@bongos/core 1.19.850 → 1.19.852

package/.bongos-core.json

@@ -2,22 +2,22 @@
   "artifact": "bongos-core",
   "manifest_schema": 1,
   "generator": "scripts/gds/package-core.js",
-  "core_version": "1.19.850",
-  "core_contract": "1.19.850",
-  "source_commit": "232e375d3248cfc923d287f61d29cb6c5f59c5d9",
+  "core_version": "1.19.852",
+  "core_contract": "1.19.852",
+  "source_commit": "bf625696dfb7d52ffce6a01a498a5f9bb7fdfa75",
   "source_ref": "HEAD",
-  "built_at": "2026-09-17T20:32:54.381Z",
+  "built_at": "2026-09-17T21:07:34.757Z",
   "redaction": {
     "model": "docs-redacted+functional-verbatim",
-    "docs_redacted": 496,
+    "docs_redacted": 497,
     "agent_docs_stubbed": 26,
-    "functional_verbatim": 2276,
+    "functional_verbatim": 2278,
     "rules": 3,
     "gate_literals": 3,
     "gate": "passed"
   },
-  "file_count": 2798,
-  "tree_sha256": "12391d158894c3d0cb4e4073c3939f9c3e83705fa0406663fe5a30859fba4af4",
+  "file_count": 2801,
+  "tree_sha256": "d02b8c530b080946a1eeca76fc4a81f1cee5c8d893f9f41639fb880495862380",
   "files": [
     {
       "path": ".claude/skills/ask-for-help/SKILL.md",
@@ -302,7 +302,7 @@
     {
       "path": ".gitattributes",
       "mode": "0000644",
-      "sha256": "2d993829478b5f8931e5a8248818b70279055d1af643e51f07de6161eab593aa"
+      "sha256": "dace360d1e995ce2a7401a275a7ed68f6ebb877da948f7cf5ff710a9ce8c8bfc"
     },
     {
       "path": "CLAUDE.md",
@@ -1097,7 +1097,7 @@
     {
       "path": "docs/adr/0125-control-plane-scaffolds-standalone-instance-repo.md",
       "mode": "0000644",
-      "sha256": "7ba60c2b7af2225c300c0a53b47da48e9417a57383bbf9525576846ea40561a2"
+      "sha256": "6bfb8f4bd56438f39f9e57892653f6680bd54a4d4661d91a10018eef9e286db0"
     },
     {
       "path": "docs/adr/0126-dedicated-cloudbongos-control-plane-droplet.md",
@@ -2014,10 +2014,15 @@
       "mode": "0000644",
       "sha256": "104b5675fe52c1725dbbc78ab6fde9fd676b4020bf0e3f05411733c95d4342e0"
     },
+    {
+      "path": "docs/adr/0305-a-recipe-lives-with-what-it-documents.md",
+      "mode": "0000644",
+      "sha256": "4571564a9bf5ccb08996bd1fae58b69945c6cccbc9ce3b58c634acc087cb7698"
+    },
     {
       "path": "docs/adr/README.md",
       "mode": "0000644",
-      "sha256": "61dd72c5f0d4157062fb93585252448e5493afd25cb014fb747bf0e20037a2ab"
+      "sha256": "00361bb3425bda49646f676baac8ef458bb3c5c32f128767c269e96985d41ccf"
     },
     {
       "path": "docs/api-reference.md",
@@ -2052,12 +2057,12 @@
     {
       "path": "docs/copy-inventory.md",
       "mode": "0000644",
-      "sha256": "e457040f6938ad12012fb8ceb1b59de65d43f2fca74849181f1e448979a4c811"
+      "sha256": "4f6e17550f44d1974e98338d2ab1bd59bce9681c741ebbcdad7c35d5105d1c10"
     },
     {
       "path": "docs/copy-registry.json",
       "mode": "0000644",
-      "sha256": "77a0c2bb223c37af27b3dac3ca8864bad9b1bcb0bc6c326c96f40cec6f9ba95d"
+      "sha256": "cdfb4dc21b70a0b6ddba18951431a44e103e95be84ebb07e6fcba3ad2030379a"
     },
     {
       "path": "docs/design/apex-pass-2-direction.md",
@@ -2582,7 +2587,7 @@
     {
       "path": "docs/module-api-changelog.md",
       "mode": "0000644",
-      "sha256": "6c3496a323791d9b6bfc8e86faba4e433a51091e5a9d12b85ede0b207d8057a5"
+      "sha256": "75cf389b149eecb2feb08521e846ec486059c4b2b56f01ec3d6d46f62e89ecf9"
     },
     {
       "path": "docs/modules-contract.md",
@@ -2702,7 +2707,7 @@
     {
       "path": "docs/recipes/core-release-pipeline.md",
       "mode": "0000644",
-      "sha256": "169425fb8bbdd3e54ab3eefb8ac772c3789dfe19f3f16e39b4e83bba5e831e76"
+      "sha256": "747ee0cf9d43a8170f6f08668bbc7fe3ee617669272e84b92f03e321cf0eb8e4"
     },
     {
       "path": "docs/recipes/devbox-app-release.md",
@@ -2842,12 +2847,12 @@
     {
       "path": "docs/recipes/upgrading-the-core.md",
       "mode": "0000644",
-      "sha256": "ffe0add6718e0620144e8b786f237153aca9888a9f9052adb41948fcbc17ddec"
+      "sha256": "8fe1aae25eddf1d61f8cebbd915e5fa26c26eaa1585a0a9b887b398550d4c782"
     },
     {
       "path": "docs/recipes/windows-builders.md",
       "mode": "0000644",
-      "sha256": "85823a0b17b646da4b17596c78819da8e7342f24395dcc2e3ea82b5e07c25cba"
+      "sha256": "dba962c19bf22e5773fd05eb6667581d15f62ecda7292a37f83b12227ad14049"
     },
     {
       "path": "docs/recipes/work-on-a-task-from-your-dev-box.md",
@@ -4772,7 +4777,7 @@
     {
       "path": "modules/hall-ui/public/builders.js",
       "mode": "0000644",
-      "sha256": "ac1252ef25e0fe8b5774ef3d6566970657437de1151cd3e9e194859067fee789"
+      "sha256": "3e0e1e9120f14a1c5c015b044bfe8cd2d37cbc261746ac62407ccf90e13f4b29"
     },
     {
       "path": "modules/hall-ui/public/chime.wav",
@@ -4992,12 +4997,12 @@
     {
       "path": "modules/hall-ui/public/hall-kit.js",
       "mode": "0000644",
-      "sha256": "b0647793327eb27b7d460ecb97a39b835ecedf4754910def1e69867bf87070f7"
+      "sha256": "febbc27ca107c7da31f997119be95a73446bab70139339c10c951440fe2e1d28"
