are descriptive, never authority), [ADR 0205](0205-federated-checkin-needs-the-hubs-own-signin-witness.md) D1/D2/D4 (the hub's own sign-in witness), [ADR 0171](0171-profile-rollup-join-and-consent.md) D2/D3 (consent in the query), [ADR 0157](0157-archon-is-rank-and-identity-only.md) (`project.curate` archon → metic), `docs/specs/<redacted>.md` D1/D2 (the recruiting opt-out), `docs/specs/<redacted>.md` D3 (leaderboards, which the opt-out must NOT touch)
 
 > **0208** is held by a session in flight; this ADR takes 0210 rather than race it (the ADR 0199 / 0202 / 0207 precedent).
 

package/docs/adr/0212-connections-on-the-profile-surface-and-addressing.md

@@ -3,7 +3,7 @@
 - **Status:** accepted
 - **Date:** 2026-08-29
 - **Task:** [task 1002296](https://cloudbongos.com/builders#/task/1002296) (R20 · goal 1000045 — Public builder profiles, criterion C6)
-- **Amends:** [ADR 0202](<redacted>.md) D4 (the design of record) and [ADR 0207](<redacted>.md) (the API's own departures). Neither decision changes; this records where the *rendering* had to choose, and what the chosen surface cannot yet do.
+- **Amends:** [ADR 0202](0202-connections-graph-and-bounded-degree.md) D4 (the design of record) and [ADR 0207](0207-connections-implementation-departures-and-honest-limits.md) (the API's own departures). Neither decision changes; this records where the *rendering* had to choose, and what the chosen surface cannot yet do.
 - **Relates to:** ADR 0016 (a connection is never authority), ADR 0171 D4/D5 (leak by subtraction; no-store), `docs/specs/<redacted>.md` (the page spec whose section 6 this is)
 
 > ADR **0210** and **0211** were spoken for by sibling sessions in flight; this ADR takes 0212 rather than race them (the ADR 0199 / 0202 / 0207 precedent).

package/docs/adr/0213-platform-terms-acceptance-is-the-hubs-own-witness.md

@@ -3,7 +3,7 @@
 - **Status:** accepted
 - **Date:** 2026-08-29
 - **Task:** [task 1002913](https://cloudbongos.com/builders#/task/1002913) (goal 1000045 — Public builder profiles)
-- **Relates to:** [ADR 0141](<redacted>.md) §4 (which deferred cross-project-aggregation consent to "the platform T&C" and conditioned the scouting view on it), [ADR 0171](<redacted>.md) D3 (fail-closed `profile_state`, and the sentence that reserved this task's place), [ADR 0016](<redacted>.md) (cross-project numbers are descriptive, never authority), [ADR 0205](<redacted>.md) D3 (the hub's own sign-in witness; `ensureAccount` vs `upsertAccount`), [ADR 0210](<redacted>.md) (the directory this consent covers), [ADR 0202](<redacted>.md) D4 (the shared effective-visibility reader), `docs/specs/<redacted>.md` (the "already carries platform T&C consent" premise), `docs/specs/<redacted>.md`
+- **Relates to:** [ADR 0141](<redacted>.md) §4 (which deferred cross-project-aggregation consent to "the platform T&C" and conditioned the scouting view on it), [ADR 0171](0171-profile-rollup-join-and-consent.md) D3 (fail-closed `profile_state`, and the sentence that reserved this task's place), [ADR 0016](0016-trust-boundary-server-enforced-permissions.md) (cross-project numbers are descriptive, never authority), [ADR 0205](0205-federated-checkin-needs-the-hubs-own-signin-witness.md) D3 (the hub's own sign-in witness; `ensureAccount` vs `upsertAccount`), [ADR 0210](0210-scouting-graduates-on-an-instance-asserted-owner-claim.md) (the directory this consent covers), [ADR 0202](0202-connections-graph-and-bounded-degree.md) D4 (the shared effective-visibility reader), `docs/specs/<redacted>.md` (the "already carries platform T&C consent" premise), `docs/specs/<redacted>.md`
 
 > **0211 and 0212** are held by sessions in flight; this ADR takes 0213 rather than race them (the ADR 0199 / 0202 / 0207 / 0210 precedent).
 
@@ -23,7 +23,7 @@ Three things were found on picking the task up, and they changed its shape:
 
 ### D1 — The acceptance record is the hub's own evidence, never a caller's claim
 
-`platform_identity_accounts` gains `terms_accepted_at timestamptz` and `terms_version text` (migration `<redacted>.sql`). Both are written by exactly one statement: `upsertAccount`'s `activate` branch. That branch has exactly one caller — `GET /sso/authorize` — where `activate: true` is a **source literal** and every other field comes from the hub's own `resolveSession` result, gated by `sessionUsableForFederation`.
+`platform_identity_accounts` gains `terms_accepted_at timestamptz` and `terms_version text` (migration `platform_identity_019_terms_acceptance.sql`). Both are written by exactly one statement: `upsertAccount`'s `activate` branch. That branch has exactly one caller — `GET /sso/authorize` — where `activate: true` is a **source literal** and every other field comes from the hub's own `resolveSession` result, gated by `sessionUsableForFederation`.
 
