@bongos/core 1.19.714 → 1.19.724

package/docs/copy-inventory.md

@@ -4,13 +4,13 @@
 > Deterministic on a given tree — regenerate and commit rather than hand-editing.
 > Machine-readable twin: [`copy-registry.json`](copy-registry.json).
 
-**1749 strings** across 3 surfaces · 1513 distinct pieces of copy · 1749 certain, 0 heuristic · 164 shown in more than one place.
+**1751 strings** across 3 surfaces · 1515 distinct pieces of copy · 1751 certain, 0 heuristic · 164 shown in more than one place.
 
 ## Surfaces
 
 | surface | lives at | files | strings |
 |---|---|---|---|
-| `builders-hall` | `modules/hall-ui/public` | 80 | 1270 |
+| `builders-hall` | `modules/hall-ui/public` | 80 | 1272 |
 | `status-dashboard` | `modules/status-ui/public` | 4 | 100 |
 | `landing` | `modules/public-landing/public` | 5 | 379 |
 
@@ -78,7 +78,7 @@ Identical copy within one surface. Sometimes right (a repeated button), sometime
 | `a072071b893c` | 2x | All time | modules/status-ui/public/index.html:286, modules/status-ui/public/index.html:313 |
 | … | | _124 more in the JSON registry_ | |
 
-## `builders-hall` — 1270 strings
+## `builders-hall` — 1272 strings
 
 | id | conf | text | where |
 |---|---|---|---|
@@ -285,8 +285,8 @@ Identical copy within one surface. Sometimes right (a repeated button), sometime
 | `7bcaeffb742f` | certain | Could not approve: {…} | `modules/hall-ui/public/gate.js:108` |
 | `c922293e668c` | certain | Could not assign: {…} | `modules/hall-ui/public/government.js:468` |
 | `94763c4d5a94` | certain | Could not block: {…} | `modules/hall-ui/public/harbor.js:167` |
-| `e1fc7cedf4e7` | certain | Could not change rank: {…} | `modules/hall-ui/public/watch.js:819` |
-| `b9e53fbd90e6` | certain | Could not change standing: {…} | `modules/hall-ui/public/watch.js:845` |
+| `e1fc7cedf4e7` | certain | Could not change rank: {…} | `modules/hall-ui/public/watch.js:860` |
+| `b9e53fbd90e6` | certain | Could not change standing: {…} | `modules/hall-ui/public/watch.js:886` |
 | `1ef1efc15b6c` | certain | Could not change that just now. | `modules/hall-ui/public/goals-render.js:1235` |
 | `78e18ea59b9f` | certain | Could not close: {…} | `modules/hall-ui/public/harbor.js:136` |
 | `c3f99e7c6e6b` | certain | Could not copy automatically — select and copy manually. ({…}) | `modules/hall-ui/public/settings.js:1017` |
@@ -310,7 +310,7 @@ Identical copy within one surface. Sometimes right (a repeated button), sometime
 | `8b69e445592a` | certain | Could not load the question labels; showing the answers as stored. | `modules/hall-ui/public/idea.js:244` |
 | `edd5bafbe075` | certain | Could not load the queue just now. | `modules/hall-ui/public/ideas.js:565` |
 | `02bb0570996a` | certain | Could not load the ranks. | `modules/hall-ui/public/ranks.js:197` |
-| `2878778cf9f3` | certain | Could not load this page. | `modules/hall-ui/public/watch.js:1311` |
+| `2878778cf9f3` | certain | Could not load this page. | `modules/hall-ui/public/watch.js:1357` |
 | `4b0c8d94541c` | certain | Could not load your account. Reload the page to try again. | `modules/hall-ui/public/settings.js:1396` |
 | `2a9fb4046bc4` | certain | Could not load your rank. Return to the hall and try again. | `modules/hall-ui/public/ranks.js:196` |
 | `9d533e811dec` | certain | Could not load your sessions: {…} | `modules/hall-ui/public/settings-sessions.js:114` |
@@ -348,7 +348,7 @@ Identical copy within one surface. Sometimes right (a repeated button), sometime
 | `d4601887a058` | certain | Could not sign out everywhere: {…} | `modules/hall-ui/public/settings-sessions.js:102` |
 | `b1602d01f4bb` | certain | Could not unblock: {…} | `modules/hall-ui/public/harbor.js:187` |
 | `3db890b074a7` | certain | Could not update visibility just now. | `modules/hall-ui/public/goals-render.js:1219` |
-| `112d12b24879` | certain | Could not verify your access. Go back and try again. | `modules/hall-ui/public/watch.js:1310` |
+| `112d12b24879` | certain | Could not verify your access. Go back and try again. | `modules/hall-ui/public/watch.js:1356` |
 | `6bd74fd20311` | certain | Could not verify your access. Try again. | `modules/hall-ui/public/sessions.js:280` |
 | `278e8281c82f` | certain | Could not vote: {…} | `modules/hall-ui/public/board-room.js:304` |
 | `a48e9f098392` | certain | Could not {…} just now. | `modules/hall-ui/public/goals-render.js:1205` |
@@ -691,7 +691,7 @@ Identical copy within one surface. Sometimes right (a repeated button), sometime
 | `d9c802f5d85e` | certain | Opening the studio… | `modules/hall-ui/public/studio.html:45` |
 | `569980a263ae` | certain | Optional. This is the ledger link — a copy change ships as a task like every other change. | `modules/hall-ui/public/copy-desk.html:130` |
 | `c78d7388ffd7` | certain | Or just stay in the online terminal | `modules/hall-ui/public/hall-render.js:779` |
-| `d89d1923ecf9` | certain | Over the last {…} days | `modules/hall-ui/public/watch.js:1153` |
+| `d89d1923ecf9` | certain | Over the last {…} days | `modules/hall-ui/public/watch.js:1194` |
 | `695ffff13730` | certain | Over time | `modules/hall-ui/public/profile.html:72` |
 | `5ded44da0cc5` | certain | Override requests | `modules/hall-ui/public/watch.html:143` |
 | `15a49bf15007` | certain | Page {…} of {…} | `modules/hall-ui/public/hall-kit.js:112` |
@@ -737,7 +737,7 @@ Identical copy within one surface. Sometimes right (a repeated button), sometime
 | `3f85bdc47099` | certain | Protected module scope — join by request; an Archon admits members | `modules/hall-ui/public/goals-render.js:848` |
 | `e5c292c8b361` | certain | Provides (seams) | `modules/hall-ui/public/atlas.js:288` |
 | `4de232a05888` | certain | Raise after | `modules/hall-ui/public/project-settings.js:113` |
-| `b9c6def6b120` | certain | Rank set to {…}. | `modules/hall-ui/public/watch.js:813` |
+| `b9c6def6b120` | certain | Rank set to {…}. | `modules/hall-ui/public/watch.js:854` |
 | `ff50a1395cbc` | certain | Rank: {…} | `modules/hall-ui/public/profile.js:50` |
 | `6824ec470f99` | certain | Ranks — {{worldName}} | `modules/hall-ui/public/ranks.html:6` |
 | `6824ec470f99` | certain | Ranks — {{worldName}} | `modules/hall-ui/public/ranks.html:6` |
@@ -745,7 +745,7 @@ Identical copy within one surface. Sometimes right (a repeated button), sometime
 | `101a51902f53` | certain | Re-issue failed: {…} | `modules/hall-ui/public/settings.js:1021` |
 | `fae2f90927bd` | certain | Read an idea, then decide. An objection needs a reason and the section it faults. | `modules/hall-ui/public/board-room.html:51` |
 | `b03e17693dcd` | certain | Read it as a table | `modules/hall-ui/public/drachmae.js:148` |
-| `b03e17693dcd` | certain | Read it as a table | `modules/hall-ui/public/watch.js:1126` |
+| `b03e17693dcd` | certain | Read it as a table | `modules/hall-ui/public/watch.js:1167` |
 | `b6fcfdd652a7` | certain | Read it here | `modules/hall-ui/public/work.html:45` |
 | `c5f19a888a15` | certain | Read the handoff notes | `modules/hall-ui/public/task.js:441` |
 | `f9e998f4af3d` | certain | Read to the end and the button below unlocks. It is an honour system — nothing here checks your comprehension. | `modules/hall-ui/public/primer.html:100` |
@@ -798,7 +798,7 @@ Identical copy within one surface. Sometimes right (a repeated button), sometime
 | `0887725744f2` | certain | Restricted. | `modules/hall-ui/public/gate.js:219` |
 | `0887725744f2` | certain | Restricted. | `modules/hall-ui/public/government.js:879` |
 | `0887725744f2` | certain | Restricted. | `modules/hall-ui/public/harbor.js:337` |
-| `0887725744f2` | certain | Restricted. | `modules/hall-ui/public/watch.js:1265` |
+| `0887725744f2` | certain | Restricted. | `modules/hall-ui/public/watch.js:1306` |
 | `b33dde402434` | certain | Retire this goal — you will be asked what happens to any unfinished work | `modules/hall-ui/public/goals-render.js:927` |
 | `feb48b0d462c` | certain | Return to the Dev Box app and click “Connect” again for a fresh code. | `modules/hall-ui/public/pair.js:32` |
 | `908a0d5d0685` | certain | Review how it judged this work, and teach it what good looked like. | `modules/hall-ui/public/studio.js:181` |
@@ -884,7 +884,7 @@ Identical copy within one surface. Sometimes right (a repeated button), sometime
 | `f79e1fb8ebd4` | certain | Suggested as you type; leave it on "no goal" and it waits for triage. | `modules/hall-ui/public/ideas.html:88` |
 | `1e40f33483eb` | certain | Switch theme | `modules/hall-ui/public/shell.js:461` |
 | `93fa2e97dd35` | certain | System default for this skill | `modules/hall-ui/public/settings.js:74` |
-| `4894b1d9b0de` | certain | System oversight: people, operations and security. | `modules/hall-ui/public/watch.js:1324` |
+| `4894b1d9b0de` | certain | System oversight: people, operations and security. | `modules/hall-ui/public/watch.js:1370` |
 | `dfc967a63d57` | certain | Task lifecycle from backlog to shipped, showing states and transitions and the edge where credits are awarded. | `modules/hall-ui/public/diagrams.html:51` |
 | `10cc12f37636` | certain | Task sections | `modules/hall-ui/public/work.html:53` |
 | `0e636ea41b29` | certain | Task status | `modules/hall-ui/public/goals-render.js:340` |
@@ -905,6 +905,7 @@ Identical copy within one surface. Sometimes right (a repeated button), sometime
 | `282c3fa2d456` | certain | That is the wording it already has. Change something, or file a flag instead if you only want to mark it. | `modules/hall-ui/public/copy-desk.js:438` |
 | `c0e28f30524d` | certain | That project's own standing, as reported by that project. | `modules/hall-ui/public/profile.js:314` |
 | `e99d4a811e92` | certain | That request is no longer available. | `modules/hall-ui/public/profile-connections.js:270` |
+| `6e5a324b2972` | certain | That's you | `modules/hall-ui/public/watch.js:803` |
 | `50198c465225` | certain | The 16-value rank enum in three bands, which ranks are live, and the permissions each rank holds. | `modules/hall-ui/public/diagrams.html:59` |
 | `c5e6bdd32fe3` | certain | The Board Room is open to the builders this project’s constitution seats on its board. | `modules/hall-ui/public/board-room.js:436` |
 | `1569b8838862` | certain | The Dev Box app now acts as | `modules/hall-ui/public/pair.js:40` |
@@ -1087,6 +1088,7 @@ Identical copy within one surface. Sometimes right (a repeated button), sometime
 | `6dadadffa36e` | certain | Your name cannot be blank. | `modules/hall-ui/public/settings.js:832` |
 | `bd77210a8c90` | certain | Your name must be {…} characters or fewer. | `modules/hall-ui/public/settings.js:837` |
 | `c0a01a95e97e` | certain | Your own idea. You may vote, but it can’t be decided by your vote alone, and a vote on your own idea earns no  | `modules/hall-ui/public/board-room.js:274` |
+| `5e0ec4cd1cfe` | certain | Your own row carries no controls. Nobody can change their own rank or standing — that guard is what stops the  | `modules/hall-ui/public/watch.js:835` |
 | `8fc605026acf` | certain | Your pending join {…}: {…} — awaiting approval. | `modules/hall-ui/public/goal-inbox.js:88` |
 | `e91418db3962` | certain | Your preferences, {…}. | `modules/hall-ui/public/settings.js:856` |
 | `e91418db3962` | certain | Your preferences, {…}. | `modules/hall-ui/public/settings.js:1413` |
@@ -1231,7 +1233,7 @@ Identical copy within one surface. Sometimes right (a repeated button), sometime
 | `4d8ee7d68974` | certain | task {…} | `modules/hall-ui/public/hall-render.js:623` |
 | `4d8ee7d68974` | certain | task {…} | `modules/hall-ui/public/idea.js:207` |
 | `4d8ee7d68974` | certain | task {…} | `modules/hall-ui/public/ideas.js:476` |
-| `4d8ee7d68974` | certain | task {…} | `modules/hall-ui/public/watch.js:1236` |
+| `4d8ee7d68974` | certain | task {…} | `modules/hall-ui/public/watch.js:1277` |
 | `a41659dc2bee` | certain | tasks remaining | `modules/hall-ui/public/roadmap.js:305` |
 | `bd3402efa59e` | certain | task{…} shipped | `modules/hall-ui/public/goals-render.js:793` |
 | `95854f8315ca` | certain | the page everyone else reads | `modules/hall-ui/public/profile.html:32` |