     },
     {
       "path": "modules/hall-ui/public/hall-render.js",
       "mode": "0000644",
-      "sha256": "ab4db906c2510541a77f76a3d8a8440f4e78ffa6a4064315a4b4b7849f93c4a8"
+      "sha256": "c41b42b12bb33bf8e40491215d596008abb21c6b40acff9a1b4bdeb369bdc784"
     },
     {
       "path": "modules/hall-ui/public/hall-visual.js",
@@ -5392,7 +5397,7 @@
     {
       "path": "modules/hall-ui/public/style.css",
       "mode": "0000644",
-      "sha256": "e06903836d2a31be222aef1fda880f6a68ab86f99667fae69b77b1fc3b118c08"
+      "sha256": "246523db6b1c4a3b417ab4539a0fca3cef8f3a5932b50dede637829d72bb2331"
     },
     {
       "path": "modules/hall-ui/public/task-detail.js",
@@ -5617,7 +5622,7 @@
     {
       "path": "modules/lifecycle/db-analytics.js",
       "mode": "0000644",
-      "sha256": "d83ba5776dee71849ac6d3ce472217db4b2559994e72f5c9b544304b8cc86641"
+      "sha256": "c910371c5127e49a8952ef95b32a4065840542b036ee400d30f570812448fc31"
     },
     {
       "path": "modules/lifecycle/db-claim-reads.js",
@@ -5852,7 +5857,7 @@
     {
       "path": "modules/lifecycle/routes/analytics.js",
       "mode": "0000644",
-      "sha256": "fb9e0f844368d2164f3279423f24ad0238774d95ceecf7039719e0bfdb0c1fcc"
+      "sha256": "b005c0e2e60cb1f7cf0c072182079301b63415c9edb0a48ee1958dd39fa62f57"
     },
     {
       "path": "modules/lifecycle/routes/artist-gate.js",
@@ -7907,12 +7912,12 @@
     {
       "path": "package-lock.json",
       "mode": "0000644",
-      "sha256": "1e217b4d7975b9c295c2806a83a5817f93fc38a0786a1976fe8ec19aac141b50"
+      "sha256": "197f6af6f83b766818989ee6f6fb71723dcf8420ddd190c18703e8c26b5aa889"
     },
     {
       "path": "package.json",
       "mode": "0000644",
-      "sha256": "6943316e63bef1a867ea04e705e42a9aa28a50e2cded10e16874899c61f69f03"
+      "sha256": "065f7ae763810587db17bc9522c11f8672ef9b9689a1cb8630debc9e12ae586e"
     },
     {
       "path": "public-docs/index.html",
@@ -8832,7 +8837,7 @@
     {
       "path": "scripts/gds/provision-repo-auth.js",
       "mode": "0000644",
-      "sha256": "b08032667c9f06495c750e4dd8d41fdc2f5aa587093cf7b4de8e7a46390f0724"
+      "sha256": "a113cdae4d6dcb3f8d968d41c2f1ce67b34d77229fe0a19d6bc5023f7ed469b5"
     },
     {
       "path": "scripts/gds/provision-repo.js",
@@ -9407,12 +9412,12 @@
     {
       "path": "scripts/gds/update-channel.js",
       "mode": "0000644",
-      "sha256": "1aeeb6171244e1d42ee7189a3aa2ae5d83fd175bfe1ce89300d6ca7511819f0b"
+      "sha256": "6418f51f933eac634a7df854af1e3a6dbde25e152e3dca0ce8df7d37d19c1d0c"
     },
     {
       "path": "scripts/gds/upgrade.js",
       "mode": "0000644",
-      "sha256": "6fb938914f50a8273640ca2bad871b3a3077102e36877c861e344235338ebef2"
+      "sha256": "9bf33575839de86c1361f78dab69f0e4607db37bbb473a38928fa6c03447d31e"
     },
     {
       "path": "scripts/gds/validate-design.js",
@@ -9852,7 +9857,7 @@
     {
       "path": "src/module-api.js",
       "mode": "0000644",
-      "sha256": "d2a5ba427ce014f7940e2757f06541e25275e0c4f59c0b9c5026396c795e41f2"
+      "sha256": "82b3a923d967a361a85d409528a785f2e70434289ee10cf25f3fd1e580eddacb"
     },
     {
       "path": "src/module-loader/catalog.js",
@@ -10794,6 +10799,11 @@
       "mode": "0000644",
       "sha256": "45c8919daeacc77a8a08ce72768a11a7ca47ad5bd65a9e815d5ec823255f743e"
     },
+    {
+      "path": "tests/curve_kind_overlay.mjs",
+      "mode": "0000644",
+      "sha256": "fa254f9da7db897bd3c74188455688efe76a6b1d7d377b992f38ee8c171fa2c7"
+    },
     {
       "path": "tests/cutover_codemod.mjs",
       "mode": "0000644",
@@ -12154,6 +12164,11 @@
       "mode": "0000644",
       "sha256": "68a429b47a1ca36a41433c0d8c3298a0f54745a19b050675aedba658a2cea0ef"
     },
+    {
+      "path": "tests/markdown_line_endings.mjs",
+      "mode": "0000644",
+      "sha256": "629ee8bb78098296039d174b9ddd460fe86acade39f60c1d9bb5f6be9d13762f"
+    },
     {
       "path": "tests/me_ship_days_bound.mjs",
       "mode": "0000644",
@@ -12717,7 +12732,7 @@
     {
       "path": "tests/provision.mjs",
       "mode": "0000644",
-      "sha256": "d763e2b5a10fbdd9a0e95fae493b524c7a52b437663125e3dbaf753435402e9c"
+      "sha256": "edcb3a67c97291be694f06cf092233dbd78dbb56898547bc6ccb562e7c27da6b"
     },
     {
       "path": "tests/provision_caddy_wiring.mjs",
@@ -13842,7 +13857,7 @@
     {
       "path": "tests/update_channel.mjs",
       "mode": "0000644",
-      "sha256": "9debf9ecdb02b986c882f3d29bdf4b5fe2154cb4e7639db0fd0a0336cd4bdc3b"
+      "sha256": "f20327544858053dbc1a27a7e1c3dbc40320f4414f057ba6d08647de949b0c10"
     },
     {
       "path": "tests/update_subscription_engine.mjs",
@@ -13852,7 +13867,7 @@
     {
       "path": "tests/upgrade.mjs",
       "mode": "0000644",
-      "sha256": "bcbba7b1c952088f43300405184849bbcbb2da789097fcc4cf38d95441e0c158"
+      "sha256": "3fe93c21665f73be4e2c17198af35626b2a3a045eceadda8827195910ad64e4c"
     },
     {
       "path": "tests/upgrade_persist_pin.mjs",

