@bongos/core 1.19.714 → 1.19.724

package/docs/adr/0234-idea-routing-capture-time-promotion-landing-matrix-homeless-inbox.md

@@ -97,7 +97,7 @@ the matrix (ready side), and is pinned by a test rather than left to erode quiet
 
 ### 3. The schema: one advisory hint column, one widened CHECK (task 1003060 / R02)
 
-`migrations/<redacted>.sql` adds `idea_inbox.suggested_goal_id` (nullable FK
+`migrations/core_222_idea_inbox_suggested_goal.sql` adds `idea_inbox.suggested_goal_id` (nullable FK
 `ON DELETE SET NULL`) — **not** where a routed idea's goal lives (that is `tasks.goal_id`, set by
 construction), but the leftover hint for rows that did **not** convert: soft-landed/homeless ideas, a
 Discord classifier's guess, Full Ideas and criterion-proposals. The migration's own comment is explicit
@@ -105,7 +105,7 @@ that the column is "load-bearing for NOTHING — no rank check, no scope wall, a
 it." It lives in **core** migrations, not a module migration, because `idea_inbox` is a core table and
 `fitness.js`'s `checkModuleMigrationsAdditive` forbids a module `ALTER TABLE` against it.
 
-`modules/ideas/migrations/<redacted>.sql` widens `ideas_task_lineage`'s CHECK to
+`modules/ideas/migrations/ideas_003_lineage_origin_route.sql` widens `ideas_task_lineage`'s CHECK to
 admit a third `origin`: `'route'`, alongside the pre-existing `'promote'` (a human triaged it) and
 `'develop'` (a spark became a Full Idea). The distinction is deliberate — "how much triage routing
 actually saved" (criterion C6) is only answerable if capture-time conversions are tagged differently

package/docs/adr/0235-a-fix-category-is-kindbug-under-a-goal-no-column-required.md

@@ -7,9 +7,9 @@
   case), [#1003157](https://cloudbongos.com/builders#/task/1003157) (extended the same exemption to the
   criterion-link advisory and the goal detail view)
 - **Goal:** [#1000071](https://cloudbongos.com/builders#/goal/1000071) — Idea routing
-- **Related:** [ADR 0086](<redacted>.md) (the real work hierarchy this decision keeps
-  intact), [ADR 0183](<redacted>.md) (why a container that never finishes is dangerous
-  now), [ADR 0192 "a category orients and authorises nothing"](<redacted>.md)
+- **Related:** [ADR 0086](0086-goal-scoped-work-hierarchy.md) (the real work hierarchy this decision keeps
+  intact), [ADR 0183](0183-criteria-close-themselves.md) (why a container that never finishes is dangerous
+  now), [ADR 0192 "a category orients and authorises nothing"](0192-a-category-orients-and-authorises-nothing.md)
   (the precedent this decision is *not* — see §2)
 
 ## 1. The problem
@@ -25,13 +25,13 @@ delivering toward one of a goal's stated outcomes; it is restoring one. Idea
 should already work," living *under* an existing goal, without a new goal being
 born for it.
 
-## 2. Why this is not a stored category, and not [ADR 0192](<redacted>.md)
+## 2. Why this is not a stored category, and not [ADR 0192](0192-a-category-orients-and-authorises-nothing.md)
 
 The obvious-looking answer — add a `category` (or `bucket`) column to `tasks` —
 is the wrong shape for two reasons specific to *this* system's schema, not taste:
 
 1. **`tasks` stores no category at all, by decision.** [ADR 0192 "a category
-   orients and authorises nothing"](<redacted>.md)
+   orients and authorises nothing"](0192-a-category-orients-and-authorises-nothing.md)
    already answered a structurally identical question for *goals* — a human label
    from an owner-named set, advisory only, gating nothing — and its own text is
    explicit that "a task stores no category… it inherits its goal's through
@@ -40,7 +40,7 @@ is the wrong shape for two reasons specific to *this* system's schema, not taste
    already exists, is already required (`migrations/006_pms_v2.sql`,
    `NOT NULL DEFAULT 'unclassified'`), and already means "this is a fix." Adding
    a column to restate it is duplication, not a new fact.
-2. **This decision is a *narrower*, more binding one than [ADR 0192](<redacted>.md)'s.**
+2. **This decision is a *narrower*, more binding one than [ADR 0192](0192-a-category-orients-and-authorises-nothing.md)'s.**
    Its category is purely a label a human reads — nothing may branch on it.
    "A bug fix needs no criterion link" and "a bug fix in the catch-all is quiet"
    are the OPPOSITE: two decision surfaces (`goal-advisory.js`) DO branch on
@@ -57,12 +57,12 @@ is the wrong shape for two reasons specific to *this* system's schema, not taste
 ## 3. Why not a global "Bugs" goal either
 
 Idea 1000828's own reasoning is the load-bearing part, and it survives unchanged
-here: a goal carries `scope_modules`, the [ADR 0086](<redacted>.md)
+here: a goal carries `scope_modules`, the [ADR 0086](0086-goal-scoped-work-hierarchy.md)
 §3 scope wall — a bugs goal spanning every module makes that wall either
 everything or nothing, which is not a wall. And a goal carries done-when criteria
 and can be marked `achieved`; a bug container never finishes, so making it a goal
 manufactures a goal that can never legitimately reach `achieved` — polluting the
-exact signal [ADR 0183](<redacted>.md)'s auto-satisfy now
+exact signal [ADR 0183](0183-criteria-close-themselves.md)'s auto-satisfy now
 depends on to cascade a goal to `achieved` the moment every linked task ships. A
 category *under* an existing goal keeps that goal's wall, keeps the "things that
 should work in THIS area" context, and never claims to be finishable on its own.
@@ -72,7 +72,7 @@ should work in THIS area" context, and never claims to be finishable on its own.
 **A fix category is `kind='bug'` on a task that carries a real `goal_id` — no
 schema change, no new column, no new goal type.** The goal is *finishable* as
 before; the fix category is a lens over its existing `kind` field, exactly the
-way [ADR 0192](<redacted>.md)'s goal category
+way [ADR 0192](0192-a-category-orients-and-authorises-nothing.md)'s goal category
 is a lens over `goals.category_id`, just enforced more strictly because two real
 gates read it.
 
@@ -100,7 +100,7 @@ shipped on `main` before this ADR was written):
   (`goals-page.js`, `f-goal-kind`) — so "the hall groups bugs by kind" was
   already true before this task, via the *same* general-purpose kind facility
   every other kind uses. Building a bug-specific grouping widget beside it would
-  be the second-hierarchy mistake [ADR 0192](<redacted>.md)
+  be the second-hierarchy mistake [ADR 0192](0192-a-category-orients-and-authorises-nothing.md)
   §2 already named once for goal categories.
 
 ## 5. What was deliberately not built
@@ -127,5 +127,5 @@ shipped on `main` before this ADR was written):
 - If a future need ever wants `kind='bug'` to carry MORE weight than an advisory
   exemption — a claim-time gate, a reward multiplier, a dependency rule — that is
   a new, explicit decision needing its own ADR, the same posture
-  [ADR 0192](<redacted>.md) §5 holds for goal
+  [ADR 0192](0192-a-category-orients-and-authorises-nothing.md) §5 holds for goal
   categories. This ADR does not pre-authorise that.

package/docs/adr/0236-many-ideas-one-task-the-lineage-key-is-the-pair.md

@@ -6,9 +6,9 @@
   idea 1000815), [#1002997](https://cloudbongos.com/builders#/task/1002997) (created the lineage table),
   [#1003065](https://cloudbongos.com/builders#/task/1003065) (the R01 diff whose grader flagged the shape)
 - **Goal:** [#1000071](https://cloudbongos.com/builders#/goal/1000071) — Idea routing
-- **Related:** [ADR 0172](<redacted>.md) (the ideator credit lane this
-  table is the rail for), [ADR 0185](<redacted>.md) (the other place an idea has more
-  than one claimant), [ADR 0234](<redacted>.md)
+- **Related:** [ADR 0172](0172-per-craft-compensation-ideator-credit-lane.md) (the ideator credit lane this
+  table is the rail for), [ADR 0185](0185-spark-handoff-credit-split.md) (the other place an idea has more
+  than one claimant), [ADR 0234](0234-idea-routing-capture-time-promotion-landing-matrix-homeless-inbox.md)
   (routing, the third `origin`)
 
 ## 1. The problem
@@ -29,7 +29,7 @@ ideas 1000811 and 1000812 were both promoted into task 1003150 (two call sites o
 one mechanism), and idea 1000811's link is gone — only its weaker
 `idea_inbox.promoted_to_task_id` pointer survived.
 
