@bongos/core 1.20.25 → 1.20.27

package/modules/government/routes/government.js

@@ -108,6 +108,18 @@ const governmentPort = {
   // is no counterpart that records an outcome, and there must never be one: an
   // outcome is written by a close, never by the module reading it.
   boardPassForIdea: board.boardPassForIdea,
+  // task 1004429 (BV2.PS04): a finished genesis stage is put to the board — the
+  // genesis home (task 1004423) calls this when a stage's tasks are done. The
+  // finished-tasks gate lives inside board.js; the item is an ordinary one under
+  // the constitution in force. And the founding band's read: per stage, what it
+  // is waiting on. A pass is announced as `board.genesis_stage.passed`.
+  openGenesisStageClose: board.openGenesisStageClose,
+  // task 1004427 (BV2.PS13): the genesis charter + legislation choice, filed as
+  // an ordinary amendment under the constitution in force — for the genesis
+  // home, which renders the stages from GET /government/constitution's
+  // `charter` block. Opening a sitting decides nothing; the vote does.
+  proposeCharter: board.proposeCharter,
+  genesisStageStatus: board.genesisStageStatus,
 };
 
 function registerSeams() {
@@ -460,6 +472,19 @@ module.exports = function buildGovernmentRouter() {
     }
   });
 
+  // rank: perm board.vote.cast — the founding band's read (task 1004429): each
+  // genesis stage's latest sitting, and who it is still waiting on under the
+  // item's own snapshot. Same atom as the room — seeing who is still to vote is
+  // part of the open ballot (§9). A read; nothing here opens or decides.
+  router.get('/government/board/genesis-stages', api.requireBuilder, api.requirePermission('board.vote.cast'), async (req, res) => {
+    try {
+      res.json(await board.genesisStageStatus());
+    } catch (err) {
+      log.error('[gds] GET /government/board/genesis-stages', err);
+      res.fail('genesis_stage_read_failed', { status: 500, message: 'internal error' });
+    }
+  });
+
   // rank: perm board.item.open — put an AMENDMENT to the board (R14 of goal
   // 1000069, ADR 0175 §7). The board's other subject never comes through here:
   // a Full Idea's window opens AUTOMATICALLY on grade pass (R07), so requesting
@@ -516,6 +541,63 @@ module.exports = function buildGovernmentRouter() {
     }
   });
 
+  // rank: perm board.item.open — the genesis charter + legislation choice (task
+  // 1004427, spec D10): a form of government and/or its two live settings
+  // (franchise, pass rule), built into a whole constitution on top of the live
+  // one and filed through the SAME amendment path as the route above — the same
+  // atom, the same strict validation, the same self-removal guard. Nothing here
+  // changes the constitution; the sitting it opens is what decides.
+  router.post('/government/board/charter', api.requireBuilder, api.requirePermission('board.item.open'), async (req, res) => {
+    if (validateOrRespond(req, res, {
+      form: { type: 'string', maxLength: 64 },
+      franchise: { type: 'string', maxLength: 32 },
+      council_rank: { type: 'string', maxLength: RANK_KEY_MAX },
+      pass_rule: { type: 'string', maxLength: 32 },
+      rationale_md: { type: 'string', maxLength: 5000 },
+      acknowledge_self_removal: { type: 'boolean' },
+    })) return;
+    const body = req.body || {};
+    if (body.window_minutes !== undefined && body.window_minutes !== null && !Number.isInteger(body.window_minutes)) {
+      return res.fail('invalid_proposal', 400, { reason: 'bad_window_minutes', expected: 'null (no clock) or a whole number of minutes' });
+    }
+    try {
+      const out = await board.proposeCharter({
+        form: body.form ?? undefined,
+        franchise: body.franchise ?? undefined,
+        councilRank: body.council_rank ?? undefined,
+        passRule: body.pass_rule ?? undefined,
+        windowMinutes: body.window_minutes,
+        rationaleMd: body.rationale_md ?? null,
+        proposedBy: req.builder.id,
+        acknowledgeSelfRemoval: body.acknowledge_self_removal === true,
+      });
+      if (!out.ok) {
+        if (out.reason === 'proposer_would_lose_their_seat') {
+          return res.fail('proposer_would_lose_their_seat', 409, {
+            membership: out.membership,
+            describes: out.describes,
+            what_this_means: out.what_this_means,
+            hint: out.hint,
+            retry_with: { acknowledge_self_removal: true },
+          });
+        }
+        if (out.reason === 'no_change') {
+          return res.fail('no_change', 409, { reason: 'the constitution in force already has these settings' });
+        }
+        return res.fail('invalid_charter', 400, {
+          reason: out.reason,
+          ...(out.field ? { field: out.field } : {}),
+          ...(out.expected ? { expected: out.expected } : {}),
+          ...(out.rank_key ? { rank_key: out.rank_key } : {}),
+        });
+      }
+      res.status(201).json({ ok: true, amendment: out.amendment, item: out.item, reads_as: out.reads_as });
+    } catch (err) {
+      log.error('[gds] POST /government/board/charter', err);
+      res.fail('charter_failed', { status: 500, message: 'internal error' });
+    }
+  });
+
   // rank: perm board.vote.cast — cast a vote on an open board item (R08 of goal
   // 1000069, ADR 0175). The atom FLOORS AT XENOS deliberately (the R04 carry-
   // note): the permission is only the coarse gate, and the real wall is the