package/.gitattributes

@@ -37,6 +37,26 @@
 # read as environmental noise.
 *.sql          text eol=lf
 
+# Markdown: pinned for the same reason *.sql above is (task 1003981). Unpinned, every
+# .md fell through `* text=auto`, so a Windows clone with the common core.autocrlf=true
+# got CRLF in the worktree for 834 of the 835 tracked .md files while the index stayed
+# LF. That is not cosmetic: this repo has several tools that read .md AS TEXT and make a
+# decision from what they parse — skill-preflight.js (SKILL.md frontmatter), fitness.js
+# G03, linkify-refs.js, docs-entropy.js, the role-pack guard and the doc-CLI guard. A
+# CRLF-blind reader does not fail loudly; it parses nothing and so reports nothing to
+# check. Measured on task 1003754: skill-preflight's /^---\n/ frontmatter regex matched
+# ZERO of 53 skills, so G03 compared an empty set against an empty set and could not
+# fail. Per-site normalisation (tasks 1003754, 1003935) fixes the reader that was
+# noticed; this rule fixes the class, for the reader nobody has written yet.
+#
+# Renormalisation cost: NONE. Measured before landing — no tracked .md carries CRLF in
+# the INDEX, so `git add --renormalize` stages zero files and no committed byte changes.
+# The rule only changes what checkout WRITES. An existing Windows worktree keeps its
+# CRLF copies (the clean filter already normalises them to LF on add, so `git status`
+# stays quiet); a fresh clone, and any file git rewrites, get LF. To convert an existing
+# checkout in place: `git rm --cached -r . && git reset --hard`.
+*.md           text eol=lf
+
 # Future Windows-only wrappers (none today) must be CRLF — cmd.exe/PowerShell
 # expect it. Declared up front so a later setup-builder.cmd lands correct.
 *.bat          text eol=crlf
@@ -115,9 +135,13 @@ src/bongos/routes/CLAUDE.md   merge=otb-regen
 # `* text=auto` above (index LF, worktree CRLF) the check reported STALE forever on
 # every Windows checkout while the committed content was already correct. The .json
 # never had the bug because `*.json text eol=lf` above already pins it; the .md fell
-# through to text=auto because no `*.md` rule exists (and none should — pinning all
-# 685 tracked .md files would renormalize the whole docs tree for one generated file).
-# `*.md` deliberately stays unpinned; only the GENERATED artifact is pinned here.
+# through to text=auto because, at the time, no `*.md` rule existed. This entry's
+# `text eol=lf` is now REDUNDANT with the blanket `*.md text eol=lf` above (task
+# 1003981) — kept because it is load-bearing documentation of WHY the generated pair
+# needs LF, and because tests/git_merge_regen.mjs pins this line's multi-attribute
+# shape. The earlier note here argued *.md should stay unpinned, on the belief that
+# pinning it would renormalize the whole docs tree; that was measured and is false —
+# the index was already uniformly LF, so the blanket rule renormalized nothing.
 docs/copy-registry.json    merge=otb-regen
 docs/copy-inventory.md     merge=otb-regen text eol=lf
 

package/docs/adr/0125-control-plane-scaffolds-standalone-instance-repo.md

@@ -19,7 +19,9 @@ The greenfield "one guided flow" (`bongos init` → provision → OAuth → veri
 
 It is **idempotent** (skips once the repo carries a `package.json`) and **dry-run-safe** (every mutation goes through the injected `exec`/`writeFile`).
 
-**Git transport = the existing SSH deploy alias.** The clone/push use `git@<alias>:<owner>/<repo>.git` (default alias `github-deploy`, overridable via `PROVISION_GIT_SSH_ALIAS`) — the **same** transport the control-plane checkout already uses for the platform repo. No secret is interpolated into a command (SSH-key auth), so nothing leaks into journald.
+**Git transport = the existing SSH deploy alias.** The clone/push use `git@<alias>:<owner>/<repo>.git` — the **same** transport the control-plane checkout already uses for the platform repo. No secret is interpolated into a command (SSH-key auth), so nothing leaks into journald.
+
+> **Amended by task 1003996 — the alias is a property of one box, so it is probed, not assumed.** `github-deploy` exists only in the founder control plane's `~/.ssh/config`; on any other plane the scaffold's `remote add origin` and push resolved nowhere. `instanceRepoRemote` now picks the alias in this order: an explicit one → `PROVISION_GIT_SSH_ALIAS` → `github-deploy` **when `ssh -G` shows it actually resolves here** → `github.com`. The founder box keeps the alias (the probe finds it) and is unchanged; every other plane addresses GitHub directly, which is what its own deploy key is issued against. A stored remote is validated against the whole accept-set (`instanceRepoRemotes`) rather than re-running the probe, so a remote an alias-carrying box wrote stays recognised.
 
