@bongos/core 1.20.24 → 1.20.26

package/.bongos-core.json

@@ -2,22 +2,22 @@
   "artifact": "bongos-core",
   "manifest_schema": 1,
   "generator": "scripts/gds/package-core.js",
-  "core_version": "1.20.24",
-  "core_contract": "1.20.24",
-  "source_commit": "64e82c9e53ba033fa0a010b81ce5a1530730df4f",
+  "core_version": "1.20.26",
+  "core_contract": "1.20.26",
+  "source_commit": "7bf58c3913461c4383f40d27a2c2abe4b357ee85",
   "source_ref": "HEAD",
-  "built_at": "2026-09-30T18:38:12.477Z",
+  "built_at": "2026-09-30T19:12:54.558Z",
   "redaction": {
     "model": "docs-redacted+functional-verbatim",
-    "docs_redacted": 558,
+    "docs_redacted": 560,
     "agent_docs_stubbed": 25,
-    "functional_verbatim": 2643,
+    "functional_verbatim": 2647,
     "rules": 3,
     "gate_literals": 3,
     "gate": "passed"
   },
-  "file_count": 3227,
-  "tree_sha256": "d2625091be4e2f62dd4ef689d1ae4db2c14ae9fd89b7491059734525b36b140a",
+  "file_count": 3233,
+  "tree_sha256": "6cc2f111dd67610b01e2286ded5cfef7db118cdbb5afe9d134262e29262f7ade",
   "files": [
     {
       "path": ".claude/skills/ask-for-help/SKILL.md",
@@ -327,12 +327,12 @@
     {
       "path": "clients/bongos-client/README.md",
       "mode": "0000644",
-      "sha256": "ff5585737cc618ca1a24c994a27411a6f4b60192d4904063771744788c0b8002"
+      "sha256": "6142e330ccbf058cfe2d266b80d1dab1419cdd9194f39933da2f410d6e20abb1"
     },
     {
       "path": "clients/bongos-client/bongos-client.global.js",
       "mode": "0000644",
-      "sha256": "f0a11cd6519a8ba62cb645c8d50da768f00f7252562a8b7a2f6e089ae0040f5e"
+      "sha256": "094ba492c058258352e891a1d418fbff5777d40176e21292a6c92c0ad4c55902"
     },
     {
       "path": "clients/bongos-client/examples/hello-world.mjs",
@@ -342,17 +342,17 @@
     {
       "path": "clients/bongos-client/index.cjs",
       "mode": "0000644",
-      "sha256": "60673c698acad267f556a78b0e4d13b60d5357208a8772fe0d69cbd60b2b1c2c"
+      "sha256": "4b57358e758f2959d9564bd59dab8c8d4ecfddebba4ee972884dd19522eb0f6c"
     },
     {
       "path": "clients/bongos-client/index.d.ts",
       "mode": "0000644",
-      "sha256": "2697fd1139e28cf2bf4ca8a5d4218d22060399bb4050cfdaa9457eae6c639b79"
+      "sha256": "c8fab17a151038309beceb2ca3e07a4dfbaa8d79f82b2b314cb3f1440882c3b6"
     },
     {
       "path": "clients/bongos-client/index.mjs",
       "mode": "0000644",
-      "sha256": "37028d9008247d9afd900f38437e1f8e335c19633c55379864177033d4f1bc89"
+      "sha256": "007c35d80ca1e647157a3330d4791871119659228b4ad2fc8091d9f6b00b6e3b"
     },
     {
       "path": "clients/bongos-client/package.json",
@@ -2239,20 +2239,25 @@
       "mode": "0000644",
       "sha256": "4445d9c306a22fb3b7e72467bedad262f4653c092bf4866f8a39410248da2724"
     },
+    {
+      "path": "docs/adr/0354-a-builder-hosts-one-project-free-and-more-takes-the-fleet-permission.md",
+      "mode": "0000644",
+      "sha256": "962d868c0887244c53b53c58754f7232715a20df6feec694f30cbda707f9e17e"
+    },
     {
       "path": "docs/adr/README.md",
       "mode": "0000644",
-      "sha256": "6be10fb1925fd406729e08b4d604569b1123b7c5f6091300559df8532831ab69"
+      "sha256": "850168519d3ef7eaf6d9658b9e2b19a80402147e9f3e8fc5318c53b7647fa9b0"
     },
     {
       "path": "docs/api-reference.md",
       "mode": "0000644",
-      "sha256": "d6a19f9db87e4d936f317efe07e1a4dfaaa75c5a6797a4c3e4939634adec8494"
+      "sha256": "0d81859e19436003332c5ee22b94c7e0a23636a61ac2a52118c15caae71fb31c"