package/docs/copy-registry.json

@@ -3,9 +3,9 @@
   "generator": "scripts/gds/copy-inventory.js",
   "goal": 1000074,
   "counts": {
-    "strings": 1749,
-    "unique_ids": 1513,
-    "certain": 1749,
+    "strings": 1751,
+    "unique_ids": 1515,
+    "certain": 1751,
     "heuristic": 0,
     "duplicate_ids": 164
   },
@@ -13,7 +13,7 @@
     "builders-hall": {
       "at": "modules/hall-ui/public",
       "files": 80,
-      "strings": 1270
+      "strings": 1272
     },
     "status-dashboard": {
       "at": "modules/status-ui/public",
@@ -147,7 +147,7 @@
         "modules/hall-ui/public/gate.js:219",
         "modules/hall-ui/public/government.js:879",
         "modules/hall-ui/public/harbor.js:337",
-        "modules/hall-ui/public/watch.js:1265"
+        "modules/hall-ui/public/watch.js:1306"
       ]
     },
     {
@@ -173,7 +173,7 @@
         "modules/hall-ui/public/hall-render.js:623",
         "modules/hall-ui/public/idea.js:207",
         "modules/hall-ui/public/ideas.js:476",
-        "modules/hall-ui/public/watch.js:1236"
+        "modules/hall-ui/public/watch.js:1277"
       ]
     },
     {
@@ -1167,7 +1167,7 @@
       "occurrences": 2,
       "at": [
         "modules/hall-ui/public/drachmae.js:148",
-        "modules/hall-ui/public/watch.js:1126"
+        "modules/hall-ui/public/watch.js:1167"
       ]
     },
     {
@@ -3584,7 +3584,7 @@
       "surface": "builders-hall",
       "text": "Could not change rank: {…}",
       "file": "modules/hall-ui/public/watch.js",
-      "line": 819,
+      "line": 860,
       "origin": "js-notice",
       "confidence": "certain"
     },
@@ -3593,7 +3593,7 @@
       "surface": "builders-hall",
       "text": "Could not change standing: {…}",
       "file": "modules/hall-ui/public/watch.js",
-      "line": 845,
+      "line": 886,
       "origin": "js-notice",
       "confidence": "certain"
     },
@@ -3809,7 +3809,7 @@
       "surface": "builders-hall",
       "text": "Could not load this page.",
       "file": "modules/hall-ui/public/watch.js",
-      "line": 1311,
+      "line": 1357,
       "origin": "js-notice",
       "confidence": "certain"
     },
@@ -4151,7 +4151,7 @@
       "surface": "builders-hall",
       "text": "Could not verify your access. Go back and try again.",
       "file": "modules/hall-ui/public/watch.js",
-      "line": 1310,
+      "line": 1356,
       "origin": "js-text-assign",
       "confidence": "certain"
     },
@@ -7238,7 +7238,7 @@
       "surface": "builders-hall",
       "text": "Over the last {…} days",
       "file": "modules/hall-ui/public/watch.js",
-      "line": 1153,
+      "line": 1194,
       "origin": "js-markup",
       "confidence": "certain"
     },
@@ -7652,7 +7652,7 @@
       "surface": "builders-hall",
       "text": "Rank set to {…}.",
       "file": "modules/hall-ui/public/watch.js",
-      "line": 813,
+      "line": 854,
       "origin": "js-notice",
       "confidence": "certain"
     },
@@ -7724,7 +7724,7 @@
       "surface": "builders-hall",
       "text": "Read it as a table",
       "file": "modules/hall-ui/public/watch.js",
-      "line": 1126,
+      "line": 1167,
       "origin": "js-markup",
       "confidence": "certain"
     },
@@ -8201,7 +8201,7 @@
       "surface": "builders-hall",
       "text": "Restricted.",
       "file": "modules/hall-ui/public/watch.js",
-      "line": 1265,
+      "line": 1306,
       "origin": "js-text-assign",
       "confidence": "certain"
     },
@@ -8975,7 +8975,7 @@
       "surface": "builders-hall",
       "text": "System oversight: people, operations and security.",
       "file": "modules/hall-ui/public/watch.js",
-      "line": 1324,
+      "line": 1370,
       "origin": "js-text-assign",
       "confidence": "certain"
     },
@@ -9159,6 +9159,15 @@
       "origin": "js-notice",
       "confidence": "certain"
     },
+    {
+      "id": "6e5a324b2972",
+      "surface": "builders-hall",
+      "text": "That's you",
+      "file": "modules/hall-ui/public/watch.js",
+      "line": 803,
+      "origin": "js-markup",
+      "confidence": "certain"
+    },
     {
       "id": "50198c465225",
       "surface": "builders-hall",
@@ -10797,6 +10806,15 @@
       "origin": "js-markup",
       "confidence": "certain"
     },
+    {
+      "id": "5e0ec4cd1cfe",
+      "surface": "builders-hall",
+      "text": "Your own row carries no controls. Nobody can change their own rank or standing — that guard is what stops the last {…} locking everyone out — so another {…} does it.",
+      "file": "modules/hall-ui/public/watch.js",
+      "line": 835,
+      "origin": "js-text-assign",
+      "confidence": "certain"
+    },
     {
       "id": "8fc605026acf",
       "surface": "builders-hall",
@@ -12098,7 +12116,7 @@
       "surface": "builders-hall",
       "text": "task {…}",
       "file": "modules/hall-ui/public/watch.js",
-      "line": 1236,
+      "line": 1277,
       "origin": "js-markup",
       "confidence": "certain"
     },