 **Operational prerequisite (the one manual grant):** the control plane's deploy public key (`~/.ssh/github_deploy.pub`) must have **write** access to each instance repo. GitHub deploy keys are per-repo, so standing up a new instance requires the owner to add that key (write) to the new repo — a one-time browser step alongside "create the empty repo," mirroring how the platform repo's deploy key is registered.
 

package/docs/adr/0305-a-recipe-lives-with-what-it-documents.md

@@ -0,0 +1,157 @@
+# ADR 0305 — A recipe lives with what it documents
+
+**Status:** accepted · **Date:** 2026-09-17 · **Task:** [task 1002156](https://cloudbongos.com/builders#/task/1002156) (goal 1000091 — BONGOS-V2)
+
+**Related:** [ADR 0098](0098-public-mirror-publish-manifest.md) (`isPublishable()` — the default-deny publish boundary this ADR re-aims) · [ADR 0107](0107-module-upstreaming-contribution-to-core-catalog.md) (submit → review → accept; the lifecycle this ADR declines to duplicate) · [ADR 0135](0135-module-upstream-submission-interim-queue.md) (the submission queue) · [ADR 0083](0083-modular-architecture-strangler-build-plan.md) (the module loader and its one-way import boundary) · [ADR 0062](0062-medusa-instance-model-decoupling.md) §1 (the portable-core / host-instance / feature-module cut-line) · [ADR 0108](0108-instance-composition-configurable-root.md) §1 (the core is consumed as a versioned npm package)
+
+## Context
+
+This is part A of the 2026-07-10 architecture-review sweep — the redesign deliberately
+deferred until direction and learnings solidified (idea 536 / idea 537; part B shipped as
+task 2155). It was held on the owner's explicit instruction not to start the ADR until the
+direction was confirmed. That confirmation came on 2026-09-17.
+
+**The thesis.** `docs/recipes/`, `scripts/` and `docs/research/` are all relevant to
+*building* Cloud Bongos, but a new project built *on* Cloud Bongos wants only a subset.
+Today the split is binary per file: [`scripts/gds/publish-manifest.js`](../../scripts/gds/publish-manifest.js)'s
+`isPublishable()` either ships a file to every instance or traps it in this repo. The thesis
+asks whether some of these assets should instead be **shareable the way modules are** —
+authored, reviewed, accepted, opt-in installed.
+
+**The binary split has already collapsed to one side.** Measured on this commit: all **36**
+files in `docs/recipes/` and all **4** in `docs/research/` pass `isPublishable()`. Every one
+ships to every instance. The instance-local half is empty in practice — the denylist entries
+that used to hold it (`cloudbongos-standup.md`, `example-decouple-r89.md`,
+`staging-data.md`) name files that no longer exist. The gate itself is sound; there is simply
+nothing on the other side of it any more. So a fresh instance today receives
+`figma-design-loop.md`, `redteam-patrol.md` and `parallel-goal-waves.md` whether or not any
+of it applies to that instance.
+
+**And the split is actively producing wrong documentation.** Four published recipes document
+the dev-box: `devbox-app-release.md`, `devbox-app-windows-test.md`,
+`work-on-a-task-from-your-dev-box.md`, `builder-box-lifecycle.md`. Goal 1000091 is in the
+middle of deleting that module. None of the nine remaining removal tasks covers these four —
+only task 1003896 touches `docs/recipes/`, and only to strip devcontainer mentions. Filed as
+[task 1004013](https://cloudbongos.com/builders#/task/1004013).
+
+That is the finding this ADR turns on. The recipes did not go stale through neglect; they
+went stale because **nothing structurally ties a recipe to the thing it documents**. The
+module is deleted in `modules/`, the recipe sits in `docs/recipes/`, and no test, no fitness
+check and no reviewer diff connects them. A published doc for a deleted feature is worse than
+no doc: it is a confident wrong answer, and `search-ingest-md` ingests it into the very index
+builders are told to consult.
+
+## Decision
+
+### 1. The rule: a recipe lives with what it documents.
+
+Not "which recipes are portable" — that is the question the binary split already answers
+badly, one file at a time, by hand, forever. The durable question is *ownership*. A recipe
+belongs in the same deletable unit as its subject, so that removing the subject removes the
+recipe as a matter of file layout rather than of anybody remembering.
+
+This yields a three-way classification, applied per file:
+
+| Class | Home | Lifecycle |
+| --- | --- | --- |
+| **Core methodology** — how to operate *any* instance | `docs/recipes/` (unchanged) | ships with the core, not optional |
+| **Feature-coupled** — how to use one module | `modules/<key>/recipes/` | ships, installs and **is deleted** with its module |
+| **Instance-operational** — this host's own ops | instance-local, denied by `isPublishable()` | never leaves the instance |
+
+### 2. `scripts/` stays core-shipped, whole.
+
+`scripts/` is not documentation with a portability question; it is the CLI. `bin/` dispatches
+into it, the fitness checks, ship gates and publish boundary *are* files in it, and
+`isPublishable()` already allowlists the subtree with deploy denied. Splitting it per file
+would make the core's own tooling conditional on an install choice. No change.
+
+### 3. `docs/research/` becomes instance-local.
+
+The four items are this instance's competitive analysis, its grader-cost evaluation and its
+own task-network map. They are situated artifacts: findings about *this* project at a moment
+in time, not methodology another instance can run. They are also the surface most likely to
+carry a brand-name leak, since nothing about them was written to be portable. Deny the