     },
     {
       "path": "docs/api/openapi.json",
       "mode": "0000644",
-      "sha256": "f44cf9111baee003af84ab6c83503e97a4a723c4cb2ad59ad367cce75f8f717e"
+      "sha256": "ce15358f33baf4ba95f59b2e2de9bfc4a5a4a0dddde5bfc91a0bfab09e4447f9"
     },
     {
       "path": "docs/architecture.md",
@@ -2277,12 +2282,12 @@
     {
       "path": "docs/copy-inventory.md",
       "mode": "0000644",
-      "sha256": "5034d255bbdcdd29c52831ce069561494a5ad7cc028b5e5711a0ab7a95a73a2b"
+      "sha256": "cc3d3c2334fabc860be82ea509588681ca03cdd34da374011e2b0d5a646b8c9a"
     },
     {
       "path": "docs/copy-registry.json",
       "mode": "0000644",
-      "sha256": "e75a8e11138b151ea81f378dde8f4e7fe395b44ba9369e7c98e865ff6516eeb4"
+      "sha256": "efedc6e640a54a117e108ae85654fec0385580a108918c62a8ec96fc3b927daa"
     },
     {
       "path": "docs/design/apex-pass-2-direction.md",
@@ -2354,6 +2359,11 @@
       "mode": "0000644",
       "sha256": "dfa1ea2c45eddd5a9528487f3a0fe80398ba9018c5f73706629015ff6c2108e0"
     },
+    {
+      "path": "docs/design/project-startup-direction.md",
+      "mode": "0000644",
+      "sha256": "b7c67956a0fe3c38efc22701741b4e19ba383c942b864d2b37b195619594392f"
+    },
     {
       "path": "docs/design/projects-hub-direction-v2.md",
       "mode": "0000644",
@@ -2782,7 +2792,7 @@
     {
       "path": "docs/module-api-changelog.md",
       "mode": "0000644",
-      "sha256": "76bebe410cae7c9eeda4bcc19c45a31595de4d7a45cb1f125cd742be9d0ea97b"
+      "sha256": "7ceae0d7b1f9b1305c7dbec25e411f80c7700a128bbcf140ae65da98d73323c9"
     },
     {
       "path": "docs/modules-contract.md",
@@ -2872,7 +2882,7 @@
     {
       "path": "docs/page-readings.json",
       "mode": "0000644",
-      "sha256": "dd7227bb9daface49cfb1e2a8702cb81b95a5d19f0169038ddfd7a6c80e04225"
+      "sha256": "e9b2c838868e4b23789112734c976ecae722ee3dcc4bea948482666e7a17863a"
     },
     {
       "path": "docs/project-context.template.md",
@@ -4307,7 +4317,7 @@
     {
       "path": "modules/discord/board-broadcast.js",
       "mode": "0000644",
-      "sha256": "1d3cfd6ef66c5dfb40d8e39cad9a2683d0a7cfd692c6da85f0a008008bfd4185"
+      "sha256": "55ebb3d10844b33e0984e553b87ee06abdc59a0684b555da462d4842155e8445"
     },
     {
       "path": "modules/discord/bug-attachments.js",
@@ -4517,7 +4527,7 @@
     {
       "path": "modules/government/board.js",
       "mode": "0000644",
-      "sha256": "cce76edcf96a8ece8bb3321f5edb505e0e93acae96babe7169da607fd1888f3b"
+      "sha256": "f620a9c3cfe606955aa4b6b7dd0d194c1160bab99ee6ffc81a801edf6b3db4a6"
     },
     {
       "path": "modules/government/catalog.js",
@@ -4532,7 +4542,7 @@
     {
       "path": "modules/government/db.js",
       "mode": "0000644",
-      "sha256": "dc56a5747bb5275ba372dc297cce585219c649984778a924ce22bab7249889a8"
+      "sha256": "1eb2e506878c52aa70fdc6b75b9a392dcb29d71617685f8efd58974b9fd92ae9"
     },
     {
       "path": "modules/government/membership-predicate.js",
@@ -4669,6 +4679,11 @@
       "mode": "0000644",
       "sha256": "d267905e59cfcfa313c9f723d69bdf309d21490dc2ca9fae43422d087720470d"
     },
+    {
+      "path": "modules/government/migrations/government_020_genesis_stage_subject.sql",
+      "mode": "0000644",
+      "sha256": "6eabf8b78f84922a44bdcfacf9e5dd4c2c5ead593b81125c2cc9ca8f13f844d9"
+    },
     {
       "path": "modules/government/module.json",
       "mode": "0000644",
@@ -4702,7 +4717,7 @@
     {