 This is deliberately the ADR 0205 D3 property, reused. An acceptance record a caller could assert is evidence of nothing; the only thing that makes the record mean "this human accepted" is that no request-controlled value can reach the statement that writes it. `ensureAccount` — the federated check-in / device-poll path, which takes an *unproven* `github_id` from a request body — writes NULL, exactly as it writes `provisional`.
 

package/docs/adr/0215-the-recruiter-sliver-is-a-ceiling-not-a-step.md

@@ -3,15 +3,15 @@
 - **Status:** accepted
 - **Date:** 2026-08-29
 - **Task:** [task 1002968](https://cloudbongos.com/builders#/task/1002968) (PV3, goal 1000045 — Public builder profiles, criteria C2/C5)
-- **Relates to:** `docs/specs/<redacted>.md` **D3** (the owner-signed sliver, 2026-08-16) and D1/D2 (the two privacy axes), [ADR 0171](<redacted>.md) D2/D4/D5 (rollup consent, no partial numbers, no-store), [ADR 0210](<redacted>.md) D2/D4 (the recruiting door; reach composed but not folded down), [ADR 0201](<redacted>.md) D3 (the `project.recruit` atom belongs to the console wave), [ADR 0016](<redacted>.md) (cross-project numbers are descriptive, never authority), [ADR 0202](<redacted>.md) D4 (one shared effective-visibility predicate)
+- **Relates to:** `docs/specs/<redacted>.md` **D3** (the owner-signed sliver, 2026-08-16) and D1/D2 (the two privacy axes), [ADR 0171](0171-profile-rollup-join-and-consent.md) D2/D4/D5 (rollup consent, no partial numbers, no-store), [ADR 0210](0210-scouting-graduates-on-an-instance-asserted-owner-claim.md) D2/D4 (the recruiting door; reach composed but not folded down), [ADR 0201](0201-cross-project-application-vouched-row-live-record.md) D3 (the `project.recruit` atom belongs to the console wave), [ADR 0016](0016-trust-boundary-server-enforced-permissions.md) (cross-project numbers are descriptive, never authority), [ADR 0202](0202-connections-graph-and-bounded-degree.md) D4 (one shared effective-visibility predicate)
 
 > 0213 and 0214 are held by sessions in flight; this ADR takes 0215 rather than race them (the ADR 0199 / 0202 / 0207 / 0210 precedent).
 
 ## Context
 
-Privacy spec D2 has a row that nothing could serve: **private · discoverable**. A builder who wants no public profile page but does want to be found for work sets `account_visibility = 'private'` and `recruiter_discoverable = true`, and until now that combination bought them exactly nothing — [ADR 0210](<redacted>.md) D4 says so in as many words: *"a private account is absent from the directory on purpose: the full rollup is never its disclosure — the D3 sliver is."* The sliver was the unbuilt half.
+Privacy spec D2 has a row that nothing could serve: **private · discoverable**. A builder who wants no public profile page but does want to be found for work sets `account_visibility = 'private'` and `recruiter_discoverable = true`, and until now that combination bought them exactly nothing — [ADR 0210](0210-scouting-graduates-on-an-instance-asserted-owner-claim.md) D4 says so in as many words: *"a private account is absent from the directory on purpose: the full rollup is never its disclosure — the D3 sliver is."* The sliver was the unbuilt half.
 
-Two consequences had accumulated around that gap. The Settings toggle's copy was deliberately **narrowed** by task 1002290 to "the People directory", because the sliver was unbuilt and no guard could hold a wider promise. And [ADR 0201](<redacted>.md) had to ship the cross-project application queue showing a private applicant's *name, handle and note only*, deferring the richer record to "the sliver half, sequenced behind the recruiter port".
+Two consequences had accumulated around that gap. The Settings toggle's copy was deliberately **narrowed** by task 1002290 to "the People directory", because the sliver was unbuilt and no guard could hold a wider promise. And [ADR 0201](0201-cross-project-application-vouched-row-live-record.md) had to ship the cross-project application queue showing a private applicant's *name, handle and note only*, deferring the richer record to "the sliver half, sequenced behind the recruiter port".
 
 The design question is not what to show. The owner signed that on 2026-08-16 and it is short: **handle, display name, avatar, the disciplines union, and a coarse "active in the last 30 days" boolean — nothing else**; name-only under `hide_stats`; never for a provisional account; never a profile-page link. The question is what *kind of thing* the sliver is, and everything below follows from one answer: **it is a ceiling, not a step.** Nothing a recruiter holds after reading it gets them closer to the record it withholds.
 
@@ -67,7 +67,7 @@ Spec D3 says the sliver is "gated at the route by `project.recruit`" — and tha
 
 **The audience is the owner's call, and it is filed rather than taken.** [Blocker 1000126](https://cloudbongos.com/builders#/blocker/1000126) asks whether the wider recruiting audience is authorized here, with the evidence and a recommendation (hold the floor; let `project.recruit` — grantable per instance — settle it, which is exactly the knob the question wants). Answering it moves **one line**, and the tests that pin the floor flip with it. Goal 1000045 C5 (*"project owners, not only Archons, browse builder profiles to recruit"*) pulls the other way, and that tension is what the blocker carries: C5 was written about the DIRECTORY, which shows public builders; this surface shows private ones.
 
-**Answered 2026-08-29 — the floor stands.** The owner kept the archon floor, and [ADR 0217](<redacted>.md) D2 records why it is now the *consistent* answer rather than the merely safe one: the owner's rule from the same review is that **rank gates inviting, not viewing**, and the per-project invite floor they asked for also defaults to archon. The sliver is a recruiting disclosure of an account that asked not to be publicly visible, so it sits on the inviting side of that line. The C5 tension recorded above is resolved rather than deferred — C5 is about *browsing*, which ADR 0217 D1 makes ungated, and was never about disclosing private accounts. No code moved; the one-line swap remains available if the console wave's `project.recruit` atom later says otherwise.
+**Answered 2026-08-29 — the floor stands.** The owner kept the archon floor, and [ADR 0217](0217-rank-gates-inviting-not-viewing.md) D2 records why it is now the *consistent* answer rather than the merely safe one: the owner's rule from the same review is that **rank gates inviting, not viewing**, and the per-project invite floor they asked for also defaults to archon. The sliver is a recruiting disclosure of an account that asked not to be publicly visible, so it sits on the inviting side of that line. The C5 tension recorded above is resolved rather than deferred — C5 is about *browsing*, which ADR 0217 D1 makes ungated, and was never about disclosing private accounts. No code moved; the one-line swap remains available if the console wave's `project.recruit` atom later says otherwise.
 
 The refusal for an unreachable *builder* is **404, never 403**: a 403 would confirm the handle exists, which is precisely the disclosure the opt-out removes. (A refusal of the *caller* is an ordinary rank 403 naming the floor it wanted, so the hall can render why.) And `Cache-Control: no-store`, the `/profiles/:handle` posture, because the rollup half is live-derived and hide must beat any cache (ADR 0171 D5) — the directory route gained the same header here, having been the last rollup read without it.
 
