@bongos/core 1.19.910 → 1.19.912

package/.bongos-core.json

@@ -2,22 +2,22 @@
   "artifact": "bongos-core",
   "manifest_schema": 1,
   "generator": "scripts/gds/package-core.js",
-  "core_version": "1.19.910",
-  "core_contract": "1.19.910",
-  "source_commit": "ab1d1de5cfa5ac30120e07b1974440f17945eefa",
+  "core_version": "1.19.912",
+  "core_contract": "1.19.912",
+  "source_commit": "d9093cd602f014a948cee8ac7ea27f36d4be922b",
   "source_ref": "HEAD",
-  "built_at": "2026-09-20T15:29:42.443Z",
+  "built_at": "2026-09-20T16:20:10.208Z",
   "redaction": {
     "model": "docs-redacted+functional-verbatim",
-    "docs_redacted": 503,
+    "docs_redacted": 504,
     "agent_docs_stubbed": 26,
-    "functional_verbatim": 2283,
+    "functional_verbatim": 2287,
     "rules": 3,
     "gate_literals": 3,
     "gate": "passed"
   },
-  "file_count": 2812,
-  "tree_sha256": "40fde6b52d1d23e9b6eba83c0721d3584999cbfd55401262111678a035e8f07b",
+  "file_count": 2817,
+  "tree_sha256": "e4f492bda78fcddcc35a433c3f5c7ca4b3e193298e923da342a7326e182fb695",
   "files": [
     {
       "path": ".claude/skills/ask-for-help/SKILL.md",
@@ -347,12 +347,12 @@
     {
       "path": "clients/bongos-client/README.md",
       "mode": "0000644",
-      "sha256": "b77c75902ed2aaa437f92d23849154fc61b4e4a6c9c3536466b6c54b5da6f396"
+      "sha256": "3d49c3ab2ec849b4b6b8856fc33161dae6d4728565afc3e781c9f9b8c00068c5"
     },
     {
       "path": "clients/bongos-client/bongos-client.global.js",
       "mode": "0000644",
-      "sha256": "146b0f072159cc2307fb0ea855e49664bec120f0a181a54253941cacd1beea7d"
+      "sha256": "2697c2c2ca3b5ede19b7f5511eb51ae6173973b4db01d20183ef560a95315c42"
     },
     {
       "path": "clients/bongos-client/examples/hello-world.mjs",
@@ -362,17 +362,17 @@
     {
       "path": "clients/bongos-client/index.cjs",
       "mode": "0000644",
-      "sha256": "885e0606f436873e274f6ec51e93697f3854115874c982299ef8275621629f8e"
+      "sha256": "b80472a5a66e342b8dc9c09c61a570cc3272756cf311eb16f77a125d8ae66afd"
     },
     {
       "path": "clients/bongos-client/index.d.ts",
       "mode": "0000644",
-      "sha256": "890072b8a2de95a5f1913f4a5fdefc7462f1977b8cb7a18869cb50706c5a645e"
+      "sha256": "de24c22270e6a95dcf5674aac3b445e08fce3cd1982d0e922d84ca9e199a36e0"
     },
     {
       "path": "clients/bongos-client/index.mjs",
       "mode": "0000644",
-      "sha256": "156a725169e5e310e69ec6a7df1bd0d9dec768d693cb8aa581710f59def69a78"
+      "sha256": "084e5d2634ec4a5ddbc4a537ad32ec88296bb55f0439c7c4dc8e534eaad5fd71"
     },
     {
       "path": "clients/bongos-client/package.json",
@@ -2062,22 +2062,27 @@
     {
       "path": "docs/adr/0314-module-protection-is-per-path-not-per-module.md",
       "mode": "0000644",
-      "sha256": "541a0ae0223982fe53fcf96e3c4a9509e94101d04db0a87395f39cc1bcd881e8"
+      "sha256": "accaba461051e427c251e9c4ec4ff74304447fd6cd68f940311f4b978ff234c2"
+    },
+    {
+      "path": "docs/adr/0315-a-plane-with-no-proxy-is-refused-not-given-a-no-op-ingress.md",
+      "mode": "0000644",
+      "sha256": "bc9dde45a33790e4fbce47682a5734a1adaf4fdd7f9347bb0128c6cca6fcf4e5"
     },
     {
       "path": "docs/adr/README.md",
       "mode": "0000644",
-      "sha256": "4bd65e814cacf8b886b542bf7741dff8f61e9aad3e101db1af2bd28e0eb1a49e"
+      "sha256": "a6bf1805ee02ca941a1910d722cfc61e4f0e519aa79c9d102aadfb8bf7d95a5a"
     },
     {
       "path": "docs/api-reference.md",
       "mode": "0000644",
-      "sha256": "6ea97c68b9346b508489108ef1dde08daea5354ab8276ae0959f25e4528289f9"
+      "sha256": "dfc37d531b880bc87d6d4e1b09eae50ef3e0301781ed84923304bc77b878b9b9"
     },
     {
       "path": "docs/api/openapi.json",
       "mode": "0000644",
-      "sha256": "37732622e53cde0e4ee6bb0133ef6bade2a862f7d6337c40723b94fbf6ae6c22"
+      "sha256": "8ab5797e6b515965da750890ab78ae16d61326d19a26751a0dde3bc2f72b6797"
     },
     {
       "path": "docs/architecture.md",
@@ -2102,12 +2107,12 @@
     {
       "path": "docs/copy-inventory.md",
       "mode": "0000644",
-      "sha256": "3a121e993f87d7379836af082bebb8c857427481eb265d477b4b55584cdd604b"
+      "sha256": "cadfe92b87eaf4f2bb952debc703c53b833fd83badbefcce40e7203a0d150c95"
     },
     {
       "path": "docs/copy-registry.json",
       "mode": "0000644",
-      "sha256": "77e94a0337636dd8e444bfca6d749c9a16a937ed8e98b372072c17f5b43cc3fe"
+      "sha256": "f6571a42a27d5cfeef058d06937fc669a31da076bc26972c5e29a8fa1d156b5d"
     },
     {
       "path": "docs/design/apex-pass-2-direction.md",
@@ -2637,7 +2642,7 @@
     {
       "path": "docs/module-api-changelog.md",
       "mode": "0000644",
-      "sha256": "01618cef9838c895da164b81675efd8db38b97151ea2e3b6882f08a03009bd8f"
+      "sha256": "1dfb3933a3ce48499941b71978e9f462fe97c49e7d472b71022b654850093e3b"
     },
     {
       "path": "docs/modules-contract.md",
@@ -2857,7 +2862,7 @@
     {
       "path": "docs/recipes/self-host.md",
       "mode": "0000644",
-      "sha256": "853761ea1330806204c35bcdda680af64fac1f096be1a1296d9d59ed9d54fabd"
+      "sha256": "2a8a4075086fbcc2815c7b809f38dd887726e53561755e65a7990a687772cf7c"
     },
     {
       "path": "docs/recipes/server-bring-up.md",
@@ -4917,17 +4922,17 @@
     {
       "path": "modules/hall-ui/public/ideas.css",
       "mode": "0000644",
-      "sha256": "80edba7f2ea1343a72b1885d13d7411c4b1f127e38a2ccffa85f50a4f3cc8dfd"
+      "sha256": "57a41781c81b02cbac7b30a0a13f50f4a913e55f348d84cfc4244a99372932c2"
     },
     {
       "path": "modules/hall-ui/public/ideas.html",
       "mode": "0000644",
-      "sha256": "05116249b8cc983297c126c1d1803cb94210d885841b06b2b1667a771cfe866a"
+      "sha256": "c59e5f293b4dcabd01e2cd17c983b42184bb17468654888f4adf2243a506623b"
     },
     {
       "path": "modules/hall-ui/public/ideas.js",
       "mode": "0000644",
-      "sha256": "3496ae8afbf111bff89198146e1b079cb5e7da3f3bd425ab9972ec7b034fbd7d"
