@bongos/core 1.19.714 → 1.19.724

package/docs/adr/0254-a-relayed-link-is-contained-downward-or-it-is-not-published.md

@@ -2,9 +2,9 @@
 
 - **Status:** accepted
 - **Date:** 2026-09-06
-- **Task:** [task 1003670](https://cloudbongos.com/builders#/task/1003670) (BONGOS-V1, goal 1000046 — *Project creation*, criterion `proj-visibility-states` / C1) — the gap [ADR 0252](<redacted>.md) §5 named and filed rather than left
+- **Task:** [task 1003670](https://cloudbongos.com/builders#/task/1003670) (BONGOS-V1, goal 1000046 — *Project creation*, criterion `proj-visibility-states` / C1) — the gap [ADR 0252](0252-the-self-hosted-visibility-report-is-a-pull-and-auto-appear-buys-a-retraction-lever.md) §5 named and filed rather than left
 - **Deciders:** Claude, building the task ADR 0252 §5 opened
-- **Related:** [ADR 0252](<redacted>.md) §3/§5 (auto-appear, and the condition it was granted on) · [ADR 0253](<redacted>.md) §2 (*narrowing is free; widening is what costs* — the asymmetry this applies again) · [ADR 0182](<redacted>.md) D2a (redaction is server-side, because the page cannot be the gate) · [ADR 0171](<redacted>.md) D7 (validation lives next to the data, where no caller can forget it) · [ADR 0114](<redacted>.md) (the discovery index this value arrives on) · [ADR 0083](<redacted>.md) (the module boundary the shared file sits inside)
+- **Related:** [ADR 0252](0252-the-self-hosted-visibility-report-is-a-pull-and-auto-appear-buys-a-retraction-lever.md) §3/§5 (auto-appear, and the condition it was granted on) · [ADR 0253](0253-the-takedown-lever-has-two-writers-and-provenance-is-a-column.md) §2 (*narrowing is free; widening is what costs* — the asymmetry this applies again) · [ADR 0182](0182-project-visibility-two-axes.md) D2a (redaction is server-side, because the page cannot be the gate) · [ADR 0171](0171-profile-rollup-join-and-consent.md) D7 (validation lives next to the data, where no caller can forget it) · [ADR 0114](0114-instance-docs-discovery-contract.md) (the discovery index this value arrives on) · [ADR 0083](0083-modular-architecture-strangler-build-plan.md) (the module boundary the shared file sits inside)
 
 ---
 
@@ -31,7 +31,7 @@ owner decision (a): *a door only where it opens somewhere else*) and it answers
 question correctly. Nothing was ever asked to answer the security one.
 
 **Why it stopped being survivable.** Under control-plane provisioning the set of origins the
-hub would ever fetch was bounded by whom the operator had provisioned. [ADR 0252](<redacted>.md)
+hub would ever fetch was bounded by whom the operator had provisioned. [ADR 0252](0252-the-self-hosted-visibility-report-is-a-pull-and-auto-appear-buys-a-retraction-lever.md)
 §3 replaced that bound with *whoever points a domain at the hub*, and §5 named this gap in
 the same breath — auto-appear turns a curated-origin risk into a phishing hop anyone can
 mint. Auto-appear was granted on the condition that its guards ship; this is one of them.
@@ -58,7 +58,7 @@ as `urlWithinOrigin(raw, origin, max)` and required by both callers. This is not
 the defect *was* two surfaces answering one question differently, and leaving the answer
 where only one of them could reach it is what let them differ. (The rename is why ADR 0252
 §5's `shipUrlWithinClientOrigin` no longer greps; ADR 0252 is left as written, per the
-[ADR 0253](<redacted>.md) §1
+[ADR 0253](0253-the-takedown-lever-has-two-writers-and-provenance-is-a-column.md) §1
 convention that a decision record is not edited after the fact.)
 
 Its own file, rather than a shared symbol left in place, for the reason a row of siblings in
@@ -78,7 +78,7 @@ every neighbour under it. The upward direction is not offered, here or for ship
 **What that costs, named rather than discovered later:** a project whose hall is a *sibling*
 of its site — site `www.example.com`, hall `builders.example.com` — loses the hall glyph on
 the hub. The hall is still reachable and the project is otherwise unaffected; the hub simply
-stops vouching for the address. That is [ADR 0253](<redacted>.md)
+stops vouching for the address. That is [ADR 0253](0253-the-takedown-lever-has-two-writers-and-provenance-is-a-column.md)
 §2's asymmetry applied again — **narrowing is free; widening is what costs** — and the only
 rule that would admit the sibling is the one that hands away the apex.
 
@@ -86,7 +86,7 @@ rule that would admit the sibling is the one that hands away the apex.
 
 - **Mirroring the check in the browser** (`modules/public-landing/public/projects.html`
   already scheme-checks and re-applies the door test client-side). Rejected: the page is not
-  the gate ([ADR 0182](<redacted>.md) D2a — a client-side filter still
+  the gate ([ADR 0182](0182-project-visibility-two-axes.md) D2a — a client-side filter still
   ships the value to anyone who opens a network tab), the server is now the only producer of
   the field, and a second copy of a containment rule is precisely the drift this ADR exists
   to end. The existing client-side scheme check stays as cheap defence in depth.

package/docs/adr/0255-a-public-lists-ordering-is-part-of-its-payload.md

@@ -4,7 +4,7 @@
 - **Date:** 2026-09-06
 - **Task:** [task 1003561](https://cloudbongos.com/builders#/task/1003561) (BONGOS-V1, goal 1000046 — *Project creation*), which absorbed [task 1003560](https://cloudbongos.com/builders#/task/1003560)
 - **Deciders:** Claude, building against ADR 0182 D2a
-- **Related:** [ADR 0182](<redacted>.md) D1/D2a/D3 (the join door, the stealth redaction, and `featured`'s remaining ranking job) · [ADR 0252](<redacted>.md) §5.3 (the per-IP ceiling on this route) · [ADR 0253](<redacted>.md) (`visibility_source` / `visibility_reported_at`, the `DOOR_KNOWN_SQL` predicate this feed joins) · [ADR 0119](0119-api-pagination-contract.md) (the `?limit=&offset=` contract this feed was the last public list to hold out on)
+- **Related:** [ADR 0182](0182-project-visibility-two-axes.md) D1/D2a/D3 (the join door, the stealth redaction, and `featured`'s remaining ranking job) · [ADR 0252](0252-the-self-hosted-visibility-report-is-a-pull-and-auto-appear-buys-a-retraction-lever.md) §5.3 (the per-IP ceiling on this route) · [ADR 0253](0253-the-takedown-lever-has-two-writers-and-provenance-is-a-column.md) (`visibility_source` / `visibility_reported_at`, the `DOOR_KNOWN_SQL` predicate this feed joins) · [ADR 0119](0119-api-pagination-contract.md) (the `?limit=&offset=` contract this feed was the last public list to hold out on)
 
 ---
 
@@ -151,7 +151,7 @@ Stated plainly, because a privacy fix that oversells itself is worse than none:
    at all, and closing it needs a different mechanism (a delay, a decoy, or accepting that a
    project's *departure* from the public list is public). Filed separately rather than
    silently implied to be fixed — and **now decided**: the owner chose to accept it and say
-   so in the copy ([ADR 0259](<redacted>.md),
+   so in the copy ([ADR 0259](0259-a-projects-departure-from-the-public-list-is-public.md),
    [task 1003672](https://cloudbongos.com/builders#/task/1003672)), which also carries the
    §6.3 residual below.
 3. **Position is stable within one epoch.** Two snapshots taken the same day can still tell

package/docs/adr/0256-the-visibility-ceiling-is-the-sign-in-gate-too-and-the-reader-moves-to-the-composer.md