@@ -85,7 +85,7 @@ Task 1002290 narrowed the discoverable toggle from "every recruiting view" to "t
 
 ### D7 — No migration, and no new file in `platform-identity.js`
 
-Both columns exist (migration `<redacted>.sql`); the activity table's `(github_id)` index already serves both reads. Spec D3 asks for the port "beside `getPublicProfileExtras`" and it is beside it *in the module*, not in the file: `platform-identity.js` sits on the 1500-line ratchet with no headroom — the `account-visibility.js` / `scouting-authz.js` / `application-echo.js` precedent, now five sessions deep.
+Both columns exist (migration `platform_identity_012_account_privacy.sql`); the activity table's `(github_id)` index already serves both reads. Spec D3 asks for the port "beside `getPublicProfileExtras`" and it is beside it *in the module*, not in the file: `platform-identity.js` sits on the 1500-line ratchet with no headroom — the `account-visibility.js` / `scouting-authz.js` / `application-echo.js` precedent, now five sessions deep.
 
 ## Consequences
 
@@ -96,7 +96,7 @@ Both columns exist (migration `<redacted>.sql`); the activity table's `(github_i
 ⚠ **Honest limits, recorded rather than fixed:**
 
 - **No UI consumes the sliver yet.** This ships the port, the route and the proof; the recruiting *view* is the console wave's (spec D6, `<redacted>.md` CT6) and the application queue's (task 1002972). The route is reachable and gated today; nothing in the hall calls it.
-- **The audience was unresolved when this shipped; it is settled now, and the floor did not move** ([blocker 1000126](https://cloudbongos.com/builders#/blocker/1000126), answered 2026-08-29 — see the D4 addendum above and [ADR 0217](<redacted>.md) D2). The archon floor was the conservative reading of an owner-signed spec rather than a call this ADR was entitled to make; the owner has since made it, and kept the floor. **What is still true:** the gate is *narrower* than goal C5 describes, so project owners cannot use the sliver today — ADR 0217 D1 resolves that tension by making C5's subject (browsing) ungated rather than by widening this surface, and `project.recruit` remains the eventual home. An earlier draft of this section called the shipped gate "narrower than the spec's atom" and "not a widening in any direction"; both were wrong, and wrong in the dangerous direction, because the SUBJECT set strictly grows: private accounts were on no recruiter surface at all before this.
+- **The audience was unresolved when this shipped; it is settled now, and the floor did not move** ([blocker 1000126](https://cloudbongos.com/builders#/blocker/1000126), answered 2026-08-29 — see the D4 addendum above and [ADR 0217](0217-rank-gates-inviting-not-viewing.md) D2). The archon floor was the conservative reading of an owner-signed spec rather than a call this ADR was entitled to make; the owner has since made it, and kept the floor. **What is still true:** the gate is *narrower* than goal C5 describes, so project owners cannot use the sliver today — ADR 0217 D1 resolves that tension by making C5's subject (browsing) ungated rather than by widening this surface, and `project.recruit` remains the eventual home. An earlier draft of this section called the shipped gate "narrower than the spec's atom" and "not a widening in any direction"; both were wrong, and wrong in the dangerous direction, because the SUBJECT set strictly grows: private accounts were on no recruiter surface at all before this.
 - **The rank gate is a documented HOLDOUT against the module-gate migration rule** (BV1.R105/R107, ADR 0151): `modules/*/routes` gates are supposed to be permission atoms, and `tests/government_require_permission.mjs` enforces it from source. This route is listed in that test's `RETAINED` set with its full argument — the atom it wants is specified and owned by another wave, minting it forks the definition, borrowing a different archon atom would name the wrong authority on a privacy surface, and the sibling's door is wider than the signed floor. It is temporary by construction: spike 1002786 R3 removes the entry.
 - **The two gates are spelled twice, on purpose.** An earlier draft called them "one gate expression … a one-line change reaching both"; they never were one, and now they are deliberately different.
 - **A recruiting read added in another FILE would not trip the two-route guard.** D6's count is over `routes/scouting.js` alone, so the "both recruiting surfaces" copy could become false without reddening. Sweeping every route file for reach-joining reads is a structural guard of its own and belongs with the shared-predicate work, not here.

package/docs/adr/0216-a-fake-pool-interpreter-must-fail-loudly-not-silently-ignore.md

@@ -3,7 +3,7 @@
 - **Status:** accepted
 - **Date:** 2026-08-29
 - **Task:** [task 1003354](https://cloudbongos.com/builders#/task/1003354) (folding in idea 1000877, raised by the adversarial review of [task 1002968](https://cloudbongos.com/builders#/task/1002968))
-- **Relates to:** [ADR 0202](<redacted>.md) D4 and [ADR 0213](<redacted>.md) (the predicates these interpreters stand in for), [ADR 0215](<redacted>.md) D7 (where the structure guard was first written), [ADR 0091](<redacted>.md) §2 (deliberate duplication across a boundary)
+- **Relates to:** [ADR 0202](0202-connections-graph-and-bounded-degree.md) D4 and [ADR 0213](0213-platform-terms-acceptance-is-the-hubs-own-witness.md) (the predicates these interpreters stand in for), [ADR 0215](0215-the-recruiter-sliver-is-a-ceiling-not-a-step.md) D7 (where the structure guard was first written), [ADR 0091](0091-bounding-the-kernel-and-db-carve.md) §2 (deliberate duplication across a boundary)
 
 ## Context
 
@@ -13,7 +13,7 @@ The design has one failure mode, and it is silent: **a term the interpreter does
 
 - an unread `$N` placeholder throws (all nine);
 - a literal comparison on an unknown column throws (four);
-- an unmodelled `IS [NOT] NULL` throws (two, added by [ADR 0213](<redacted>.md)).
+- an unmodelled `IS [NOT] NULL` throws (two, added by [ADR 0213](0213-platform-terms-acceptance-is-the-hubs-own-witness.md)).
 