       "path": "modules/government/routes/government.js",
       "mode": "0000644",
-      "sha256": "29b3cc9ab6f2aedc6992437394ad190de7da7d85c878e62be8f778fb996beea7"
+      "sha256": "58415db3a65d68f1e30f626cab20882fc324c2575226b8d6f0a82b8f018694c4"
     },
     {
       "path": "modules/government/routes/rank-sync.js",
@@ -4942,7 +4957,7 @@
     {
       "path": "modules/hall-ui/public/board-room.js",
       "mode": "0000644",
-      "sha256": "e5cfe87a21297ce1c61132b7b98f43edf07fdaf8075be6e219d09c279bfb836e"
+      "sha256": "8eb8c988b6cbdd59151f10593c3b751eac95ec2f73be198c52145d6bb934aefc"
     },
     {
       "path": "modules/hall-ui/public/board-room.states.json",
@@ -7269,6 +7284,11 @@
       "mode": "0000644",
       "sha256": "f00a21da3c27933cd34cb66a7d99ef1104eac1180d0655e8fa59e96f9a366ace"
     },
+    {
+      "path": "modules/provisioning/free-place-lock.js",
+      "mode": "0000644",
+      "sha256": "82b9f7ee39820735ca4d0f55b12fd72903b9909d3c9f0abedb684dcc98ac77c6"
+    },
     {
       "path": "modules/provisioning/migrations/provisioning_001_tables.sql",
       "mode": "0000644",
@@ -7422,7 +7442,7 @@
     {
       "path": "modules/provisioning/paid-shape-gate.js",
       "mode": "0000644",
-      "sha256": "7f7f9b1a6ffcf2f58d3a3a7b5d5244a3474f0245274a7bd6777befba36c5fc9c"
+      "sha256": "aad8d8e8a641ebcbff9aeeed765e6c1657fa5896dc9cc3e84aa32f6d327b7db2"
     },
     {
       "path": "modules/provisioning/pollers/app-liveness.js",
@@ -7512,7 +7532,7 @@
     {
       "path": "modules/provisioning/routes/provisioning.js",
       "mode": "0000644",
-      "sha256": "18a8a728c48070f99dfdaa1c21d738f8d6fcfe8dc8534574fc115cec77f8bf77"
+      "sha256": "d0a1e16b8ba6cb03bfadf95c7a3b688007309d173812e34b4e69d6e4dc33d21f"
     },
     {
       "path": "modules/provisioning/routes/render-standup.js",
@@ -8067,7 +8087,7 @@
     {
       "path": "modules/public-landing/public/projects.html",
       "mode": "0000644",
-      "sha256": "b2780277742b8f560dc431ce77498ffdefaf1a027ffde893caa472e59da512f3"
+      "sha256": "dc489131cceef3330ea6d3ee0d24c05a723076478496efb46ce8e509381aea03"
     },
     {
       "path": "modules/public-landing/public/projects.probes.json",
@@ -8912,12 +8932,12 @@
     {
       "path": "package-lock.json",
       "mode": "0000644",
-      "sha256": "cc2bd4f2449af9d3c504aa278de3c2cb3601b64d23fd2156b38764b726395217"
+      "sha256": "60d6f4672fc29b5851546d35e5a6f14c6323d7e5946908d1c2bbe301bb3a0dfa"
     },
     {
       "path": "package.json",
       "mode": "0000644",
-      "sha256": "f57e0105f2c5994b176ded81625dbf0dc0e6f9a4b5ca26cf4e2eba6a9215af23"
+      "sha256": "9bb1f16462f06299a105da0895a24faac4f1c5bb689c5c9045deeb4bb97fb5bc"
     },
     {
       "path": "public-docs/index.html",
@@ -8937,7 +8957,7 @@
     {
       "path": "release-notes.json",
       "mode": "0000644",
-      "sha256": "0ff22595a15543713edcced44a6c4cf66150bcedfdc4b242b6e83d9c45418dfa"
+      "sha256": "1e79c9b3c2692c720aac6166d50e881f8069d94be738e57e6eef882ea2ec9d4a"
     },
     {
       "path": "scripts/bongos-mcp.js",
@@ -10907,7 +10927,7 @@
     {
       "path": "src/bongos/route-rank-check.js",
       "mode": "0000644",
-      "sha256": "3d8c71836bd7a33ed336497ad98a5085ef1aaed216d6427dec09f6dcebe59250"
+      "sha256": "0a4448143b5673781ab21a3ec982a3a183c410caeb7e3afd3ba5d69586de06b2"
     },
     {
       "path": "src/bongos/routes.js",
@@ -11052,7 +11072,7 @@
     {
       "path": "src/module-api.js",
       "mode": "0000644",