@@ -4,9 +4,9 @@
 - **Date:** 2026-09-06
 - **Task:** [task 1003579](https://cloudbongos.com/builders#/task/1003579) (BONGOS-V1, goal 1000046 — *Project creation*, criterion `proj-join-policy`)
 - **Deciders:** Claude, under the Archon's standing scope
-- **Closes:** [ADR 0247](<redacted>.md)'s written *KNOWN LIMIT* — *"the door narrows, the sign-in gate does not"*
-- **Implements:** [ADR 0182](<redacted>.md) D6's **Self-join** column (the half ADR 0247 enforced was the *Applications* column)
-- **Related:** [ADR 0194](<redacted>.md) (the one-reader move this repeats one level up; D2's fail-closed rule) · [ADR 0192](<redacted>.md) §2 (where that fail-closed rule comes from) · [ADR 0050](<redacted>.md) (the legacy `OPEN_XENOS_ENROLLMENT` flag) · [ADR 0190](<redacted>.md) (how a knob reaches the instance)
+- **Closes:** [ADR 0247](0247-the-join-door-is-one-composed-answer-and-dark-matter-has-no-live-verdict-yet.md)'s written *KNOWN LIMIT* — *"the door narrows, the sign-in gate does not"*
+- **Implements:** [ADR 0182](0182-project-visibility-two-axes.md) D6's **Self-join** column (the half ADR 0247 enforced was the *Applications* column)
+- **Related:** [ADR 0194](0194-joinability-one-door-decision.md) (the one-reader move this repeats one level up; D2's fail-closed rule) · [ADR 0192](0192-platform-visibility-member-door.md) §2 (where that fail-closed rule comes from) · [ADR 0050](0050-device-flow-admission-invite-gated-by-default.md) (the legacy `OPEN_XENOS_ENROLLMENT` flag) · [ADR 0190](0190-settings-apply-in-place-env-patch.md) (how a knob reaches the instance)
 
 ---
 

package/docs/adr/0257-auth-resolves-before-the-hall-mounts-anything.md

@@ -4,7 +4,7 @@
 - **Date:** 2026-09-06
 - **Task:** [task 1003673](https://cloudbongos.com/builders#/task/1003673) (BONGOS-V1, goal 1000063 — *The front door*)
 - **Deciders:** Claude, under the Archon's standing scope
-- **Related:** [ADR 0050](<redacted>.md) (admission is invite-gated by default — the posture this defect made unusable) · [ADR 0194](<redacted>.md) + [ADR 0247](<redacted>.md) (the door the landing form renders) · [ADR 0062 §4](<redacted>.md) (the hall-widget registry)
+- **Related:** [ADR 0050](0050-device-flow-admission-invite-gated-by-default.md) (admission is invite-gated by default — the posture this defect made unusable) · [ADR 0194](0194-joinability-one-door-decision.md) + [ADR 0247](0247-the-join-door-is-one-composed-answer-and-dark-matter-has-no-live-verdict-yet.md) (the door the landing form renders) · [ADR 0062 §4](0062-medusa-instance-model-decoupling.md) (the hall-widget registry)
 
 ---
 

package/docs/adr/0258-the-public-cli-is-a-generated-client-package-not-the-published-core.md

@@ -4,7 +4,7 @@
 - **Date:** 2026-09-07
 - **Task:** [task 1003679](https://cloudbongos.com/builders#/task/1003679) (BONGOS-V1, goal 1000054 — *A newcomer can build without the UI*)
 - **Deciders:** Claude, under the Archon's standing scope
-- **Related:** [ADR 0083](<redacted>.md) (a module may import only `src/module-api.js` — the reason a static closure cannot answer this question) · [ADR 0099](<redacted>.md) (the lagged, redacted public mirror — still dormant) · [ADR 0108](<redacted>.md) (the core ships as a private versioned dependency) · [ADR 0118](<redacted>.md) (the generated client this package vendors) · [ADR 0161](<redacted>.md) (why the core's version moves many times a day)
+- **Related:** [ADR 0083](0083-modular-architecture-strangler-build-plan.md) (a module may import only `src/module-api.js` — the reason a static closure cannot answer this question) · [ADR 0099](0099-delayed-redacted-mirror-export.md) (the lagged, redacted public mirror — still dormant) · [ADR 0108](0108-instance-composition-configurable-root.md) (the core ships as a private versioned dependency) · [ADR 0118](0118-api-contract-source-of-truth-code-first.md) (the generated client this package vendors) · [ADR 0161](0161-publish-on-merge.md) (why the core's version moves many times a day)
 
 ---
 

package/docs/adr/0259-a-projects-departure-from-the-public-list-is-public.md

@@ -4,7 +4,7 @@
 - **Date:** 2026-09-07
 - **Task:** [task 1003672](https://cloudbongos.com/builders#/task/1003672) (BONGOS-V1, goal 1000046 — *Project creation*)
 - **Deciders:** the owner (choosing between accept / delay / decoys), Claude
-- **Related:** [ADR 0255](<redacted>.md) §6.2 (which filed this leak rather than implying it fixed) · [ADR 0182](<redacted>.md) D2a (the stealth redaction and its `STEALTH_ANONYMOUS_KEEPS` allow-list) · [ADR 0253](<redacted>.md) (the `visibility_source` provenance this feed joins)
+- **Related:** [ADR 0255](0255-a-public-lists-ordering-is-part-of-its-payload.md) §6.2 (which filed this leak rather than implying it fixed) · [ADR 0182](0182-project-visibility-two-axes.md) D2a (the stealth redaction and its `STEALTH_ANONYMOUS_KEEPS` allow-list) · [ADR 0253](0253-the-takedown-lever-has-two-writers-and-provenance-is-a-column.md) (the `visibility_source` provenance this feed joins)
 
 ---
 
@@ -26,7 +26,7 @@ is an allow-list precisely so a column added next year is anonymous without anyo
 remembering to come back to it. But the identity was never carried *on* the anonymous row.
 It is carried by the **absence** of the named row that used to sit beside it.
 
-**It is larger than the leak [ADR 0255](<redacted>.md)
+**It is larger than the leak [ADR 0255](0255-a-public-lists-ordering-is-part-of-its-payload.md)
 closed.** The ordering channel needed repeated sampling and correlation to be useful. This
 one is a single diff of two snapshots and it is exact.
 
@@ -75,7 +75,7 @@ The owner-facing copy for Stealth previously read:
 Every clause is true and the paragraph as a whole still oversells, because a reader takes
 "its name stays yours" to cover the switch itself. The copy now names the boundary in both
 places an owner meets this setting — the choice's blurb and the explanatory fold — in the
-plain register [ADR 0182](<redacted>.md)'s interview fixed for this
+plain register [ADR 0182](0182-project-visibility-two-axes.md)'s interview fixed for this
 card (the space metaphor belongs to the drawn orb, never to the words).
 
 **A privacy control that oversells is worse than one that admits a limit**, which is the
@@ -86,18 +86,18 @@ same standard 0255 §6 set for itself.
 Recorded so a later attempt does not undo the two guarantees that *are* held:
 
 - **No stable per-project key on an anonymous row** — the `STEALTH_ANONYMOUS_KEEPS`
-  allow-list ([ADR 0182](<redacted>.md) D2a). A decoy scheme that
+  allow-list ([ADR 0182](0182-project-visibility-two-axes.md) D2a). A decoy scheme that
   needs to tell its own padding apart from real rows is the classic way this gets
   reintroduced.
 - **No anonymous ordering an observer can predict or correlate**
-  ([ADR 0255](<redacted>.md) §3) — the trailing
+  ([ADR 0255](0255-a-public-lists-ordering-is-part-of-its-payload.md) §3) — the trailing
   block's keyed, rotating permutation.
 