 Every one of those guards is a **term** guard, and three separate reviews found the same thing: the term list is not the predicate.
 

package/docs/adr/0217-rank-gates-inviting-not-viewing.md

@@ -4,7 +4,7 @@
 - **Date:** 2026-08-29
 - **Task:** [task 1003358](https://cloudbongos.com/builders#/task/1003358) (ledger close-out, goal 1000045 — Public builder profiles)
 - **Blockers answered:** [1000121](https://cloudbongos.com/builders#/blocker/1000121), [1000122](https://cloudbongos.com/builders#/blocker/1000122), [1000123](https://cloudbongos.com/builders#/blocker/1000123), [1000124](https://cloudbongos.com/builders#/blocker/1000124), [1000126](https://cloudbongos.com/builders#/blocker/1000126)
-- **Relates to:** [ADR 0210](<redacted>.md) D2 (the instance-asserted owner door), [ADR 0215](<redacted>.md) D4 (the sliver's archon floor), [ADR 0213](<redacted>.md) (the consent axis), [ADR 0209](<redacted>.md) (the account-existence oracle), [ADR 0201](<redacted>.md) D3 (the `project.recruit` atom belongs to the console wave), [ADR 0016](<redacted>.md) (cross-project numbers are descriptive, never authority)
+- **Relates to:** [ADR 0210](0210-scouting-graduates-on-an-instance-asserted-owner-claim.md) D2 (the instance-asserted owner door), [ADR 0215](0215-the-recruiter-sliver-is-a-ceiling-not-a-step.md) D4 (the sliver's archon floor), [ADR 0213](0213-platform-terms-acceptance-is-the-hubs-own-witness.md) (the consent axis), [ADR 0209](0209-one-budget-for-the-account-existence-oracle.md) (the account-existence oracle), [ADR 0201](0201-cross-project-application-vouched-row-live-record.md) D3 (the `project.recruit` atom belongs to the console wave), [ADR 0016](0016-trust-boundary-server-enforced-permissions.md) (cross-project numbers are descriptive, never authority)
 
 ## Context
 

package/docs/adr/0218-the-apex-root-web-surface.md

@@ -3,7 +3,7 @@
 - **Status:** accepted
 - **Date:** 2026-08-30
 - **Task:** [task 1003322](https://cloudbongos.com/builders#/task/1003322) (goal 1000080 — the apex frontend pass; the last of the five tasks scoped with the owner on 2026-08-28, after 1003320 the kit, 1003321 the skills, 1003323 the style library and 1003324 the module)
-- **Relates to:** [ADR 0083](<redacted>.md) (the module system, the one-way rule, and §Decision #4 "the kernel names no module key"), [ADR 0093 §1](<redacted>.md) (the web-surface carves: status-UI BV1.R84, hall-UI BV1.R85), [ADR 0197 §8](<redacted>.md) ("the front door keeps its own key" — this carve was named there), [ADR 0062 §7](<redacted>.md) (the core ↔ host split), [ADR 0108 §1](<redacted>.md) (host content vs the core package), [ADR 0152](<redacted>.md) (the landing is served by the core app), `modules/public-landing/CLAUDE.md`
+- **Relates to:** [ADR 0083](0083-modular-architecture-strangler-build-plan.md) (the module system, the one-way rule, and §Decision #4 "the kernel names no module key"), [ADR 0093 §1](0093-tranche-2-core-carve-sequence.md) (the web-surface carves: status-UI BV1.R84, hall-UI BV1.R85), [ADR 0197 §8](0197-the-ui-design-module.md) ("the front door keeps its own key" — this carve was named there), [ADR 0062 §7](0062-medusa-instance-model-decoupling.md) (the core ↔ host split), [ADR 0108 §1](0108-instance-composition-configurable-root.md) (host content vs the core package), [ADR 0152](0152-landing-gate-served-by-the-core-app.md) (the landing is served by the core app), `modules/public-landing/CLAUDE.md`
 
 ## Context
 
@@ -44,7 +44,7 @@ The hall had already established the other half of the answer. A web-surface mod
 
 8. **The kernel still names no module key** (ADR 0083 §Decision #4). `platform-server.js` selects its surface with `surfaces.find((s) => s.apexRoot)` — a predicate over the *declaration*, exactly as `serve-internal.js` partitions the hall with a predicate over the *host*. Neither file's **code** names the key after this change — only comments say where the bytes happen to live today. A future instance that ships its own front door module gets the apex by declaring `apexRoot`, with no core edit.
 
-9. **The nested `modules/public-landing/CLAUDE.md` is the newcomer's map of this instance's world** — `DESIGN.md`, the fifteen-token contract and why there are two sheets ([ADR 0196](<redacted>.md)), the direction records and the mocks, which page is which, the test pins that bite, the traps, and a pointer to `modules/ui-design/`'s kit for the look-before-you-ship loop. The module ships the *world*; the method for building one stays in `ui-design`.
+9. **The nested `modules/public-landing/CLAUDE.md` is the newcomer's map of this instance's world** — `DESIGN.md`, the fifteen-token contract and why there are two sheets ([ADR 0196](0196-chrome-world-token-contract-and-the-landing-sheets.md)), the direction records and the mocks, which page is which, the test pins that bite, the traps, and a pointer to `modules/ui-design/`'s kit for the look-before-you-ship loop. The module ships the *world*; the method for building one stays in `ui-design`.
 