package/modules/hall-ui/public/board-room.js

@@ -132,6 +132,11 @@
       const title = item.subject ? item.subject.title : `idea ${item.subject_id}`;
       return `<a href="/#/idea/${escapeHtml(String(item.subject_id))}">${escapeHtml(title)}</a> ${pill('quiet', 'Full Idea')}`;
     }
+    // task 1004429: the third subject — closing a founding stage.
+    if (item.subject_type === 'genesis_stage') {
+      const label = item.subject ? item.subject.label : `stage ${item.subject_id}`;
+      return `Close the ${escapeHtml(label)} stage ${pill('quiet', 'genesis stage')}`;
+    }
     return `Constitutional amendment ${pill('quiet', 'amendment')}`;
   }
 

package/modules/hall-ui/public/government.js

@@ -678,6 +678,16 @@
   // hand" note; PASS_RULE_NAME sits beside its sentence-length twin
   // PASS_RULE_PLAIN there, so the two renderings of one pass rule cannot drift.
 
+  // The form of government the constitution in force READS AS (task 1004427):
+  // the real name and its plain explanation, or Custom. The server does the
+  // reading (charter.js readCharter) — the name follows the settings, so this
+  // page never guesses it. An older server without the block is said plainly.
+  function formOfGovernmentSentence(charter) {
+    const r = charter && charter.reads_as;
+    if (!r || !r.name) return 'Not available from this server yet.';
+    return `<strong>${escapeHtml(r.name)}</strong>. ${escapeHtml(r.explanation || '')}`;
+  }
+
   function dialRow(name, sentenceHtml) {
     return `<li class="ov-row"><div class="ov-row__main"><span class="ov-row__title">${escapeHtml(name)}</span><p class="ov-row__sub">${sentenceHtml}</p></div></li>`;
   }
@@ -829,6 +839,7 @@
     live.innerHTML = `
       ${divergenceHtml(data.divergence)}
       <ul class="ov-rows">
+        ${dialRow('Form of government', formOfGovernmentSentence(data.charter))}
         ${dialRow('Who sits on the board', membershipSentence(b))}
         ${dialRow('What counts as passing', passRuleSentence(b))}
         ${dialRow('How long a sitting runs', windowSentence(b, data.clock))}

package/modules/platform-identity/migrations/platform_identity_028_purge_pre_notice_invites.sql