-This table is the rail [ADR 0172](<redacted>.md)'s
+This table is the rail [ADR 0172](0172-per-craft-compensation-ideator-credit-lane.md)'s
 stream 1 pays against (`<redacted>`, `sourceIdeaForTask`), so an
 overwritten row is an ideator silently not paid for work their idea produced,
 with no trace anywhere that it happened. It also made "N duplicate reports merged
@@ -92,7 +92,7 @@ both the list and its count, so the pill can never disagree with the rows).
 - **`DROP CONSTRAINT` here is additive.** Postgres has no "widen a key" verb, so
   the change is drop-then-re-add of the same-named constraint — the shape
   `fitness.js`'s `isConstraintWidening` exempts, and the one
-  [`ideas_003`](../../modules/ideas/migrations/<redacted>.sql)
+  [`ideas_003`](../../modules/ideas/migrations/ideas_003_lineage_origin_route.sql)
   already recorded for a CHECK. The new key permits a strict superset of the old
   one, so no existing row can be invalidated. The migration asserts its own
   effect and raises if the primary key is still single-column.

package/docs/adr/0237-a-starter-bundle-is-a-preset-over-the-always-on-core-keyed-by-declared-type.md

@@ -5,10 +5,10 @@
 - **Tasks:** [#1002338](https://cloudbongos.com/builders#/task/1002338) (this decision — BV1.R19)
 - **Goal:** [#1000046](https://cloudbongos.com/builders#/goal/1000046) — Project creation: visibility and
   customization, criterion `proj-module-select` ("during setup a default set of modules is pre-selected…")
-- **Related:** [ADR 0083](<redacted>.md) (the one-way import rule that
-  keeps this file pure), [ADR 0107](<redacted>.md) +
-  [ADR 0167](<redacted>.md) (the module catalog a bundle names into),
-  [ADR 0182](<redacted>.md) D4 (the publish bar a bundle may not join),
+- **Related:** [ADR 0083](0083-modular-architecture-strangler-build-plan.md) (the one-way import rule that
+  keeps this file pure), [ADR 0107](0107-module-upstreaming-contribution-to-core-catalog.md) +
+  [ADR 0167](0167-module-catalog-source-vs-provenance.md) (the module catalog a bundle names into),
+  [ADR 0182](0182-project-visibility-two-axes.md) D4 (the publish bar a bundle may not join),
   task [#1002772](https://cloudbongos.com/builders#/task/1002772) (the declared project type),
   task [#1002334](https://cloudbongos.com/builders#/task/1002334) (R15, the detail interview)
 
@@ -113,7 +113,7 @@ catalog it names into is already public at `GET /public/modules`.
 
 ## 6. Consequences
 
-- **A bundle is never a publish precondition.** [ADR 0182](<redacted>.md)
+- **A bundle is never a publish precondition.** [ADR 0182](0182-project-visibility-two-axes.md)
   D4 fixes the bar at identity alone — a name and a description, "not tagline, art,
   modules, governance, or a completed interview." Taking or declining a bundle
   cannot move a project's dark-matter state.

package/docs/adr/0238-the-join-door-is-a-provisioning-settings-policy-key.md

@@ -4,7 +4,7 @@
 - **Date:** 2026-09-03
 - **Task:** [task 1002324](https://cloudbongos.com/builders#/task/1002324) (BONGOS-V1, goal 1000046 — *Project creation — visibility and customization*, criterion `proj-visibility-states`)
 - **Deciders:** jaxri (Archon), Claude
-- **Related:** [ADR 0182](<redacted>.md) (the two axes — this ADR only says *where* R05's half lives) · [ADR 0141](<redacted>.md) §3 (authority stays local) · [ADR 0190](<redacted>.md) (a pushed setting takes effect by a restart) · [ADR 0192](<redacted>.md) (`platform_visibility`, the neighbouring axis)
+- **Related:** [ADR 0182](0182-project-visibility-two-axes.md) (the two axes — this ADR only says *where* R05's half lives) · [ADR 0141](<redacted>.md) §3 (authority stays local) · [ADR 0190](0190-settings-apply-in-place-env-patch.md) (a pushed setting takes effect by a restart) · [ADR 0192](0192-platform-visibility-member-door.md) (`platform_visibility`, the neighbouring axis)
 
 ---
 

package/docs/adr/0239-a-recommendation-is-a-table-that-carries-its-own-reason.md

@@ -7,9 +7,9 @@
   customization; criteria `proj-module-select` ("additional modules are recommended (rule-based) from the
   project's details"), `proj-governance-reco` ("a recommended governance setup … derived from its details"),
   `proj-invite-builders` ("the owner can optionally invite guilds or top builders")
-- **Related:** [ADR 0237](<redacted>.md)
-  (R19, the per-type preset this adjusts), [ADR 0182](<redacted>.md) D4 (skipping the
-  interview is a supported answer), [ADR 0083](<redacted>.md) (the
+- **Related:** [ADR 0237](0237-a-starter-bundle-is-a-preset-over-the-always-on-core-keyed-by-declared-type.md)
+  (R19, the per-type preset this adjusts), [ADR 0182](0182-project-visibility-two-axes.md) D4 (skipping the
+  interview is a supported answer), [ADR 0083](0083-modular-architecture-strangler-build-plan.md) (the
   one-way import rule that makes the invite lookup a seam),
   task [#1002334](https://cloudbongos.com/builders#/task/1002334) (R15, the interview whose answer this reads),
   task [#1002772](https://cloudbongos.com/builders#/task/1002772) (the declared project type),
@@ -24,7 +24,7 @@ the near term: "near-term recommendations are rule-based and module search is
 lexical; the AI/embeddings layer … is a deferred follow-up captured in the idea
 inbox."
 
-R19 ([ADR 0237](<redacted>.md))
+R19 ([ADR 0237](0237-a-starter-bundle-is-a-preset-over-the-always-on-core-keyed-by-declared-type.md))
 already answered the type half — a starter bundle per declared project type — and
 said explicitly that it is "a declaration and not a rule engine … R17/R22 own the
 layer that reasons." This is that layer.

package/docs/adr/0240-a-skipped-module-picker-stores-nothing-and-resolves-the-bundle-on-read.md

@@ -5,11 +5,11 @@
 - **Tasks:** [#1002339](https://cloudbongos.com/builders#/task/1002339) (this decision — BV1.R20)
 - **Goal:** [#1000046](https://cloudbongos.com/builders#/goal/1000046) — Project creation: visibility and
   customization, criterion `proj-module-select` ("during setup a default set of modules is pre-selected…")
-- **Related:** [ADR 0237](<redacted>.md)
+- **Related:** [ADR 0237](0237-a-starter-bundle-is-a-preset-over-the-always-on-core-keyed-by-declared-type.md)
   (R19 — the bundles this picker renders, and the file that closed with "where a chosen selection lands
-  is R20's decision"), [ADR 0182](<redacted>.md) D4 (the publish bar a module set
-  may not join), [ADR 0083](<redacted>.md) (the one-way import rule),
-  [ADR 0111](<redacted>.md) (the enqueue-only web tier), migration
+  is R20's decision"), [ADR 0182](0182-project-visibility-two-axes.md) D4 (the publish bar a module set
+  may not join), [ADR 0083](0083-modular-architecture-strangler-build-plan.md) (the one-way import rule),
+  [ADR 0111](0111-instance-hosting-provisioning-module.md) (the enqueue-only web tier), migration
   `provisioning_013` (the `detail` column this deliberately does not use)
 