package/docs/design/hall-direction-v2.md

@@ -1,7 +1,7 @@
 # The builders' hall, direction v2: five archetypes of the chrome world (task 1003302)
 
 **Date:** 2026-08-30 · **Goal:** 1000081 (Builders' hall in the world) · **Criterion:** `hall-archetypes-approved` ·
-**World:** the chrome world, recorded in `DESIGN.md` at the repo root by task 1003298 ([ADR 0196](adr/<redacted>.md), [ADR 0204](adr/<redacted>.md)).
+**World:** the chrome world, recorded in `DESIGN.md` at the repo root by task 1003298 ([ADR 0196](adr/0196-chrome-world-token-contract-and-the-landing-sheets.md), [ADR 0204](adr/0204-the-apex-is-dark-only.md)).
 
 This document records the hall's composition round: five archetype pages, three versions each, built as real
 HTML against the world the apex already lives in. It is the round that answers *how the hall should look*.
@@ -177,7 +177,7 @@ does differently, and its honest risk.
 4. **Two regions on the task page do not exist today.** This round's brief asked for a grade panel and a session
    log; grades live on Standing and session logs on `/sessions`. The task mocks show both marked `proposed`, with
    a dashed edge and a mono eyebrow. Say whether the build adds them or leaves them where they are.
-5. **The light mode.** The apex went dark only ([ADR 0204](adr/<redacted>.md)), so the hall is now
+5. **The light mode.** The apex went dark only ([ADR 0204](adr/0204-the-apex-is-dark-only.md)), so the hall is now
    the only surface with a real light mode. Confirm it stays, since it doubles the build's contrast work.
 
 **If no pick lands, the build takes v2 "the sheet" for all five archetypes**, as the version that reads the
@@ -291,5 +291,5 @@ for a signed-out stranger and need honest signed-out states (`hall_page_gate_map
 *Round run under task 1003302, goal 1000081. Mocks: `docs/design/mocks/hall/<archetype>/v{1,2,3}.html`. Contact
 sheet: `docs/design/mocks/hall/hall-sheet.html`. Token tier: `docs/design/mocks/hall/_tokens.css`. World:
 `DESIGN.md`. IA, untouched: `docs/design/vanilla-hall-ui-redesign-scope.md` and `tests/hall_nav.mjs`. Prior rounds:
-`docs/design/apex-pass-2-direction.md` (the world pick) and `docs/design/<redacted>.md` (the
+`docs/design/apex-pass-2-direction.md` (the world pick) and `docs/design/landing-page-direction-v2.md` (the
 landing's composition pick).*

package/docs/design/landing-page-direction-v2.md

@@ -60,7 +60,7 @@ What the pick settles: the settled constraint (dark-first with a real, tested li
 
 **2026-08-28, the second note (task 1003334).** Seeing the before/after of task 1003333, the owner found the chrome bongo pair sitting on the top-right sweeping form did not fit ("the random bongos on the blobs background"). Offered three treatments (remove it from the hero; keep it off the blob on plain black or paper; phones only), the owner picked **remove it from the hero**. The pair is no longer a hero object: `.mark`, its arrival and its tokens leave; it stays as the closing figure, the second project orb and the bar's mark. The sweeping form stays as a bare backdrop. Under 900 the masthead is the big blob alone, with the words keeping the 56vw the pair used to hold above them.
 
-**2026-08-28, the third note — dark only (task 1003336, [ADR 0204](../adr/<redacted>.md)).** Reviewing the planets (task 1003319) with both grounds in front of them, the owner took option 4 of §5 after all, widened to the whole apex: "only black or only white is a bit bland, frankly I am leaning towards only dark mode for this page and keep the dark/light mode to be solely for the builder hall … we could invest into a cool space themed backdrop for the blobs." Built: `data-mode="dark"` fixed on `<html>` of every apex page, the pre-paint script and the persisted `cb-color-mode` gone, the moon/sun glyph and its wiring out of both bars, the kit rendering dark only. What the 2026-08-27 pick settled about light — the cutouts on paper under a contact shadow, the toggle staying on the landing — no longer describes the apex; the cutouts remain the closing figure and the planets' masks. The light tier of `world.css` stays until its own removal. The space backdrop is the next task (1003337).
+**2026-08-28, the third note — dark only (task 1003336, [ADR 0204](../adr/0204-the-apex-is-dark-only.md)).** Reviewing the planets (task 1003319) with both grounds in front of them, the owner took option 4 of §5 after all, widened to the whole apex: "only black or only white is a bit bland, frankly I am leaning towards only dark mode for this page and keep the dark/light mode to be solely for the builder hall … we could invest into a cool space themed backdrop for the blobs." Built: `data-mode="dark"` fixed on `<html>` of every apex page, the pre-paint script and the persisted `cb-color-mode` gone, the moon/sun glyph and its wiring out of both bars, the kit rendering dark only. What the 2026-08-27 pick settled about light — the cutouts on paper under a contact shadow, the toggle staying on the landing — no longer describes the apex; the cutouts remain the closing figure and the planets' masks. The light tier of `world.css` stays until its own removal. The space backdrop is the next task (1003337).
 
 ## 7. Shot list: real imagery still owed
 

package/docs/design/projects-hub-direction-v2.md

@@ -173,7 +173,7 @@ Three mastheads, rendered dark and light at 1440 / 390 / 320 (ALL CLEAN) and mea
 
 ## 12. Dark only (task 1003336)
 
-**Date:** 2026-08-28 (decided), 2026-08-29 (built) · the owner's call on the planets review (§11): the apex renders dark only and the light/dark switch is the builders' hall's alone — [ADR 0204](../adr/<redacted>.md). On `/projects`: `data-mode="dark"` is fixed on `<html>`, the pre-paint script is gone, the `#modeToggle` glyph and its `resolvedMode` / `paintModeToggle` wiring leave the bar (Projects, then the chip), the `.modeBtn` rules and the icon-swap twins leave `cosmos.css`, the mode-toggle probe leaves `projects.probes.json`, and `projects.states.json` declares `"modes": ["dark"]` so the kit renders the hub's twelve states at three widths in one mode (48 shots, ALL CLEAN; probes 31/31). The light tier of `cosmos.css` stays until its own removal. Why first: the space backdrop for the field (task 1003337) is a black-ground plate; one mode is what lets the field commit to it.
+**Date:** 2026-08-28 (decided), 2026-08-29 (built) · the owner's call on the planets review (§11): the apex renders dark only and the light/dark switch is the builders' hall's alone — [ADR 0204](../adr/0204-the-apex-is-dark-only.md). On `/projects`: `data-mode="dark"` is fixed on `<html>`, the pre-paint script is gone, the `#modeToggle` glyph and its `resolvedMode` / `paintModeToggle` wiring leave the bar (Projects, then the chip), the `.modeBtn` rules and the icon-swap twins leave `cosmos.css`, the mode-toggle probe leaves `projects.probes.json`, and `projects.states.json` declares `"modes": ["dark"]` so the kit renders the hub's twelve states at three widths in one mode (48 shots, ALL CLEAN; probes 31/31). The light tier of `cosmos.css` stays until its own removal. Why first: the space backdrop for the field (task 1003337) is a black-ground plate; one mode is what lets the field commit to it.
 