+      "sha256": "54fa21caf9ab7173952e9b84d60e6334743f749044c8b226cd21277f7dec574e"
     },
     {
       "path": "modules/hall-ui/public/ideas.states.json",
@@ -5344,6 +5349,11 @@
       "mode": "0000644",
       "sha256": "ff6c0346215d1b88309c4c9360cd60c59299b21b45e27cce09c4b748bf3411e1"
     },
+    {
+      "path": "modules/ideas/landing-preview.js",
+      "mode": "0000644",
+      "sha256": "912c7007c534a198adce9c83a56e39da8a1475bfe5b09b2a6fe1ff8914d775c9"
+    },
     {
       "path": "modules/ideas/migrations/ideas_001_grades.sql",
       "mode": "0000644",
@@ -5397,7 +5407,7 @@
     {
       "path": "modules/ideas/routes/inbox.js",
       "mode": "0000644",
-      "sha256": "cd4e4d741dcbc4bb581f86aeec5b1e17dfe630712a0e5466a108daba78c74429"
+      "sha256": "5ec576c26e46c8a27cd3b40d400abd177f4bdf1f2124e286a294fa58a809489a"
     },
     {
       "path": "modules/ideas/routing.js",
@@ -7787,12 +7797,12 @@
     {
       "path": "package-lock.json",
       "mode": "0000644",
-      "sha256": "adc1e3888e98381ca917459b11366a25c6da5e00e72411b1bc3e22aad10c4f69"
+      "sha256": "d424dadd5439bf9883d9e0e44a938ed30a2e5c63f4dd1ed336e6130dbef959e6"
     },
     {
       "path": "package.json",
       "mode": "0000644",
-      "sha256": "09320d2a344a74fcb4db29bb52b658f61df23191bdf4247916c017277c31b25d"
+      "sha256": "ffdc1c047d136b67d5443336e8c8874b9cf7c13868a908a486470ffdcc780f3c"
     },
     {
       "path": "public-docs/index.html",
@@ -7884,6 +7894,11 @@
       "mode": "0000644",
       "sha256": "7a639c73f8d2f4f523899ab737641174ca7b5ed5409427238d7fc397cdba65ed"
     },
+    {
+      "path": "scripts/gds/api-alias-caller-scan.js",
+      "mode": "0000644",
+      "sha256": "bdb23756d2dcf4f9a3f22a8c64151f70aee5c62b82601672f5e8fb6adbc367ed"
+    },
     {
       "path": "scripts/gds/api.js",
       "mode": "0000644",
@@ -8367,7 +8382,7 @@
     {
       "path": "scripts/gds/fitness-ratchets.js",
       "mode": "0000644",
-      "sha256": "178d2cfb91c97c107d60cc3895ba1b3eff74c45d383646e7a64621d018c21b47"
+      "sha256": "ab08226e81589231f0704c304a1abcd0f25c24ff48dc1cd0ecc7b3d088536055"
     },
     {
       "path": "scripts/gds/fitness.js",
@@ -8742,7 +8757,7 @@
     {
       "path": "scripts/gds/provision-net.js",
       "mode": "0000644",
-      "sha256": "f1ca176ff8cdb8de65940af1e30316db600cb5df529abbc997697abf1cbc2c2d"
+      "sha256": "734ae6982953f2474d424bf16789adfb709b5657ce62014df5c29a791506a988"
     },
     {
       "path": "scripts/gds/provision-process.js",
@@ -8772,7 +8787,7 @@
     {
       "path": "scripts/gds/provision.js",
       "mode": "0000644",
-      "sha256": "71d4edd0e5653207a535e6a0febca39a19ba281ffce7f248049b826dc5ab3b84"
+      "sha256": "8722cf581fac65b5839f2b44987c9b09b721452d8f20d2079f2029b386841396"
     },
     {
       "path": "scripts/gds/publish-credential-check.js",
@@ -9387,7 +9402,7 @@
     {
       "path": "scripts/hall-preview/server.js",
       "mode": "0000644",
-      "sha256": "0052e9ed7ea2f5779c5bda8d54b1dabd731c0c11de87b4f8e06b00d051ed7a25"
+      "sha256": "f66f32220b4090f4dd29e0446ac4c2b68e8ac8dbf46a0f64487cadc68fc1a1b1"
     },
     {
       "path": "scripts/hall-preview/task-visual.js",
@@ -9597,7 +9612,7 @@
     {
       "path": "src/bongos/module-scope-map.js",
       "mode": "0000644",
-      "sha256": "7f393fc515fe751d5296ce0a574e0d3e40695c0346933a0d8b9c30ed6ae39a1b"
+      "sha256": "b82d3257c27689e53b3d491251cc46d474c8f4da944e2e8f73242525df878484"
     },
     {
       "path": "src/bongos/module-submissions.js",
@@ -9787,7 +9802,7 @@
     {
       "path": "src/module-api.js",
       "mode": "0000644",
-      "sha256": "fef1ab161dad460d5e2e95cfea66403745c0658e4551a90528a1318b9525ad7f"
+      "sha256": "b0f164fe792662f67fe4184880ea2197ae4b22bec2696fdcb1693778caf44999"
     },
     {
       "path": "src/module-loader/catalog.js",
@@ -9979,6 +9994,11 @@
       "mode": "0000644",
       "sha256": "f4c30504e6240d68774e8960d031888616074d90e60e0edb5adddec2c820ac75"
     },
+    {
+      "path": "tests/api_alias_caller_ratchet.mjs",
+      "mode": "0000644",
+      "sha256": "58e78fbcfada9df14fee87c526d225bdcc0e6f65a5e9085a4b6ea382a8041eb2"
+    },
     {
       "path": "tests/api_alias_exceptions.mjs",
       "mode": "0000644",
@@ -11854,6 +11874,11 @@
       "mode": "0000644",
       "sha256": "d7dd04f3e4678295ddf89897ab360f1931794228de3ce5ee8a3dd86e9385cbc9"
     },
+    {
+      "path": "tests/idea_landing_preview.mjs",
+      "mode": "0000644",
+      "sha256": "ba21a652edd95d5e1a88f9c5b48d27e68610e4d89508efcd343a063c6d8c3169"
+    },
     {
       "path": "tests/idea_quick_guard.mjs",
       "mode": "0000644",
@@ -11882,7 +11907,7 @@
     {
       "path": "tests/idea_spark_hall.mjs",
       "mode": "0000644",
-      "sha256": "c7125e9c139999e48a778e7d149068e94da1e817ce737446f2312e75aaad4388"
+      "sha256": "997437b9259fdbc0583080dee18026be40c0369809b26de0b918b9c0f034bb2d"
     },
     {
       "path": "tests/idea_spark_mark.mjs",
@@ -12277,7 +12302,7 @@
     {
       "path": "tests/module-scope-map.mjs",
       "mode": "0000644",
-      "sha256": "b2609440d099b93b61c63c3cdaa4cf6e65c6dc107b8aa4d06d9cb81c9ec5e2c9"
+      "sha256": "fae747eaeea8e9d657de097a72e5f8d244bd2ece6c7e890ff4c9756787721bc5"
     },
     {
       "path": "tests/module_api.mjs",
@@ -12762,7 +12787,7 @@
     {
       "path": "tests/provision_caddy_wiring.mjs",
       "mode": "0000644",
-      "sha256": "a4d448622c05e963602cbc0488215ba168c909bd12cd0db20eaa6fcb7de7a91e"
+      "sha256": "2eb850e431c5355d2645eec48554c686ad5b57222ee863489a29b78d945b7a26"
     },
     {
       "path": "tests/provision_disconnect.mjs",
@@ -12947,7 +12972,7 @@
     {
       "path": "tests/quarantine_canonical.mjs",
       "mode": "0000644",
-      "sha256": "d8a2376c5ff96d77378626c9b4d1c32660e8412afb2531cf93085564890ffdef"
+      "sha256": "672096eb5917d45b1c77e1d07c4b7a6613a0714eb4b38327057fcea11a41b7ad"
     },
     {
       "path": "tests/rank_floor_wiring.mjs",