 ## 1. The problem

package/docs/adr/0241-the-artist-gate-is-a-per-project-deploy-gate-that-reads-a-state.md

@@ -3,7 +3,7 @@
 - **Status:** Accepted
 - **Date:** 2026-09-03
 - **Tasks:** [#1003116](https://cloudbongos.com/builders#/task/1003116) (R05 of goal 1000074, the artist's loop) — the decision task the goal placed BEFORE [#1003115](https://cloudbongos.com/builders#/task/1003115) (R04, the review task), so that no code is wired to a gate whose authority is unsettled
-- **Reconciles:** [ADR 0162](<redacted>.md) — review gates retired on `main`; a verdict is advisory and never self-executing
+- **Reconciles:** [ADR 0162](0162-review-gates-retired-rank-consistent-ci-only.md) — review gates retired on `main`; a verdict is advisory and never self-executing
 - **Related:** 0178 (the copy desk flag + queue, which deliberately blocked nothing and named this decision as the one that would settle it), 0233 (a copy proposal is a task carrying a patch), 0016 (authority is resolved server-side, never from a local file), 0120 (pay on land), 0137 (land → release → deploy are three separate gates)
 
 ## Context

package/docs/adr/0242-a-cascade-is-a-declaration-table-on-the-event-that-already-exists.md

@@ -42,8 +42,8 @@ A cascade is one frozen entry: `{ key, discipline, when(task), title(task), body
 no condition language, no stored rules, no per-project configuration, no UI, and no priority
 ordering. Adding a cascade means appending an entry; the runner does not change.
 
-This is the [ADR 0237](<redacted>.md)
-/ [ADR 0239](<redacted>.md) shape applied to a
+This is the [ADR 0237](0237-a-starter-bundle-is-a-preset-over-the-always-on-core-keyed-by-declared-type.md)
+/ [ADR 0239](0239-a-recommendation-is-a-table-that-carries-its-own-reason.md) shape applied to a
 different problem, and for the same reason: the generalisations worth building are the ones two or
 three real entries have shown they share. With one consumer in existence, a rules engine would be
 inventing the requirements it then satisfied.

package/docs/adr/0243-a-bundle-adjustment-belongs-to-the-bundle-not-the-advice-about-it.md

@@ -5,12 +5,12 @@
 - **Tasks:** [#1002341](https://cloudbongos.com/builders#/task/1002341) (this decision — BV1.R22)
 - **Goal:** [#1000046](https://cloudbongos.com/builders#/goal/1000046) — Project creation, criterion
   `proj-module-select` ("during setup a default set of modules is pre-selected…")
-- **Related:** [ADR 0237](<redacted>.md)
+- **Related:** [ADR 0237](0237-a-starter-bundle-is-a-preset-over-the-always-on-core-keyed-by-declared-type.md)
   (R19 — the per-type presets, and the file that said the bundle layer "is a declaration and not a rule
-  engine"), [ADR 0239](<redacted>.md) (R17 — the rule
-  engine, and the `TEAM_SHAPE_RULES` table this moves), [ADR 0240](<redacted>.md)
+  engine"), [ADR 0239](0239-a-recommendation-is-a-table-that-carries-its-own-reason.md) (R17 — the rule
+  engine, and the `TEAM_SHAPE_RULES` table this moves), [ADR 0240](0240-a-skipped-module-picker-stores-nothing-and-resolves-the-bundle-on-read.md)
   (R20 — the picker, the nullable `modules` column, and §2's "one function, called twice" property this
-  is written to preserve), [ADR 0083](<redacted>.md) (the one-way
+  is written to preserve), [ADR 0083](0083-modular-architecture-strangler-build-plan.md) (the one-way
   import rule)
 
 ## 1. The problem

package/docs/adr/0244-a-catalog-search-is-a-view-over-the-rows-never-an-edit-to-the-selection.md

@@ -5,11 +5,11 @@
 - **Tasks:** [#1002340](https://cloudbongos.com/builders#/task/1002340) (this decision — BV1.R21)
 - **Goal:** [#1000046](https://cloudbongos.com/builders#/goal/1000046) — Project creation, criterion
   `proj-module-select` ("during setup a default set of modules is pre-selected…")
-- **Related:** [ADR 0237](<redacted>.md)
+- **Related:** [ADR 0237](0237-a-starter-bundle-is-a-preset-over-the-always-on-core-keyed-by-declared-type.md)
   (R19 — the per-type presets, and the file that already said "R21 searches the catalog"),
-  [ADR 0240](<redacted>.md)
+  [ADR 0240](0240-a-skipped-module-picker-stores-nothing-and-resolves-the-bundle-on-read.md)
   (R20 — the picker, and the three-valued `modules` column whose `null` this must not disturb),
-  [ADR 0243](<redacted>.md)
+  [ADR 0243](0243-a-bundle-adjustment-belongs-to-the-bundle-not-the-advice-about-it.md)
   (R22 — the tailored preselect the search now filters)
 
 ## 1. The problem

package/docs/adr/0245-the-way-back-into-an-optional-step-is-that-step-s-own-answer-route.md

@@ -5,15 +5,15 @@
 - **Tasks:** [#1002342](https://cloudbongos.com/builders#/task/1002342) (this decision — BV1.R23)
 - **Goal:** [#1000046](https://cloudbongos.com/builders#/goal/1000046) — Project creation, criterion
   `proj-module-select` ("during setup a default set of modules is pre-selected…")
-- **Related:** [ADR 0240](<redacted>.md)
+- **Related:** [ADR 0240](0240-a-skipped-module-picker-stores-nothing-and-resolves-the-bundle-on-read.md)
   (R20 — the nullable `modules` column, the three-valued contract, and §6's "R23 … needs to know whether
-  an owner has ever been asked"), [ADR 0237](<redacted>.md)
+  an owner has ever been asked"), [ADR 0237](0237-a-starter-bundle-is-a-preset-over-the-always-on-core-keyed-by-declared-type.md)
   (R19 — the bundles and the `OPTIONAL_MODULES` catalog this surface renders),
-  [ADR 0243](<redacted>.md) (R22 — the
+  [ADR 0243](0243-a-bundle-adjustment-belongs-to-the-bundle-not-the-advice-about-it.md) (R22 — the
   team-shape adjustment inside the fallback, and why `PATCH …/detail` already answered with `modules`),
-  [ADR 0238](<redacted>.md) (R05 — the manage view, and its
+  [ADR 0238](0238-the-join-door-is-a-provisioning-settings-policy-key.md) (R05 — the manage view, and its
   finding that "the project's own hall settings" is a page that does not exist),
-  [ADR 0111](<redacted>.md) (the enqueue-only web tier)
+  [ADR 0111](0111-instance-hosting-provisioning-module.md) (the enqueue-only web tier)
 
 ## 1. The problem
 
@@ -49,7 +49,7 @@ kind of thing:
 steps after creation"* — the name is narrower than the job. It already carries the
 ownership gate (`instanceAccessDenied`: own-scoped, Archon override, 404 with no
 existence leak), already records an event with an `api:self` / `api:archon:<id>`
-actor, and — since [ADR 0243](<redacted>.md)
+actor, and — since [ADR 0243](0243-a-bundle-adjustment-belongs-to-the-bundle-not-the-advice-about-it.md)
 — **already answers with `effectiveModules(updated)`**, because a `team_shape`
 answer moves a bundle-sourced project's modules. The route was already reporting
 this value; all that was missing was the ability to set it.
@@ -58,7 +58,7 @@ A second route would have duplicated the gate, the actor rule, the 404 shape and
 the receipt, for one column on a row the first route already writes. Duplicated
 authorization is the kind that drifts.
 