 ## Consequences
 

package/docs/adr/0219-a-look-is-a-branding-pack-the-style-library.md

@@ -3,7 +3,7 @@
 - **Status:** accepted
 - **Date:** 2026-09-01
 - **Task:** [task 1003323](https://cloudbongos.com/builders#/task/1003323) (goal 1000083 — the ui-design module as a platform capability; criterion `uidesign-style-library`)
-- **Relates to:** [ADR 0062 §3/§7](<redacted>.md) (the branding contract; the core ↔ host split), [ADR 0196](<redacted>.md) (the chrome world becomes the token contract), [ADR 0197](<redacted>.md) (the module; `styles/` reserved), [ADR 0204](<redacted>.md), `modules/ui-design/styles/README.md`, `DESIGN.md`
+- **Relates to:** [ADR 0062 §3/§7](0062-medusa-instance-model-decoupling.md) (the branding contract; the core ↔ host split), [ADR 0196](0196-chrome-world-token-contract-and-the-landing-sheets.md) (the chrome world becomes the token contract), [ADR 0197](0197-the-ui-design-module.md) (the module; `styles/` reserved), [ADR 0204](0204-the-apex-is-dark-only.md), `modules/ui-design/styles/README.md`, `DESIGN.md`
 
 ## Context
 

package/docs/adr/0220-an-in-house-rebuilt-skill-is-a-first-party-skill.md

@@ -1,7 +1,7 @@
 # ADR 0220 — An in-house rebuilt skill is a first-party skill: it lands at `skills/<name>/`, opens with the same preamble, carries a "Rebuilt from" section instead of a sidecar, and is counted
 
 - **Status:** Accepted (2026-09-01)
-- **Task:** [task 1003325](https://cloudbongos.com/builders#/task/1003325) (goal 1000083 — the ui-design module as a platform capability; the first of the rebuild-spec tasks [ADR 0198](<redacted>.md) filed)
+- **Task:** [task 1003325](https://cloudbongos.com/builders#/task/1003325) (goal 1000083 — the ui-design module as a platform capability; the first of the rebuild-spec tasks [ADR 0198](0198-third-party-skill-vendoring-policy.md) filed)
 - **Owner intent (2026-08-28):** every builder, on every instance, can produce good-looking, functional UIs in line with that instance's world. The taste skills that produced Cloud Bongos's world were to become part of the module; the scan said they could not be copied, so they are rebuilt.
 
 ## Context

package/docs/adr/0221-the-impeccable-method-is-one-skill-with-sub-command-playbooks.md

@@ -1,12 +1,12 @@
 # ADR 0221 — The impeccable method is one skill with sub-command playbooks: one preamble, one playbook per request, the three homes are the instance's own files, and the origin's mechanisms are dropped rather than disabled
 
 - **Status:** Accepted (2026-09-01)
-- **Task:** [task 1003326](https://cloudbongos.com/builders#/task/1003326) (goal 1000083 — the ui-design module as a platform capability; the second rebuild-spec task after [ADR 0220](<redacted>.md))
+- **Task:** [task 1003326](https://cloudbongos.com/builders#/task/1003326) (goal 1000083 — the ui-design module as a platform capability; the second rebuild-spec task after [ADR 0220](0220-an-in-house-rebuilt-skill-is-a-first-party-skill.md))
 - **Owner intent (2026-08-28):** every builder, on every instance, can produce good-looking, functional UIs in line with that instance's world. The impeccable skill was the operating skill the hub round ran under; the scan said it could not be copied, so its method is rebuilt.
 
 ## Context
 
-`/scan-before-install` reduced `pbakaus/impeccable` @ `<redacted>` to `dangerous` at the default tier: three critical findings at the deterministic floor, and a panel that upheld PostToolUse and Stop hooks written into five harness configs, a child agent spawned with its permissions bypassed from a loopback HTTP route with the parent environment forwarded, a setup directive that overrode the harness's own instructions, a live-server credential embedded in page source, an unverified remote bundle, and default-on telemetry ([ADR 0198](<redacted>.md); the roster in `modules/ui-design/skills/README.md`). The REBUILD-SPEC in the task body lists a hundred and forty requirements derived from the origin's documentation only, across twelve areas: entry, world, commands, craft floor, detector, live, finish, native, hooks, assets, docs.
+`/scan-before-install` reduced `pbakaus/impeccable` @ `<redacted>` to `dangerous` at the default tier: three critical findings at the deterministic floor, and a panel that upheld PostToolUse and Stop hooks written into five harness configs, a child agent spawned with its permissions bypassed from a loopback HTTP route with the parent environment forwarded, a setup directive that overrode the harness's own instructions, a live-server credential embedded in page source, an unverified remote bundle, and default-on telemetry ([ADR 0198](0198-third-party-skill-vendoring-policy.md); the roster in `modules/ui-design/skills/README.md`). The REBUILD-SPEC in the task body lists a hundred and forty requirements derived from the origin's documentation only, across twelve areas: entry, world, commands, craft floor, detector, live, finish, native, hooks, assets, docs.
 
 ADR 0220 fixed where a rebuild lives and what it carries. It did not say how a method that is a *family of sub-commands* lands (the taste core was four independent skills), what the origin's three persisted homes (product truth, the visual system, per-surface briefs) become on a platform whose world is already the instance's files, or what to do with the six areas of the spec whose whole substance is the mechanism the panel condemned.
 

package/docs/adr/0222-the-image-family-under-the-hero-only-rule.md

@@ -1,12 +1,12 @@
 # ADR 0222 — The image family under the hero-only rule: plates and hero objects, never screens; the mark is drawn; the board is a contact sheet; the pair and the sidecar are the output contract
 
 - **Status:** Accepted (2026-09-02)
-- **Task:** [task 1003328](https://cloudbongos.com/builders#/task/1003328) (goal 1000083 — the ui-design module as a platform capability; the third rebuild-spec task after [ADR 0220](<redacted>.md) and [ADR 0221](<redacted>.md))
+- **Task:** [task 1003328](https://cloudbongos.com/builders#/task/1003328) (goal 1000083 — the ui-design module as a platform capability; the third rebuild-spec task after [ADR 0220](0220-an-in-house-rebuilt-skill-is-a-first-party-skill.md) and [ADR 0221](0221-the-impeccable-method-is-one-skill-with-sub-command-playbooks.md))
 - **Owner intent (2026-08-28):** "a simple port, with ONE rewrite the upstream never had: the owner's rule that image generation is for text-free hero plates and hero objects only; UI is rebuilt from templates and the instance's world, never painted."
 