package/clients/bongos-client/README.md

@@ -5,7 +5,7 @@ A **generated**, zero-dependency typed client for the Bongos API — produced fr
 by hand; it regenerates when the spec changes, so it can never drift from the routes.
 
 - API version: **v1** (served at `/api/bongos/v1`)
-- 400 operations across 60 resource groups
+- 401 operations across 60 resource groups
 
 ## Use it from your project
 

package/clients/bongos-client/bongos-client.global.js

@@ -521,6 +521,8 @@ function createClient(opts = {}) {
       getInboxAwaitingNod: (args) => request("GET", "/inbox/awaiting-nod", { hasBody: false }, args),
       // GET /inbox/by-builder/{id} — rank: any-builder — GET /inbox/by-builder/:id
       getInboxByBuilderId: (args) => request("GET", "/inbox/by-builder/{id}", { hasBody: false }, args),
+      // POST /inbox/preview-landing — rank: any-builder — POST /inbox/preview-landing
+      postInboxPreviewLanding: (args) => request("POST", "/inbox/preview-landing", { hasBody: true }, args),
       // GET /inbox/rotting — rank: any-builder — GET /inbox/rotting
       getInboxRotting: (args) => request("GET", "/inbox/rotting", { hasBody: false }, args),
       // POST /inbox/score — rank: any-builder — POST /inbox/score