-**Not the settings channel**, for [ADR 0240](<redacted>.md)
+**Not the settings channel**, for [ADR 0240](0240-a-skipped-module-picker-stores-nothing-and-resolves-the-bundle-on-read.md)
 §3's reason, restated: a setting is *a policy the running instance obeys* — it
 rides `web.env`, queues a `settings-apply` intent and restarts the service. A
 module selection is a declaration held on the platform row until a catalog row

package/docs/adr/0246-catalog-membership-is-a-projection-not-a-federation-side-effect.md

@@ -4,7 +4,7 @@
 - **Date:** 2026-09-04
 - **Task:** [task 1003576](https://cloudbongos.com/builders#/task/1003576) (BONGOS-V1, goal 1000046 — *Project creation*, criterion `proj-detail-interview` / C3)
 - **Deciders:** jaxri (Archon), Claude
-- **Related:** [ADR 0182](<redacted>.md) (the two axes; D4 is the publish gate, D5 makes the hub column a cache) · [ADR 0238](<redacted>.md) (the join door is a provisioning setting; the hub's owner column is attribution, never authority) · [ADR 0141](<redacted>.md) §2/§4 (the SSO client registry and what a client secret is for) · [ADR 0083](<redacted>.md) (the module one-way rule — why this travels on a port) · [ADR 0181](0181-teardown-state-gate-and-address-retention.md) §2 (an abandoned address left pointing at platform infra)
+- **Related:** [ADR 0182](0182-project-visibility-two-axes.md) (the two axes; D4 is the publish gate, D5 makes the hub column a cache) · [ADR 0238](0238-the-join-door-is-a-provisioning-settings-policy-key.md) (the join door is a provisioning setting; the hub's owner column is attribution, never authority) · [ADR 0141](<redacted>.md) §2/§4 (the SSO client registry and what a client secret is for) · [ADR 0083](0083-modular-architecture-strangler-build-plan.md) (the module one-way rule — why this travels on a port) · [ADR 0181](0181-teardown-state-gate-and-address-retention.md) §2 (an abandoned address left pointing at platform infra)
 
 ---
 

package/docs/adr/0247-the-join-door-is-one-composed-answer-and-dark-matter-has-no-live-verdict-yet.md

@@ -4,8 +4,8 @@
 - **Date:** 2026-09-04
 - **Task:** [task 1002331](https://cloudbongos.com/builders#/task/1002331) (BONGOS-V1, goal 1000046 — *Project creation*, criterion `proj-join-policy`)
 - **Deciders:** Claude, under the Archon's standing scope
-- **Implements:** [ADR 0182](<redacted>.md) D6 (*"visibility sets the ceiling; join policy may only narrow it"*) — which stated the rule and left it unimplemented
-- **Related:** [ADR 0194](<redacted>.md) (`joinabilityMode`, the one-reader precedent this extends) · [ADR 0238](<redacted>.md) (the settings channel the new knob rides) · [ADR 0116](<redacted>.md) (the refusal envelope) · [ADR 0083](<redacted>.md) (the doorway)
+- **Implements:** [ADR 0182](0182-project-visibility-two-axes.md) D6 (*"visibility sets the ceiling; join policy may only narrow it"*) — which stated the rule and left it unimplemented
+- **Related:** [ADR 0194](0194-joinability-one-door-decision.md) (`joinabilityMode`, the one-reader precedent this extends) · [ADR 0238](0238-the-join-door-is-a-provisioning-settings-policy-key.md) (the settings channel the new knob rides) · [ADR 0116](0116-api-error-envelope-and-code-taxonomy.md) (the refusal envelope) · [ADR 0083](0083-modular-architecture-strangler-build-plan.md) (the doorway)
 
 ---
 

package/docs/adr/0248-a-hub-project-s-owner-is-the-provisioning-row-carried-on-a-port.md

@@ -4,15 +4,15 @@
 - **Date:** 2026-09-04
 - **Task:** [task 1003580](https://cloudbongos.com/builders#/task/1003580) (BONGOS-V1, goal 1000046 — *Project creation*, criterion `proj-invite-builders` / C6), GAP 2
 - **Deciders:** Claude, under the Archon's standing scope
-- **Implements:** [ADR 0246](<redacted>.md)'s named remainder — *"what remains there is purely the ownership branch… the ownership proof it should carry is `provisioning_instances.owner_builder_id`"*
-- **Related:** [ADR 0210](<redacted>.md) (owner-or-rank as one middleware; the atom stays spelled in the route's own list) · [ADR 0238](<redacted>.md) (the hub's `owner_github_id` columns are attribution, never authority) · [ADR 0083](<redacted>.md) (the one-way module rule — why this travels on a port) · [ADR 0182](<redacted>.md) D2a (a stealth project is anonymous, so a refusal may not identify it) · [ADR 0016](<redacted>.md) (fail-closed authority)
+- **Implements:** [ADR 0246](0246-catalog-membership-is-a-projection-not-a-federation-side-effect.md)'s named remainder — *"what remains there is purely the ownership branch… the ownership proof it should carry is `provisioning_instances.owner_builder_id`"*
+- **Related:** [ADR 0210](0210-scouting-graduates-on-an-instance-asserted-owner-claim.md) (owner-or-rank as one middleware; the atom stays spelled in the route's own list) · [ADR 0238](0238-the-join-door-is-a-provisioning-settings-policy-key.md) (the hub's `owner_github_id` columns are attribution, never authority) · [ADR 0083](0083-modular-architecture-strangler-build-plan.md) (the one-way module rule — why this travels on a port) · [ADR 0182](0182-project-visibility-two-axes.md) D2a (a stealth project is anonymous, so a refusal may not identify it) · [ADR 0016](0016-trust-boundary-server-enforced-permissions.md) (fail-closed authority)
 
 ---
 
 ## Context
 
 `POST /projects/invite` is gated `requirePermission('project.curate')`, floor `metic`
-([ADR 0157](<redacted>.md)). It is a **curation** gate:
+([ADR 0157](0157-archon-is-rank-and-identity-only.md)). It is a **curation** gate:
 `requirePermission` is purely grant/rank-based and has no own-scope branch. The creation
 wizard's audience is any signed-in GitHub user — on the hub, typically a `xenos` holding
 nothing at all. So the person who created a project got **403 on inviting anyone into their

package/docs/adr/0249-the-invite-step-is-the-done-panel-s-first-act-not-a-rail-step.md

@@ -4,8 +4,8 @@
 - **Date:** 2026-09-04
 - **Task:** [task 1002346](https://cloudbongos.com/builders#/task/1002346) (BONGOS-V1, goal 1000046 — *Project creation*, criterion `proj-invite-builders` / C6), BV1.R27
 - **Deciders:** Claude, under the Archon's standing scope
-- **Depends on:** [ADR 0246](<redacted>.md) (a control-plane project is a catalog row keyed on its slug — what makes `client_id` resolve at all) · [ADR 0248](<redacted>.md) (the project's own owner may invite — what makes the wizard's audience anything but a 403)
-- **Related:** [ADR 0245](<redacted>.md) (an optional step is a default rather than a dead end only if there is a way back) · [ADR 0237](<redacted>.md) / [ADR 0240](<redacted>.md) (the wizard's other skippable steps) · [ADR 0182](<redacted>.md) D2a (a refusal may not identify a stealth project)
+- **Depends on:** [ADR 0246](0246-catalog-membership-is-a-projection-not-a-federation-side-effect.md) (a control-plane project is a catalog row keyed on its slug — what makes `client_id` resolve at all) · [ADR 0248](0248-a-hub-project-s-owner-is-the-provisioning-row-carried-on-a-port.md) (the project's own owner may invite — what makes the wizard's audience anything but a 403)
+- **Related:** [ADR 0245](0245-the-way-back-into-an-optional-step-is-that-step-s-own-answer-route.md) (an optional step is a default rather than a dead end only if there is a way back) · [ADR 0237](0237-a-starter-bundle-is-a-preset-over-the-always-on-core-keyed-by-declared-type.md) / [ADR 0240](0240-a-skipped-module-picker-stores-nothing-and-resolves-the-bundle-on-read.md) (the wizard's other skippable steps) · [ADR 0182](0182-project-visibility-two-axes.md) D2a (a refusal may not identify a stealth project)
 