 ## Context
 
-The four image skills of `Leonxlnx/taste-skill` (`image-to-code`, `imagegen-frontend-web`, `imagegen-frontend-mobile`, `brandkit`) scanned `dangerous` with the rest of that origin ([ADR 0198](<redacted>.md)); their REBUILD-SPEC groups sit in the body of task 1003325. All four are built around generating **pictures of interfaces**: one design-reference image per section, one app screen per flow step inside a phone mockup, an identity board with the brand name and labels rendered into the image, and a build loop whose source of truth is the generated image. The panel flagged the eagerness mandate, the "do not be lazy with image count" rule and the must-invoke-any-image-tool directive by name. The owner's rule (2026-08-26, reaffirmed 2026-08-27, recorded in the preamble's item 4 and in the chrome world's materials table) forbids the whole category: an image with letters, a comp, a screen or a frame around one is not a hero plate.
+The four image skills of `Leonxlnx/taste-skill` (`image-to-code`, `imagegen-frontend-web`, `imagegen-frontend-mobile`, `brandkit`) scanned `dangerous` with the rest of that origin ([ADR 0198](0198-third-party-skill-vendoring-policy.md)); their REBUILD-SPEC groups sit in the body of task 1003325. All four are built around generating **pictures of interfaces**: one design-reference image per section, one app screen per flow step inside a phone mockup, an identity board with the brand name and labels rendered into the image, and a build loop whose source of truth is the generated image. The panel flagged the eagerness mandate, the "do not be lazy with image count" rule and the must-invoke-any-image-tool directive by name. The owner's rule (2026-08-26, reaffirmed 2026-08-27, recorded in the preamble's item 4 and in the chrome world's materials table) forbids the whole category: an image with letters, a comp, a screen or a frame around one is not a hero plate.
 
 A port that kept the method and changed only the subject had to answer what each skill *makes* when it may not make a picture of a screen.
 

package/docs/adr/0223-the-detector-is-two-tiers-in-the-kit.md

@@ -1,12 +1,12 @@
 # ADR 0223 — The anti-pattern detector is two tiers inside the kit: mechanical floors fail, craft tells warn, a false positive is waived in the file with its reason, and nothing new is installed
 
 - **Status:** Accepted (2026-09-02)
-- **Task:** [task 1003329](https://cloudbongos.com/builders#/task/1003329) (goal 1000083 — the ui-design module as a platform capability; the fourth rebuild-spec task, after [ADR 0220](<redacted>.md), [ADR 0221](<redacted>.md) and [ADR 0222](<redacted>.md))
+- **Task:** [task 1003329](https://cloudbongos.com/builders#/task/1003329) (goal 1000083 — the ui-design module as a platform capability; the fourth rebuild-spec task, after [ADR 0220](0220-an-in-house-rebuilt-skill-is-a-first-party-skill.md), [ADR 0221](0221-the-impeccable-method-is-one-skill-with-sub-command-playbooks.md) and [ADR 0222](0222-the-image-family-under-the-hero-only-rule.md))
 - **Owner intent (2026-08-28):** the parts of impeccable worth rebuilding include "a static anti-pattern detector"; the task body says to land it "as RULES in the kit that already exists, never as a second tool, never as a browser bundle, never with a hook".
 
 ## Context
 
-The [detector] group of impeccable's REBUILD-SPEC (the body of task 1003326) describes a deterministic rule engine of about sixty rules split between generated-design tells and general quality, usable standalone and inside the skill, over three input kinds, with machine-readable output and a gating exit code, a cascade resolver for computed values, per-project ignores, in-file waivers, a browser-injected variant, a screenshot contrast pass, and the rule that a clean scan is a floor and never proof. The origin shipped it as its own CLI plus a browser bundle, wired to PostToolUse and Stop hooks, and the panel condemned the hooks and the bundle ([ADR 0198](<redacted>.md)).
+The [detector] group of impeccable's REBUILD-SPEC (the body of task 1003326) describes a deterministic rule engine of about sixty rules split between generated-design tells and general quality, usable standalone and inside the skill, over three input kinds, with machine-readable output and a gating exit code, a cascade resolver for computed values, per-project ignores, in-file waivers, a browser-injected variant, a screenshot contrast pass, and the rule that a clean scan is a floor and never proof. The origin shipped it as its own CLI plus a browser bundle, wired to PostToolUse and Stop hooks, and the panel condemned the hooks and the bundle ([ADR 0198](0198-third-party-skill-vendoring-policy.md)).
 
 The kit already had the engine's shape: `check-mock.js` runs pure rules over a mock's source and keeps the platform's rules apart from the instance's `DESIGN.md` taste bans; `render.js` evaluates `lib.js`'s `factsInPage` in the real page per state, width and mode and audits the facts against the floors; `contrast.js` measures the pairs; every CLI exits 0 / 1 / 2 / 3. What it did not have was the detector's rule content, a place for rules that are reads rather than floors, and a way to name a false positive without deleting the rule.
 
@@ -30,4 +30,4 @@ The kit already had the engine's shape: `check-mock.js` runs pure rules over a m
 - **A second CLI beside `check-mock.js`** ("`kit/detect.js`"): one more thing to run, one more exit code to learn, and the same rules; the task body forbade it.
 - **Every tell as a floor:** the tells are reads a world can legitimately contradict (a hard offset shadow in a brutalist look, a stripe in a ledger); failing a mock on them would make the kit the taste and the instance the exception, the inversion the module exists to prevent.
 - **A per-project ignore config with an admin action set:** a suppression nobody sees where the rule fires; the file-scoped waiver with a mandatory place for a reason keeps the finding and its dismissal on the same line.
-- **A hook that runs the detector on every edit:** the pre-flight is the kit and the ship gate is the sweep ([ADR 0221](<redacted>.md) D3).
+- **A hook that runs the detector on every edit:** the pre-flight is the kit and the ship gate is the sweep ([ADR 0221](0221-the-impeccable-method-is-one-skill-with-sub-command-playbooks.md) D3).

package/docs/adr/0224-module-skills-reach-the-core-checkout-as-untracked-self-ignored-copies.md