 ## 13. The space and the materials (task 1003337)
 

package/docs/file-map.md

@@ -1,7 +1,7 @@
 # File Map — Where Things Live
 
 > Split out of `CLAUDE.md` §11 in V3.R86 ([#305](https://example.com/builders#/task/305)) to keep the agent index lean. `CLAUDE.md` §11 now
-> carries a one-paragraph orientation and points here. Paths below are relative to the repo root — **today** one checkout. [ADR 0108](adr/<redacted>.md) (configurable-root) means that stops being universally true once a consumer installs the core as a `node_modules` dependency: `resolveCoreRoot()` and `resolveInstanceRoot()` ([`src/instance-config.js`](../src/instance-config.js)) can diverge, and this single tree below splits into a **core-package tree** (everything `isPublishable()` selects — see [`docs/modules-contract.md`](modules-contract.md) and [ADR 0098](adr/<redacted>.md)) and an **instance tree** (`config/`, instance `modules/`, `migrations/instance/`, `.claude/` once materialized — ADR 0108 §3). Both resolvers return this repo's root today, so the tree below is still accurate for the live instance; this note is the marker for when that stops being true (ADR 0108 §6 lands the split on Mercury, R85, before Example).
+> carries a one-paragraph orientation and points here. Paths below are relative to the repo root — **today** one checkout. [ADR 0108](adr/0108-instance-composition-configurable-root.md) (configurable-root) means that stops being universally true once a consumer installs the core as a `node_modules` dependency: `resolveCoreRoot()` and `resolveInstanceRoot()` ([`src/instance-config.js`](../src/instance-config.js)) can diverge, and this single tree below splits into a **core-package tree** (everything `isPublishable()` selects — see [`docs/modules-contract.md`](modules-contract.md) and [ADR 0098](adr/0098-public-mirror-publish-manifest.md)) and an **instance tree** (`config/`, instance `modules/`, `migrations/instance/`, `.claude/` once materialized — ADR 0108 §3). Both resolvers return this repo's root today, so the tree below is still accurate for the live instance; this note is the marker for when that stops being true (ADR 0108 §6 lands the split on Mercury, R85, before Example).
 
 **Project root:**
 
@@ -255,6 +255,7 @@
 │   │   ├── cascade-dispatch.js  ← (dormant System 3, ADR 0079) the model-tier escalation ladder for autonomous dispatch
 │   │   ├── goal-scope-check.js / hierarchy-config.js / module-scope-map.js ← goal-scope protected-path checks, the configurable work-hierarchy tiers, and the module→file-glob map
 │   │   ├── project-door.js      ← the project's COMPOSED join/apply door — visibility × join_grant × joinability → open | apply | invite_only | locked (BV1.R12 / task 1002331, ADR 0182 D6 + ADR 0247). PURE + kernel; published as api.projectJoinDoor() so the public POST /access-requests, the hall landing form, the CLI and the hub's join relay cannot answer one stranger differently — and since task 1003579 (ADR 0256) the SIGN-IN gate reads it too (openEnrollmentEnabled), which is why joinabilityMode() lives here rather than in auth-admission.js
+│   │   ├── artist-gate.js       ← the project's ARTIST GATE — off | advisory | strict (task 1003575, ADR 0241). PURE + kernel; published as api.artistGate so the lifecycle cascade ("file this review?") and the pin move ("does an open one hold?") resolve the same knob through one reader. It reads a STATE (is a cascade-filed artist review still open?), never a verdict, and what it can hold is the DEPLOY, never a builder's ship — that boundary is the whole reconciliation with ADR 0162
 │   │   ├── path-match.js / repo-info.js / metrics.js / uptime-poller.js / app-pair.js ← touches[] overlap matcher, git-remote parser, Prometheus metrics endpoint, uptime poller, Claude-Desktop pairing store
 │   └── world/
 │       ├── terrain.js           ← (Phase D + ADR 0012, CJS): TERRAIN + OBJECT enums + BLOCKING_TERRAINS + BLOCKING_OBJECTS (server twin of public/game/world/terrain.js)
@@ -456,6 +457,7 @@ tests/
 ├── overnight-builder/SKILL.md         ← autonomous overnight session-runner — claims the highest-priority safe task, works it end-to-end and ships it; autonomy-gated and OFF by default (restored in task 1003365; unscheduled in core — only redteam-weekly has a firing workflow; config/scheduled-routines.json records the intended cadence)
 ├── overnight-code-review/SKILL.md     ← nightly autonomous code-quality review; each finding lands as its own idea_inbox row so it survives triage; autonomy-gated and OFF by default (restored in task 1003365; unscheduled in core — only redteam-weekly has a firing workflow; config/scheduled-routines.json records the intended cadence)
 ├── peer-vote-tally/SKILL.md           ← deterministic tally (`tally.js`) folding builder-on-builder peer votes at least 7 days old into karma_log rows (criterion C2) (restored in task 1003365; unscheduled in core — only redteam-weekly has a firing workflow; config/scheduled-routines.json records the intended cadence)
+├── rank-roles-audit/SKILL.md          ← nightly deterministic check that every builder holds one of the four live ranks, so none silently resolves to zero permissions under the governance_002 backfill's INNER JOIN; detect-only, files one idea_inbox row and never repairs, and never fatal at boot (task 1002873; unscheduled in core — only redteam-weekly has a firing workflow; config/scheduled-routines.json records the intended cadence)
 ├── redteam-weekly/SKILL.md            ← weekly deterministic red-team patrol (task 1003128): full-history gitleaks scan + dependency drift review (audit delta, cooldown, young pkgs, stale overrides) + action-pin check → files security reports (advisory, ADR 0162). FIRED BY .github/workflows/redteam-patrol.yml, Mondays 06:17 UTC — `cadence: weekly` here and that cron must agree or fitness Check 25 (scripts/gds/routine-schedule.js) fails the gate (task 1003209, ADR 0188)
 ├── repo-simplify-sweep/SKILL.md       ← weekly repo-cleanliness janitor — runs repo-metrics, files dead-code findings to idea_inbox, and auto-fixes only the narrow safe class (restored in task 1003365; unscheduled in core — only redteam-weekly has a firing workflow; config/scheduled-routines.json records the intended cadence)
 ├── security-review-weekly/SKILL.md    ← weekly security-state review — stale vulnerability_reports, ageing security-tagged tasks, recent high/critical dependency alerts; one Archon broadcast when anything is stale, silent otherwise (restored in task 1003365; unscheduled in core — only redteam-weekly has a firing workflow; config/scheduled-routines.json records the intended cadence)

package/docs/module-api-changelog.md

@@ -7,7 +7,7 @@ The release ledger for `CORE_VERSION`, the semver of the published module doorwa
 `src/module-api.js` and is still the single literal every release reads. Only the
 history lives here.
 