 ---
 
@@ -52,7 +52,7 @@ moment the created-instance record carries an id and a slug, and skippable there
    (`setInviteSlug`). The wizard's answer is the created record; the manage page's is that
    the per-id provisioning read is own-scoped and 404s for everyone else, so *reaching*
    `renderManage` IS the ownership answer. A page that re-derived ownership would be a second,
-   weaker copy of a server rule ([ADR 0016](<redacted>.md)).
+   weaker copy of a server rule ([ADR 0016](0016-trust-boundary-server-enforced-permissions.md)).
 
 ### The 403 is quoted carefully, and that is the point
 

package/docs/adr/0250-strict-versioning-the-version-boundary-is-the-scope-gate.md

@@ -4,8 +4,8 @@
 - **Date:** 2026-09-06
 - **Tasks:** [#1003589](https://cloudbongos.com/builders#/task/1003589) (this decision), seeded by the planning session `#1003586`. The implementation is BV1.R03–R30 under the same goal.
 - **Goal:** [#1000086](https://cloudbongos.com/builders#/goal/1000086) — Strict versioning: a goal cannot outlive its tasks, and a version's goal set is closed.
-- **Builds on:** [ADR 0086](<redacted>.md) (Project → Version → Goal → Criteria → Task — the hierarchy this decision finally closes at the top), [ADR 0015](<redacted>.md) (deps are load-bearing, the rank prefix is decorative), [ADR 0183](<redacted>.md) (a criterion satisfies itself when its tasks ship).
-- **Amends:** [ADR 0157](<redacted>.md) — for one key, `version.create`. See §6.
+- **Builds on:** [ADR 0086](0086-goal-scoped-work-hierarchy.md) (Project → Version → Goal → Criteria → Task — the hierarchy this decision finally closes at the top), [ADR 0015](0015-task-dependencies-and-auto-promotion.md) (deps are load-bearing, the rank prefix is decorative), [ADR 0183](0183-criteria-close-themselves.md) (a criterion satisfies itself when its tasks ship).
+- **Amends:** [ADR 0157](0157-archon-is-rank-and-identity-only.md) — for one key, `version.create`. See §6.
 
 ## 1. The problem, measured
 
@@ -35,7 +35,7 @@ work, and the tasks become unreachable except by direct id.
 No one decided any of this. Four gaps in the code produce all of it:
 
 1. **`POST /goals` never reads the version's status** ([`modules/lifecycle/routes/goals.js`](../../modules/lifecycle/routes/goals.js)). It fetches the version row to validate the id and ignores `status`, so a goal can be added to a version that has been building for months. That is how a version's scope grows without anyone widening it.
-2. **Goal achievement is computed from criteria alone** ([`db-goals.js`](../../modules/lifecycle/db-goals.js) `achieveGoalIfComplete`, and the cascade in [`done-when.js`](../../modules/lifecycle/done-when.js)). Neither writer consults `tasks`. Since [ADR 0183](<redacted>.md) criteria satisfy themselves on ship, the path from "the criteria I happened to link are satisfied" to `achieved` is fully automatic — and a task nobody linked to a criterion holds nothing open.
+2. **Goal achievement is computed from criteria alone** ([`db-goals.js`](../../modules/lifecycle/db-goals.js) `achieveGoalIfComplete`, and the cascade in [`done-when.js`](../../modules/lifecycle/done-when.js)). Neither writer consults `tasks`. Since [ADR 0183](0183-criteria-close-themselves.md) criteria satisfy themselves on ship, the path from "the criteria I happened to link are satisfied" to `achieved` is fully automatic — and a task nobody linked to a criterion holds nothing open.
 3. **`POST /goals/:id/archive` checks nothing at all.** Archiving is a single call that discards whatever the goal was holding, silently.
 4. **No route ships a version.** Version status has only ever moved by hand-run SQL on the droplet; `scripts/gds/version-close.js` prints that the API cannot do it. A thing with no closing move does not close.
 
@@ -95,20 +95,20 @@ override to be filed.
 ## 4. What this is not
 
 - **Not a new gate on shipping.** Nothing here can refuse a ship, block a claim, or park a task. Every rule acts on a *closing* move — goal achievement, goal archive, version close, goal/task creation. A builder's day is unchanged unless they try to close something that is not finished.
-- **Not a re-litigation of [ADR 0183](<redacted>.md).** Criteria still satisfy themselves. D2 adds a second condition to the *goal's* flip, not a human gate in front of the criterion's.
+- **Not a re-litigation of [ADR 0183](0183-criteria-close-themselves.md).** Criteria still satisfy themselves. D2 adds a second condition to the *goal's* flip, not a human gate in front of the criterion's.
 - **Not a change to what `abandoned` means.** [Task 1002651](https://cloudbongos.com/builders#/task/1002651) already made abandoned terminal; D2 relies on that and adds nothing.
 
 ## 5. Rejected alternatives
 
 - **Count `completed`/`confirmed` as finished.** It would close the visible symptom with one word and is wrong: those states can fail a grade, strand at `confirmed`, or be reconciled back. A goal closed on a task that never landed is the same lie in a shorter timeframe. (The goals **board** does bucket them as done — that is a progress ring, and `task-status.js` keeps the two questions apart on purpose.)
 - **A nightly reconciler that reopens wrongly-closed goals.** Repairs the ledger after the fact and leaves the four gaps open, so the report can never be trusted between sweeps. Prevention is available here; detection is what you build when it is not.
-- **A human review gate before a goal may close.** This is the queue [ADR 0183](<redacted>.md) deliberately dismantled. The check D2 needs is a fact the database already holds — asking a person to assert it is slower and less reliable than asking the table.
+- **A human review gate before a goal may close.** This is the queue [ADR 0183](0183-criteria-close-themselves.md) deliberately dismantled. The check D2 needs is a fact the database already holds — asking a person to assert it is slower and less reliable than asking the table.
 - **Allow concurrent building versions and scope them by module.** Tempting, because it is the state the instance is in. But two live trains on one project means every "what is in this version" question has two answers, and the goal set can never close on either. The `planning` version is the supported way to work ahead.
 - **Retire versions entirely and let goals stand alone.** Genuinely considered: goals already carry criteria, membership and scope, so the version is arguably ceremony. Rejected because the version is the unit the owner sets scope in and the unit `limitations/<version>-shipped.md` archives — removing it would move the scope conversation somewhere with no home.
 