 ## 5. The residual this does not address either
 
 Within one 24h epoch the anonymous block's permutation is stable, so two snapshots taken the
 same day can tell black holes apart — though not name them. Bounded by the rotation, and
-carried here from [ADR 0255](<redacted>.md) §6.3 so
+carried here from [ADR 0255](0255-a-public-lists-ordering-is-part-of-its-payload.md) §6.3 so
 both residuals live in one place. Accepted on the same reasoning: the fix is a per-request
 permutation, which breaks pagination exactly the way `ORDER BY random()` was rejected for in
 0255.
@@ -110,7 +110,7 @@ permutation, which breaks pagination exactly the way `ORDER BY random()` was rej
 - The Stealth copy carries the boundary in both surfaces, and
   `tests/projects_hub.mjs` pins that it does, so the sentence cannot quietly drop out of a
   future copy edit and leave the page overselling again.
-- [ADR 0255](<redacted>.md) §6.2's "filed
+- [ADR 0255](0255-a-public-lists-ordering-is-part-of-its-payload.md) §6.2's "filed
   separately" is now resolved, and points here.
 
 ## Alternatives rejected

package/docs/adr/0260-the-application-is-the-consent-and-the-echo-is-the-gate.md

@@ -3,7 +3,7 @@
 - **Status:** accepted
 - **Date:** 2026-09-03
 - **Task:** [task 1002972](https://cloudbongos.com/builders#/task/1002972) (PV7, goal 1000045 — criterion C4)
-- **Relates to:** `docs/specs/<redacted>.md` **D7** (owner-signed 2026-08-16), [ADR 0215](<redacted>.md) (the D3 sliver this reuses), [ADR 0205](<redacted>.md) + security report 1000027 (client credentials name a project, never a person), [ADR 0201](<redacted>.md) D1.2/D1.3 (the vouch mark and the statusless echo), [ADR 0171](<redacted>.md) D4/D5 (indistinguishable nulls, no-store), [ADR 0016](<redacted>.md) (descriptive, never authority), [ADR 0083](<redacted>.md) (the doorway)
+- **Relates to:** `docs/specs/<redacted>.md` **D7** (owner-signed 2026-08-16), [ADR 0215](0215-the-recruiter-sliver-is-a-ceiling-not-a-step.md) (the D3 sliver this reuses), [ADR 0205](0205-federated-checkin-needs-the-hubs-own-signin-witness.md) + security report 1000027 (client credentials name a project, never a person), [ADR 0201](0201-cross-project-application-vouched-row-live-record.md) D1.2/D1.3 (the vouch mark and the statusless echo), [ADR 0171](0171-profile-rollup-join-and-consent.md) D4/D5 (indistinguishable nulls, no-store), [ADR 0016](0016-trust-boundary-server-enforced-permissions.md) (descriptive, never authority), [ADR 0083](0083-modular-architecture-strangler-build-plan.md) (the doorway)
 
 ## Context
 
@@ -15,7 +15,7 @@ profile view. Private account → the D3 sliver. No new disclosure class.
 Two halves of that already existed when this task opened. The applicant's note
 reaches the project's queue through the join relay (task 1002330,
 `relayApplicationNote`). The D3 projection exists and is proved
-([ADR 0215](<redacted>.md)). What did not
+([ADR 0215](0215-the-recruiter-sliver-is-a-ceiling-not-a-step.md)). What did not
 exist was the **rule** — which of the two views an applicant gets — and the
 **path** by which a project's reviewer queue could ask the hub for it.
 
@@ -78,7 +78,7 @@ tempting refactor cannot pass quietly.
 like its two siblings. **That authentication is not sufficient on its own**, and
 this is the whole security argument for the route.
 
-[ADR 0205](<redacted>.md) / security
+[ADR 0205](0205-federated-checkin-needs-the-hubs-own-signin-witness.md) / security
 report 1000027 is the lesson `/sso/membership/check-in` and `/sso/activity/rollup`
 both had to learn: credentials prove *which project* is calling and say **nothing
 about who the `github_id` in the body is**. Without a per-subject witness, this
@@ -89,7 +89,7 @@ would mirror.
 
 The witness is `platform_identity_application_echoes` — the statusless
 "you applied to this project on this date" row from
-[ADR 0201](<redacted>.md) D1.3. It is
+[ADR 0201](0201-cross-project-application-vouched-row-live-record.md) D1.3. It is
 the right witness because **the hub writes it itself**, in its own join relay,
 only after the project answered the relayed application with a success. A client
 cannot assert itself into that table. `applicationBacksProfileRead` is the exact

package/docs/adr/0261-a-preselect-always-carries-a-reason-the-bundle-summary-is-the-floor.md

@@ -1,7 +1,7 @@
 # ADR 0261 — A preselect always carries a reason; the bundle's summary is the floor
 
 **Status:** Accepted · 2026-09-07 · task 1003684
-**Supersedes nothing. Resolves a tension between [ADR 0237](<redacted>.md) and [ADR 0243](<redacted>.md).**
+**Supersedes nothing. Resolves a tension between [ADR 0237](0237-a-starter-bundle-is-a-preset-over-the-always-on-core-keyed-by-declared-type.md) and [ADR 0243](0243-a-bundle-adjustment-belongs-to-the-bundle-not-the-advice-about-it.md).**
 
 ## Context
 

package/docs/adr/0262-a-bug-never-lands-in-the-inbox.md

@@ -1,7 +1,7 @@
 # ADR 0262 — A bug never lands in the inbox: the system names the home the reporter didn't
 
 **Status:** Accepted · 2026-09-07 · task 1003691
-**Supersedes nothing. Amends nothing.** It makes the explicit decision [ADR 0235](<redacted>.md) §6 said would be needed, and it keeps [ADR 0234](<redacted>.md)'s `#ideas` interview decision and [ADR 0250](<redacted>.md) D4's invariant both intact.
+**Supersedes nothing. Amends nothing.** It makes the explicit decision [ADR 0235](0235-a-fix-category-is-kindbug-under-a-goal-no-column-required.md) §6 said would be needed, and it keeps [ADR 0234](0234-idea-routing-capture-time-promotion-landing-matrix-homeless-inbox.md)'s `#ideas` interview decision and [ADR 0250](0250-strict-versioning-the-version-boundary-is-the-scope-gate.md) D4's invariant both intact.
 
 ## Context
 

package/docs/adr/0263-how-a-version-closes.md

@@ -4,11 +4,11 @@
 - **Date:** 2026-09-07
 - **Tasks:** [#1003593](https://cloudbongos.com/builders#/task/1003593) (this design pass, BV1.R06). Implemented by BV1.R12 ([#1003599](https://cloudbongos.com/builders#/task/1003599)), R16 ([#1003603](https://cloudbongos.com/builders#/task/1003603)), R17 ([#1003604](https://cloudbongos.com/builders#/task/1003604)), R18 ([#1003605](https://cloudbongos.com/builders#/task/1003605)), R20 ([#1003607](https://cloudbongos.com/builders#/task/1003607)) and R23 ([#1003610](https://cloudbongos.com/builders#/task/1003610)).
 - **Goal:** [#1000086](https://cloudbongos.com/builders#/goal/1000086) — Strict versioning.
-- **Implements:** [ADR 0250](<redacted>.md) D5. That decision says a version *can* close; this one says *how*, so the five build tasks under it are mechanical.
+- **Implements:** [ADR 0250](0250-strict-versioning-the-version-boundary-is-the-scope-gate.md) D5. That decision says a version *can* close; this one says *how*, so the five build tasks under it are mechanical.
 