-**Why the history moved** ([ADR 0203](adr/<redacted>.md)):
+**Why the history moved** ([ADR 0203](adr/0203-doorway-changelog-out-of-module-api.md)):
 the CI auto-patch carrier (ADR 0161) appends a two-line entry on *every* release and
 pushes straight to `main`, bypassing the `unit` gate. As a comment block inside
 `src/module-api.js` that growth pushed the file past the 1500-line
@@ -1887,5 +1887,40 @@ is load-bearing: the script throws rather than guess if it is missing, and
         landed since 1.19.712 with no explicit bump. run 34745667268. (task 1002620)
   1.19.714 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
         landed since 1.19.713 with no explicit bump. run 34746102135. (task 1002620)
+  1.19.715 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+        landed since 1.19.714 with no explicit bump. run 34747181910. (task 1002620)
+  1.19.716 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+        landed since 1.19.715 with no explicit bump. run 34750496516. (task 1002620)
+  (next carrier) — artistGate + getFoundingBuilder re-exported (task 1003575,
+        goal 1000074; ADR 0241). The project ARTIST GATE — off | advisory | strict —
+        and the pure verdict helpers over it. Two modules ask it two different
+        questions: the lifecycle cascade asks "should this artist review be filed at
+        all?" (off files none), and the deploy asks "does an open one hold the pin?"
+        (strict holds it). Both must resolve the knob through THIS one reader rather
+        than branding().project, because the fail-closed default and ADR 0241
+        section 5 non-retroactivity cutoff live in it, and a second reader is how the
+        level that FILES and the level that HOLDS start disagreeing.
+        getFoundingBuilder rides with it as kernel identity beside getBuilderById:
+        ADR 0241 section 3 gives the gate's one escape hatch to the PROJECT OWNER
+        alone, and a module cannot enforce that without being able to ask who that
+        is. Additive — a MINOR by the 1.19.0 precedent, but a hand-bumped version
+        cannot pass the publish lane LIVE test (tests/bump_version.mjs), so it rides
+        the next CI patch, exactly as projectJoinDoor did.
+  1.19.717 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+        landed since 1.19.716 with no explicit bump. run 34751690435. (task 1002620)
+  1.19.718 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+        landed since 1.19.717 with no explicit bump. run 34753530801. (task 1002620)
+  1.19.719 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+        landed since 1.19.718 with no explicit bump. run 34754578762. (task 1002620)
+  1.19.720 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+        landed since 1.19.719 with no explicit bump. run 34755367817. (task 1002620)
+  1.19.721 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+        landed since 1.19.720 with no explicit bump. run 34756186426. (task 1002620)
+  1.19.722 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+        landed since 1.19.721 with no explicit bump. run 34757838186. (task 1002620)
+  1.19.723 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+        landed since 1.19.722 with no explicit bump. run 34758720786. (task 1002620)
+  1.19.724 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+        landed since 1.19.723 with no explicit bump. run 34759302425. (task 1002620)
 ---------------------------------------------------------------------------
 ```

package/docs/modules-contract.md

@@ -1,7 +1,7 @@
 # The module plugin-API contract (`src/module-api.js` + `modules/*/`)
 
-> **Decision record:** [ADR 0083](adr/<redacted>.md) — the build plan.
-> **Live state:** the shipped modules under `modules/` are the four feature modules `dev-box`, `game`, `discord`, `art-pipeline` (+ `character-anim`, declaration-only; ADR 0088) and the carved core-domain modules `memory` (R72), `grading` (R73), `economy` (R77), `ideas` (R78), `security` (R79), `builder-settings` (R80), `onboarding` (R81), and `sessions` (R82) — see [ADR 0093](adr/<redacted>.md) for the remaining carve sequence.
+> **Decision record:** [ADR 0083](adr/0083-modular-architecture-strangler-build-plan.md) — the build plan.
+> **Live state:** the shipped modules under `modules/` are the four feature modules `dev-box`, `game`, `discord`, `art-pipeline` (+ `character-anim`, declaration-only; ADR 0088) and the carved core-domain modules `memory` (R72), `grading` (R73), `economy` (R77), `ideas` (R78), `security` (R79), `builder-settings` (R80), `onboarding` (R81), and `sessions` (R82) — see [ADR 0093](adr/0093-tranche-2-core-carve-sequence.md) for the remaining carve sequence.
 > **Author a new module:** jump to [the module-author recipe](#module-author-recipe).
 
 The module system turns optional features into self-contained directories. Adding a feature is "drop `modules/<key>/`"; the loader discovers, validates, and mounts it — no core file changes. The **one-way rule** is the load-bearing invariant:
@@ -18,7 +18,7 @@ Two fitness checks enforce it on every build — a violation is a red CI gate, n
 
 ## The cut: core vs modules
 
-- **Core** is the trust kernel + the lifecycle state machine + the domains not yet carved: auth/identity/audit/rank (the kernel, [ADR 0091](adr/<redacted>.md) §1), the lifecycle (tasks, claims, versions, done-when, ship — never split), and the still-core domains (autonomy/MAS, the two web UIs) plus always-on infra (analytics, audit-log, gate-approvals, healthz, public). The remaining tranche-2 domains carve out per [ADR 0093](adr/<redacted>.md) §1; the lifecycle stays core. (Sessions/BFG — the `session_records` corpus + data plane + the BFG scorer + session-pulse — carved to `modules/sessions/` at R82; like `memory` it registers no port and core never calls back in. The per-claim `session_logs` ship LOG + `builder_sessions` auth tokens stay core.)
+- **Core** is the trust kernel + the lifecycle state machine + the domains not yet carved: auth/identity/audit/rank (the kernel, [ADR 0091](adr/0091-bounding-the-kernel-and-db-carve.md) §1), the lifecycle (tasks, claims, versions, done-when, ship — never split), and the still-core domains (autonomy/MAS, the two web UIs) plus always-on infra (analytics, audit-log, gate-approvals, healthz, public). The remaining tranche-2 domains carve out per [ADR 0093](adr/0093-tranche-2-core-carve-sequence.md) §1; the lifecycle stays core. (Sessions/BFG — the `session_records` corpus + data plane + the BFG scorer + session-pulse — carved to `modules/sessions/` at R82; like `memory` it registers no port and core never calls back in. The per-claim `session_logs` ship LOG + `builder_sessions` auth tokens stay core.)
 - **Modules** are optional features an instance turns on via `config/modules.json` or env (the feature modules `dev-box`, `game`, `discord`, `art-pipeline`, `character-anim`), plus the **core-domain modules** that are `default: true` (always on unless disabled): `memory` (R72), `grading` (R73), `economy` — credits/cost/streaks/achievements/leaderboard (R77), `ideas` — inbox/capture/triage/blockers (R78), `security` — red-team reports + bounty (R79), `builder-settings` — wandering/skill/sound/render prefs + builder-needs (R80), `onboarding` — admission/onboarding-state/newcomer-restock (R81), and `sessions` — session_records corpus + BFG + session-pulse (R82). Each is a self-contained directory under `modules/<key>/`.
 
 ---
@@ -54,7 +54,7 @@ A module's `module.json` declares `"coreVersion": "^1.4.0"` (a semver range). Th
 
 **Current `CORE_VERSION`:** `1.8.0`
 
-> The table below is a hand-maintained summary of the MINOR bumps only, and it lags. The authoritative, complete release ledger — every version, including the CI carrier patches — is [`docs/module-api-changelog.md`](module-api-changelog.md) ([ADR 0203](adr/<redacted>.md) moved it out of `src/module-api.js`); the live value is the `const CORE_VERSION` literal in `src/module-api.js`.
+> The table below is a hand-maintained summary of the MINOR bumps only, and it lags. The authoritative, complete release ledger — every version, including the CI carrier patches — is [`docs/module-api-changelog.md`](module-api-changelog.md) ([ADR 0203](adr/0203-doorway-changelog-out-of-module-api.md) moved it out of `src/module-api.js`); the live value is the `const CORE_VERSION` literal in `src/module-api.js`.
 
 | Bump | What it added |
 |---|---|
@@ -113,19 +113,19 @@ Every module must have a `module.json` at its root (`modules/<key>/module.json`)
 
 An unknown key throws at validate time — typos fail loud (top-level attribution fields have no closed allowlist; only `contributes` sub-keys do).
 
-### `dependencies` — a module's own npm deps ([ADR 0138](adr/<redacted>.md))