+subtree; keep any genuinely portable finding by promoting it into an ADR, which is the
+artifact class that already exists for durable conclusions.
+
+### 4. A shared recipe is a module contribution, not a new registry.
+
+This is the half of the thesis that is **rejected in its literal form**. The task asks whether
+recipes should become "a NEW shareable/opt-in asset class parallel to modules". They should
+not be parallel to modules. They should be *carried by* modules.
+
+A module already has every mechanism a shareable recipe needs, all of it built and shipped:
+a validated manifest with `author` / `origin` / `license` / `maintainer`
+([`manifest-schema.js`](../../src/module-loader/manifest-schema.js) `ATTRIBUTION_KEYS`),
+submit → review → accept with a security review as a hard accept-gate (ADR 0107 §1, §5),
+a submissions table (`migrations/core_191_module_submissions.sql`), default-off enablement
+plus the publish-allowlist *as* the accept action (ADR 0107 §6), and a maintenance/orphaning
+policy that refuses a `maintained` status without a named maintainer (ADR 0166).
+
+Building a second registry would mean a second manifest, a second review queue, a second
+attribution model and a second orphaning policy — to distribute Markdown. The precedent is
+already on disk and nobody designed it: `modules/ui-design/docs/design-contract.md` is a
+module-owned document that ships and dies with its module, and it has never needed a registry.
+
+So: **no new asset class, no new lifecycle, no new CLI verb.** A recipe pack is a directory
+inside a module. `bongos module submit` already carries it; enabling the module installs it;
+deleting the module deletes it.
+
+### 5. The publish boundary follows the layout; it does not define it.
+
+`isPublishable()` keeps its default-deny two-layer design unchanged (ADR 0098). What changes
+is that it stops being the *only* thing standing between a stale recipe and every instance.
+Once a feature-coupled recipe lives under `modules/<key>/`, the existing module allowlist
+entries already govern it and no per-file denylist row is needed. Per-file rows remain only
+for the instance-operational class — the one case where a file must stay behind for reasons
+the directory structure cannot express.
+
+### 6. Sequencing.
+
+This ADR decides direction only. It changes no code and moves no file. The moves are follow-on
+work, and the dev-box four ([task 1004013](https://cloudbongos.com/builders#/task/1004013))
+are deliberately *not* folded into it: that module is being deleted this goal, so its recipes
+should be deleted outright rather than relocated into a directory that is about to disappear.
+They are the worked example of the problem, not the first migration.
+
+## Alternatives considered (rejected)
+
+**A new shareable asset class parallel to modules** (the thesis as literally written; the
+Chef Supermarket / Ansible Galaxy / Terraform-registry shape). Rejected on cost against an
+already-built alternative: it duplicates the manifest, review queue, attribution model and
+orphaning policy that ADR 0107 and ADR 0135 already ship, and it would leave a recipe's
+lifecycle *still* unconnected to its subject's — the actual defect. The prior art also does
+not transfer cleanly: Supermarket and Galaxy distribute executable units with dependency
+resolution, which is what a module already is here. A recipe has no dependencies to resolve.
+
+**Keep the binary split and fix it by classification** (the cheaper option the owner was
+offered). Rejected because it treats the symptom. Hand-classifying 36 files restores the
+instance-local half for exactly as long as it takes the next module to ship a recipe, and it
+does nothing to stop the next dev-box four — under this option those are found by a human
+reading `ls docs/recipes/`, which is exactly how the ADR-numbering collision behind
+[ADR 0300](0300-a-missing-protected-surface-registry-is-a-broken-install.md)'s sibling guard
+was found, and the lesson there was to make the structure enforce the rule.
+
+**Per-recipe front-matter declaring portability.** Rejected: it puts the ownership claim in a
+place no build step reads and no deletion touches. A `portable: false` key in a file whose
+module was deleted is still a file in `docs/recipes/`.
+
+**Delete `docs/research/` rather than make it instance-local.** Rejected: the grader-cost
+evaluation and the competitive analysis are live inputs to open goals. Instance-local is the
+correct home for a situated artifact, not the bin.
+
+## Consequences
+
+- **The stale-recipe class of defect stops being possible for module-coupled docs.** Deleting
+  `modules/<key>/` takes its recipes with it, in the same commit, visible in the same diff.
+- **A fresh instance receives less.** Recipes for modules it has not enabled no longer arrive.
+  That is the thesis's goal, and it is what makes the core's own documentation honest about
+  what is installed.
+- **Module authors gain a documentation surface with attribution already attached** — the
+  `author` / `origin` credit ADR 0107 §2 defines now covers the recipe as well as the code.
+- **Follow-on work is a sweep, not a build.** Classify the 36 recipes against §1, move the
+  feature-coupled ones into their modules, deny `docs/research/`, and add a fitness check that
+  fails when a recipe under `modules/<key>/recipes/` outlives its module. No new machinery.
+- **Revisit if a recipe ever needs to ship without a module to carry it.** That is the one
+  shape this decision cannot express, and it would be the real argument for §4's rejected
+  alternative. Nothing in the current 36 has it.