-      "sha256": "3482788e77daee0cd538f507f349ab0ac522566ea19600c3d3163101bc7c1abb"
+      "sha256": "3e5ca31fb6e6c2fc7f351aa64ef4946c206050c6c34df748946a794011cd6f66"
     },
     {
       "path": "src/module-loader/catalog.js",
@@ -12794,6 +12814,11 @@
       "mode": "0000644",
       "sha256": "1bf22bc4ae339459e28a9f4e7975aac9e9d84eacd3f901d30371b44574f714c1"
     },
+    {
+      "path": "tests/government_board_genesis_stage.mjs",
+      "mode": "0000644",
+      "sha256": "a477c3f0aa0ab45167ed33a3452a8d9075a5a01a3d8722a1c290165b09ec08cf"
+    },
     {
       "path": "tests/government_board_hash_redirect.mjs",
       "mode": "0000644",
@@ -12947,7 +12972,7 @@
     {
       "path": "tests/government_seed.mjs",
       "mode": "0000644",
-      "sha256": "7760510e5a5e4ec5adf5dd255520b85888a5d95341c4f8d20f672f3fe4c96182"
+      "sha256": "3ccf2c31544009a8031fc9a5b632f285ebd08712504684662317cfbadb879f4e"
     },
     {
       "path": "tests/government_session_scope.mjs",
@@ -14467,7 +14492,7 @@
     {
       "path": "tests/project_catalog_routes.mjs",
       "mode": "0000644",
-      "sha256": "90a8283375de41b753c28096ef5c286146322857c10b83124c52748df9ba570d"
+      "sha256": "e19d61fb2734092104276d1f74f1cbdf691bfe4f920414c543a1c07e839725e6"
     },
     {
       "path": "tests/project_door_ui.mjs",
@@ -14552,7 +14577,7 @@
     {
       "path": "tests/projects_hub_pre_uat.mjs",
       "mode": "0000644",
-      "sha256": "c498363abc196c09cfc30b4e69b4cc943dd293ebecb9aa7b4319c92721a82f30"
+      "sha256": "5a2d7c53cf71d22dc7a7f4547c9dc59746002e35330a92c7047e4742c1977073"
     },
     {
       "path": "tests/projects_hub_render_connect.mjs",
@@ -14662,7 +14687,7 @@
     {
       "path": "tests/provisioning_capacity_gate.mjs",
       "mode": "0000644",
-      "sha256": "406ea4d32fe1bbb7aa1f69e0c4dc967feb2fc43c8bf0f70848547fdc6faf8762"
+      "sha256": "478f4e06bd11f64e69efd9482094f262ac29016d052117c6a866cc9f0d55c318"
     },
     {
       "path": "tests/provisioning_cost_ledger.mjs",
@@ -14687,7 +14712,7 @@
     {
       "path": "tests/provisioning_domain_attach.mjs",
       "mode": "0000644",
-      "sha256": "cd0f81de7dd909fb1db27f86be4f541e38ec36f6d76cf97f7e7c759565f9d392"
+      "sha256": "160acd275e3b466088ee5913186d430e974973a4e3eee51f3d62d8604a8fd64f"
     },
     {
       "path": "tests/provisioning_domain_lookup_index.mjs",
@@ -14727,7 +14752,7 @@
     {
       "path": "tests/provisioning_paid_shape_gate.mjs",
       "mode": "0000644",
-      "sha256": "f6f2a28ebadee97523019e3346f69f399864c6bf23b4e14029d6df81dee872cb"
+      "sha256": "c9fa4aa59e6e47c139277e3c57298ca441180c4d4752ca6994c72678219df8c8"
     },
     {
       "path": "tests/provisioning_public_refusal.mjs",
@@ -14787,13 +14812,18 @@
     {
       "path": "tests/provisioning_teardown_intent.mjs",
       "mode": "0000644",
-      "sha256": "08128da3c6b810df963cb167cf29608181627d6c6203efe57f27d1c29e22d54a"
+      "sha256": "4d06c5fd13f8cc81c050c2ed6940c91db5cdd95dea9f26ad7b8d6a8089c0254a"
     },
     {
       "path": "tests/provisioning_teardown_states.mjs",
       "mode": "0000644",
       "sha256": "1b5decd026e6487c9477b87f533852dd93821b6688c3c76e694041b3918ee420"
     },
+    {
+      "path": "tests/provisioning_wizard_create_xenos.mjs",
+      "mode": "0000644",
+      "sha256": "2b7048eb35f09fd40f93e301e7c7e999db1b12b04bd0855e616b8ae1d93006a8"
+    },
     {
       "path": "tests/pruned_lockfile_integrity.mjs",
       "mode": "0000644",