package/clients/bongos-client/index.cjs

@@ -520,6 +520,8 @@ function createClient(opts = {}) {
       getInboxAwaitingNod: (args) => request("GET", "/inbox/awaiting-nod", { hasBody: false }, args),
       // GET /inbox/by-builder/{id} — rank: any-builder — GET /inbox/by-builder/:id
       getInboxByBuilderId: (args) => request("GET", "/inbox/by-builder/{id}", { hasBody: false }, args),
+      // POST /inbox/preview-landing — rank: any-builder — POST /inbox/preview-landing
+      postInboxPreviewLanding: (args) => request("POST", "/inbox/preview-landing", { hasBody: true }, args),
       // GET /inbox/rotting — rank: any-builder — GET /inbox/rotting
       getInboxRotting: (args) => request("GET", "/inbox/rotting", { hasBody: false }, args),
       // POST /inbox/score — rank: any-builder — POST /inbox/score

package/clients/bongos-client/index.d.ts

@@ -325,6 +325,7 @@ export interface PostInboxIdDevelopRequest { field_values: Record<string, unknow
 export interface PostInboxIdRatifyRequest { notes_md?: string }
 export interface PostInboxIdResubmitRequest { field_values: Record<string, unknown>; template_key?: string }
 export interface PostInboxIdSparkResponse { idea: unknown; sparked: boolean; unchanged: boolean }
+export interface PostInboxPreviewLandingRequest { goal_id?: number; kind?: string; grade?: string }
 export interface PostInboxRequest { title: string; body_md?: string; kind?: string; suggested_version?: string; suggested_priority?: number; goal_id?: number; grade?: string; template_key?: string; field_values?: Record<string, unknown> }
 export interface PostInboxScoreRequest { field_values: Record<string, unknown>; template_key?: string }
 export interface PostInboxScoreResponse { score: unknown; fields: unknown; template_key: unknown }
@@ -893,6 +894,8 @@ export interface BongosClient {
     getInboxAwaitingNod(args?: RequestArgs): Promise<GetInboxAwaitingNodResponse>;
     /** GET /inbox/by-builder/{id} — rank: any-builder */
     getInboxByBuilderId(args?: RequestArgs): Promise<GetInboxByBuilderIdResponse>;
+    /** POST /inbox/preview-landing — rank: any-builder */
+    postInboxPreviewLanding(args?: RequestArgs & { body?: PostInboxPreviewLandingRequest }): Promise<ApiResponse>;
     /** GET /inbox/rotting — rank: any-builder */
     getInboxRotting(args?: RequestArgs): Promise<GetInboxRottingResponse>;
     /** POST /inbox/score — rank: any-builder */

package/clients/bongos-client/index.mjs

@@ -517,6 +517,8 @@ export function createClient(opts = {}) {
       getInboxAwaitingNod: (args) => request("GET", "/inbox/awaiting-nod", { hasBody: false }, args),
       // GET /inbox/by-builder/{id} — rank: any-builder — GET /inbox/by-builder/:id
       getInboxByBuilderId: (args) => request("GET", "/inbox/by-builder/{id}", { hasBody: false }, args),
+      // POST /inbox/preview-landing — rank: any-builder — POST /inbox/preview-landing
+      postInboxPreviewLanding: (args) => request("POST", "/inbox/preview-landing", { hasBody: true }, args),
       // GET /inbox/rotting — rank: any-builder — GET /inbox/rotting
       getInboxRotting: (args) => request("GET", "/inbox/rotting", { hasBody: false }, args),
       // POST /inbox/score — rank: any-builder — POST /inbox/score

package/docs/adr/0314-module-protection-is-per-path-not-per-module.md

@@ -1,6 +1,6 @@
 # ADR 0314 — A module owns a protected path without the whole module becoming protected
 
-- **Status:** accepted (design only — the implementation is a follow-up, see *Not built here*)
+- **Status:** accepted — **implemented** by [task 1004109](https://cloudbongos.com/builders#/task/1004109) (2026-09-20)
 - **Date:** 2026-09-20
 - **Task:** [task 1004070](https://cloudbongos.com/builders#/task/1004070), goal 1000095 — BONGOS-V2
 - **From:** idea 1000689; owner decision 2026-09-19 — *option 1, narrow what counts as protected*
@@ -105,7 +105,12 @@ Three reasons this is the honest shape rather than the convenient one:
 Per the task: an ADR first, implementation as a follow-up. This decision builds no
 new derivation mechanism. Filed separately:
 
-- The implementation of the per-path goal-scope wall.
+- ~~The implementation of the per-path goal-scope wall.~~ **Landed** in
+  [task 1004109](https://cloudbongos.com/builders#/task/1004109): `isProtected` now
+  filters a module's protecting globs to those that are not CLI entrypoints (a
+  structural path test — directories under `scripts/` are territory and still
+  protect), narrowing the derived set from twelve to the nine predicted below.
+  Nothing was unprotected to achieve it and the path wall did not move.
 - **`builder-settings`, deliberately out of scope.** Its overlap is
   `src/bongos/routes/me.js` caught by the blanket `src/bongos/routes/` prefix, so
   narrowing it means either finishing the strangler move of `me.js` into

package/docs/adr/0315-a-plane-with-no-proxy-is-refused-not-given-a-no-op-ingress.md