@@ -0,0 +1,65 @@
+-- platform_identity_028_purge_pre_notice_invites.sql — delete the `pending` rows the
+-- OLD hub invite wrote (task 1004408, the owner's call on ADR 0353's open consequence).
+--
+-- WHY. Before ADR 0353 the hub's POST /projects/invite wrote a `pending` membership
+-- row and nothing on the project. My Projects renders that row as "Open project →",
+-- and on any door but `open` (the default is `apply`) it leads to the project's own
+-- gate, which never heard of the invite: a locked door. Since ADR 0353 a `pending`
+-- row is a NOTICE that only the project writes (POST /sso/invites/notify), after it
+-- wrote its own `invited` row. So a pending row is a dead end exactly when it
+-- predates the hub's first run of ADR 0353 code.
+--
+-- THE CUTOFF IS THAT FIRST RUN, read from the core_upgrades ledger: the earliest
+-- upgrade to core 1.20.22 or later (the first release carrying ADR 0353, PR 1367).
+-- No such row means the hub has never served a notice route, so every pending row
+-- is an old one and all of them go. That is the expected case: the hub served
+-- 1.19.1081 when this was written, and upgrade.js writes the ledger row AFTER
+-- migrate, so the upgrade applying this file is not yet in the ledger. The ledger
+-- row lands just after the restart, so a notice written in those few seconds would
+-- also go; an old-style row cannot survive either way.
+--
+-- WHAT IS LOST. The owner accepted this (option (a)): an old row on an `open` door
+-- did lead somewhere, and it is deleted too. That invitee can still sign in to the
+-- project, and the inviter can re-invite through the project's own hall.
+--
+-- Touches `pending` rows only, so no real membership (owner, member, visitor) can
+-- be removed. One-shot: a replay after this file is recorded does nothing, so a
+-- hand-run later can never sweep up real notices. Deletes data but adds nothing
+-- the previous release cannot read, so it is forward-safe (ADR 0083 §5).
+
+BEGIN;
+
+DO $$
+DECLARE
+  notices_since timestamptz;
+  removed       integer;
+BEGIN
+  IF EXISTS (SELECT 1 FROM schema_migrations
+              WHERE version = 'platform_identity_028_purge_pre_notice_invites') THEN
+    RETURN;
+  END IF;
+
+  -- Only a well-formed x.y.z counts (any suffix ignored); the digit caps keep the
+  -- int cast from overflowing, so a malformed ledger row can never fail the deploy.
+  IF to_regclass('core_upgrades') IS NOT NULL THEN
+    SELECT min(applied_at) INTO notices_since
+      FROM (SELECT applied_at,
+                   substring(to_version FROM '^v?([0-9]{1,6}\.[0-9]{1,6}\.[0-9]{1,6})(?:[^0-9]|$)') AS xyz
+              FROM core_upgrades) u
+     WHERE xyz IS NOT NULL
+       AND string_to_array(xyz, '.')::int[] >= ARRAY[1, 20, 22];
+  END IF;
+
+  DELETE FROM platform_identity_project_memberships
+   WHERE membership_kind = 'pending'
+     AND (notices_since IS NULL OR joined_at < notices_since);
+  GET DIAGNOSTICS removed = ROW_COUNT;
+
+  RAISE NOTICE 'platform_identity_028: removed % pre-ADR-0353 pending invite row(s) (cutoff: %)',
+    removed, COALESCE(notices_since::text, 'none, the hub never ran ADR 0353');
+END $$;
+
+INSERT INTO schema_migrations (version) VALUES ('platform_identity_028_purge_pre_notice_invites')
+  ON CONFLICT DO NOTHING;
+
+COMMIT;