@@ -2,7 +2,7 @@
 
 - **Status:** Accepted (2026-09-02)
 - **Task:** [task 1003330](https://cloudbongos.com/builders#/task/1003330) (goal 1000083 — the ui-design module as a platform capability; from idea 1000864, filed by task 1003321)
-- **Context:** [ADR 0198](<redacted>.md) landed module-owned skills for INSTANCES (`claude-materialize.js` step 1b, on `bongos init` / `upgrade`); [ADR 0220](<redacted>.md) and its successors noted each time that "the core checkout itself still does not see module-owned skills".
+- **Context:** [ADR 0198](0198-third-party-skill-vendoring-policy.md) landed module-owned skills for INSTANCES (`claude-materialize.js` step 1b, on `bongos init` / `upgrade`); [ADR 0220](0220-an-in-house-rebuilt-skill-is-a-first-party-skill.md) and its successors noted each time that "the core checkout itself still does not see module-owned skills".
 
 ## Context
 

package/docs/adr/0225-privacy-suppresses-cross-project-surfaces-only.md

@@ -3,7 +3,7 @@
 - **Status:** Accepted
 - **Date:** 2026-09-02
 - **Tasks:** [#1003443](https://cloudbongos.com/builders#/task/1003443) (goal 1000075 — collaboration and the social hall; criterion `community-is-one-builders-page`)
-- **Related:** [ADR 0171](<redacted>.md) (owns `hide_stats` + `profile_state`, fail-closed consent in the READ path) · [`docs/specs/<redacted>.md`](../specs/<redacted>.md) (the spec this amends)
+- **Related:** [ADR 0171](0171-profile-rollup-join-and-consent.md) (owns `hide_stats` + `profile_state`, fail-closed consent in the READ path) · [`docs/specs/<redacted>.md`](../specs/<redacted>.md) (the spec this amends)
 
 ## 1. Why this ADR exists
 

package/docs/adr/0226-one-stale-timer-reporting-degrades-enforcement-refuses.md

@@ -51,7 +51,7 @@ Precedence, widest scope last:
    the `GDS_STALE_CLAIM_HOURS` the live sweeper has always read. **Nothing in a
    running deployment has to change for this to resolve to what it resolves to
    today.** This is also the channel a platform-managed project already has: the
-   provisioning runner patches `web.env` in place and restarts ([ADR 0190](<redacted>.md)).
+   provisioning runner patches `web.env` in place and restarts ([ADR 0190](0190-settings-apply-in-place-env-patch.md)).
 3. **`6`** — the default. Deliberately the *sweeper's* historical number and not
    the roster's 24: the sweeper is the surface that acts, and adopting 24 would
    have quietly made every project three times more patient with a dead claim

package/docs/adr/0227-a-task-network-map-is-refused-the-goal-graph-is-the-map.md

@@ -34,7 +34,7 @@ Every edge a map could draw is already stored. None needs a new table.
 | task → goal | `tasks.goal_id` → `goals` | The aggregation key for view C's node weights. |
 | task → criterion → goal | `task_criteria` → `done_when_criteria` | The done-when rollup `/status` already walks (ADR 0025). |
 | idea → task (promotion) | `idea_inbox.promoted_to_task_id` → `tasks` | Triage lineage, forward direction. |
-| idea → idea (merge) | `idea_inbox.merged_into_idea_id` (`migrations/<redacted>.sql`) | The merge target; chain-free by CHECK constraint. |
+| idea → idea (merge) | `idea_inbox.merged_into_idea_id` (`migrations/core_195_idea_triage_provenance.sql`) | The merge target; chain-free by CHECK constraint. |
 | task → version | `tasks.version_id` → `versions` | Membership, not connection — a filter, never an edge to draw. |
 
 The triage-lineage edges (the last three) are the ones the owner's question actually

package/docs/adr/0230-a-look-skill-is-a-composition-grammar-the-palette-is-the-pack.md

@@ -3,7 +3,7 @@
 - **Status:** accepted
 - **Date:** 2026-09-02
 - **Task:** [task 1003327](https://cloudbongos.com/builders#/task/1003327) (goal 1000083 — the ui-design module as a platform capability; criterion `uidesign-skills-in-house`)
-- **Relates to:** [ADR 0198](<redacted>.md) (a dangerous verdict lands a spec, never a copy), [ADR 0219](<redacted>.md) (a look is a branding pack), [ADR 0220](<redacted>.md) (the landing shape of a rebuild), [ADR 0222](<redacted>.md) (the owner's imagery rule), [ADR 0223](0223-the-detector-is-two-tiers-in-the-kit.md) (the tells the pre-flights point at), [ADR 0196](<redacted>.md) (the token contract)
+- **Relates to:** [ADR 0198](0198-third-party-skill-vendoring-policy.md) (a dangerous verdict lands a spec, never a copy), [ADR 0219](0219-a-look-is-a-branding-pack-the-style-library.md) (a look is a branding pack), [ADR 0220](0220-an-in-house-rebuilt-skill-is-a-first-party-skill.md) (the landing shape of a rebuild), [ADR 0222](0222-the-image-family-under-the-hero-only-rule.md) (the owner's imagery rule), [ADR 0223](0223-the-detector-is-two-tiers-in-the-kit.md) (the tells the pre-flights point at), [ADR 0196](0196-chrome-world-token-contract-and-the-landing-sheets.md) (the token contract)
 
 ## Context
 

package/docs/adr/0231-the-style-session-an-owner-authors-a-look-inside-the-contract.md