@@ -0,0 +1,96 @@
+# ADR 0315 — A plane with no proxy is refused, not given a no-op ingress
+
+**Status:** accepted · **Date:** 2026-09-20 · **Task:** [task 1004017](https://cloudbongos.com/builders#/task/1004017) (goal 1000106 — BONGOS-V2)
+
+**Related:** [ADR 0303](0303-provisioning-verifies-the-base-caddyfile-and-never-edits-it.md) (detect-and-refuse on the base Caddyfile — the check this one sits in front of) · [ADR 0306](0306-instance-supervision-is-a-seam-with-systemd-as-the-default.md) (the supervision seam that explicitly deferred Caddy reload to this task) · [ADR 0285](0285-a-shared-box-holds-about-twelve-projects-per-gb-and-memory-is-the-wall.md) (the capacity preflight this one is ordered behind) · [ADR 0111](0111-instance-hosting-provisioning-module.md) (the standup runbook both checks live inside)
+
+## Context
+
+Provisioning step 6 writes a per-instance `<slug>.caddy` snippet and runs
+`systemctl reload caddy`. The self-host image installs `postgresql-client bash tini curl
+ca-certificates git`, runs `USER node`, and ships no proxy of any kind — so on a compose
+self-host that step cannot work, and a child instance provisioned there has no front door.
+
+ADR 0306 named this explicitly as the piece its seam does not cover: *"`systemctl reload
+caddy` is shared-proxy config, governed by ADR 0303, and the container has no Caddy at
+all — that is task 1004017, not this seam."*
+
+**Two failure shapes, and only one of them was visible.** ADR 0303's preflight is gated on
+`inst.domain`, so:
+
+- A **domained** child already half-refused — `caddy adapt` fails with no binary, which
+  ADR 0303's own `catch` turns into a gap string. But the message told the operator to add
+  a directive to `/etc/caddy/Caddyfile`: a file the container does not have and that
+  provisioning will never create (ADR 0303 §1 forbids writing it).
+- A **domainless** child skipped the preflight entirely, walked to step 6, and died on
+  `boxWriteFile('/etc/caddy/sites/<slug>.caddy', …, {sudo: true})`. That throw is uncaught,
+  so it bypasses the `{ok:false}` pending-retry path and hard-errors the instance on attempt
+  one. The runner recorded a crash where the honest answer was a refusal.
+
+## Decision
+
+**A plane with no reverse proxy is refused before anything is attempted, and the refusal
+names what the plane lacks.**
+
+`ingressPlaneGap(exec)` in `scripts/gds/provision-net.js` probes the plane with
+`caddy version` — one cheap, unprivileged, read-only command, the same posture as
+`checkCaddyWiring`'s `caddy adapt`. It returns `null` when a proxy answers, or a string
+naming the missing proxy. Both standup legs (`provisionInstance` step 6's owner, and
+`domainAttachInstance`) call it and return `{ok:false, error: 'Ingress preflight failed: …'}`.
+
+**It is deliberately NOT domain-gated.** That is the whole point: the domainless child is
+the one ADR 0303 could not see.
+
+**A missing binary is the only failure that proves there is no proxy.** Under remote exec
+`boxExec` is `ssh <host> bash -s`, so a briefly-unreachable co-hosting box throws here too —
+and answering that with "this plane has no reverse proxy, provision from a host that runs
+Caddy" would be a confident wrong diagnosis, burning the intent's retry budget on a network
+blip. Exit 127 (and the `command not found` / `is not recognized` wordings) is read as proof;
+anything else returns *"could not confirm a reverse proxy on this plane"* with the real cause
+leading. ssh reports its own failures as 255 and otherwise propagates the remote command's
+status, so 127 still means "no caddy" across the hop.
+
+**The three refusals are ordered capacity → ingress → wiring**, cheapest and most
+fundamental first, and all three return before anything on the box changes:
+
+1. `capacityPreflight` measures locally (ADR 0285 promises a full box is measured first and
+   refuses before anything else runs);
+2. ingress asks whether this plane has a proxy **at all**;
+3. ADR 0303 then asks whether that proxy is wired for **this domain**.
+
+Asking 0303 first is what produced the "edit a Caddyfile you do not have" answer, so this
+ADR moves 0303's preflight behind the capacity measurement to make room. Both still refuse
+before any mutation, so neither guarantee is weakened — only the precedence between two
+refusals changes.
+
+**No ingress seam, and no no-op backend.** The obvious symmetry with ADR 0306 would be a
+`resolveIngress()` registry with a `none` implementation whose `writeSite`/`reload` are
+no-ops. That is rejected: a no-op backend lets the standup **succeed** while leaving the
+child unreachable, which is neither "reachable at a documented address" nor "refuses with a
+clear error" — it is the silently-broken instance this task exists to prevent. ADR 0306's
+seam exists because two real planes both need supervising; here the second plane cannot
+serve a child at all, and the honest encoding of that is a refusal, not an implementation.
+
+## Consequences
+
+- **A compose self-host still cannot provision a child instance — it now says so.** This
+  closes the failure mode, not the capability. Giving the container a real front door
+  (a published port, a bundled proxy, an explicit localhost-only shape) remains unbuilt, and
+  a future ADR that adds one replaces this refusal rather than extending it.
+
+- **One extra `caddy version` per applied standup.** Read-only, unprivileged, and it runs
+  after the capacity measurement, so a full box still refuses without it. A dry run never
+  probes, and a dedicated droplet is skipped — Caddy comes from cloud-init there.
+
+- **ADR 0303's territory is untouched.** "Caddy is here but mis-wired" is still its question
+  and still its message; this ADR only answers the prior one. Every command string ADR 0303
+  pins in `tests/provision_caddy_wiring.mjs`, `tests/provision.mjs` and
+  `tests/provision_teardown_address.mjs` is unchanged.
+
+- **Teardown is not covered.** `provision-teardown.js` removes the snippet and reloads with
+  `allowFail: true`, so it already degrades rather than crashing. Left alone deliberately: a
+  refusal on the teardown path would strand a row instead of cleaning it.
+
+- **The probe is a capability question, not a configuration knob.** There is no
+  `PROVISION_INGRESS` env var. A plane either answers `caddy version` or it does not, and an
+  operator who wants provisioning to proceed needs a proxy, not a flag that says to pretend.