 ## 1. Why a second ADR
 
-[ADR 0250](<redacted>.md) is the
+[ADR 0250](0250-strict-versioning-the-version-boundary-is-the-scope-gate.md) is the
 decision: the version boundary is the scope gate, and a version must be able to
 reach done. It deliberately stops at the rule. Closing a version is the widest
 write in the system — it flips a version, dispositions every goal still standing,
@@ -65,7 +65,7 @@ where the weight is.
 
 ## 4. Auto-close: where it fires, and why it cannot fail a ship
 
-Goal achievement has **two writers**, and [ADR 0250](<redacted>.md) D2 already made them a deliberate,
+Goal achievement has **two writers**, and [ADR 0250](0250-strict-versioning-the-version-boundary-is-the-scope-gate.md) D2 already made them a deliberate,
 documented duplicate rather than one helper, because collapsing them creates a
 require cycle (`db-goals` → `done-when` → `db-goals`):
 

package/docs/adr/0264-the-ten-working-areas.md

@@ -5,7 +5,7 @@
 - **Tasks:** [#1003696](https://cloudbongos.com/builders#/task/1003696) (this record). Executed by BV1.R25 ([#1003612](https://cloudbongos.com/builders#/task/1003612)), R26 ([#1003613](https://cloudbongos.com/builders#/task/1003613)), R27 ([#1003614](https://cloudbongos.com/builders#/task/1003614)), R28 ([#1003615](https://cloudbongos.com/builders#/task/1003615)) and R29 ([#1003617](https://cloudbongos.com/builders#/task/1003617)).
 - **Goal:** [#1000086](https://cloudbongos.com/builders#/goal/1000086) — Strict versioning, criterion `sv-cutover-proven-live`.
 - **Decided by:** the owner and the full team, in a manual goal review on 2026-09-07.
-- **Builds on:** [ADR 0250](<redacted>.md) (the version boundary is the scope gate — this is the scope that boundary will hold), [ADR 0086](<redacted>.md) (the goal tier).
+- **Builds on:** [ADR 0250](0250-strict-versioning-the-version-boundary-is-the-scope-gate.md) (the version boundary is the scope gate — this is the scope that boundary will hold), [ADR 0086](0086-goal-scoped-work-hierarchy.md) (the goal tier).
 
 ## 1. The decision
 
@@ -30,7 +30,7 @@ these ten.
 ## 2. Why ten, and why now
 
 Thirty-eight open goals is not a plan; it is a list of everything anyone has ever
-wanted. [ADR 0250](<redacted>.md) measured what that costs — 523 open tasks, fourteen goals
+wanted. [ADR 0250](0250-strict-versioning-the-version-boundary-is-the-scope-gate.md) measured what that costs — 523 open tasks, fourteen goals
 reporting done while holding thirty-five unfinished tasks — and built the
 machinery to stop the drift. But **enforcement alone cannot shrink a scope that
 is already too large**: D1 closes the goal set of a *building* version, which
@@ -145,7 +145,7 @@ is the system working as designed, one task ahead of its own remedy.
 
 ## 6. What actually executed, 2026-09-08
 
-The cut ran to completion in one pass under [#1003728](https://cloudbongos.com/builders#/task/1003728), in the order [ADR 0265](<redacted>.md) §3 requires. **BONGOS-V1 is `shipped`, BONGOS-V2 is `building`, and the board is eleven rows: the ten working areas plus the maintenance goal.** All six strict-versioning invariants hold; 532 non-terminal tasks are homed and none are orphaned.
+The cut ran to completion in one pass under [#1003728](https://cloudbongos.com/builders#/task/1003728), in the order [ADR 0265](0265-work-with-no-goal-and-the-order-the-cut-needs.md) §3 requires. **BONGOS-V1 is `shipped`, BONGOS-V2 is `building`, and the board is eleven rows: the ten working areas plus the maintenance goal.** All six strict-versioning invariants hold; 532 non-terminal tasks are homed and none are orphaned.
 
 **The close** dispositioned all 21 open non-maintenance goals — 20 `roll_forward`, and `abandon` for [#1000067](https://cloudbongos.com/builders#/goal/1000067) (Ideator compensation), which held no unfinished work. 391 tasks moved onto BONGOS-V2 with their goals; the maintenance queue's 50 carried into a fresh goal, [#1000118](https://cloudbongos.com/builders#/goal/1000118).
 

package/docs/adr/0265-work-with-no-goal-and-the-order-the-cut-needs.md

@@ -4,7 +4,7 @@
 - **Date:** 2026-09-08
 - **Tasks:** [#1003713](https://cloudbongos.com/builders#/task/1003713) (this record + the fix). Found while re-basing the cutover plan in [#1003711](https://cloudbongos.com/builders#/task/1003711).
 - **Goal:** [#1000086](https://cloudbongos.com/builders#/goal/1000086) — Strict versioning, criteria `sv-every-task-has-a-goal` and `sv-cutover-proven-live`.
-- **Builds on:** [ADR 0250](<redacted>.md) (D3, D4, D5), [ADR 0263](<redacted>.md) (§5–§8), [ADR 0264](<redacted>.md) (the cut this order executes).
+- **Builds on:** [ADR 0250](0250-strict-versioning-the-version-boundary-is-the-scope-gate.md) (D3, D4, D5), [ADR 0263](0263-how-a-version-closes.md) (§5–§8), [ADR 0264](0264-the-ten-working-areas.md) (the cut this order executes).
 
 ## 1. The defect
 
@@ -21,7 +21,7 @@ it, the goal re-count cannot see it, and the version flips to `shipped` with the
 task still stamped with it. It is then permanently non-terminal on a version that
 is over, and invisible to every surface that reasons per goal.
 
-[ADR 0250](<redacted>.md) D3 shut this door one tier down — R10 and R14 made a *goal* refuse to
+[ADR 0250](0250-strict-versioning-the-version-boundary-is-the-scope-gate.md) D3 shut this door one tier down — R10 and R14 made a *goal* refuse to
 close while holding unfinished tasks. The version tier never got the same
 treatment, and D4 ("every task has a goal") was written as a property of the data
 rather than as a gate anything enforced at the boundary.
@@ -52,7 +52,7 @@ discover which ones is how forty-seven went unnoticed.
 Two exemptions, both forced rather than chosen:
 
 - **The maintenance goal's tasks.** `carryBugsForward` runs in the `onClosed`
-  hook, which fires *after* this check and after the flip ([ADR 0263](<redacted>.md) §8), so
+  hook, which fires *after* this check and after the flip ([ADR 0263](0263-how-a-version-closes.md) §8), so
   maintenance work is legitimately still on the version at check time. Exempted
   through `maintenanceGoalExemptSql` — the **same** predicate the goal count
   uses, never a second copy. R18 replaced that function's body once already (a
@@ -71,7 +71,7 @@ dispositions were about to move anyway.
 ## 3. The consequence: the cut needs roll-forward, *then* fold
 
 Verifying the above surfaced two facts that together determine how
-[ADR 0264](<redacted>.md)'s thirty-eight-goals-to-ten cut can be executed at all:
+[ADR 0264](0264-the-ten-working-areas.md)'s thirty-eight-goals-to-ten cut can be executed at all:
 
 1. **A task cannot cross a version boundary by hand.** `PATCH /tasks/:id { goal_id }`
    refuses with 409 `goal_version_mismatch` — "a task can only join a goal in its
@@ -92,7 +92,7 @@ because the area goals live on BONGOS-V2 and the tasks live on BONGOS-V1.
 