+### `dependencies` — a module's own npm deps ([ADR 0138](adr/0138-bundled-module-deps-declared-per-module.md))
 
-`@bongos/core` ships lean — its synthesized `package.json` declares only `express` + `pg` ([ADR 0108](adr/<redacted>.md)). A bundled module that needs an external npm package at runtime (e.g. `discord` → `discord.js`) declares it in its own `module.json` `dependencies` (`{ "<npm-name>": "<semver-range>" }`, schema-validated). **Core does not carry it**, so the *consumer* must — greenfield `bongos init` composes the ENABLED modules' declared deps into the instance `package.json` (`enabledModuleDeps` → `buildInstancePackageJson`; an explicit pre-existing pin wins, `@bongos/core` is always set), and the R89 cutover preserves the monolith's existing dependency closure. If a module needs a dep and neither declares it nor is it in the consumer's closure, an instance that enables the module crashes at boot — so **declare it here**.
+`@bongos/core` ships lean — its synthesized `package.json` declares only `express` + `pg` ([ADR 0108](adr/0108-instance-composition-configurable-root.md)). A bundled module that needs an external npm package at runtime (e.g. `discord` → `discord.js`) declares it in its own `module.json` `dependencies` (`{ "<npm-name>": "<semver-range>" }`, schema-validated). **Core does not carry it**, so the *consumer* must — greenfield `bongos init` composes the ENABLED modules' declared deps into the instance `package.json` (`enabledModuleDeps` → `buildInstancePackageJson`; an explicit pre-existing pin wins, `@bongos/core` is always set), and the R89 cutover preserves the monolith's existing dependency closure. If a module needs a dep and neither declares it nor is it in the consumer's closure, an instance that enables the module crashes at boot — so **declare it here**.
 
-**Attribution (`author`/`origin`/`license`/`maintainer`) is portable metadata, not a cross-Bongos link** — each repo runs its own Bongos with its own builder identities ([ADR 0100](adr/<redacted>.md) §3), so credit travels *with the module* rather than through a foreign key ([ADR 0107](adr/<redacted>.md) §2). `bongos module new` stamps all four as TODO placeholders (license defaults to `AGPL-3.0`) so a module carries its authorship from the day it's scaffolded, not bolted on later at upstream-submit time.
+**Attribution (`author`/`origin`/`license`/`maintainer`) is portable metadata, not a cross-Bongos link** — each repo runs its own Bongos with its own builder identities ([ADR 0100](adr/0100-two-repo-instance-model.md) §3), so credit travels *with the module* rather than through a foreign key ([ADR 0107](adr/0107-module-upstreaming-contribution-to-core-catalog.md) §2). `bongos module new` stamps all four as TODO placeholders (license defaults to `AGPL-3.0`) so a module carries its authorship from the day it's scaffolded, not bolted on later at upstream-submit time.
 
-**`bongos module list [--catalog] [--search <text>] [--json]`** ([ADR 0107](adr/<redacted>.md) §2/§3, [ADR 0167](adr/<redacted>.md)) is the browsable catalog from the terminal: every module on disk with its enabled state, its author + origin credit, and its upkeep posture. `--catalog` narrows to the **core-shipped** modules — the shared catalog an instance opts into (§6, default-off). Two axes travel on each row and they are *not* the same question: **`source`** (which tree ships it — the core package or this instance's own repo, read structurally from the loader's discovery root, [ADR 0108](adr/<redacted>.md) §1) and **`provenance`** (who built it, derived from the declared `origin`). A core module that declares no attribution is credited to the platform and the credit is **marked inferred** (`*`) rather than left blank or silently invented. The hall's Modules tab renders the same model (`src/module-loader/catalog.js`) via `GET /modules`, so the two surfaces cannot drift.
+**`bongos module list [--catalog] [--search <text>] [--json]`** ([ADR 0107](adr/0107-module-upstreaming-contribution-to-core-catalog.md) §2/§3, [ADR 0167](adr/0167-module-catalog-source-vs-provenance.md)) is the browsable catalog from the terminal: every module on disk with its enabled state, its author + origin credit, and its upkeep posture. `--catalog` narrows to the **core-shipped** modules — the shared catalog an instance opts into (§6, default-off). Two axes travel on each row and they are *not* the same question: **`source`** (which tree ships it — the core package or this instance's own repo, read structurally from the loader's discovery root, [ADR 0108](adr/0108-instance-composition-configurable-root.md) §1) and **`provenance`** (who built it, derived from the declared `origin`). A core module that declares no attribution is credited to the platform and the credit is **marked inferred** (`*`) rather than left blank or silently invented. The hall's Modules tab renders the same model (`src/module-loader/catalog.js`) via `GET /modules`, so the two surfaces cannot drift.
 
-**`bongos module check <key> [--sign-off "Name <email>"]`** ([ADR 0107](adr/<redacted>.md) §4) is the submit-time pre-check a module must clear before it can be upstreamed. It reuses (never re-types) the public-mirror publish denylist (`scripts/gds/publish-manifest.js`'s `matchesDeny`) to reject content that cannot ship under AGPL (game content, pixel art, copyrighted reference material) — deliberately the DENY half only, since a brand-new module is never on the publish ALLOWLIST until it's accepted into core (§6). It also requires `module.json`'s `license` to be AGPL-3.0 (inbound = outbound) and a declared `maintenance` posture — acceptance is a commitment to upkeep, so a module with no `maintenance.status`, or one already `deprecated`/`orphaned`, is refused ([ADR 0166](adr/<redacted>.md); see below). On a pass, `--sign-off` records a lightweight DCO-style affirmation (own work, licensed AGPL-3.0 — never a copyright-assignment CLA) to `modules/<key>/.upstream-signoff.json`.
+**`bongos module check <key> [--sign-off "Name <email>"]`** ([ADR 0107](adr/0107-module-upstreaming-contribution-to-core-catalog.md) §4) is the submit-time pre-check a module must clear before it can be upstreamed. It reuses (never re-types) the public-mirror publish denylist (`scripts/gds/publish-manifest.js`'s `matchesDeny`) to reject content that cannot ship under AGPL (game content, pixel art, copyrighted reference material) — deliberately the DENY half only, since a brand-new module is never on the publish ALLOWLIST until it's accepted into core (§6). It also requires `module.json`'s `license` to be AGPL-3.0 (inbound = outbound) and a declared `maintenance` posture — acceptance is a commitment to upkeep, so a module with no `maintenance.status`, or one already `deprecated`/`orphaned`, is refused ([ADR 0166](adr/0166-module-maintenance-and-deprecation-policy.md); see below). On a pass, `--sign-off` records a lightweight DCO-style affirmation (own work, licensed AGPL-3.0 — never a copyright-assignment CLA) to `modules/<key>/.upstream-signoff.json`.
 
-### `maintenance` — who keeps this module true as the core advances ([ADR 0166](adr/<redacted>.md))
+### `maintenance` — who keeps this module true as the core advances ([ADR 0166](adr/0166-module-maintenance-and-deprecation-policy.md))
 
-A module pinned to an old `coreVersion` rots as the core advances ([ADR 0107](adr/<redacted>.md) §7). The `maintenance` block is where a module states, in a place the upgrade pre-check can read, **who owns that upkeep** — and what happens if nobody does. It is optional in the schema (pre-policy manifests keep validating) but **required to be upstreamed**.
+A module pinned to an old `coreVersion` rots as the core advances ([ADR 0107](adr/0107-module-upstreaming-contribution-to-core-catalog.md) §7). The `maintenance` block is where a module states, in a place the upgrade pre-check can read, **who owns that upkeep** — and what happens if nobody does. It is optional in the schema (pre-policy manifests keep validating) but **required to be upstreamed**.
 
 | `status` | Means | What it owes |
 |---|---|---|
@@ -136,15 +136,15 @@ A module pinned to an old `coreVersion` rots as the core advances ([ADR 0107](ad
 
 `orphaned` is a first-class, declarable state on purpose: a policy that only permits happy statuses gets satisfied by lying. `removeAfter` is rejected on a non-sunset status, and is **declarative** — nothing deletes a module automatically; `bongos upgrade` only reports that the core has advanced past the date.
 