 ## 6. The one amendment to ADR 0157
 
-[ADR 0157](<redacted>.md) lowered `version.create` to
+[ADR 0157](0157-archon-is-rank-and-identity-only.md) lowered `version.create` to
 `metic`, on the argument that **authoring delegates, disposition does not**:
 creating a version confers no authority, so its siblings are `goal.create` and
 `task.create`, and only `version.close` stays Archon. That argument was correct

package/docs/adr/0251-a-suggestion-of-who-to-invite-is-a-recruiting-surface-and-owes-the-opt-out.md

@@ -4,14 +4,14 @@
 - **Date:** 2026-09-06
 - **Task:** [task 1002347](https://cloudbongos.com/builders#/task/1002347) (BONGOS-V1, goal 1000046 — *Project creation*, criterion `proj-invite-builders` / C6), BV1.R28
 - **Deciders:** Claude, under the Archon's standing scope
-- **Depends on:** [ADR 0239](<redacted>.md) §6 (the seam this fills: the engine emits `invites.seeking` and names R28 as its reader) · [ADR 0249](<redacted>.md) (the widget these names arrive in, and its "only door in" rule) · [ADR 0083](<redacted>.md) (the one-way import rule that makes this a port)
-- **Related:** [ADR 0210](<redacted>.md) (the `/scouting` gate this route deliberately does **not** reuse) · [ADR 0248](<redacted>.md) (the ownership fact the invite route already admits on) · [ADR 0016](<redacted>.md) (a surface never re-derives a server rule)
+- **Depends on:** [ADR 0239](0239-a-recommendation-is-a-table-that-carries-its-own-reason.md) §6 (the seam this fills: the engine emits `invites.seeking` and names R28 as its reader) · [ADR 0249](0249-the-invite-step-is-the-done-panel-s-first-act-not-a-rail-step.md) (the widget these names arrive in, and its "only door in" rule) · [ADR 0083](0083-modular-architecture-strangler-build-plan.md) (the one-way import rule that makes this a port)
+- **Related:** [ADR 0210](0210-scouting-graduates-on-an-instance-asserted-owner-claim.md) (the `/scouting` gate this route deliberately does **not** reuse) · [ADR 0248](0248-a-hub-project-s-owner-is-the-provisioning-row-carried-on-a-port.md) (the ownership fact the invite route already admits on) · [ADR 0016](0016-trust-boundary-server-enforced-permissions.md) (a surface never re-derives a server rule)
 
 ---
 
 ## Context
 
-[ADR 0239](<redacted>.md) §6 left one recommendation deliberately unfinished. The creation wizard's rule engine emits, per team shape, a **seek** rather than a list:
+[ADR 0239](0239-a-recommendation-is-a-table-that-carries-its-own-reason.md) §6 left one recommendation deliberately unfinished. The creation wizard's rule engine emits, per team shape, a **seek** rather than a list:
 
 ```
 solo        → seeking: null                              ("suggest nobody", a real answer)
@@ -53,11 +53,11 @@ Two things are enforced inside the module rather than asked of callers:
 
 It deliberately does **not** reuse `/scouting`'s gate (`project.curate` or a hub-witnessed `membership_kind='owner'`). A brand-new owner has no witnessed owner-membership row at the moment the done panel paints — that row is written later, by the child instance at SSO check-in — so the correct-looking gate would refuse the exact caller the feature exists for.
 
-Reaching this route **is** the ownership answer ([ADR 0249](<redacted>.md) §4), so the surface re-derives nothing and cannot become a weaker second copy of a server rule ([ADR 0016](<redacted>.md)). 404 rather than 403 keeps it leaking no more instance existence than its neighbour.
+Reaching this route **is** the ownership answer ([ADR 0249](0249-the-invite-step-is-the-done-panel-s-first-act-not-a-rail-step.md) §4), so the surface re-derives nothing and cannot become a weaker second copy of a server rule ([ADR 0016](0016-trust-boundary-server-enforced-permissions.md)). 404 rather than 403 keeps it leaking no more instance existence than its neighbour.
 
 ## What the surface does with the answer
 
-The widget keeps its shape from [ADR 0249](<redacted>.md): it still answers neither "is anyone signed in" nor "is this their project", and gains a **second door in** (`setInviteSuggestions`) beside `setInviteSlug` rather than learning to fetch for itself.
+The widget keeps its shape from [ADR 0249](0249-the-invite-step-is-the-done-panel-s-first-act-not-a-rail-step.md): it still answers neither "is anyone signed in" nor "is this their project", and gains a **second door in** (`setInviteSuggestions`) beside `setInviteSlug` rather than learning to fetch for itself.
 
 - **The reason is always said, including when the answer is nobody.** `seeking: null` returns its own sentence and never touches the directory. A solo owner is suggested nobody *on purpose*, and rendering that as an empty list would turn a stated answer into what looks like a failed lookup.
 - **A picked name takes the same write path as a typed one** — it fills the field and calls `doInvite`. One write path means the refusal vocabulary, the busy guard and the pending receipt cannot drift into a second copy.

package/docs/adr/0252-the-self-hosted-visibility-report-is-a-pull-and-auto-appear-buys-a-retraction-lever.md

@@ -5,8 +5,8 @@
 - **Task:** [task 1002321](https://cloudbongos.com/builders#/task/1002321) (BONGOS-V1, goal 1000046 — *Project creation*, criterion `proj-visibility-states` / C1), BV1.R02 — a spike whose output is this decision
 - **Gates:** [task 1002327](https://cloudbongos.com/builders#/task/1002327) (BV1.R08 — the build)
 - **Deciders:** the Archon (the two product calls in §3 and §5), Claude (the mechanism)
-- **Depends on:** [ADR 0182](<redacted>.md) D3/D5 (the two axes, and the hand-off that named this ADR's scope) · [ADR 0238](<redacted>.md) (the owner's door is a provisioning settings key; the hub column stays the cache) · [ADR 0246](<redacted>.md) (the control-plane projection, and the line this ADR sits on)
-- **Related:** [ADR 0144](<redacted>.md) (the tripwire this route avoids) · [ADR 0145](<redacted>.md) (why `standalone` holds no credential) · [ADR 0205](<redacted>.md) (what a self-report may and may not buy) · [ADR 0047](<redacted>.md) (the straight-through path and its abuse guard are one task) · [ADR 0199](<redacted>.md) / [ADR 0226](<redacted>.md) (a degraded report is not a state change)
+- **Depends on:** [ADR 0182](0182-project-visibility-two-axes.md) D3/D5 (the two axes, and the hand-off that named this ADR's scope) · [ADR 0238](0238-the-join-door-is-a-provisioning-settings-policy-key.md) (the owner's door is a provisioning settings key; the hub column stays the cache) · [ADR 0246](0246-catalog-membership-is-a-projection-not-a-federation-side-effect.md) (the control-plane projection, and the line this ADR sits on)
+- **Related:** [ADR 0144](0144-federated-single-logout-backchannel.md) (the tripwire this route avoids) · [ADR 0145](0145-free-hosted-project-tier-isolation-and-domain-separation.md) (why `standalone` holds no credential) · [ADR 0205](0205-federated-checkin-needs-the-hubs-own-signin-witness.md) (what a self-report may and may not buy) · [ADR 0047](0047-discord-bugs-intake-anti-abuse.md) (the straight-through path and its abuse guard are one task) · [ADR 0199](0199-restart-an-unreachable-active-project.md) / [ADR 0226](0226-one-stale-timer-reporting-degrades-enforcement-refuses.md) (a degraded report is not a state change)
 
 ---
 
@@ -20,9 +20,9 @@ Reading the tree first changed the question. **A self-hosted instance has no cha
 if (inst.hosting_shape !== 'co-tenant') return { federate: false, reason: … };
 ```
 
-Every writer of `sso_clients` is control-plane; no route registers a client. So *federated* ⊆ *operator-provisioned co-tenant*, and *self-hosted* is a disjoint set holding nothing. That is deliberate on two counts: [ADR 0145](<redacted>.md) says in as many words **do not** extend federation to `standalone` as it exists today, and [ADR 0144](<redacted>.md)'s Known Limitation rests on it — *"today every secret-holder is an operator-provisioned, trusted instance … the proper fix must land before federation opens to untrusted third-party clients."*
+Every writer of `sso_clients` is control-plane; no route registers a client. So *federated* ⊆ *operator-provisioned co-tenant*, and *self-hosted* is a disjoint set holding nothing. That is deliberate on two counts: [ADR 0145](0145-free-hosted-project-tier-isolation-and-domain-separation.md) says in as many words **do not** extend federation to `standalone` as it exists today, and [ADR 0144](0144-federated-single-logout-backchannel.md)'s Known Limitation rests on it — *"today every secret-holder is an operator-provisioned, trusted instance … the proper fix must land before federation opens to untrusted third-party clients."*
 
-So the literal reading of R08 — "a self-hosted instance authenticates and pushes a report" — cannot be built without first minting credentials for untrusted third parties, which walks straight into that tripwire. [ADR 0182](<redacted>.md) D5's phrasing ("accepts a report from the authenticated `sso_client`") described a client that, for this population, does not exist.
+So the literal reading of R08 — "a self-hosted instance authenticates and pushes a report" — cannot be built without first minting credentials for untrusted third parties, which walks straight into that tripwire. [ADR 0182](0182-project-visibility-two-axes.md) D5's phrasing ("accepts a report from the authenticated `sso_client`") described a client that, for this population, does not exist.
 