package/docs/adr/README.md

@@ -406,3 +406,4 @@ This keeps the decision history honest and traceable.
 | 0312 | [**Provenance is a SECOND ideas-owned edge table, written by the seams that already know** ([task 1004080](https://cloudbongos.com/builders#/task/1004080), goal 1000095 — BONGOS-V2). The spike [ADR 0311](0311-an-idea-is-a-permanent-origin-tag.md) deferred: how the descent edges are physically recorded. A descent (`idea → task → rewrite → split → removal`) is four levels deep and crosses a version boundary, and the task hierarchy refuses both — `attachParent` enforces `SELF_PARENT`, `VERSION_MISMATCH`, `PARENT_HAS_PARENT` and `TARGET_HAS_CHILDREN`, all load-bearing for ship rollup and claim safety. The spike was told to CONFIRM `ideas_task_lineage` rather than assume it, and confirmed one half while refuting the other: the table is right as the **idea→task anchor** (bipartite, no depth cap, no version predicate) but CANNOT carry the task→task edge, because a derivation is a property of the task PAIR and [ADR 0236](0236-many-ideas-one-task-the-lineage-key-is-the-pair.md) made co-source ideas both legal and common — a `derived_from_task_id` column would write the same derivation once per co-source idea and let two rows disagree about where a task came from, the same under-keying that silently lost attribution on prod once already. A merge also gives a task SEVERAL parents, so the relation is a **DAG, not a tree**. Decision: a new `ideas_task_descent` (`task_id`, `parent_task_id`, CHECK'd `relation`, PK on the pair, indexed both ways), with NO depth cap and NO version predicate, and **cycles refused at write time** because the payout walks this graph and a cycle is a non-terminating walk rather than a cosmetic error. On who writes it — the question the task actually set, since an edge depending on memory will have holes — **three seams already know and none is telling anyone**: `cascade.js` encodes the originating task id inside `source_ref` as a STRING nothing can join on, `tasks.merged_into_task_id` already records the fold, and `parent_task_id` already records the split. Only `rewrite` and cross-version `merge` stay manual, which is honest — they are editorial acts with no automatic signal, and their absence degrades the picture rather than corrupting it. What it fixes: `sourceIdeaForTask` and `awardIdeaTaskShipCredit` are both one-hop `LIMIT 1` point reads, so a DERIVED task resolves to `no_source_idea` and the origin is not paid at all. Does not decide: the decay rate beyond its default, what counts as removed ([ADR 0313](0313-a-removal-is-proposed-by-the-ship-and-confirmed-by-a-person.md)), or how any of it is drawn.](0312-provenance-is-a-second-ideas-owned-edge-table.md) | ideas / lifecycle |
 | 0313 | [**A removal is derived from the SERVER's own merge diff and confirmed by a person** ([task 1004081](https://cloudbongos.com/builders#/task/1004081), goal 1000095 — BONGOS-V2). The other half [ADR 0311](0311-an-idea-is-a-permanent-origin-tag.md) deferred: what counts as removed, so that brightness can fall at all. Nothing records it today — `shipped` is terminal (`rot.js` says so outright) and `merged_into_task_id` is CHECK'd to `abandoned` rows, describing only work cut BEFORE it landed. Owner decision 13 set the shape (system proposes, person confirms); this settles the detail, and corrects two premises the task was written on. **`cascade.js` is no longer empty** — it carries a production rule and [ADR 0242](0242-a-cascade-is-a-declaration-table-on-the-event-that-already-exists.md) fixed the contract (append an entry, never touch the runner), so there is a precedent to copy including its anti-recursion guard. **`netNegativeBonusAmount` cannot be the trigger** despite being the named nearest signal: it is an aggregate with NO TARGET (it says deletion happened, never what or whose), it is CLIENT-SUPPLIED via `signals.diff_stats`, and `grader-score.js` already documents the forgery it defends against — and brightness sits beside a payout, so a forgeable target-less counter cannot carry it. **Nothing durable records what any ship touched**: `committed_files` and `diff_stats` are client-supplied at grade time and never persisted, `touches[]` is advisory ([ADR 0049](0049-split-parallel-safety-contract.md)), so a removal cannot be reconstructed from history — only derived as a ship lands. Decision: derive it from the SERVER's own merge diff ([ADR 0055](0055-server-mediated-branch-publish.md) — the server holds the repo and does the merge, so it computes the diff rather than being told one), and attribute the deleted hunks through **`claims.published_head_sha`** (`migrations/171`), NOT by parsing `(task NNNN)` out of commit text — only 7 of `main`'s last 15 commits carry a task id, and a convention that holds most of the time cannot underwrite a payout. An UNATTRIBUTABLE deletion files nothing: a wrong proposal costs attention and dims a real star. A rename, a move and a rewrite-in-place are NOT removals, and a cold body is not a remnant — removal applies only below a task that actually shipped. The proposal is an appended `CASCADES` entry filing a QUESTION; confirmation is Metic+/`task.promote` on the existing awaiting-nod surface; an unanswered one rots on the normal clock. Only a CONFIRMED proposal dims a star. The derivation must be NON-BLOCKING — landing work matters more than dimming a star on time. Brightness can only fall forward from here, so historical sizes need a marker or the number lies.](0313-a-removal-is-proposed-by-the-ship-and-confirmed-by-a-person.md) | ideas / lifecycle |