-**What surfaces it.** `bongos upgrade` appends a maintenance hint to every `coreVersion` mismatch row and rolls up deprecations, modules past `removeAfter`, and modules with no declared upkeep. A **real** bump (`bongos upgrade --to <version>`) does the same via `preflightModules` → `reportModulePreflight`, printed before the blocking check returns so a refused bump reports them too. The asymmetry is deliberate: an incompatible **enabled** module refuses the bump; an incompatible **disabled** one never blocks but is always reported with its owner named — accepted catalog modules ship `default: false` ([ADR 0107](adr/<redacted>.md) §6), so *every* rotted catalog entry is disabled by construction, and silence there is exactly how the catalog fills with broken entries. `GET /modules` and the hall Modules tab show an `upkeep:` chip, including `upkeep: undeclared`.
+**What surfaces it.** `bongos upgrade` appends a maintenance hint to every `coreVersion` mismatch row and rolls up deprecations, modules past `removeAfter`, and modules with no declared upkeep. A **real** bump (`bongos upgrade --to <version>`) does the same via `preflightModules` → `reportModulePreflight`, printed before the blocking check returns so a refused bump reports them too. The asymmetry is deliberate: an incompatible **enabled** module refuses the bump; an incompatible **disabled** one never blocks but is always reported with its owner named — accepted catalog modules ship `default: false` ([ADR 0107](adr/0107-module-upstreaming-contribution-to-core-catalog.md) §6), so *every* rotted catalog entry is disabled by construction, and silence there is exactly how the catalog fills with broken entries. `GET /modules` and the hall Modules tab show an `upkeep:` chip, including `upkeep: undeclared`.
 
-**`bongos module submit <key> [--sign-off "Name <email>"]`** ([ADR 0107](adr/<redacted>.md) §1) re-runs the §4 pre-check + requires a sign-off, then packages the module (manifest + a full file snapshot + the sign-off) and files it into the rank-gated (metic+archon) upstreaming review queue via `POST /modules/:key/submit` — the same route the hall "Modules" tab's submit button calls. Refuses (exit 1) if the pre-check fails or no sign-off can be found/recorded. The queue currently lives in **this instance's own DB**, not a live call to the extracted core repo — see [ADR 0135](adr/<redacted>.md) for why, and `GET /modules/submissions` to read it back.
+**`bongos module submit <key> [--sign-off "Name <email>"]`** ([ADR 0107](adr/0107-module-upstreaming-contribution-to-core-catalog.md) §1) re-runs the §4 pre-check + requires a sign-off, then packages the module (manifest + a full file snapshot + the sign-off) and files it into the rank-gated (metic+archon) upstreaming review queue via `POST /modules/:key/submit` — the same route the hall "Modules" tab's submit button calls. Refuses (exit 1) if the pre-check fails or no sign-off can be found/recorded. The queue currently lives in **this instance's own DB**, not a live call to the extracted core repo — see [ADR 0135](adr/0135-module-upstream-submission-interim-queue.md) for why, and `GET /modules/submissions` to read it back.
 
 ---
 
 ## The loader — `src/module-loader/loader.js`
 
-> **Two-root discovery ([ADR 0108](adr/<redacted>.md) §1, task 1881/W1 shipped):** `DEFAULT_ROOTS` resolves `modules/` off `resolveCoreRoot()` ([`src/instance-config.js`](../src/instance-config.js)), not a hardcoded `__dirname`-relative path. Today `resolveCoreRoot() === resolveInstanceRoot()` (both the repo root), so discovery is unchanged. Once a consumer installs the core as a package, an **instance-owned** `modules/` directory (host-authored modules, living in the instance repo, not the core package) becomes possible — the loader would then discover across both roots via `opts.roots`, same mechanism as below, no core-file change. That instance-root modules directory does not exist yet; this is the seam it will attach to.
+> **Two-root discovery ([ADR 0108](adr/0108-instance-composition-configurable-root.md) §1, task 1881/W1 shipped):** `DEFAULT_ROOTS` resolves `modules/` off `resolveCoreRoot()` ([`src/instance-config.js`](../src/instance-config.js)), not a hardcoded `__dirname`-relative path. Today `resolveCoreRoot() === resolveInstanceRoot()` (both the repo root), so discovery is unchanged. Once a consumer installs the core as a package, an **instance-owned** `modules/` directory (host-authored modules, living in the instance repo, not the core package) becomes possible — the loader would then discover across both roots via `opts.roots`, same mechanism as below, no core-file change. That instance-root modules directory does not exist yet; this is the seam it will attach to.
 
 At boot the loader (called from `src/modules.js` and the route mounter) runs:
 
@@ -154,7 +154,7 @@ At boot the loader (called from `src/modules.js` and the route mounter) runs:
 4. **Enablement filter** — check `isModuleEnabled(key)` (env override → `config/modules.json` → `config/modules.neutral.json` → `manifest.default`); disabled modules are skipped.
 5. **Mount routes** — for each `contributes.routes` key, `require(`modules/<key>/routes/<routeKey>.js`)` and call the factory. Audit is already composed at the kernel level (routes.js runs `auditMiddleware` before the loader mounts anything); each route self-gates at the appropriate rank via `api.requireBuilder` / `api.requireRank`. The fitness check (`BV1.R44`) ensures every write route is rank-gated.
 6. **Start pollers** — call each `contributes.pollers` file's `start()` on successful mount.
-7. **Serve web surfaces** — a `contributes.webSurfaces` entry says WHERE the surface answers in exactly one of two ways, never both and never neither ([ADR 0218](adr/<redacted>.md)):
+7. **Serve web surfaces** — a `contributes.webSurfaces` entry says WHERE the surface answers in exactly one of two ways, never both and never neither ([ADR 0218](adr/0218-the-apex-root-web-surface.md)):
    - `{ host: "status.", dir: "public" }` — a **Host-header prefix**. `serve-internal.js` (via `loader.moduleWebSurfaces`) serves `modules/<key>/<dir>/` on the matching host, with the content-hash-stamped index + branding injection the status page always used. This is how the status dashboard (`status-ui`) reaches `status.<apex>` with no core edit (BV1.R84).
    - `{ apexRoot: true, dir: "public" }` — the **apex root**: whatever host is left once the subdomains are taken (`isApexHost` = `!isStatusHost && !isBuildersHost`). Declared by `public-landing`, the front door, and served by `platform-server.js`'s dedicated block. **`host: ""` is rejected, not read as "the root"** — the routers match with `host.startsWith(s.host)` and every string starts with `""`, so an empty prefix would answer on `builders.`/`status.` too and make `isModuleSurfaceHost()` true for every request, silently un-serving the hall.
 
@@ -197,12 +197,12 @@ A module calls `api.seams.emit(eventName, payload)` to broadcast. Any module tha
 | Port: `game.precreateWorldRoom` | `game` | `server.js` pre-create step | `(matchMaker) → Promise<void>` — pre-creates the singleton room. |
 | Port: `discord.isLinked` | `discord` | core `routes/me.js` | `(builderId) → Promise<bool>` — whether the builder has linked their Discord account. |
 | Port: `art.sharedKeyConfigured` | `art-pipeline` | core `routes/me.js` | `() → Promise<bool>` — whether a shared Gemini key is configured for the instance. |
-| Port: `grade` | `grading` (R73) | the lifecycle (`routes/tasks.js`, `routes/public.js`) | the quality-gate capability the ship path resolves instead of importing `grader.js` ([ADR 0091](adr/<redacted>.md) §4). |
-| Port: `reward` | `economy` (R77) | the lifecycle (`db.applyGrade`/`confirmTask`/…) + read routes (`me.js`/`public.js`/`builders.js`/`sessions.js`) | a **transaction-participant** port — credit/achievement writes take the caller's tx `client` ([ADR 0093](adr/<redacted>.md) §2). |
-| Port: `ideas.capture` | `ideas` (R78) | the `discord` module (`discord-inbound.js`) | `(idea) → Promise<row>` — file an `idea_inbox` row. The **first module→module port** (every other is consumed by core); retired the `captureIdea` doorway leak ([ADR 0093](adr/<redacted>.md) §5). |
-| Port: `security` | `security` (R79) | core `routes/public.js` (`/public/bounty-table`) | `{ bountyTableDetailed(), bountyTable() }` — the env-aware red-team bounty payout schedule. Core reads via `resolveOptional('security').bountyTableDetailed()` instead of importing the module (security is default-on; only <redacted> moved — [ADR 0093](adr/<redacted>.md) §1, [02-module-map §5](design/modular-architecture/02-module-map.md)). |
-| Port: `builder-settings` | `builder-settings` (R80) | core `routes/me.js` (`GET /me`) + `cascade-dispatch.js` | `{ getBuilderBehaviorPrefs, describeWandering, describeRender, computeNeeds, skillCeiling }` — the per-builder prefs read surface. The `GET /me` aggregator resolves it for its wandering/render/needs slices; the dormant cascade router for the skill ceiling. Default-on; degrades gracefully when off ([ADR 0093](adr/<redacted>.md) §1, [02-module-map §2](design/modular-architecture/02-module-map.md)). |