 ## 2. The channel is a PULL of the instance's own public manifest
 
@@ -33,20 +33,20 @@ That value is already there and already public. The owner's pick lives at `provi
 Five things a pull gets for free, each of which a push would have had to build:
 
 1. **No credential.** Nothing is minted for anyone, so ADR 0144's tripwire is untouched and ADR 0145's rule holds. This is the whole reason the decision goes this way.
-2. **No replay surface.** ADR 0182 D5 handed R02 "replay, rate" as its scope. A pull reads *current state*, so there is no message to capture and resend — the `jti`-style machinery [ADR 0144](<redacted>.md) D6 needed for the push direction is moot here. Replay is answered by not having a message.
-3. **No wire change on anyone else's upgrade clock.** [ADR 0205](<redacted>.md) rejected adding a required body field precisely because "the callers are other instances on their own upgrade schedule," and [ADR 0201](<redacted>.md) D2.2 solved the same problem with a header. Here the field already ships in every core; nothing has to be added at all.
-4. **The hub still authorizes nothing.** It reads a declaration and caches it, which is exactly what [ADR 0182](<redacted>.md) D5 requires and what [ADR 0238](<redacted>.md) rejected a `PATCH /projects/:id/visibility` for failing.
+2. **No replay surface.** ADR 0182 D5 handed R02 "replay, rate" as its scope. A pull reads *current state*, so there is no message to capture and resend — the `jti`-style machinery [ADR 0144](0144-federated-single-logout-backchannel.md) D6 needed for the push direction is moot here. Replay is answered by not having a message.
+3. **No wire change on anyone else's upgrade clock.** [ADR 0205](0205-federated-checkin-needs-the-hubs-own-signin-witness.md) rejected adding a required body field precisely because "the callers are other instances on their own upgrade schedule," and [ADR 0201](0201-cross-project-application-vouched-row-live-record.md) D2.2 solved the same problem with a header. Here the field already ships in every core; nothing has to be added at all.
+4. **The hub still authorizes nothing.** It reads a declaration and caches it, which is exactly what [ADR 0182](0182-project-visibility-two-axes.md) D5 requires and what [ADR 0238](0238-the-join-door-is-a-provisioning-settings-policy-key.md) rejected a `PATCH /projects/:id/visibility` for failing.
 5. **The fetch is already written.** `modules/platform-identity/project-stats.js` fans out to project origins today behind a real SSRF guard — DNS-resolve-all with a public-address assertion, `redirect: 'error'` (a curated origin is trusted, a redirect target is not), per-request timeouts, a TTL cache, a negative cache and inflight collapsing. The visibility read rides that machinery rather than opening a second, weaker outbound path.
 
 **The pull carries `visibility` and nothing else.** It is a three-value closed enum; an absent or off-vocabulary answer yields *no verdict* (§4), never a default. No free text, no name, no tagline, no art reaches the catalog through this channel — those stay curated fields, so the property the map has today (a project owner controls no free-text field that reaches the feed) is not spent here.
 
 ## 3. Auto-appear: no human stands between a public project and the map
 
-**Decision (the Archon's).** A self-hosted project reporting `public` appears on the map with **no human act**. `featured` keeps the only job [ADR 0182](<redacted>.md) D3 left it — ranking among rows already there — and curation stays editorial.
+**Decision (the Archon's).** A self-hosted project reporting `public` appears on the map with **no human act**. `featured` keeps the only job [ADR 0182](0182-project-visibility-two-axes.md) D3 left it — ranking among rows already there — and curation stays editorial.
 
 The alternative (a one-time admission, or ongoing curation) was offered and declined. What was declined with it is the friction ADR 0182 D3 had already removed once: an owner setting their project public and seeing nothing happen until someone else acted.
 
-**This decision is conditional, and the condition is §5.** Auto-appear is only defensible because retraction ships beside it; [ADR 0047](<redacted>.md) is explicit that the straight-through path and the abuse guard are the *same* task, and this ADR treats that as binding rather than advisory.
+**This decision is conditional, and the condition is §5.** Auto-appear is only defensible because retraction ships beside it; [ADR 0047](0047-discord-bugs-intake-anti-abuse.md) is explicit that the straight-through path and the abuse guard are the *same* task, and this ADR treats that as binding rather than advisory.
 
 ## 4. Trust follows provenance — the asymmetry is in the guards, not in a gate
 
@@ -59,18 +59,18 @@ The alternative (a one-time admission, or ongoing curation) was offered and decl
 | status of the value | authoritative | a **cached claim, with a recency stamp** |
 | may move | its own row | its own row, and only its own row |
 
-Stated once, so it is not re-litigated: **an instance is authoritative about its own door and about nothing else.** That is [ADR 0016](<redacted>.md) and [ADR 0141](<redacted>.md)'s line held in a new place — identity and self-description federate, authority does not.
+Stated once, so it is not re-litigated: **an instance is authoritative about its own door and about nothing else.** That is [ADR 0016](0016-trust-boundary-server-enforced-permissions.md) and [ADR 0141](<redacted>.md)'s line held in a new place — identity and self-description federate, authority does not.
 
 ### Absent is a third state, and it must not purge
 
-[ADR 0182](<redacted>.md) D5 says the absent-report default is fail-closed: unreported ⇒ dark matter. That stands, **scoped to a self-hosted row that has never once answered** — such a project is off the map rather than exposed by omission.
+[ADR 0182](0182-project-visibility-two-axes.md) D5 says the absent-report default is fail-closed: unreported ⇒ dark matter. That stands, **scoped to a self-hosted row that has never once answered** — such a project is off the map rather than exposed by omission.
 
-It must never be evaluated against control-plane rows, and it must never be read as "answered before, silent now." [ADR 0247](<redacted>.md) D4 found the live shape of this trap: at the time of writing, *every* catalog row carried `description: null`, so a naive fail-closed enforcement wired that day would have refused every join on the platform at once. The same hazard applies here.
+It must never be evaluated against control-plane rows, and it must never be read as "answered before, silent now." [ADR 0247](0247-the-join-door-is-one-composed-answer-and-dark-matter-has-no-live-verdict-yet.md) D4 found the live shape of this trap: at the time of writing, *every* catalog row carried `description: null`, so a naive fail-closed enforcement wired that day would have refused every join on the platform at once. The same hazard applies here.
 
 So the tri-state is explicit — `null` (never read) ≠ `false` (read, and negative) ≠ `true`:
 
 - **never successfully read** → dark matter (D5's rule, doing its job)
-- **read before, unreachable now** → **keep the last known state, stamped with its recency.** A project does not leave the map because its server was down for a sweep. [ADR 0199](<redacted>.md): liveness is an overlay, never a lifecycle state. [ADR 0226](<redacted>.md): reporting may degrade where enforcement must refuse — and this is reporting.
+- **read before, unreachable now** → **keep the last known state, stamped with its recency.** A project does not leave the map because its server was down for a sweep. [ADR 0199](0199-restart-an-unreachable-active-project.md): liveness is an overlay, never a lifecycle state. [ADR 0226](0226-one-stale-timer-reporting-degrades-enforcement-refuses.md): reporting may degrade where enforcement must refuse — and this is reporting.
 - **read, and narrower than before** → applied immediately and unconditionally. A report that *reduces* exposure needs no trust at all: the worst a lying instance achieves is hiding itself.
 