package/modules/provisioning/planet-physics.js

@@ -0,0 +1,154 @@
+// modules/provisioning/planet-physics.js — the seven "planet physics" answers a new
+// project carries (BV2.PS02, task 1004416; goal 1000121, spec
+// docs/specs/bongos-v2-project-startup.md).
+//
+// WHAT. The questions the startup flow asks before any technical setup, as a closed
+// vocabulary the provisioning `detail` jsonb stores (the R15 dumb-store contract in
+// provisioning.js: a later question costs no migration). In the canvas's order:
+//
+//   1 state       project_state, existing_work (all that apply), main_work
+//   2 geography   home_country, home_region, builder_geography
+//   3 ages        minors_on_board
+//   4 entity      entity — a legal type (already formed) or an intent (not yet)
+//   5 builders    builders_at_start, builders_expected (the month-three estimate)
+//   6 rewards     reward_intents (all being considered — intent, never binding)
+//   7 framing     framing (A–D: managed, hybrid, local, open-source) and services
+//
+// THREE KINDS OF QUESTION. `one` takes a single member of its list, `many` takes an
+// array of members (stored de-duplicated, in the list's own order, so two spellings of
+// one answer store the same bytes), and `count` takes a whole number in a range.
+// Every kind has the same two rules as `team_shape`: an unknown value is REFUSED at the
+// boundary (badProjectDetail says which and why), and an explicit null un-answers.
+//
+// THESE ARE FACTS, NOT POLICY. Nothing here restricts what a project may do: the age
+// tiers and the payout geography are enforced by nobody yet (out of scope, spec "Out
+// of scope"). They are stored so the soft-limit table (soft-limits.js) can grey an
+// option with a reason, and so the later enforcement has the facts it will need.
+//
+// PURE, and requires nothing — provisioning.js composes these into
+// PROJECT_DETAIL_VOCAB, and soft-limits.js reads them, so a require of either from
+// here would be a cycle.
+
+'use strict';
+
+// ISO 3166-1 alpha-2, the officially assigned codes. A closed list rather than a
+// two-letter pattern, because "ZZ" is a typo the pattern would store as a country.
+const COUNTRY_CODES = Object.freeze((
+  'AD AE AF AG AI AL AM AO AQ AR AS AT AU AW AX AZ BA BB BD BE BF BG BH BI BJ BL BM BN BO BQ ' +
+  'BR BS BT BV BW BY BZ CA CC CD CF CG CH CI CK CL CM CN CO CR CU CV CW CX CY CZ DE DJ DK DM ' +
+  'DO DZ EC EE EG EH ER ES ET FI FJ FK FM FO FR GA GB GD GE GF GG GH GI GL GM GN GP GQ GR GS ' +
+  'GT GU GW GY HK HM HN HR HT HU ID IE IL IM IN IO IQ IR IS IT JE JM JO JP KE KG KH KI KM KN ' +
+  'KP KR KW KY KZ LA LB LC LI LK LR LS LT LU LV LY MA MC MD ME MF MG MH MK ML MM MN MO MP MQ ' +
+  'MR MS MT MU MV MW MX MY MZ NA NC NE NF NG NI NL NO NP NR NU NZ OM PA PE PF PG PH PK PL PM ' +
+  'PN PR PS PT PW PY QA RE RO RS RU RW SA SB SC SD SE SG SH SI SJ SK SL SM SN SO SR SS ST SV ' +
+  'SX SY SZ TC TD TF TG TH TJ TK TL TM TN TO TR TT TV TW TZ UA UG UM US UY UZ VA VC VE VG VI ' +
+  'VN VU WF WS YE YT ZA ZM ZW'
+).split(' '));
+
+// The sub-national level the canvas asks for ("your country · state"), ISO 3166-2
+// style. Only where the law that matters to a project — minors' work permits, what
+// kind of company you can form — is set at that level: the US states (with DC and the
+// territories) and the Canadian provinces and territories. Anywhere else the answer is
+// the country alone, and a region is refused rather than stored unread.
+const US_REGIONS = (
+  'AL AK AZ AR CA CO CT DE FL GA HI ID IL IN IA KS KY LA ME MD MA MI MN MS MO MT NE NV NH NJ ' +
+  'NM NY NC ND OH OK OR PA RI SC SD TN TX UT VT VA WA WV WI WY DC AS GU MP PR UM VI'
+).split(' ').map((s) => `US-${s}`);
+const CA_REGIONS = 'AB BC MB NB NL NS NT NU ON PE QC SK YT'.split(' ').map((s) => `CA-${s}`);
+const REGION_CODES = Object.freeze([...US_REGIONS, ...CA_REGIONS]);
+
+// The European Union's member states — what "EU builders" means to the soft limits.
+const EU_COUNTRIES = Object.freeze(
+  'AT BE BG CY CZ DE DK EE ES FI FR GR HR HU IE IT LT LU LV MT NL PL PT RO SE SI SK'.split(' ')
+);
+
+const WORK_KINDS = Object.freeze(['code', 'digital-files', 'physical-work']);
+
+// Question 4. A project that already exists picks its legal type; a new one says
+// roughly where it is heading (the canvas: "there's nothing to sign yet"). One key,
+// because they answer one question and a project holds exactly one of them.
+const ENTITY_INTENTS = Object.freeze(['intent-company', 'intent-nonprofit', 'intent-solo', 'intent-unsure']);
+const ENTITY_FORMS = Object.freeze([