 1. **Give every homeless task a goal on its own version.** The 47 null-goal rows
    and the two catch-alls' populations go to any real goal on the version they
-   are already on — bugs to that version's maintenance goal ([ADR 0262](<redacted>.md)), the rest
+   are already on — bugs to that version's maintenance goal ([ADR 0262](0262-a-bug-never-lands-in-the-inbox.md)), the rest
    to whichever existing goal fits. This is the step the new invariant makes
    mandatory rather than optional.
 2. **Close the building version, rolling every goal that still holds work

package/docs/adr/0266-the-board-room-is-its-own-surface-reachable-by-whoever-may-vote.md

@@ -5,8 +5,8 @@
 - **Tasks:** [#1003734](https://cloudbongos.com/builders#/task/1003734) (this record). Executed by [#1003735](https://cloudbongos.com/builders#/task/1003735) (the carve), [#1003736](https://cloudbongos.com/builders#/task/1003736) (the deep links), [#1003737](https://cloudbongos.com/builders#/task/1003737) (the waiting-vote count).
 - **Goal:** [#1000111](https://cloudbongos.com/builders#/goal/1000111) — Working area 7, Government; criterion `wa7-government`.
 - **Decided by:** the owner (Masterqua / `IAMMASTERQUA`, Archon, member of area 7), 2026-09-08.
-- **Builds on:** [ADR 0175](<redacted>.md) (the Board Room, and §6 — who governs is configuration), [ADR 0157](<redacted>.md) (the `page.view.government` floor at metic), [ADR 0151](<redacted>.md) (permissions as the atom), [ADR 0016](<redacted>.md) (server-enforced, uncached, per request).
-- **Related:** [ADR 0174](<redacted>.md) (government, not governance).
+- **Builds on:** [ADR 0175](0175-the-board-room-full-idea-ratification.md) (the Board Room, and §6 — who governs is configuration), [ADR 0157](0157-archon-is-rank-and-identity-only.md) (the `page.view.government` floor at metic), [ADR 0151](0151-governance-permissions-as-atom-ranks-as-roles.md) (permissions as the atom), [ADR 0016](0016-trust-boundary-server-enforced-permissions.md) (server-enforced, uncached, per request).
+- **Related:** [ADR 0174](0174-government-terminology-ranks-not-roles.md) (government, not governance).
 
 ## 1. Context — the room with no door
 

package/docs/adr/0267-unanimity-and-the-revise-and-re-sit-loop.md

@@ -3,7 +3,7 @@
 - **Status:** Accepted
 - **Date:** 2026-09-08
 - **Tasks:** [#1003733](https://cloudbongos.com/builders#/task/1003733) (goal [#1000111](https://cloudbongos.com/builders#/goal/1000111) — Government).
-- **Amends:** [ADR 0175](<redacted>.md) §3 (the pass-rule set) and [ADR 0191](<redacted>.md) §2 (the same set, and the clock argument in §4). Everything else in both stands — in particular 0191 §3, the author who may vote and may never decide alone, which this decision leans on rather than touches, and 0175 §8, Discord is outbound-only and never a ballot.
+- **Amends:** [ADR 0175](0175-the-board-room-full-idea-ratification.md) §3 (the pass-rule set) and [ADR 0191](0191-majority-and-the-author-who-may-not-decide-alone.md) §2 (the same set, and the clock argument in §4). Everything else in both stands — in particular 0191 §3, the author who may vote and may never decide alone, which this decision leans on rather than touches, and 0175 §8, Discord is outbound-only and never a ballot.
 
 ## 1. The decision
 

package/docs/adr/0268-the-constitution-comes-from-two-roots.md

@@ -2,8 +2,8 @@
 
 - **Status:** Accepted
 - **Date:** 2026-09-09
-- **Tasks:** [#1003739](https://cloudbongos.com/builders#/task/1003739) (goal [#1000111](https://cloudbongos.com/builders#/goal/1000111) — Government). Found while shipping [#1003733](https://cloudbongos.com/builders#/task/1003733) ([ADR 0267](<redacted>.md)).
-- **Builds on:** [ADR 0108](<redacted>.md) §1 (the two configurable roots), [ADR 0175](<redacted>.md) §7 (a passed amendment becomes the live constitution), [ADR 0083](<redacted>.md) (a module reaches core only through the doorway).
+- **Tasks:** [#1003739](https://cloudbongos.com/builders#/task/1003739) (goal [#1000111](https://cloudbongos.com/builders#/goal/1000111) — Government). Found while shipping [#1003733](https://cloudbongos.com/builders#/task/1003733) ([ADR 0267](0267-unanimity-and-the-revise-and-re-sit-loop.md)).
+- **Builds on:** [ADR 0108](0108-instance-composition-configurable-root.md) §1 (the two configurable roots), [ADR 0175](0175-the-board-room-full-idea-ratification.md) §7 (a passed amendment becomes the live constitution), [ADR 0083](0083-modular-architecture-strangler-build-plan.md) (a module reaches core only through the doorway).
 
 ## 1. What happened
 
@@ -15,7 +15,7 @@ day-one monarchy, with the passed amendment sitting in its own `history` array
 directly beneath the `board` block that contradicted it.
 
 Every Board Room sitting in those two weeks was decided under a rule the board
-had voted to replace. It also quietly un-shipped [ADR 0191](<redacted>.md)
+had voted to replace. It also quietly un-shipped [ADR 0191](0191-majority-and-the-author-who-may-not-decide-alone.md)
 (majority) and would have un-shipped ADR 0267 (unanimity) the same way: both
 shipped as code, and neither could reach anybody.
 

package/docs/adr/0269-the-cli-session-store-is-host-keyed-at-a-fixed-anchor.md

@@ -4,7 +4,7 @@
 - **Date:** 2026-09-09
 - **Task:** [task 1003741](https://cloudbongos.com/builders#/task/1003741) (BONGOS-V2, goal 1000090 — *Working area 4, Bongos Core distribution*)
 - **Deciders:** Claude, under the Archon's standing scope
-- **Related:** [ADR 0258](<redacted>.md) (the public CLI, which is where this bites) · [ADR 0108](<redacted>.md) (each instance its own checkout) · [ADR 0083](<redacted>.md) (why the store directory may not be called `sessions`)
+- **Related:** [ADR 0258](0258-the-public-cli-is-a-generated-client-package-not-the-published-core.md) (the public CLI, which is where this bites) · [ADR 0108](0108-instance-composition-configurable-root.md) (each instance its own checkout) · [ADR 0083](0083-modular-architecture-strangler-build-plan.md) (why the store directory may not be called `sessions`)
 
 ---
 

package/docs/adr/0270-rank-floor-derives-without-a-prediction.md

@@ -1,7 +1,7 @@
 # ADR 0270 — The rank floor derives from facts, not from a prediction
 
 **Date:** 2026-09-09
-**Context:** BONGOS-V2, goal [1000111](https://cloudbongos.com/builders#/task/1003663) (Working area 7 — Government), task [1003663](https://cloudbongos.com/builders#/task/1003663). Repairs an interaction between [ADR 0084](<redacted>.md) (the per-task `requires_rank` floor) and [ADR 0049](<redacted>.md) (the split parallel-safety contract, which retired predictive `touches[]`). Generalises the protected-scope floor task 1003066 (BV1.R05) shipped for the ideas vector.
+**Context:** BONGOS-V2, goal [1000111](https://cloudbongos.com/builders#/task/1003663) (Working area 7 — Government), task [1003663](https://cloudbongos.com/builders#/task/1003663). Repairs an interaction between [ADR 0084](0084-auto-derived-per-task-rank-floor.md) (the per-task `requires_rank` floor) and [ADR 0049](0049-split-parallel-safety-contract.md) (the split parallel-safety contract, which retired predictive `touches[]`). Generalises the protected-scope floor task 1003066 (BV1.R05) shipped for the ideas vector.
 **Status:** Accepted.
 