package/clients/bongos-client/README.md

@@ -5,7 +5,7 @@ A **generated**, zero-dependency typed client for the Bongos API — produced fr
 by hand; it regenerates when the spec changes, so it can never drift from the routes.
 
 - API version: **v1** (served at `/api/bongos/v1`)
-- 463 operations across 70 resource groups
+- 464 operations across 70 resource groups
 
 ## Use it from your project
 

package/clients/bongos-client/bongos-client.global.js

@@ -465,6 +465,8 @@ function createClient(opts = {}) {
       postGovernmentAssignments: (args) => request("POST", "/government/assignments", { hasBody: true }, args),
       // DELETE /government/assignments/{builderId}/{rankKey} — rank: archon — DELETE /government/assignments/:builderId/:rankKey
       deleteGovernmentAssignmentsBuilderIdRankKey: (args) => request("DELETE", "/government/assignments/{builderId}/{rankKey}", { hasBody: false }, args),
+      // GET /government/board/genesis-stages — rank: any-builder — GET /government/board/genesis-stages
+      getGovernmentBoardGenesisStages: (args) => request("GET", "/government/board/genesis-stages", { hasBody: false }, args),
       // GET /government/board/items — rank: any-builder — GET /government/board/items
       getGovernmentBoardItems: (args) => request("GET", "/government/board/items", { hasBody: false }, args),
       // POST /government/board/items — rank: metic+archon — POST /government/board/items

package/clients/bongos-client/index.cjs

@@ -464,6 +464,8 @@ function createClient(opts = {}) {
       postGovernmentAssignments: (args) => request("POST", "/government/assignments", { hasBody: true }, args),
       // DELETE /government/assignments/{builderId}/{rankKey} — rank: archon — DELETE /government/assignments/:builderId/:rankKey
       deleteGovernmentAssignmentsBuilderIdRankKey: (args) => request("DELETE", "/government/assignments/{builderId}/{rankKey}", { hasBody: false }, args),
+      // GET /government/board/genesis-stages — rank: any-builder — GET /government/board/genesis-stages
+      getGovernmentBoardGenesisStages: (args) => request("GET", "/government/board/genesis-stages", { hasBody: false }, args),
       // GET /government/board/items — rank: any-builder — GET /government/board/items
       getGovernmentBoardItems: (args) => request("GET", "/government/board/items", { hasBody: false }, args),
       // POST /government/board/items — rank: metic+archon — POST /government/board/items

package/clients/bongos-client/index.d.ts

@@ -894,6 +894,8 @@ export interface BongosClient {
     postGovernmentAssignments(args: RequestArgs & { body: PostGovernmentAssignmentsRequest }): Promise<ApiResponse>;
     /** DELETE /government/assignments/{builderId}/{rankKey} — rank: archon */
     deleteGovernmentAssignmentsBuilderIdRankKey(args?: RequestArgs): Promise<DeleteGovernmentAssignmentsBuilderIdRankKeyResponse>;
+    /** GET /government/board/genesis-stages — rank: any-builder */
+    getGovernmentBoardGenesisStages(args?: RequestArgs): Promise<ApiResponse>;
     /** GET /government/board/items — rank: any-builder */
     getGovernmentBoardItems(args?: RequestArgs): Promise<ApiResponse>;
     /** POST /government/board/items — rank: metic+archon */

package/clients/bongos-client/index.mjs

@@ -461,6 +461,8 @@ export function createClient(opts = {}) {
       postGovernmentAssignments: (args) => request("POST", "/government/assignments", { hasBody: true }, args),
       // DELETE /government/assignments/{builderId}/{rankKey} — rank: archon — DELETE /government/assignments/:builderId/:rankKey
       deleteGovernmentAssignmentsBuilderIdRankKey: (args) => request("DELETE", "/government/assignments/{builderId}/{rankKey}", { hasBody: false }, args),
+      // GET /government/board/genesis-stages — rank: any-builder — GET /government/board/genesis-stages
+      getGovernmentBoardGenesisStages: (args) => request("GET", "/government/board/genesis-stages", { hasBody: false }, args),
       // GET /government/board/items — rank: any-builder — GET /government/board/items
       getGovernmentBoardItems: (args) => request("GET", "/government/board/items", { hasBody: false }, args),
       // POST /government/board/items — rank: metic+archon — POST /government/board/items

package/docs/adr/0354-a-builder-hosts-one-project-free-and-more-takes-the-fleet-permission.md