+  'nonprofit', 'for-profit', 'corporate-division', 'research', // organization
+  'university-project', 'social-group',                        // group
+  'single-owner-llc', 'private-individual',                    // individual
+]);
+
+// Question 7's A–D, in that order (A = managed … D = open-source).
+const FRAMINGS = Object.freeze(['managed', 'hybrid', 'local', 'open-source']);
+
+// The suite a hybrid or local framing chooses from.
+const SERVICES = Object.freeze([
+  'hosting', 'labor-payment', 'starter-kit', 'marketplace-buy', 'marketplace-sell',
+  'guild-access', 'guild-create', 'company-creation', 'cbaas-consulting', 'public-marketing',
+]);
+
+// The ceiling on a builder count is a sanity bound, not a product limit.
+const BUILDER_COUNT = Object.freeze({ kind: 'count', min: 1, max: 100000 });
+
+const PLANET_PHYSICS_QUESTIONS = Object.freeze({
+  project_state: Object.freeze({ kind: 'one', values: Object.freeze(['new', 'existing']) }),
+  existing_work: Object.freeze({ kind: 'many', values: WORK_KINDS }),
+  main_work: Object.freeze({ kind: 'one', values: WORK_KINDS }),
+  home_country: Object.freeze({ kind: 'one', values: COUNTRY_CODES }),
+  home_region: Object.freeze({ kind: 'one', values: REGION_CODES }),
+  builder_geography: Object.freeze({ kind: 'one', values: Object.freeze(['us-only', 'us-eu', 'global', 'not-sure']) }),
+  minors_on_board: Object.freeze({ kind: 'one', values: Object.freeze([false, true]) }),
+  entity: Object.freeze({ kind: 'one', values: Object.freeze([...ENTITY_INTENTS, ...ENTITY_FORMS]) }),
+  builders_at_start: BUILDER_COUNT,
+  builders_expected: BUILDER_COUNT,
+  reward_intents: Object.freeze({ kind: 'many', values: Object.freeze(['non-monetary', 'cash', 'equity', 'future-payouts']) }),
+  framing: Object.freeze({ kind: 'one', values: FRAMINGS }),
+  services: Object.freeze({ kind: 'many', values: SERVICES }),
+});
+
+// The answer as it may be STORED, or undefined when it is not one. `many` answers come
+// back de-duplicated in the list's order; an empty array is a real answer ("none of
+// these"), distinct from never answering. PURE.
+function canonicalAnswer(question, value) {
+  if (!question) return undefined;
+  if (question.kind === 'one') return question.values.includes(value) ? value : undefined;
+  if (question.kind === 'many') {
+    if (!Array.isArray(value) || !value.every((v) => question.values.includes(v))) return undefined;
+    return question.values.filter((v) => value.includes(v));
+  }
+  if (question.kind === 'count') {
+    return Number.isInteger(value) && value >= question.min && value <= question.max ? value : undefined;
+  }
+  return undefined;
+}
+
+// Why a value is not an answer, in a sentence the caller can act on. Lists longer
+// than a dozen (the country and region codes) are named by their standard instead of
+// printed. PURE.
+function answerFaultMessage(key, question) {
+  const list = (values) => (values.length > 12
+    ? (key === 'home_country' ? 'an ISO 3166-1 alpha-2 country code, like US or DE' : 'a US state or Canadian province code, like US-CA or CA-ON')
+    : `one of: ${values.join(', ')}`);
+  if (question.kind === 'many') return `"${key}" must be a list, each item ${list(question.values)} — or null to un-answer it.`;
+  if (question.kind === 'count') return `"${key}" must be a whole number from ${question.min} to ${question.max} — or null to un-answer it.`;
+  return `"${key}" must be ${list(question.values)} — or null to un-answer it.`;
+}
+
+// Faults BETWEEN answers sent together in one body. Only within the body: a merge
+// patch may legitimately change one half now and the other later, and refusing a
+// write for disagreeing with a stored answer would make the order of edits matter.
+// Returns a message, or null. PURE.
+function crossAnswerFault(detail) {
+  if (Array.isArray(detail.existing_work) && typeof detail.main_work === 'string'
+      && !detail.existing_work.includes(detail.main_work)) {
+    return `"main_work" must be one of the kinds in "existing_work" (${detail.existing_work.join(', ') || 'none given'}).`;
+  }
+  if (typeof detail.home_region === 'string' && typeof detail.home_country === 'string'
+      && !detail.home_region.startsWith(`${detail.home_country}-`)) {
+    return `"home_region" ${detail.home_region} is not in "home_country" ${detail.home_country}.`;
+  }
+  return null;
+}
+
+module.exports = {
+  PLANET_PHYSICS_QUESTIONS,
+  COUNTRY_CODES, REGION_CODES, EU_COUNTRIES,
+  ENTITY_FORMS,
+  canonicalAnswer, answerFaultMessage, crossAnswerFault,
+};