 ## Problem
@@ -54,6 +54,6 @@ Three properties travel with the decision:
 
 - **A protected goal wall is blunt, and that is accepted.** `scopeIncludesProtected` is true when *any* module in the wall is protected, so a purely `hall-ui` task inside goal 1000111 (`hall-ui` + `kernel` + `lifecycle` + `government`) also floors at `metic`. This is the same semantics the ideas vector has enforced since task 1003066, it fails in the safe direction, and `metic` is the first *trusted working* rank rather than a rare one. The cost is a smaller Xenos queue in mixed-scope goals. The remedy, when it bites, is to narrow the goal's wall — which is the honest fix anyway.
 - **The newcomer queue is unaffected today** — there are currently **zero** claimable `newcomer_friendly` tasks, in protected-scope goals or otherwise. Worth re-checking if the beginner queue is ever restocked inside a protected-scope goal; a `newcomer_friendly` carve-out was deliberately **not** added, because an exception that lowers a safety floor is exactly the kind of thing that should require a decision rather than exist by default.
-- **A one-time backfill**, `migrations/<redacted>.sql`, raises still-claimable (`backlog`/`ready`) `xenos` rows that meet either new condition. It is scoped to claimable work because the floor is a claim-time gate — rewriting shipped or abandoned rows would change no decision that has not already been made. It raises only, and there is no down-migration, for the reason ADR 0084 gave: lowering a safety floor is never automatic.
+- **A one-time backfill**, `migrations/core_236_rank_floor_backfill.sql`, raises still-claimable (`backlog`/`ready`) `xenos` rows that meet either new condition. It is scoped to claimable work because the floor is a claim-time gate — rewriting shipped or abandoned rows would change no decision that has not already been made. It raises only, and there is no down-migration, for the reason ADR 0084 gave: lowering a safety floor is never automatic.
 - **The protected-module list is spelled once in that migration**, as a point-in-time snapshot. A migration cannot call into JS, and a historical backfill should record the roster as it stood the day it ran. The live authority remains `module-scope-map.scopeIncludesProtected` over `PROTECTED_GLOBS`.
 - **`goal-create/SKILL.md` now tells authors to set `needs_migration: true`** on any task that will alter the live database. It is the input that floors such a task, and omitting it is how a schema change reaches the open queue.

package/docs/adr/0271-the-ideator-surface-is-two-halves.md

@@ -4,7 +4,7 @@
 - **Date:** 2026-09-09
 - **Tasks:** [#1003506](https://cloudbongos.com/builders#/task/1003506) (this record and the prose half). Promoted from idea 1000732 (owner, 2026-08-16).
 - **Goal:** [#1000095](https://cloudbongos.com/builders#/goal/1000095) — Working area 6 (Governor / Builder / Artist / Ideator experience), criterion `wa6-kernel-and-packs`.
-- **Builds on:** [ADR 0264](<redacted>.md) §1 (the area and its owner), [ADR 0016](<redacted>.md) (the trust boundary — why the permission prompt was never the gate), [ADR 0104](<redacted>.md) (the existing bypass posture on dev boxes).
+- **Builds on:** [ADR 0264](0264-the-ten-working-areas.md) §1 (the area and its owner), [ADR 0016](0016-trust-boundary-server-enforced-permissions.md) (the trust boundary — why the permission prompt was never the gate), [ADR 0104](0104-trust-gds-api-channel-in-auto-mode.md) (the existing bypass posture on dev boxes).
 - **Answers** the ideator half of the argument the `artist-mode` criterion answered for artists with the Studio (goal [#1000074](https://cloudbongos.com/builders#/goal/1000074)).
 
 ## 1. The decision
@@ -72,7 +72,7 @@ flag wins, for three reasons in increasing order of force:
 1. **The least technical role is the worst audience for removing confirmations.**
    Shipping bypass *to ideators specifically* concentrates the one change that
    removes review on the people least equipped to review.
-2. **The permission prompt was never the gate.** [ADR 0016](<redacted>.md)
+2. **The permission prompt was never the gate.** [ADR 0016](0016-trust-boundary-server-enforced-permissions.md)
    is load-bearing: authority is `builders.rank`, checked server-side per request
    with no caching. The client prompt is a speed bump, not a boundary. The
    protected-path globs and pre-push hook are what actually bound a sub-Metic
@@ -214,7 +214,7 @@ project's `.claude/settings.json` or `.claude/settings.local.json` *does not tak
 effect* — the session starts in Manual. There is no channel by which a project
 repo can ship a bypass default to be mitigated. And the "narrower blast radius"
 the CAUTION asked to pair it with **already exists**, server-side and
-independently of the prompt: rank checked per request ([ADR 0016](<redacted>.md)) plus the
+independently of the prompt: rank checked per request ([ADR 0016](0016-trust-boundary-server-enforced-permissions.md)) plus the
 sub-Metic protected-path globs. So there was no mitigation left to deliver and
 nothing to attach it to. Rejecting was the honest reading of the CAUTION, not a
 reversal of it.

package/docs/adr/0272-a-craft-is-an-identity-not-a-toolchain.md

@@ -1,7 +1,7 @@
 # ADR 0272 — A craft is an identity, not a toolchain: `artist` becomes core
 
 **Date:** 2026-09-09
-**Context:** BONGOS-V2, goal [1000111](https://cloudbongos.com/builders#/task/1003719) (Working area 7 — Government), task [1003719](https://cloudbongos.com/builders#/task/1003719), re-filed from task 1002908 under [ADR 0265](<redacted>.md). Supersedes the R59 (task 1198) decision that `artist` rides the `art-pipeline` module. Neighbour of [ADR 0098](<redacted>.md) (the publish manifest) and task 1003487 (module-contributed disciplines).
+**Context:** BONGOS-V2, goal [1000111](https://cloudbongos.com/builders#/task/1003719) (Working area 7 — Government), task [1003719](https://cloudbongos.com/builders#/task/1003719), re-filed from task 1002908 under [ADR 0265](0265-work-with-no-goal-and-the-order-the-cut-needs.md). Supersedes the R59 (task 1198) decision that `artist` rides the `art-pipeline` module. Neighbour of [ADR 0098](0098-public-mirror-publish-manifest.md) (the publish manifest) and task 1003487 (module-contributed disciplines).
 **Status:** Accepted.
 