 | 0314 | [**A module owns a protected path without the whole module becoming protected** ([task 1004070](https://cloudbongos.com/builders#/task/1004070), goal 1000095 — BONGOS-V2). Three modules derive `protected` — and so are Archon-only to scope a goal to — because of ONE file that is not their domain: `onboarding` on `scripts/gds/setup.js`, `autonomy` on `scripts/gds/conductor-dispatch.js`, `copy-desk` on `scripts/gds/copy-inventory.js`. The owner chose *narrow what counts as protected*; the task set the fork and required the choice be justified before any glob moved. **Deleting the glob is out**: `MODULE_GLOBS` is also the territory deciding who may AUTHOR a task on a path, and the shared floor is only `tests/`, so an unowned path is authorable by no goal at all. That left reassigning each CLI to an already-protected module — **measured, not reasoned about**, by applying the edit to the source and re-requiring in a fresh process (`MODULE_SCOPE_MAP` is frozen and built from a COPY of `MODULE_GLOBS` at load, so an in-process mutation proves nothing and passes green). The measurement kills it: `copy-desk` and `autonomy` lose the ability to author on their own generator and their own conductor, and — the row that decides it — `devsecops` as the new owner **cannot author the generator together with the two artifacts it writes**, because `docs/copy-registry.json` and `docs/copy-inventory.md` stay `copy-desk`'s. So *change a UI string, regenerate the registry* becomes authorable by no single goal, and that is the ship-check freshness gate every UI task hits. Decision: **protection becomes per-path at the goal-scope wall, as it already is at the other three** — `matchProtected` decides task-authoring, the grader and gate decide ship, the post-push audit decides the dishonest case; only goal-creation asked about the MODULE, and that inconsistency is the whole defect. The derivation stays computed from `PROTECTED_GLOBS` and no flag is hand-set ([ADR 0086](0086-goal-scoped-work-hierarchy.md) §7 / SEC #863), and the Metic floor on those paths does not move. **Corrects the task's own numbers**: 12 of 26 modules derive protected, not 11, and `agents` (protected by `modules/agents/`, itself a protected glob) is absent from its list of seven — which is why the one thing this ADR SHIPS is a test pinning the full protected key set **by name**, a count assertion passing on the wrong twelve being exactly how that drifted. Implementation is deferred to task 1004109, per the task's own instruction to stop after the ADR. Also filed: `builder-settings` (task 1004110), whose overlap rides the blanket `src/bongos/routes/` prefix and so needs either the `me.js` strangler move or its own security ADR; and **nine protected paths owned by no module at all** (task 1004111) — the freshness generators, the merge-driver pair and `cli-lib.js` among them — found while checking whether deletion was viable, a pre-existing hole rather than one this opens. Does not decide: the floor a protected path carries, whether `scripts/gds/` deserves a shared-floor entry the way `tests/` has one, or how the nine unowned paths get a home.](0314-module-protection-is-per-path-not-per-module.md) | modules / permissions |
+| 0315 | [**A plane with no proxy is refused, not given a no-op ingress** ([task 1004017](https://cloudbongos.com/builders#/task/1004017), goal 1000106 — BONGOS-V2). The piece [ADR 0306](0306-instance-supervision-is-a-seam-with-systemd-as-the-default.md) explicitly deferred: the self-host image ships no proxy, so provisioning step 6's `<slug>.caddy` snippet write and `systemctl reload caddy` cannot work there and a child instance gets no front door. **Two failure shapes, only one visible**: a DOMAINED child already half-refused, because `caddy adapt` fails with no binary and [ADR 0303](0303-provisioning-verifies-the-base-caddyfile-and-never-edits-it.md)'s own catch turns that into a gap — but the message told the operator to add a directive to `/etc/caddy/Caddyfile`, a file the container does not have and that ADR 0303 §1 forbids provisioning from creating; a DOMAINLESS child skipped that preflight entirely (it is gated on `inst.domain`), reached step 6 and died on the `sudo` write, an uncaught throw that bypasses the `{ok:false}` pending-retry path and hard-errors the instance on attempt one — a crash recorded where a refusal was the honest answer. Decision: `ingressPlaneGap(exec)` probes the plane with `caddy version` — one cheap unprivileged read, the same posture as `checkCaddyWiring` — and both standup legs refuse with `Ingress preflight failed: …`, deliberately NOT domain-gated, because the domainless child is the one 0303 could not see. **Only a missing binary proves there is no proxy**: under remote exec `boxExec` is `ssh <host> bash -s`, so an unreachable co-hosting box throws here too, and diagnosing a network blip as 'this plane has no proxy, provision elsewhere' would be a confident wrong answer that burns the intent's retry budget — exit 127 is read as proof, anything else answers 'could not confirm a reverse proxy on this plane' with the real cause leading. The three refusals are ordered **capacity → ingress → wiring**, cheapest and most fundamental first and all before any mutation, which moves 0303's preflight behind the ADR 0285 capacity measurement; both still refuse before anything changes, so only the precedence between two refusals moves. **No ingress seam and no no-op backend**, despite the obvious symmetry with 0306: a `none` implementation whose `writeSite`/`reload` are no-ops lets the standup SUCCEED while leaving the child unreachable — neither half of the task's done-when, and exactly the silently-broken instance it exists to prevent. Does not decide: what a child's front door IS on a container plane (a published port, a bundled proxy, an explicit localhost-only shape) — a future ADR that adds one replaces this refusal rather than extending it. Teardown is left alone on purpose: it already reloads `allowFail`, and refusing there would strand a row instead of cleaning it.](0315-a-plane-with-no-proxy-is-refused-not-given-a-no-op-ingress.md) | provisioning / ingress |