@@ -0,0 +1,46 @@
+# ADR 0354 — A builder hosts one project for free, and more takes the fleet permission
+
+- **Status:** accepted
+- **Date:** 2026-09-30
+- **Task:** [task 1004412](https://cloudbongos.com/builders#/task/1004412) (goal 1000106 — working area 1, Project creation)
+- **Amends:** the gate [task 1003370](https://cloudbongos.com/builders#/task/1003370) put on `cloud-host` (audit B4), for a builder's first hosted project only
+- **Builds on:** [ADR 0345](0345-we-host-every-projects-hall-and-its-app-deploys-where-the-owner-chooses.md) decision 1 (we host every project's hall, and creating a project needs no platform account, key or bill) · [ADR 0285](0285-a-shared-box-holds-about-twelve-projects-per-gb-and-memory-is-the-wall.md) (the shared box holds about fifteen projects)
+- **Decided with:** the owner chose D1 on 2026-09-30, from three options put to them in plain language.
+
+## Context
+
+The create wizard sends one request when the owner presses its last button, "Create my project", and that request always asks for `cloud-host`: the hall, hosted by us. Task 1003370 (2026-09-19) gated that shape behind `provisioning.fleet.manage` (floor: Metic), because a hosted hall runs code from its owner's repository on the platform's own box. A new hub signup is a Xenos. So from that day, every new user who pressed "Create my project" was refused with `permission_forbidden`. The wizard showed it as its generic "We couldn't file the request just now", with the permission name underneath. Task 1004412 confirmed this with a route-level test that uses the real permission gate and a Xenos's real grants.
+
+ADR 0345 came nine days later and made `cloud-host` the free front door. The two decisions contradicted each other, and no test covered the path they shared.
+
+## Decision
+
+### D1 — One live hosted project per builder needs no permission
+
+A builder may create a `cloud-host` project with no permission if they hold no other live `cloud-host` project. "Live" means any status except `torn_down`. A queued or failed project still holds its place, and its owner can retry it or take it offline. Asking again for your own project's slug (a retry or a revive) counts as that same project, not a second one. A further live hosted project needs `provisioning.fleet.manage`, and the refusal is the kernel gate's own `permission_forbidden`.
+
+What stops one person taking every place on the box is this limit, not rank. `byo-host` stays open without limit, and `control-plane` and `co-tenant` stay unrequestable. The gate is still an allow-list, so a shape added later is gated by omission.
+
+If the count cannot be read, the gate refuses with `request_failed`. It is an authority gate, so it fails closed (ADR 0016).
+
+### D2 — One first-free request per builder at a time
+
+The count and the insert are two separate steps, so two requests sent together would both count zero. The gate takes a Postgres advisory lock keyed on the builder (`free-place-lock.js`, a try-lock on its own connection) before it counts, and lets it go as soon as the route has inserted the row (or when the response closes, on any earlier exit). A second request sent in the meantime, from any web process, gets 409 `create_in_progress`. A lock that cannot be taken refuses, like an unreadable count. (The first version used a process-local mark; the grader flagged that it would not hold across processes, so it moved into the database before shipping.)
+
+### D3 — The wizard states both refusals in plain words
+
+- **`permission_forbidden` with a readable `held`:** "Each account can host one project for free, and yours already has one…". The sentence names the project page's own "Take it offline" control, and says that trusted builders can host more than one (the owner asked for that line when reviewing the wording).
+- **`box_full`:** "Our shared server is full right now…", instead of the operator's sentence.
+- **`permission_forbidden` with `held: null`:** authority could not be checked at all, so the wizard keeps its generic sentence.
+
+## Consequences
+
+- New users can create a project from the wizard again. Each project costs us about $0.80 a month (ADR 0285).
+- A stranger's code now runs on the shared box, on the same server as the hub. It runs in its own locked account (task 1003369), and the hub's sign-in cookie no longer reaches project halls (task 1004357). **Nothing caps a hosted project's memory or CPU**, so one misbehaving project can slow every hall and the hub. That was already true of every hosted project; this decision widens who can have one.
+- Each first-free request holds one database connection from its count to its insert. Creates are rare, so the pool can carry it.
+
+## Alternatives considered
+
+- **Open to everyone, limited only by the box's capacity.** The smallest change. But one person could take every free place, and the capacity gate would then refuse everyone else.
+- **Trusted builders only, with a plain refusal.** Keeps task 1003370's rule whole. But new users still could not start a project, which ADR 0345 decision 1 rules out.
+- **An approval queue for new users' projects.** Keeps the rule and admits new users. But it is new machinery, and it would collide with the owner's redesign of the creation flow (begun 2026-09-30).