 ## Problem
@@ -25,7 +25,7 @@ The API hands a builder a value and then refuses to accept it back. A builder co
 enabledDisciplines() → ["engineer","ideator","ui"]
 ```
 
-So `artist` was offered by **no instance in any configuration** — not a vanilla one, not a full checkout, not production. It is also unreachable by construction on a *published* core: [ADR 0098](<redacted>.md)'s manifest excludes `modules/art-pipeline/` outright for a hard copyright reason (it carries ripped reference maps), so no registry install could ever carry that manifest even if someone wrote one.
+So `artist` was offered by **no instance in any configuration** — not a vanilla one, not a full checkout, not production. It is also unreachable by construction on a *published* core: [ADR 0098](0098-public-mirror-publish-manifest.md)'s manifest excludes `modules/art-pipeline/` outright for a hard copyright reason (it carries ripped reference maps), so no registry install could ever carry that manifest even if someone wrote one.
 
 Meanwhile the craft stayed first-class in every other core surface:
 
@@ -52,7 +52,7 @@ The offered set is now a superset of what the DB CHECK accepts, which is the inv
 
 - **Enable `art-pipeline` on cloudbongos.com.** Impossible, not merely undesirable: the module is not in the published package, and `src/modules.js` throws at boot when a config enables an absent module. The owner's intent ("artist should exist here") could not have been delivered this way.
 - **Write the missing `modules/art-pipeline/module.json`.** It would work only in a full repo checkout and never on a published instance, re-creating the same invisible divergence one layer down.
-- **An instance-declared discipline list in `config/modules.json`.** More architecturally tidy on paper — which crafts an instance recognises is host context ([ADR 0062](<redacted>.md) §7) — but it puts the fix in the *instance* repo, leaving the core's own DB CHECK still describing a craft the core cannot offer. It also would not have fixed the vanilla case, where the craft is equally unofferable.
+- **An instance-declared discipline list in `config/modules.json`.** More architecturally tidy on paper — which crafts an instance recognises is host context ([ADR 0062](0062-medusa-instance-model-decoupling.md) §7) — but it puts the fix in the *instance* repo, leaving the core's own DB CHECK still describing a craft the core cannot offer. It also would not have fixed the vanilla case, where the craft is equally unofferable.
 - **Strip unofferable crafts from stored rows.** This deletes a builder's stated identity to make a validator's mistake look consistent. The owner was asked and chose that artists should exist here.
 
 ## Consequences
@@ -61,4 +61,4 @@ The offered set is now a superset of what the DB CHECK accepts, which is the inv
 - **Existing stored values round-trip again.** No migration or backfill: the rows were always valid per the CHECK: only the validator disagreed. Builders holding `artist` (the owner among them) can save their profile without losing it.
 - **The copyright exclusion is untouched.** `modules/art-pipeline/` stays out of the published core; nothing here moves art *tooling* anywhere.
 - **The R59 rationale is formally retired.** Its premise — that the craft exists to serve the game's pixel art — no longer holds: `modules/game/` is likewise excluded from the published core, while the craft remained wired into help requests, task classification and the DB.
-- **Not yet visible to users.** cloudbongos.com serves core 1.19.608; this reaches builders only when the instance pin moves (gate 3 of [ADR 0137](<redacted>.md)).
+- **Not yet visible to users.** cloudbongos.com serves core 1.19.608; this reaches builders only when the instance pin moves (gate 3 of [ADR 0137](0137-upstream-publish-policy-manual-owner-gated.md)).

package/docs/adr/0273-hall-nav-can-gate-on-a-permission.md

@@ -5,7 +5,7 @@
 - **Tasks:** [#1003744](https://cloudbongos.com/builders#/task/1003744) (this record and the work).
 - **Goal:** [#1000111](https://cloudbongos.com/builders#/goal/1000111) — Working area 7, Government; criterion `wa7-government`.
 - **Decided by:** the owner (Masterqua / `IAMMASTERQUA`, Archon, member of area 7), 2026-09-09 — the placement question in §3.
-- **Builds on:** [ADR 0266](<redacted>.md) (the carve that surfaced this gap), [ADR 0175](<redacted>.md) §6 (who governs is configuration), [ADR 0151](<redacted>.md) (permissions as the atom), [ADR 0157](<redacted>.md) (`page.view.government` floors at metic), [ADR 0016](<redacted>.md) (the server enforces; the client decorates).
+- **Builds on:** [ADR 0266](0266-the-board-room-is-its-own-surface-reachable-by-whoever-may-vote.md) (the carve that surfaced this gap), [ADR 0175](0175-the-board-room-full-idea-ratification.md) §6 (who governs is configuration), [ADR 0151](0151-governance-permissions-as-atom-ranks-as-roles.md) (permissions as the atom), [ADR 0157](0157-archon-is-rank-and-identity-only.md) (`page.view.government` floors at metic), [ADR 0016](0016-trust-boundary-server-enforced-permissions.md) (the server enforces; the client decorates).
 
 ## 1. Context — a sidebar that could only speak rank
 

package/docs/adr/0274-one-kernel-three-role-packs.md

@@ -1,7 +1,7 @@
 # ADR 0274 — One kernel, three role packs: the always-loaded instructions stop being an engineer's
 
 **Date:** 2026-09-10
-**Context:** BONGOS-V2, goal [1000095](https://cloudbongos.com/builders#/goal/1000095) (Working area 6 — Governor / Builder / Artist / Ideator experience), criterion `wa6-kernel-and-packs`, task [1002990](https://cloudbongos.com/builders#/task/1002990). Builds on [ADR 0061](<redacted>.md) (the CLAUDE.md context budget), [ADR 0062](<redacted>.md) §7 (the core ↔ host split), [ADR 0272](<redacted>.md) (a craft is an identity, not a toolchain) and [ADR 0271](<redacted>.md) (which predicted this move: *"when declaration lands the contract MOVES into the Ideator pack"*). Its dependency, task 1002989, widened the module map to cover the methodology surfaces so this work had a wall to stand in.
+**Context:** BONGOS-V2, goal [1000095](https://cloudbongos.com/builders#/goal/1000095) (Working area 6 — Governor / Builder / Artist / Ideator experience), criterion `wa6-kernel-and-packs`, task [1002990](https://cloudbongos.com/builders#/task/1002990). Builds on [ADR 0061](<redacted>.md) (the CLAUDE.md context budget), [ADR 0062](0062-medusa-instance-model-decoupling.md) §7 (the core ↔ host split), [ADR 0272](0272-a-craft-is-an-identity-not-a-toolchain.md) (a craft is an identity, not a toolchain) and [ADR 0271](0271-the-ideator-surface-is-two-halves.md) (which predicted this move: *"when declaration lands the contract MOVES into the Ideator pack"*). Its dependency, task 1002989, widened the module map to cover the methodology surfaces so this work had a wall to stand in.
 **Status:** Accepted.
 
 ## Problem

package/docs/adr/0275-one-source-for-a-written-role-responsibility.md

@@ -1,7 +1,7 @@
 # ADR 0275 — A role's written responsibility has one source, and the pack's copy is generated
 
 **Date:** 2026-09-10
-**Context:** BONGOS-V2, goal [1000095](https://cloudbongos.com/builders#/goal/1000095) (Working area 6), criterion `wa6-written-responsibilities`, task [1003732](https://cloudbongos.com/builders#/task/1003732). Depends on [ADR 0274](<redacted>.md) (the kernel/pack split, which reserved the seam this fills) and [ADR 0272](<redacted>.md) (`CORE_DISCIPLINES`). The three sentences were fixed by the area owner on 2026-09-08.