@@ -3,7 +3,7 @@
 - **Status:** accepted
 - **Date:** 2026-09-02
 - **Task:** [task 1003475](https://cloudbongos.com/builders#/task/1003475) (goal 1000083 — the ui-design module as a platform capability; criterion `uidesign-skills-in-house`)
-- **Relates to:** [ADR 0219](<redacted>.md) (a look is a branding pack), [ADR 0220](<redacted>.md) (the landing shape of a rebuild), [ADR 0230](<redacted>.md) (a look skill carries no colours), [ADR 0198](<redacted>.md) (the vendoring policy), [ADR 0062 §7](<redacted>.md) (the core ↔ host boundary), `modules/ui-design/styles/README.md`
+- **Relates to:** [ADR 0219](0219-a-look-is-a-branding-pack-the-style-library.md) (a look is a branding pack), [ADR 0220](0220-an-in-house-rebuilt-skill-is-a-first-party-skill.md) (the landing shape of a rebuild), [ADR 0230](0230-a-look-skill-is-a-composition-grammar-the-palette-is-the-pack.md) (a look skill carries no colours), [ADR 0198](0198-third-party-skill-vendoring-policy.md) (the vendoring policy), [ADR 0062 §7](0062-medusa-instance-model-decoupling.md) (the core ↔ host boundary), `modules/ui-design/styles/README.md`
 
 ## Context
 
@@ -26,7 +26,7 @@ Writing that loop as a skill exposed a second problem the module had not hit bef
 ## Consequences
 
 - An owner who cannot write CSS can now produce a look that is provably landable, because every claim the look makes is measured against three sheets that already exist before anyone adopts it. The session's cost is bounded by four steps and a fixed set of commands, not by how long the conversation runs.
-- The library gains a cool entry, which the four look skills of [ADR 0230](<redacted>.md) immediately need: `industrial-brutalist-ui`'s Swiss-print archetype and `minimalist-ui`'s quiet grammar both read differently on cool paper, and until now every entry was warm.
+- The library gains a cool entry, which the four look skills of [ADR 0230](0230-a-look-skill-is-a-composition-grammar-the-palette-is-the-pack.md) immediately need: `industrial-brutalist-ui`'s Swiss-print archetype and `minimalist-ui`'s quiet grammar both read differently on cool paper, and until now every entry was warm.
 - The module's skills can grow in two directions without either kind lying about itself. The next original — a session, a playbook, a generator that has no third-party ancestor — declares `## First party` and is counted the same way.
 - Rejected: **giving `/style` a `## Rebuilt from` section** naming a spec it does not have (the section exists so a reader can trace provenance; a fabricated one destroys exactly that); **letting the session edit `config/branding.json`** so the owner sees the look live immediately (it is the host boundary, and a session that repaints the instance mid-conversation is a change nobody claimed); **shipping the look without the catalogue rows** and filing them later (a look nobody can find is not in the library, and "later" is how the markdown graveyard starts); and **a wizard that generates a palette from a reference image** (an interesting idea, but it would want the art pipeline, and the retune — the part that actually decides whether a look can ship — is unchanged by where the first guess came from).
 - Open: the retune table encodes five failures seen across four looks. If a sixth recurs, it belongs in the table; if the table reaches ten, the loop wants a `--suggest` mode on the suites rather than a longer list a human reads.

package/docs/adr/0232-rot-is-derived-not-swept-and-water-is-the-only-new-verb.md

@@ -4,7 +4,7 @@
 - **Date:** 2026-09-02
 - **Tasks:** [#1003279](https://cloudbongos.com/builders#/task/1003279)
 - **Goal:** [#1000072](https://cloudbongos.com/builders#/goal/1000072) — Human legibility, criterion `legibility-sort-and-staleness`.
-- **Completes:** [ADR 0226](<redacted>.md), which split the *claim* timer out of this task and recorded that "1003279 stays open for its inbox half". This is that half.
+- **Completes:** [ADR 0226](0226-one-stale-timer-reporting-degrades-enforcement-refuses.md), which split the *claim* timer out of this task and recorded that "1003279 stays open for its inbox half". This is that half.
 - **Builds on:** [#1003278](https://cloudbongos.com/builders#/task/1003278) (the shared *task* staleness vocabulary the boards use — §3 below is why this reuses its definition rather than writing a second one).
 - **Unblocks:** [#1003280](https://cloudbongos.com/builders#/task/1003280), whose settings page needs the timer to be "live, DB-backed" and warns "do not fork a second store". §4 is that store.
 
@@ -60,7 +60,7 @@ items table, because the derivation is the part worth keeping.
 Rot is **work nobody has picked up**, not work in flight. Tasks at `backlog` or `ready`;
 goals at `open`. Every exclusion is excluded because *another surface already owns that
 question*, and two surfaces asking one question with two different timers is exactly the
-failure [ADR 0226](<redacted>.md) was
+failure [ADR 0226](0226-one-stale-timer-reporting-degrades-enforcement-refuses.md) was
 written to end:
 
 | Excluded | Who owns it instead |

package/docs/adr/0233-a-copy-proposal-is-a-task-carrying-a-patch.md

@@ -3,8 +3,8 @@
 - **Status:** Accepted
 - **Date:** 2026-09-02
 - **Tasks:** [#1003114](https://cloudbongos.com/builders#/task/1003114) (R03 of goal 1000074, the artist's loop) — builds on [#1003112](https://cloudbongos.com/builders#/task/1003112) (R01, the registry) and [#1003113](https://cloudbongos.com/builders#/task/1003113) (R02, the flag and the queue)
-- **Extends:** [ADR 0081](<redacted>.md) — the repo is the source of truth, with swappable tool adapters that land their output as a committed diff. This applies that contract to TEXT.
-- **Extends:** [ADR 0178](<redacted>.md) — which pinned that `copy_desk_flags` may never hold replacement text, and named this task as the one that would have to keep that true while adding an editing affordance.
+- **Extends:** [ADR 0081](0081-tool-agnostic-design-layer.md) — the repo is the source of truth, with swappable tool adapters that land their output as a committed diff. This applies that contract to TEXT.
+- **Extends:** [ADR 0178](0178-the-copy-desk-flag-and-queue.md) — which pinned that `copy_desk_flags` may never hold replacement text, and named this task as the one that would have to keep that true while adding an editing affordance.
 - **Related:** 0083 (module system, ports), 0086 (goals), 0016 (authority resolved server-side), 0162 (a verdict is advisory, never self-executing), 0197 (the ui-design module)
 
 ## Context