package/docs/api/openapi.json

@@ -8476,6 +8476,48 @@
         ]
       }
     },
+    "/inbox/preview-landing": {
+      "post": {
+        "operationId": "post_inbox_preview_landing",
+        "tags": [
+          "inbox"
+        ],
+        "summary": "POST /inbox/preview-landing",
+        "description": "POST /inbox/preview-landing — GRAVITY, MADE VISIBLE (task 1004083, BV2.R02). What pressing \"File it\" would do, without doing it. The composer draws one line from this so a filer can see which goal will catch the thought, change it, or deliberately let it float — the criterion's done-when, read literally. A DRY RUN IN THE SHAPE OF /inbox/score DIRECTLY ABOVE: same POST-with-a-body reason (the draft is the input, not an id), same \"a half-formed draft is a legal state\" contract. It differs in one way worth naming, because the file header above claims /score is pure: this one READS (the goal row, the building version). It still WRITES NOTHING — see ../landing-preview.js, which calls `currentBuildingVersionId` and deliberately never `ensureMaintenanceGoal`, so previewing a homeless bug cannot mint a goal as a side effect of typing. THE RANK AND THE VECTOR ARE NOT READ FROM THE BODY, exactly as POST /inbox refuses to read them: the rank comes off the authenticated builder and the vector is hardcoded to 'api'. A preview is only worth having if it is the same question the capture will be asked — one that answered a rank the filer does not hold would teach them a landing they cannot have. NEVER A 4xx FOR A DRAFT. Only the input SHAPE is validated; an unknown kind, an absent title, a goal that vanished all come back as `outcome: null` (\"nothing to say yet\"), because a composer redrawing on every keystroke must degrade to silence rather than to a red error under a half-typed thought. rank: any-builder — it answers only about the caller's own prospective filing, and filing itself is open to every rank.\n\n**Rank:** `any-builder` — Any authenticated builder (row-level ownership enforced in-handler).",
+        "x-rank": "any-builder",
+        "x-source": "modules/ideas/routes/inbox.js",
+        "requestBody": {
+          "required": false,
+          "content": {
+            "application/json": {
+              "schema": {
+                "$ref": "#/components/schemas/PostInboxPreviewLandingRequest"
+              }
+            }
+          },
+          "x-validated": true
+        },
+        "responses": {
+          "200": {
+            "description": "Success."
+          },
+          "400": {
+            "$ref": "#/components/responses/ValidationFailed"
+          },
+          "401": {
+            "$ref": "#/components/responses/Unauthorized"
+          },
+          "403": {
+            "$ref": "#/components/responses/Forbidden"
+          }
+        },
+        "security": [
+          {
+            "builderSession": []
+          }
+        ]
+      }
+    },
     "/inbox/rotting": {
       "get": {
         "operationId": "get_inbox_rotting",
@@ -23123,6 +23165,24 @@
           "unchanged"
         ]
       },
+      "PostInboxPreviewLandingRequest": {
+        "type": "object",
+        "properties": {
+          "goal_id": {
+            "type": "integer",
+            "minimum": 1
+          },
+          "kind": {
+            "type": "string",
+            "maxLength": 64
+          },
+          "grade": {
+            "type": "string",
+            "maxLength": 16
+          }
+        },
+        "additionalProperties": false
+      },
       "PostInboxRequest": {
         "type": "object",
         "properties": {
@@ -25361,8 +25421,8 @@
       "description": "A required dependency/feature is not configured or is temporarily down."
     }
   },
-  "x-endpoint-count": 400,
-  "x-schema-count": 439,
+  "x-endpoint-count": 401,
+  "x-schema-count": 440,
   "x-undocumented-bodies": 9,
   "x-response-schemas": 300,
   "x-generated-by": "scripts/gds/gen-api-docs.js"

package/docs/api-reference.md

@@ -2,7 +2,7 @@
 
 # Bongos API reference
 
-> **Generated from the live route files** — the route file is authoritative. 400 endpoints across 64 route files.
+> **Generated from the live route files** — the route file is authoritative. 401 endpoints across 64 route files.
 > Machine-readable spec: [`docs/api/openapi.json`](api/openapi.json) (OpenAPI 3.1). Rendered docs site: **`/docs`** (e.g. `cloudbongos.com/docs`).
 
 Base path: `/api/bongos`. Ranks (enforced server-side, [ADR 0016](adr/0016-trust-boundary-server-enforced-permissions.md)): `public` < `any-builder` < `metic+archon` < `archon`.
@@ -337,7 +337,7 @@ Base path: `/api/bongos`. Ranks (enforced server-side, [ADR 0016](adr/0016-trust
 | GET | `/api/bongos/help-requests/for-me` | `any-builder` | — | The addressed read — C01's answer to "and fires a notification". |
 | GET | `/api/bongos/help-requests/mine` | `any-builder` | — | your own asks, so you can settle them. |
 
-## `inbox` (16)
+## `inbox` (17)
 
 | Method | Path | Rank | Body | Description |
 |---|---|---|---|---|
@@ -353,6 +353,7 @@ Base path: `/api/bongos`. Ranks (enforced server-side, [ADR 0016](adr/0016-trust
 | DELETE | `/api/bongos/inbox/:id/spark` | `any-builder` | — | Withdraw the Big Idea Spark mark — the reversibility half of R144. |
 | GET | `/api/bongos/inbox/awaiting-nod` | `metic+archon` | — | GET /inbox/awaiting-nod — the NOD QUEUE (task 1003066, BV1.R05). |
 | GET | `/api/bongos/inbox/by-builder/:id` | `any-builder` | — | THE IDEA TRAIL: every idea one builder filed, newest first, with what became of each (task 1003281, goal 1000072, criterion legibility-ac… |
+| POST | `/api/bongos/inbox/preview-landing` | `any-builder` | `goal_id`, `kind`, `grade` | POST /inbox/preview-landing — GRAVITY, MADE VISIBLE (task 1004083, BV2.R02). |
 | GET | `/api/bongos/inbox/rotting` | `any-builder` | — | GET /inbox/rotting — what is quietly rotting, for this caller. |
 | POST | `/api/bongos/inbox/score` | `any-builder` | `field_values`, `template_key` |  |
 | GET | `/api/bongos/inbox/sparks` | `any-builder` | — | GET /inbox/sparks — THE SPARK QUEUE (task 1002921 / BV1.R145, goal 1000062). |