+**Context:** BONGOS-V2, goal [1000095](https://cloudbongos.com/builders#/goal/1000095) (Working area 6), criterion `wa6-written-responsibilities`, task [1003732](https://cloudbongos.com/builders#/task/1003732). Depends on [ADR 0274](0274-one-kernel-three-role-packs.md) (the kernel/pack split, which reserved the seam this fills) and [ADR 0272](0272-a-craft-is-an-identity-not-a-toolchain.md) (`CORE_DISCIPLINES`). The three sentences were fixed by the area owner on 2026-09-08.
 **Status:** Accepted.
 
 ## Problem

package/docs/adr/0276-the-skill-listing-budget-cannot-hold-every-trigger.md

@@ -2,7 +2,7 @@
 
 **Status:** Accepted (the ratchet). The budget question itself is **open and owner-gated** — [blocker #1000139](https://cloudbongos.com/builders#/blocker/1000139), see §5.
 **Task:** [#1003620](https://cloudbongos.com/builders#/task/1003620) · goal 1000095 — *Working area 6*, criterion `wa6-role-experience`
-**Builds on:** [ADR 0274](<redacted>.md) (which measured the listing at 27,022 chars against a ~8,000 budget and sequenced this task behind it), tasks 1003548 and 1003587 (the two earlier trims)
+**Builds on:** [ADR 0274](0274-one-kernel-three-role-packs.md) (which measured the listing at 27,022 chars against a ~8,000 budget and sequenced this task behind it), tasks 1003548 and 1003587 (the two earlier trims)
 
 ## 1. The problem, and why trimming keeps not solving it
 

package/docs/adr/0277-a-box-is-in-use-only-while-a-human-is-attached.md

@@ -3,7 +3,7 @@
 - **Status:** accepted
 - **Date:** 2026-09-10
 - **Task:** [1003507](https://cloudbongos.com/builders#/task/1003507) (goal 1000095 — *Working area 6*, criterion `wa6-role-experience`)
-- **Supersedes the "never touch a box with a claude process" rule** in [ADR 0031](<redacted>.md) §5(a); the park/preserve guarantee of tasks 1002726/1002727 is unchanged and is what makes this safe.
+- **Supersedes the "never touch a box with a claude process" rule** in [ADR 0031](0031-cloud-dev-environments-for-builders.md) §5(a); the park/preserve guarantee of tasks 1002726/1002727 is unchanged and is what makes this safe.
 
 ## Context
 

package/docs/adr/0278-a-gated-project-still-takes-applications.md

@@ -4,8 +4,8 @@
 - **Date:** 2026-09-11
 - **Tasks:** [task 1003525](https://cloudbongos.com/builders#/task/1003525) (this decision + the applicant's poll), with the apply write itself in [task 1003624](https://cloudbongos.com/builders#/task/1003624).
 - **Goal:** [#1000106](https://cloudbongos.com/builders#/goal/1000106) — Working area 1, Project creation.
-- **Decider:** the owner, 2026-09-11. The question was raised as an owner decision by task 1003525's own body and by [ADR 0192](<redacted>.md) §3, and is answered here rather than by whoever held the task.
-- **Extends, does not amend:** [ADR 0192](<redacted>.md) (the member door and its exempt list), [ADR 0194](<redacted>.md) (the join door), [ADR 0209](<redacted>.md) (one budget across the two account-existence reads; the response-collapse question, still open).
+- **Decider:** the owner, 2026-09-11. The question was raised as an owner decision by task 1003525's own body and by [ADR 0192](0192-platform-visibility-member-door.md) §3, and is answered here rather than by whoever held the task.
+- **Extends, does not amend:** [ADR 0192](0192-platform-visibility-member-door.md) (the member door and its exempt list), [ADR 0194](0194-joinability-one-door-decision.md) (the join door), [ADR 0209](0209-one-budget-for-the-account-existence-oracle.md) (one budget across the two account-existence reads; the response-collapse question, still open).
 
 ## Context
 

package/docs/adr/0279-an-upgrade-is-proven-by-the-served-version-not-the-health-check.md

@@ -3,7 +3,7 @@
 - **Status:** accepted
 - **Date:** 2026-09-11
 - **Task:** [task 1002884](https://cloudbongos.com/builders#/task/1002884) (BONGOS-V2, goal 1000090 — *Working area 4, Bongos Core distribution*), from idea 1000682
-- **Extends** the mandatory post-restart health check of task 1002222 (audit H9, finding F5) and the auto-rollback of task 2149, whose unattended policy is [ADR 0136](<redacted>.md) §3. The health check stays; this says why it was never sufficient on its own.
+- **Extends** the mandatory post-restart health check of task 1002222 (audit H9, finding F5) and the auto-rollback of task 2149, whose unattended policy is [ADR 0136](0136-update-channel-subscription-policy.md) §3. The health check stays; this says why it was never sufficient on its own.
 
 ## Context
 

package/docs/adr/0280-the-unattended-lane-may-drive-a-co-tenant-because-the-roster-is-the-decision.md

@@ -3,7 +3,7 @@
 - **Status:** accepted
 - **Date:** 2026-09-12
 - **Task:** [1003843](https://cloudbongos.com/builders#/task/1003843) (goal 1000106) — from [task 1003521](https://cloudbongos.com/builders#/task/1003521), which built co-tenant mode into `go-live.js` and deliberately left this caller alone.
-- **Adjacent:** [ADR 0279](<redacted>.md) (why this lane prefers `go-live.js` at all) · [ADR 0136](<redacted>.md) (the subscription policy core).
+- **Adjacent:** [ADR 0279](0279-an-upgrade-is-proven-by-the-served-version-not-the-health-check.md) (why this lane prefers `go-live.js` at all) · [ADR 0136](0136-update-channel-subscription-policy.md) (the subscription policy core).
 
 ## Context
 

package/docs/adr/0281-an-instance-identity-is-its-own-unix-account-and-pg-role.md

@@ -4,11 +4,11 @@
 
 ## Context
 
-[ADR 0111](<redacted>.md) made instance standup automatic and [ADR 0128](<redacted>.md) settled how the *runner* escalates to perform it. Neither settled who the *instance* is once it is running, and the answer was: everybody is the same person.
+[ADR 0111](0111-instance-hosting-provisioning-module.md) made instance standup automatic and [ADR 0128](0128-provisioning-runner-privilege-and-db-auth-model.md) settled how the *runner* escalates to perform it. Neither settled who the *instance* is once it is running, and the answer was: everybody is the same person.
 
 `serviceUnit` hardcoded `User=lars` / `Group=lars`, and **co-tenant is the default shape** — so on a shared box every instance's Node process ran under one uid. Two consequences, both reachable by any code an instance runs, neither of them a bug in any route:
 
-- **Sibling environments.** A unix user may read `/proc/<pid>/environ` of its own processes. Every instance's `EnvironmentFile` carries `GITHUB_APP_PRIVATE_KEY`, `<PREFIX>_HUB_CLIENT_SECRET` and its OAuth client secret ([ADR 0141](<redacted>.md) §4, [ADR 0133](<redacted>.md)). One uid meant every instance could read every sibling's.
+- **Sibling environments.** A unix user may read `/proc/<pid>/environ` of its own processes. Every instance's `EnvironmentFile` carries `GITHUB_APP_PRIVATE_KEY`, `<PREFIX>_HUB_CLIENT_SECRET` and its OAuth client secret ([ADR 0141](<redacted>.md) §4, [ADR 0133](0133-github-app-manifest-onboarding-signin.md)). One uid meant every instance could read every sibling's.
 - **Sibling databases.** `src/bongos/pool.js` connected by **passwordless peer auth** over the local socket, with `PGDATABASE` supplied as a systemd `Environment=` default. Peer auth answers "which unix user are you", so any code running as `lars` could open a pool against **any** database on the box by naming it — including the control plane's own `builders` and `builder_sessions`.
 
 The per-instance `web.env` (`chmod 600`) and the per-instance database were already correct. They were sound walls with one door, and every instance had the key.