package/docs/adr/README.md

@@ -396,3 +396,4 @@ This keeps the decision history honest and traceable.
 | 0302 | [**The third identical failure stops the session and asks** ([task 1003990](https://cloudbongos.com/builders#/task/1003990), goal 1000095). Sessions looped without noticing: one PR re-shipped into the same red check nine times, and 45 of 169 claim attempts were the same refusal retried minutes apart. A PostToolUse hook now counts walls per session — the signature is the `[otb-plain]` card's "What happened" line + the task id + the RED line, so a red check naming different failing tests each run reads as progress — and on the third identical one injects a single instruction: stop retrying, diagnose (path named), or /ask-for-help. Waiting cards ("Nothing to do…") are never counted; git-guard and worktree-guard count their own blocks through the same helper; it never blocks a tool call and echoes nothing a tool printed. Rejected: counting any repeated failing command (red→green is that), blocking the fourth attempt (a new gate, ADR 0162), server-side detection (cannot see guard blocks or speak into the session).](0302-the-third-identical-failure-stops-the-session-and-asks.md) | GDS / sessions / hooks |
 | 0303 | [**Provisioning verifies the base Caddyfile, and never edits it** ([task 1002860](https://cloudbongos.com/builders#/task/1002860), goal 1000106, from idea 1000524). The runner assumed the box's `/etc/caddy/Caddyfile` carried the `on_demand_tls` tls-check ask and `import /etc/caddy/sites/*.caddy`, and reloaded with `allowFail` — a box missing either provisioned "successfully" and the instance was unreachable. It now reads Caddy's RESOLVED config (`caddy adapt`: unprivileged, no key access, indifferent to how the directives are written) before touching the box (the ask) and after writing the snippet (the domain is served ⇒ the import reaches it), refusing with the exact line to add, and the reload is loud. Rejected: editing the base file (`on_demand_tls` must sit inside the global block an append cannot place, and a bad write takes down the control plane's own apex); `caddy validate` (loads certificate keys, needs root).](0303-provisioning-verifies-the-base-caddyfile-and-never-edits-it.md) | provisioning / infra |
 | 0304 | [**Routine reads run without a prompt; anything a flag can turn into a write is exact-form** ([task 1003992](https://cloudbongos.com/builders#/task/1003992), goal 1000095). The shipped `.claude/settings.json` pre-allowed six commands, so every `gh pr view` or `git fetch` asked a non-technical builder to approve a command they cannot evaluate. The read-only subset is now pre-allowed — `git status`, `gh pr view/checks/list`, `gh run view/list` and the gds CLIs audited read-only under every flag as prefix rules; `git branch` and `git fetch` as exact forms only, because a flag turns either into a write or an exec — and the instance starter mirrors it rule for rule. `git diff/log/show` get NO rule: the harness already runs their read-only forms unprompted with a flag check, and a prefix rule switched that check off (`--output=<path>` writes anywhere, `diff --no-index` reads deny-listed files — both reproduced in review). A test pins the whole allow-list, that no rule covers a command git-guard blocks, and that no rule covers a write dressed as a read. Rejected: `Bash(git:*)`, prefix-plus-`ask` for diff/log/show (argument patterns are evaded by quoting), prefix rules for fetch/branch, `bypassPermissions` everywhere.](0304-routine-reads-run-without-a-prompt-and-anything-a-flag-can-turn-into-a-write-is-exact-form.md) | GDS / sessions / permissions |
+| 0305 | [**A recipe lives with what it documents** ([task 1002156](https://cloudbongos.com/builders#/task/1002156), goal 1000091, from idea 536 / idea 537). Part A of the 2026-07-10 architecture review, held until the owner confirmed direction. The binary core-vs-instance split in `isPublishable()` has collapsed to one side: all **36** files in `docs/recipes/` and all **4** in `docs/research/` publish, and the denylist rows that once held the instance-local half name files that no longer exist. Worse, it is producing wrong docs — four published recipes document the dev-box that goal 1000091 is deleting, and none of the nine removal tasks covers them ([task 1004013](https://cloudbongos.com/builders#/task/1004013)). The cause is not neglect: **nothing structurally ties a recipe to what it documents**. So the rule is ownership, not portability — a recipe lives in the same deletable unit as its subject. Three classes: core methodology stays in `docs/recipes/`; feature-coupled moves to `modules/<key>/recipes/` and dies with its module; instance-operational stays behind the publish gate. `scripts/` is unchanged (it is the CLI, not documentation with a portability question); `docs/research/` becomes instance-local (situated artifacts, and the likeliest brand-name leak). **The thesis is rejected in its literal form**: a shared recipe is not a NEW asset class parallel to modules but a directory *inside* one, reusing the manifest attribution, submit→review→accept, security accept-gate, default-off enablement and orphaning policy that ADR 0107/0135 already ship — `modules/ui-design/docs/design-contract.md` is the undesigned precedent. Rejected: a parallel registry (a second manifest, queue, attribution model and orphaning policy, to distribute Markdown; Supermarket/Galaxy distribute executables with dependency resolution, which is what a module already is); classify-and-keep-the-binary-split (treats the symptom, restores the local half only until the next module ships a recipe); per-recipe portability front-matter (no build step reads it, no deletion touches it); deleting `docs/research/` (live inputs to open goals). Decides direction only — no file moves; the sweep and a fitness check for a recipe outliving its module are follow-on.](0305-a-recipe-lives-with-what-it-documents.md) | modules / upstreaming |

package/docs/copy-inventory.md

@@ -4,13 +4,13 @@
 > Deterministic on a given tree — regenerate and commit rather than hand-editing.
 > Machine-readable twin: [`copy-registry.json`](copy-registry.json).
 
-**1874 strings** across 3 surfaces · 1627 distinct pieces of copy · 1874 certain, 0 heuristic · 171 shown in more than one place.
+**1875 strings** across 3 surfaces · 1628 distinct pieces of copy · 1875 certain, 0 heuristic · 171 shown in more than one place.
 
 ## Surfaces
 
 | surface | lives at | files | strings |
 |---|---|---|---|
-| `builders-hall` | `modules/hall-ui/public` | 89 | 1384 |
+| `builders-hall` | `modules/hall-ui/public` | 89 | 1385 |
 | `status-dashboard` | `modules/status-ui/public` | 4 | 100 |
 | `landing` | `modules/public-landing/public` | 5 | 390 |
 
@@ -78,7 +78,7 @@ Identical copy within one surface. Sometimes right (a repeated button), sometime
 | `3e5a62bc4887` | 2x | A GitHub username is needed. | modules/hall-ui/public/hall-render.js:377, modules/hall-ui/public/watch.js:311 |
 | … | | _131 more in the JSON registry_ | |
 