package/docs/adr/README.md

@@ -472,3 +472,4 @@ These 20 numbers are each shared by exactly two files. They are **accepted histo
 | 0351 | [**A criterion closes on a UAT, not on its linked tasks shipping** ([task 1004392](https://cloudbongos.com/builders#/task/1004392), goal 1000089 — working area 3). Supersedes ADR 0183's close rule. `wa7-government` had closed on six Board Room navigation tasks while nothing it describes was on the live site. **D1:** three checks — Code (linked tasks done, ≥1 shipped; automatic), Live, UAT — and the sweep closes a criterion only with a CURRENT sign-off (no older than the newest linked ship). **D2 (owner):** "Awaiting UAT" is a visible state. **D3 (owner):** one step; the signer is refused if they shipped linked work, the project owner excepted. **D4 (owner):** an mp4/webm up to 100 MB on the project's own server. **D5 (owner):** backend-only is set while a criterion is open and takes a recording-free sign-off. **D6 (owner):** Live is read via the `deploy.taskWhere` port where the site can tell, attested otherwise. **D7 (owner):** already-closed criteria stay closed ("Closed before UAT"). **D8:** `/satisfy` is a recorded override that needs a reason. **D9:** `/goal-uat` + `scripts/gds/uat.js`; the hall is task 1004402.](0351-a-criterion-closes-on-a-uat.md) | lifecycle / criteria / review |
 | 0352 | [**A rollup report carries its "as of" in a header, and the hub keeps the newest** ([task 1004268](https://cloudbongos.com/builders#/task/1004268), goal 1000110). `POST /sso/activity/rollup` was last-writer-wins with no report timestamp, so a sign-in push read earlier and a ship push read later could land the older totals last. **D1:** the instance's read time rides a `Bongos-Report-As-Of` HEADER, not a body field, because the hub validates the body strictly and hub and instances upgrade independently: a body field from a newer instance would 400 on an older hub and lose the report, while an unknown header is ignored. **D2:** missing or unparseable = unstamped = last-writer-wins, never a 400. **D3:** the guard is a WHERE on the upsert's conflict branch (migration 026, `reported_as_of`, no backfill); a skipped update keeps the row lock, so the task 1004244 snapshot stays in step. **D4:** the stamp is compared only with the same client's, and clamped to the hub's `now()`.](0352-a-rollup-report-carries-its-as-of-in-a-header.md) | platform identity / federation |
 | 0353 | [**A hub invite is a notice of the project's own invite, and signing in accepts it** ([task 1002818](https://cloudbongos.com/builders#/task/1002818), goal 1000110 — R6 of the admin console wave). The hub's own invite wrote a `pending` membership that no project reads, so an "accepted" invite met a locked door (new projects default to `apply`). **D1:** that row is now a NOTICE the PROJECT writes: its invite route calls `POST /sso/invites/notify` and a dismissal that leaves no invited row calls `/sso/invites/clear` (client credentials, pending rows only, always `{ ok: true }` so no account oracle); core's `notifyHubOfInvite` is fire-and-forget. **D2:** the hub-side accept route is deleted; signing in to the project accepts, and the hub's own sign-in witness turns the row into a membership. **D3 (owner):** `POST /projects/invite` writes nothing and answers `{ invited: false, invite_url }`, the project's hall invite link (`/builders/watch?invite=<login>`, which only pre-fills); the signed-assertion relay is deferred. **D4:** new routes, so an older hub 404s and only the notice is lost (ADR 0352).](0353-a-hub-invite-is-a-notice-of-the-projects-own-invite.md) | platform identity / federation |
+| 0354 | [**A builder hosts one project for free, and more takes the fleet permission** ([task 1004412](https://cloudbongos.com/builders#/task/1004412), goal 1000106 — working area 1, the owner's ruling of 2026-09-30). The create wizard always asks for `cloud-host`, which task 1003370 had gated behind `provisioning.fleet.manage`, so every new (Xenos) user was refused at "Create my project" — against ADR 0345 decision 1. **D1:** a builder's first live `cloud-host` project needs no permission; a further one needs the fleet permission (a retry of your own slug is the same project; only `torn_down` frees the place; an unreadable count refuses). **D2:** one first-free request per builder at a time (409 `create_in_progress`), held as a Postgres advisory lock so it holds across processes. **D3:** the wizard states `permission_forbidden` and `box_full` in plain words. Nothing yet caps a hosted project's memory.](0354-a-builder-hosts-one-project-free-and-more-takes-the-fleet-permission.md) | provisioning / security / project creation |