-| Port: `onboarding` | `onboarding` (R81) | the lifecycle (`db.js` claim/ship — transaction-participant `markStage`) + `auth.js` + `routes/me.js`/`builders.js`/`tasks.js`/`claims.js` | `{ getState, shapeForApi, safeMarkStage, markStage, broadcastGraduation, restockForClaim, restockAll, SOURCE_TAG }` — the onboarding state-machine + newcomer-restock surface. The FIRST core→module port the lifecycle ticks inside its own txn (alongside `reward`). Default-on; degrades to best-effort no-ops when off ([ADR 0093](adr/<redacted>.md) §1). |
+| Port: `grade` | `grading` (R73) | the lifecycle (`routes/tasks.js`, `routes/public.js`) | the quality-gate capability the ship path resolves instead of importing `grader.js` ([ADR 0091](adr/0091-bounding-the-kernel-and-db-carve.md) §4). |
+| Port: `reward` | `economy` (R77) | the lifecycle (`db.applyGrade`/`confirmTask`/…) + read routes (`me.js`/`public.js`/`builders.js`/`sessions.js`) | a **transaction-participant** port — credit/achievement writes take the caller's tx `client` ([ADR 0093](adr/0093-tranche-2-core-carve-sequence.md) §2). |
+| Port: `ideas.capture` | `ideas` (R78) | the `discord` module (`discord-inbound.js`) | `(idea) → Promise<row>` — file an `idea_inbox` row. The **first module→module port** (every other is consumed by core); retired the `captureIdea` doorway leak ([ADR 0093](adr/0093-tranche-2-core-carve-sequence.md) §5). |
+| Port: `security` | `security` (R79) | core `routes/public.js` (`/public/bounty-table`) | `{ bountyTableDetailed(), bountyTable() }` — the env-aware red-team bounty payout schedule. Core reads via `resolveOptional('security').bountyTableDetailed()` instead of importing the module (security is default-on; only <redacted> moved — [ADR 0093](adr/0093-tranche-2-core-carve-sequence.md) §1, [02-module-map §5](design/modular-architecture/02-module-map.md)). |
+| Port: `builder-settings` | `builder-settings` (R80) | core `routes/me.js` (`GET /me`) + `cascade-dispatch.js` | `{ getBuilderBehaviorPrefs, describeWandering, describeRender, computeNeeds, skillCeiling }` — the per-builder prefs read surface. The `GET /me` aggregator resolves it for its wandering/render/needs slices; the dormant cascade router for the skill ceiling. Default-on; degrades gracefully when off ([ADR 0093](adr/0093-tranche-2-core-carve-sequence.md) §1, [02-module-map §2](design/modular-architecture/02-module-map.md)). |
+| Port: `onboarding` | `onboarding` (R81) | the lifecycle (`db.js` claim/ship — transaction-participant `markStage`) + `auth.js` + `routes/me.js`/`builders.js`/`tasks.js`/`claims.js` | `{ getState, shapeForApi, safeMarkStage, markStage, broadcastGraduation, restockForClaim, restockAll, SOURCE_TAG }` — the onboarding state-machine + newcomer-restock surface. The FIRST core→module port the lifecycle ticks inside its own txn (alongside `reward`). Default-on; degrades to best-effort no-ops when off ([ADR 0093](adr/0093-tranche-2-core-carve-sequence.md) §1). |
 | Event: `builder.box-reconcile-needed` | core `db.js` (on rank change / deactivate / auto-graduation) | `dev-box` | `{ builderId, rank, status, actor }` — flags the box for reconciliation. |
 
 ---
@@ -254,14 +254,14 @@ Rules (enforced by the `BV1.R45` fitness check):
 | **`hall-ui`** *(core-domain web surface, default-on; R85)* | webSurfaces: `{ host: "builders.", dir: "public" }` (the authenticated builders' hall) | — (registers NO port; keeps a DEDICATED serving block in `serve-internal.js`, unlike `status-ui`) | `^1.11.0` |
 | **`public-landing`** *(core-domain web surface, default-on; task 1003322 / ADR 0218)* | webSurfaces: `{ apexRoot: true, dir: "public" }` (the front door at the apex root: `/`, `/projects`, `/create`, `/privacy`, `/terms`, `/contact`) | — (registers NO port; the first surface that is not a subdomain, and like `hall-ui` it keeps a DEDICATED serving block — in `platform-server.js`) | `^1.19.0` |
 | **`lifecycle`** *(core-domain, default-on; R86)* | routes: `tasks`, `claims`, `versions`, `done-when`, `goals`, `dependencies`, `gate-approvals`, `analytics` | provides `lifecycle` (createTask, classifyTaskKind, tallyPeerVotes, work-tracking reads); resolves `reward`, `onboarding` | `^1.12.0` |
-| **`provisioning`** *(default-off; [ADR 0111](adr/<redacted>.md))* | routes: `provisioning` (own+Archon rank-gated) | provides `provisioning.instanceState` | `^1.14.0` |
-| **`ui-design`** *(core-domain, default-on; [ADR 0197](adr/<redacted>.md))* | skills: `design`, `design-sync`, `figma-design-sync` (the /design playbook + the two tool round-trips); the ADR 0081 adapters, sync CLIs and validator live in the module dir | — (registers NO port, NO routes; declaration-only — disabling it withdraws the skills and touches no served surface) | `^1.19.0` |
+| **`provisioning`** *(default-off; [ADR 0111](adr/0111-instance-hosting-provisioning-module.md))* | routes: `provisioning` (own+Archon rank-gated) | provides `provisioning.instanceState` | `^1.14.0` |
+| **`ui-design`** *(core-domain, default-on; [ADR 0197](adr/0197-the-ui-design-module.md))* | skills: `design`, `design-sync`, `figma-design-sync` (the /design playbook + the two tool round-trips); the ADR 0081 adapters, sync CLIs and validator live in the module dir | — (registers NO port, NO routes; declaration-only — disabling it withdraws the skills and touches no served surface) | `^1.19.0` |
 
 Each module's `modules/<key>/CLAUDE.md` is the authoritative per-module reference (files, seams, tests, what is NOT in the module).
 
-> **Only <redacted> is the `security` module** ([ADR 0093](adr/<redacted>.md) §1, [02-module-map §5](design/modular-architecture/02-module-map.md)): the red-team / vulnerability reports + bounty (rank-gated Metic+). <redacted> — the `permission-path-check`/`route-rank-check` authz machinery AND the `/security/adr` threat-model reader + Archon-only `/security/docs` exploit-detail store (`src/bongos/routes/security.js`, backed by the core `db.js` `security_docs` queries) — stays kernel.
+> **Only <redacted> is the `security` module** ([ADR 0093](adr/0093-tranche-2-core-carve-sequence.md) §1, [02-module-map §5](design/modular-architecture/02-module-map.md)): the red-team / vulnerability reports + bounty (rank-gated Metic+). <redacted> — the `permission-path-check`/`route-rank-check` authz machinery AND the `/security/adr` threat-model reader + Archon-only `/security/docs` exploit-detail store (`src/bongos/routes/security.js`, backed by the core `db.js` `security_docs` queries) — stays kernel.
 
-> **`character-anim` is a declaration-only module** ([ADR 0088](adr/<redacted>.md)): consistent-character generative animation. Its manifest contributes the `otb-character-review` skill and declares the `art-pipeline` prerequisite; it has no routes/seams/migrations. The runtime — the contract entry point `art/pipeline/character_anim_module.py` (`animate(model-sheet + action-spec) → graded registered frame set + manifest`), with a config-driven rubric (a `character_anim` family) and a pluggable generator backend — lives under `art/` like the rest of the art pipeline, the same way `art-pipeline` keeps `art/` at the repo root.
+> **`character-anim` is a declaration-only module** ([ADR 0088](adr/0088-consistent-character-generative-animation.md)): consistent-character generative animation. Its manifest contributes the `otb-character-review` skill and declares the `art-pipeline` prerequisite; it has no routes/seams/migrations. The runtime — the contract entry point `art/pipeline/character_anim_module.py` (`animate(model-sheet + action-spec) → graded registered frame set + manifest`), with a config-driven rubric (a `character_anim` family) and a pluggable generator backend — lives under `art/` like the rest of the art pipeline, the same way `art-pipeline` keeps `art/` at the repo root.
 
 ---
 

package/docs/onboarding/browser-terminal-guide.md

@@ -70,4 +70,4 @@ It prints a **pairing link**. Open that link and you can now drive your box stra
 
 ---
 
-*Deeper detail (the systemd units, the Cloudflare tunnel, operator setup, and end-to-end verification) lives in the operator recipe [`docs/recipes/managed-settings-remote-control.md`](../recipes/managed-settings-remote-control.md) (Part 2) and [ADR 0038](../adr/<redacted>.md) / [ADR 0040](../adr/<redacted>.md). This page is the builder-facing summary of that flow.*
+*Deeper detail (the systemd units, the Cloudflare tunnel, operator setup, and end-to-end verification) lives in the operator recipe [`docs/recipes/managed-settings-remote-control.md`](../recipes/managed-settings-remote-control.md) (Part 2) and [ADR 0038](../adr/0038-chromebook-ttyd-cloudflare-tunnel.md) / [ADR 0040](../adr/0040-remote-control-default-browser-onramp.md). This page is the builder-facing summary of that flow.*