-## `builders-hall` — 1384 strings
+## `builders-hall` — 1385 strings
 
 | id | conf | text | where |
 |---|---|---|---|
@@ -142,7 +142,7 @@ Identical copy within one surface. Sometimes right (a repeated button), sometime
 | `1b326b0be1a4` | certain | A {…} — you are a {…}. Mingle pairs across crafts. | `modules/hall-ui/public/collab.js:365` |
 | `996edffc1966` | certain | Access requests | `modules/hall-ui/public/watch.html:46` |
 | `996edffc1966` | certain | Access requests | `modules/hall-ui/public/watch.html:61` |
-| `303f8d90266f` | certain | Achievements could not be loaded. | `modules/hall-ui/public/builders.js:1158` |
+| `303f8d90266f` | certain | Achievements could not be loaded. | `modules/hall-ui/public/builders.js:1204` |
 | `6ca31dd5eb91` | certain | Acknowledge the primer | `modules/hall-ui/public/primer.html:99` |
 | `4461b13f95c2` | certain | Actions apply at once. Closing stops and deletes the box; you can start a fresh one anytime. | `modules/hall-ui/public/settings.html:209` |
 | `74cc57f76b42` | certain | Active recently | `modules/hall-ui/public/watch.js:435` |
@@ -155,7 +155,7 @@ Identical copy within one surface. Sometimes right (a repeated button), sometime
 | `cc4125ca7cff` | certain | Added to this version after it started building — an Archon override of the scope gate. Open the goal to see w | `modules/hall-ui/public/goals-render.js:184` |
 | `c600ff97ea70` | certain | Added — they are in the goal now, without being asked. | `modules/hall-ui/public/goals-render.js:1290` |
 | `ff67fba11965` | certain | Admitted into {…} mid-build | `modules/hall-ui/public/goals-render.js:873` |
-| `8b736e365191` | certain | All builders | `modules/hall-ui/public/hall-render.js:1145` |
+| `8b736e365191` | certain | All builders | `modules/hall-ui/public/hall-render.js:1208` |
 | `b5e03617b319` | certain | All goals | `modules/hall-ui/public/goals.html:53` |
 | `e08d410571e9` | certain | All kinds | `modules/hall-ui/public/sessions.js:286` |
 | `9c34bccb06ef` | certain | All open asks | `modules/hall-ui/public/collab.html:64` |
@@ -164,7 +164,7 @@ Identical copy within one surface. Sometimes right (a repeated button), sometime
 | `b38c01691857` | certain | All your work → | `modules/hall-ui/public/hall-widgets.js:110` |
 | `e99cc5d37404` | certain | Already a member? | `modules/hall-ui/public/hall-render.js:346` |
 | `da5368d10f85` | certain | Amendment {…} passed{…}, and the constitution below is not the one it decided: | `modules/hall-ui/public/government.js:633` |
-| `69f0ca4a4d84` | certain | Analytics scope | `modules/hall-ui/public/hall-render.js:1143` |
+| `69f0ca4a4d84` | certain | Analytics scope | `modules/hall-ui/public/hall-render.js:1206` |
 | `14bdceaac078` | certain | Answer the five questions and this spark becomes a Full Idea. | `modules/hall-ui/public/ideas.js:601` |
 | `0293418d5e8e` | certain | Answerable for: | `modules/hall-ui/public/profile.js:72` |
 | `05761b08ec8f` | certain | Answering is optional and declining costs nothing. Nobody is assigned by being asked. | `modules/hall-ui/public/collab.html:90` |
@@ -411,7 +411,7 @@ Identical copy within one surface. Sometimes right (a repeated button), sometime
 | `541127601291` | certain | Download for Mac | `modules/hall-ui/public/settings.html:224` |
 | `2ed2fd8376c0` | certain | Download for Windows | `modules/hall-ui/public/settings.html:225` |
 | `c7af57097d94` | certain | Download the Dev Box app: | `modules/hall-ui/public/hall-render.js:779` |
-| `9cf07334a5a9` | certain | Downvote (−1) | `modules/hall-ui/public/builders.js:739` |
+| `9cf07334a5a9` | certain | Downvote (−1) | `modules/hall-ui/public/builders.js:785` |
 | `9c728558d6e7` | certain | Drachmae & karma | `modules/hall-ui/public/drachmae.html:22` |
 | `9c728558d6e7` | certain | Drachmae & karma | `modules/hall-ui/public/drachmae.html:22` |
 | `9c728558d6e7` | certain | Drachmae & karma | `modules/hall-ui/public/drachmae.html:37` |
@@ -534,7 +534,7 @@ Identical copy within one surface. Sometimes right (a repeated button), sometime
 | `a4ff1e9c34e3` | certain | Idea {…} | `modules/hall-ui/public/idea.js:267` |
 | `ba82ec56f1e3` | certain | Idea — {{worldName}} | `modules/hall-ui/public/idea.html:6` |
 | `ba82ec56f1e3` | certain | Idea — {{worldName}} | `modules/hall-ui/public/idea.html:6` |
-| `e181637c5a5e` | certain | Ideas awaiting triage | `modules/hall-ui/public/builders.js:859` |
+| `e181637c5a5e` | certain | Ideas awaiting triage | `modules/hall-ui/public/builders.js:905` |
 | `d4e21769ce1c` | certain | Ideas filed, and what became of them | `modules/hall-ui/public/profile.html:152` |
 | `379b20d548ad` | certain | Ideas whose author has said "I had the thought but not the full picture". Anyone can develop one — the author  | `modules/hall-ui/public/ideas.html:42` |
 | `ef224c9de7c8` | certain | Ideas — {{worldName}} | `modules/hall-ui/public/ideas.html:6` |
@@ -571,7 +571,8 @@ Identical copy within one surface. Sometimes right (a repeated button), sometime
 | `fbe40b5818a3` | certain | Key removed. | `modules/hall-ui/public/settings.js:1148` |
 | `93c17262bacf` | certain | Key storage is being set up by an Archon — check back shortly. {…} | `modules/hall-ui/public/settings.js:1027` |
 | `2a3c9e501f8e` | certain | Key storage isn't set up yet. As an Archon you can turn it on now — the server generates and safely stores the | `modules/hall-ui/public/settings.js:1023` |
-| `7d6eaa8d4514` | certain | Kinds of work shipped | `modules/hall-ui/public/hall-render.js:1194` |
+| `e3b473af2f69` | certain | Kind of work | `modules/hall-ui/public/hall-render.js:1173` |
+| `7d6eaa8d4514` | certain | Kinds of work shipped | `modules/hall-ui/public/hall-render.js:1286` |
 | `81f62e066dbf` | certain | Last 14 days: {…} / 10 average across {…} graded work{…} ({…} passed). | `modules/hall-ui/public/builders.js:595` |
 | `35a15eb0a117` | certain | Last 30 days | `modules/hall-ui/public/hall-widgets.js:129` |
 | `9be8b839eff8` | certain | Last 7 days | `modules/hall-ui/public/hall-widgets.js:129` |
@@ -622,7 +623,7 @@ Identical copy within one surface. Sometimes right (a repeated button), sometime
 | `df335a1224ae` | certain | Member since {…} | `modules/hall-ui/public/profile.js:94` |
 | `c7a670e9552d` | certain | Merged into | `modules/hall-ui/public/profile.js:406` |