 That last line is the shape of the whole trust model. **Narrowing is free; widening is what costs.**
@@ -81,9 +81,9 @@ That last line is the shape of the whole trust model. **Narrowing is free; widen
 
 Under control-plane provisioning that was survivable, because the set of rows was bounded by who the operator had provisioned. Auto-appear replaces that bound with *whoever points a domain at us*, and a one-way door onto a public surface is not a door. So R08 ships, in the same task:
 
-1. **`PATCH /projects/:id/status`** — `active|hidden`, `project.curate` floor (metic, per [ADR 0157](<redacted>.md)), audited.
+1. **`PATCH /projects/:id/status`** — `active|hidden`, `project.curate` floor (metic, per [ADR 0157](0157-archon-is-rank-and-identity-only.md)), audited.
 2. **`hidden` is STICKY against the pull.** A retracted project that keeps reporting `public` **stays hidden**. This is the single most important line in this ADR: without it the next sweep silently undoes every takedown, and the lever is decorative. Retraction is a hub decision about the hub's own surface, and the pull may not overwrite it — the pull moves `visibility`, never `status`. The two columns answer different questions and this is where that separation earns its keep.
-3. **A per-IP read limit on the public feed** (the [ADR 0209](<redacted>.md) precedent). `GET /projects/featured` is unauthenticated, CORS-open and currently unmetered, and each cold sweep can drive up to 500 rows × 4 outbound fetches.
+3. **A per-IP read limit on the public feed** (the [ADR 0209](0209-one-budget-for-the-account-existence-oracle.md) precedent). `GET /projects/featured` is unauthenticated, CORS-open and currently unmetered, and each cold sweep can drive up to 500 rows × 4 outbound fetches.
 
 ### One gap this decision widens, named rather than left
 
@@ -97,13 +97,13 @@ The corpus already has the right rule and applies it one field over: `shipUrlWit
 - **The hub reaches out to more origins.** The fan-out ceiling is unchanged (500 rows, TTL + negative caches), but the *population* is no longer bounded by provisioning. The feed read limit exists for this.
 - **Two populations, one column, different provenance** — readers of `platform_identity_projects.visibility` cannot assume how it got there. The recency stamp is what tells them.
 - **A self-hosted instance that never upgrades never appears.** It already serves `branding.project.visibility`, so in practice this is only the very old.
-- **Nothing here federates a self-hosted instance.** It holds no credential, mints no assertion, writes no membership, and reports no analytics. The later analytics feed R02 was asked to anticipate is deliberately *not* decided here: it carries per-person data, which is exactly what [ADR 0205](<redacted>.md) proved cannot ride an unwitnessed self-report. It needs the ADR 0144 credential work first, and it is a separate decision.
+- **Nothing here federates a self-hosted instance.** It holds no credential, mints no assertion, writes no membership, and reports no analytics. The later analytics feed R02 was asked to anticipate is deliberately *not* decided here: it carries per-person data, which is exactly what [ADR 0205](0205-federated-checkin-needs-the-hubs-own-signin-witness.md) proved cannot ride an unwitnessed self-report. It needs the ADR 0144 credential work first, and it is a separate decision.
 
 ## 7. Rejected
 
-- **A pushed report authenticated by a client credential.** The literal reading of R08. Rejected: self-hosted instances hold no credential, and minting them is the exact move [ADR 0144](<redacted>.md) and [ADR 0145](<redacted>.md) say must not happen yet. It would also have owed replay protection, a rate budget and a wire-compatible field — three problems the pull does not have.
-- **`PATCH /projects/:id/visibility` on the hub.** Already rejected by [ADR 0238](<redacted>.md) for making the hub authorize a door change; restated here because a pull could be mistaken for a licence to add one.
+- **A pushed report authenticated by a client credential.** The literal reading of R08. Rejected: self-hosted instances hold no credential, and minting them is the exact move [ADR 0144](0144-federated-single-logout-backchannel.md) and [ADR 0145](0145-free-hosted-project-tier-isolation-and-domain-separation.md) say must not happen yet. It would also have owed replay protection, a rate budget and a wire-compatible field — three problems the pull does not have.
+- **`PATCH /projects/:id/visibility` on the hub.** Already rejected by [ADR 0238](0238-the-join-door-is-a-provisioning-settings-policy-key.md) for making the hub authorize a door change; restated here because a pull could be mistaken for a licence to add one.
 - **A one-time admission, and ongoing curation.** Both offered to the Archon; both declined in favour of auto-appear (§3).
 - **Trusting the pull to move `status`.** The retraction lever would be decorative (§5.2).
-- **Enforcing "unreported ⇒ dark matter" across all rows.** [ADR 0247](<redacted>.md) D4's live finding: it empties the map (§4).
+- **Enforcing "unreported ⇒ dark matter" across all rows.** [ADR 0247](0247-the-join-door-is-one-composed-answer-and-dark-matter-has-no-live-verdict-yet.md) D4's live finding: it empties the map (§4).
 - **Letting the pull carry name, tagline or art.** Today no project owner controls a free-text field that reaches the feed. That is a property worth keeping, and a visibility report is not the place to spend it.

package/docs/adr/0253-the-takedown-lever-has-two-writers-and-provenance-is-a-column.md

@@ -4,8 +4,8 @@
 - **Date:** 2026-09-06
 - **Task:** [task 1002327](https://cloudbongos.com/builders#/task/1002327) (BONGOS-V1, goal 1000046 — *Project creation*, criterion `proj-visibility-states` / C1), BV1.R08 — the build
 - **Deciders:** Claude, building R08 against ADR 0252's design
-- **Amends:** [ADR 0252](<redacted>.md) §4 and §5 — three premises that did not survive contact with the tree. The decisions ADR 0252 took are unchanged; what changes is what has to be built to make them true.
-- **Related:** [ADR 0246](<redacted>.md) (the control-plane projection, and the writer §5 missed) · [ADR 0247](<redacted>.md) D4 (the fail-closed trap, found live one column over) · [ADR 0182](<redacted>.md) D5 (dark matter) · [ADR 0083](<redacted>.md) (the one-way import rule that forces §2's shape) · [ADR 0209](<redacted>.md) (the limiter precedent) · [ADR 0199](<redacted>.md) / [ADR 0226](<redacted>.md) (reporting degrades; enforcement refuses)
+- **Amends:** [ADR 0252](0252-the-self-hosted-visibility-report-is-a-pull-and-auto-appear-buys-a-retraction-lever.md) §4 and §5 — three premises that did not survive contact with the tree. The decisions ADR 0252 took are unchanged; what changes is what has to be built to make them true.
+- **Related:** [ADR 0246](0246-catalog-membership-is-a-projection-not-a-federation-side-effect.md) (the control-plane projection, and the writer §5 missed) · [ADR 0247](0247-the-join-door-is-one-composed-answer-and-dark-matter-has-no-live-verdict-yet.md) D4 (the fail-closed trap, found live one column over) · [ADR 0182](0182-project-visibility-two-axes.md) D5 (dark matter) · [ADR 0083](0083-modular-architecture-strangler-build-plan.md) (the one-way import rule that forces §2's shape) · [ADR 0209](0209-one-budget-for-the-account-existence-oracle.md) (the limiter precedent) · [ADR 0199](0199-restart-an-unreachable-active-project.md) / [ADR 0226](0226-one-stale-timer-reporting-degrades-enforcement-refuses.md) (reporting degrades; enforcement refuses)
 
 ---