package/docs/api/openapi.json

@@ -7898,6 +7898,40 @@
         ]
       }
     },
+    "/government/board/genesis-stages": {
+      "get": {
+        "operationId": "get_government_board_genesis_stages",
+        "tags": [
+          "government"
+        ],
+        "summary": "GET /government/board/genesis-stages",
+        "description": "board.vote.cast — the founding band's read (task 1004429): each genesis stage's latest sitting, and who it is still waiting on under the item's own snapshot. Same atom as the room — seeing who is still to vote is part of the open ballot (§9). A read; nothing here opens or decides.\n\n**Rank:** `any-builder` — Any authenticated builder (row-level ownership enforced in-handler).\n\n**Permissions:** `board.vote.cast` (all required).",
+        "x-rank": "any-builder",
+        "x-source": "modules/government/routes/government.js",
+        "x-permissions": [
+          "board.vote.cast"
+        ],
+        "responses": {
+          "200": {
+            "description": "Success."
+          },
+          "400": {
+            "$ref": "#/components/responses/BadRequest"
+          },
+          "401": {
+            "$ref": "#/components/responses/Unauthorized"
+          },
+          "403": {
+            "$ref": "#/components/responses/Forbidden"
+          }
+        },
+        "security": [
+          {
+            "builderSession": []
+          }
+        ]
+      }
+    },
     "/government/board/items": {
       "get": {
         "operationId": "get_government_board_items",
@@ -14418,7 +14452,7 @@
           "provisioning"
         ],
         "summary": "POST /provisioning/instances",
-        "description": "POST /provisioning/instances — request a new instance. rank: any authenticated builder (own resource) for the free `co-tenant` shape. Every other shape also needs provisioning.fleet.manage — `dedicated` because it bills, `standalone` because it runs the caller's own repo on the platform's box — and `control-plane` is refused outright, since the platform enrolls its own row (../paid-shape-gate.js, task 1003370 / audit B4). A full shared box answers 409 box_full up front (../capacity-gate.js). ENQUEUES a 'provision' intent the runner (task P3) stands up. Idempotent on slug for the SAME owner (re-request returns the existing row); a slug owned by ANOTHER builder → 409. Body: { slug (required), target_ref?, hosting_shape? (co-tenant free; others gated), domain?, tier?, onboard_mode? (greenfield|adopt) }. onboard_mode is LOAD-BEARING, not a label (task 1002562): the control-plane runner branches its repo scaffold on it. 'adopt' means target_ref is a repo the owner ALREADY has, so the runner must clone + layer onto its history instead of pushing a fresh tree at `main` (which an existing repo rejects as unrelated history). Absent → 'greenfield', the safe default.\n\n**Rank:** `any-builder` — Any authenticated builder (row-level ownership enforced in-handler).",
+        "description": "POST /provisioning/instances — request a new instance. rank: any authenticated builder (own resource) for `byo-host`, and for their FIRST live `cloud-host` (task 1004412, ADR 0354). A further cloud-host needs provisioning.fleet.manage, and `control-plane` / `co-tenant` are refused outright (../paid-shape-gate.js). A full shared box answers 409 box_full up front (../capacity-gate.js). ENQUEUES a 'provision' intent the runner (task P3) stands up. Idempotent on slug for the SAME owner (re-request returns the existing row); a slug owned by ANOTHER builder → 409. Body: { slug (required), target_ref?, hosting_shape? (byo-host free; one cloud-host free), domain?, tier?, onboard_mode? (greenfield|adopt) }. onboard_mode is LOAD-BEARING, not a label (task 1002562): the control-plane runner branches its repo scaffold on it. 'adopt' means target_ref is a repo the owner ALREADY has, so the runner must clone + layer onto its history instead of pushing a fresh tree at `main` (which an existing repo rejects as unrelated history). Absent → 'greenfield', the safe default.\n\n**Rank:** `any-builder` — Any authenticated builder (row-level ownership enforced in-handler).",
         "x-rank": "any-builder",
         "x-source": "modules/provisioning/routes/provisioning.js",
         "requestBody": {
@@ -29629,7 +29663,7 @@
       "description": "A required dependency/feature is not configured or is temporarily down."
     }
   },
-  "x-endpoint-count": 463,
+  "x-endpoint-count": 464,
   "x-schema-count": 496,
   "x-undocumented-bodies": 12,
   "x-response-schemas": 336,

package/docs/api-reference.md

@@ -2,7 +2,7 @@
 
 # Bongos API reference
 
-> **Generated from the live route files** — the route file is authoritative. 463 endpoints across 83 route files.
+> **Generated from the live route files** — the route file is authoritative. 464 endpoints across 83 route files.
 > Machine-readable spec: [`docs/api/openapi.json`](api/openapi.json) (OpenAPI 3.1). Rendered docs site: **`/docs`** (e.g. `cloudbongos.com/docs`).
 
 Base path: `/api/bongos`. Ranks (enforced server-side, [ADR 0016](adr/0016-trust-boundary-server-enforced-permissions.md)): `public` < `any-builder` < `metic+archon` < `archon`.
@@ -310,13 +310,14 @@ Base path: `/api/bongos`. Ranks (enforced server-side, [ADR 0016](adr/0016-trust
 | GET | `/api/bongos/goals/rollups` | `any-builder` | — | GET /goals/rollups?version= — one small row per goal: readiness counters, the last-activity timestamp, the craft set, and the next claima… |
 | GET | `/api/bongos/goals/suggestions` | `any-builder` | — | GET /goals/suggestions — "which goal should this draft live in?", answered before anything is created (task 1003062 / R07). |
 
-## `government` (13)
+## `government` (14)
 
 | Method | Path | Rank | Body | Description |
 |---|---|---|---|---|
 | GET | `/api/bongos/government/assignments` | `archon` | — | government.manage — every builder↔rank assignment row. |
 | POST | `/api/bongos/government/assignments` | `archon` | `builder_id`, `rank_key` | government.manage — assign a CUSTOM rank to a builder. |
 | DELETE | `/api/bongos/government/assignments/:builderId/:rankKey` | `archon` | — | government.manage — remove a custom-rank assignment. |
+| GET | `/api/bongos/government/board/genesis-stages` | `any-builder` | — | board.vote.cast — the founding band's read (task 1004429): each genesis stage's latest sitting, and who it is still waiting on under the … |
 | GET | `/api/bongos/government/board/items` | `any-builder` | — | board.vote.cast — the Board Room view: open items with their clock, the OPEN BALLOT, the closed history (R16 of goal 1000069). |
 | POST | `/api/bongos/government/board/items` | `metic+archon` | `subject_type`, `proposal`, `rationale_md`, `acknowledge_self_removal` | board.item.open — put an AMENDMENT to the board (R14 of goal 1000069, ADR 0175 §7). |
 | POST | `/api/bongos/government/board/items/:itemId/votes` | `any-builder` | `direction`, `reason_md`, `section_key` | board.vote.cast — cast a vote on an open board item (R08 of goal 1000069, ADR 0175). |