 | `6bd456635167` | certain | Merging work does not put it in front of anyone. This is the step that does: it moves this instance onto a new | `modules/hall-ui/public/deploy.html:39` |
-| `7637613c231b` | certain | Metic rank and above may vote | `modules/hall-ui/public/builders.js:743` |
+| `7637613c231b` | certain | Metic rank and above may vote | `modules/hall-ui/public/builders.js:789` |
 | `d3fa05c5e3fe` | certain | Mingle pairs you with someone from another craft. Saying no costs nothing. | `modules/hall-ui/public/collab.html:80` |
 | `d7ce4a3bb745` | certain | Minimize the welcome panel | `modules/hall-ui/public/hall-widgets.js:52` |
 | `19b0ed5781ae` | certain | Minimum rank required to claim this task | `modules/hall-ui/public/task-lib.js:65` |
@@ -1008,7 +1009,7 @@ Identical copy within one surface. Sometimes right (a repeated button), sometime
 | `381f29be7497` | certain | The most recently shipped tasks. | `modules/hall-ui/public/work.html:120` |
 | `82479c539fca` | certain | The name shown beside your work — in the roster, the leaderboard, and the work feed. Your sign-in and the cred | `modules/hall-ui/public/settings.html:75` |
 | `b88dd8b96b72` | certain | The next person to notice this sentence reads your note instead of re-litigating it. | `modules/hall-ui/public/copy-desk.html:135` |
-| `aa716f3dd551` | certain | The page could not be loaded. Try again. | `modules/hall-ui/public/builders.js:1425` |
+| `aa716f3dd551` | certain | The page could not be loaded. Try again. | `modules/hall-ui/public/builders.js:1484` |
 | `74bc22f38140` | certain | The platform confirmed this request came from the account it names. | `modules/hall-ui/public/watch.js:373` |
 | `6c3d88de42de` | certain | The primer | `modules/hall-ui/public/primer.html:41` |
 | `dea378cd4837` | certain | The primer did not load | `modules/hall-ui/public/primer.html:88` |
@@ -1087,7 +1088,7 @@ Identical copy within one surface. Sometimes right (a repeated button), sometime
 | `6516cc82021a` | certain | UI design | `modules/hall-ui/public/settings.html:303` |
 | `2c1c20785a6e` | certain | Unclear — a person would not know what to do | `modules/hall-ui/public/copy-desk.html:91` |
 | `aa445f06cc5e` | certain | Unlink failed: {…} | `modules/hall-ui/public/settings.js:876` |
-| `67fbc770b3b3` | certain | Upvote (+1) | `modules/hall-ui/public/builders.js:739` |
+| `67fbc770b3b3` | certain | Upvote (+1) | `modules/hall-ui/public/builders.js:785` |
 | `e7e2a99a2bea` | certain | Use this | `modules/hall-ui/public/settings-specialities.js:148` |
 | `e1ecd543a2ca` | certain | Using this speciality. | `modules/hall-ui/public/settings-specialities.js:199` |
 | `6200bac6bdca` | certain | View all sessions | `modules/hall-ui/public/watch.html:106` |
@@ -1096,7 +1097,7 @@ Identical copy within one surface. Sometimes right (a repeated button), sometime
 | `f8546b3e285e` | certain | View tasks {…} | `modules/hall-ui/public/roadmap.js:154` |
 | `71c09cda8246` | certain | Voice for {…} | `modules/hall-ui/public/settings.js:76` |
 | `2940b7828d26` | certain | Volume {…}%. | `modules/hall-ui/public/settings.js:218` |
-| `6905f2ee5702` | certain | Vote on this work | `modules/hall-ui/public/builders.js:739` |
+| `6905f2ee5702` | certain | Vote on this work | `modules/hall-ui/public/builders.js:785` |
 | `b2937e14ee9b` | certain | Vote yes | `modules/hall-ui/public/board-room.js:276` |
 | `8cc425582984` | certain | Vulnerability reports | `modules/hall-ui/public/watch.html:132` |
 | `b1e63e33f739` | certain | Vulnerability reports, engagement reports, override requests, and the audit log. | `modules/hall-ui/public/watch.html:129` |
@@ -1288,7 +1289,7 @@ Identical copy within one surface. Sometimes right (a repeated button), sometime
 | `fdfb8b2ce948` | certain | new identity | `modules/hall-ui/public/box-panel.js:339` |
 | `86f235ddfe01` | certain | new thread | `modules/hall-ui/public/settings.html:343` |
 | `b9f2e0d43c94` | certain | no clock | `modules/hall-ui/public/government.js:607` |
-| `e02979266baf` | certain | no data | `modules/hall-ui/public/hall-kit.js:705` |
+| `e02979266baf` | certain | no data | `modules/hall-ui/public/hall-kit.js:735` |
 | `9e194a57d054` | certain | no reading | `modules/hall-ui/public/deploy.js:74` |
 | `33ca71bef112` | certain | no tasks yet | `modules/hall-ui/public/goals-render.js:163` |
 | `739a4bd6bd83` | certain | node scripts/setup-builder.js | `modules/hall-ui/public/hall-render.js:846` |
@@ -1431,7 +1432,7 @@ Identical copy within one surface. Sometimes right (a repeated button), sometime
 | `3d74668f69e5` | certain | {…}{…} · {…} | `modules/hall-ui/public/task.js:649` |
 | `9588652a7aff` | certain | · follows your profile setting | `modules/hall-ui/public/settings.js:568` |
 | `4a5ff4f662df` | certain | — ${…} of ${…} this month ({…}%). {…} | `modules/hall-ui/public/hall-render.js:471` |
-| `a6ae9cbdee30` | certain | — all builders — | `modules/hall-ui/public/builders.js:675` |
+| `a6ae9cbdee30` | certain | — all builders — | `modules/hall-ui/public/builders.js:721` |
 | `729d4ce22b99` | certain | — any — | `modules/hall-ui/public/hall-widgets.js:132` |
 | `d2c30a1ee74e` | certain | — decide — | `modules/hall-ui/public/goals-render.js:970` |
 | `417adabd1a00` | certain | — no goal suggested — open the goal board and pick one — | `modules/hall-ui/public/task-detail.js:324` |
@@ -1446,7 +1447,7 @@ Identical copy within one surface. Sometimes right (a repeated button), sometime
 | `5b9fa7cb4fb0` | certain | …and {…} more waiting — | `modules/hall-ui/public/goal-inbox.js:121` |
 | `b2a04abfead0` | certain | …{…} more awaiting a nod. | `modules/hall-ui/public/goal-inbox.js:264` |
 | `616fb9adf3cf` | certain | …{…} more going quiet. | `modules/hall-ui/public/goal-inbox.js:353` |
-| `e35f11bdc5d7` | certain | …{…} more open ideas — triage clears them one at a time. | `modules/hall-ui/public/builders.js:857` |
+| `e35f11bdc5d7` | certain | …{…} more open ideas — triage clears them one at a time. | `modules/hall-ui/public/builders.js:903` |
 | `5f1d914ad45e` | certain | …{…} more — | `modules/hall-ui/public/goal-inbox.js:427` |
 | `de8fa5223aee` | certain | ‹ Prev | `modules/hall-ui/public/hall-kit.js:74` |
 | `d4b84b7fbdeb` | certain | ← All goals | `modules/hall-ui/public/goals.html:80` |