package/modules/provisioning/provisioning.js

@@ -19,6 +19,11 @@
 // valued, and the value it resolves to when nobody answered is the type's starter
 // bundle — so storage and the read projection both have to read that declaration.
 const { normalizeModuleSelection, effectiveModules } = require('./starter-bundles');
+// The planet-physics answers and the soft limits over them (BV2.PS02, task 1004416) —
+// pure declarations beside this file, for the same reason: storage and the read
+// projection both have to read them.
+const { PLANET_PHYSICS_QUESTIONS, canonicalAnswer } = require('./planet-physics');
+const { softLimitsFor } = require('./soft-limits');
 
 // ---------------------------------------------------------------------------
 // Constants (mirror the CHECK constraints in provisioning_001_tables.sql)
@@ -253,9 +258,18 @@ const PLANET_VOCAB = Object.freeze({
 // obey, so an absent one has to resolve to today's behaviour; a detail answer is
 // something the owner SAID, and inventing one they never said would feed R17 a
 // recommendation nobody asked for. Absent stays absent, and skipped stays skipped.
-const PROJECT_DETAIL_VOCAB = Object.freeze({
-  team_shape: ['solo', 'small-team', 'community'],
+//
+// The seven planet-physics answers (BV2.PS02, task 1004416) ride the same column under
+// the same contract. They add two kinds of question beside the closed single answer:
+// a list of members (`many`) and a whole number (`count`) — see planet-physics.js.
+// PROJECT_DETAIL_QUESTIONS is the whole contract; PROJECT_DETAIL_VOCAB is its closed
+// answer lists, the shape every reader and the `options` reply already take.
+const PROJECT_DETAIL_QUESTIONS = Object.freeze({
+  team_shape: Object.freeze({ kind: 'one', values: Object.freeze(['solo', 'small-team', 'community']) }),
+  ...PLANET_PHYSICS_QUESTIONS,
 });
+const PROJECT_DETAIL_VOCAB = Object.freeze(Object.fromEntries(Object.entries(PROJECT_DETAIL_QUESTIONS)
+  .filter(([, question]) => question.values).map(([key, question]) => [key, question.values])));
 // The publish-gate half of the interview is prose, so it needs a ceiling. Long
 // enough for a real paragraph, short enough that the column is never a document —
 // the Explore card renders `tagline`, not this.
@@ -401,6 +415,7 @@ async function isProvisionedHostname(db, hostname) {
 // explicitly means a future sensitive column is never leaked by accident.
 function publicInstance(row) {
   if (!row) return { state: 'none' };
+  const detail = projectDetail(row);
   return {
     id: row.id,
     slug: row.slug,
@@ -431,7 +446,10 @@ function publicInstance(row) {
     // in (ADR 0182 D4). Surfaced so a form can render "here's what's still
     // missing" from a plain instance read, without a second endpoint.
     description: row.description || null,
-    detail: projectDetail(row),
+    detail,
+    // Which startup options those answers hide, grey or annotate, each with its reason
+    // (BV2.PS02, spec D6). Advice only — `enforced: false` says so on every read.
+    soft_limits: softLimitsFor(detail),
     // The creation picker's module set (task 1002339): the always-on core, what
     // the owner ends up with, and whether that came from their own toggles or
     // from the type's starter bundle because they never answered. Resolved, not
@@ -631,8 +649,9 @@ function normalizeDescription(input) {
 function normalizeProjectDetail(input) {
   const given = input && typeof input === 'object' && !Array.isArray(input) ? input : {};
   const out = {};
-  for (const [key, vocab] of Object.entries(PROJECT_DETAIL_VOCAB)) {
-    if (vocab.includes(given[key])) out[key] = given[key];
+  for (const [key, question] of Object.entries(PROJECT_DETAIL_QUESTIONS)) {
+    const answer = canonicalAnswer(question, given[key]);
+    if (answer !== undefined) out[key] = answer;
   }
   return out;
 }
@@ -650,9 +669,10 @@ function projectDetailPatch(input) {
   const given = input && typeof input === 'object' && !Array.isArray(input) ? input : {};
   const set = {};
   const clear = [];
-  for (const [key, vocab] of Object.entries(PROJECT_DETAIL_VOCAB)) {
+  for (const [key, question] of Object.entries(PROJECT_DETAIL_QUESTIONS)) {
+    const answer = canonicalAnswer(question, given[key]);
     if (given[key] === null) clear.push(key);
-    else if (vocab.includes(given[key])) set[key] = given[key];
+    else if (answer !== undefined) set[key] = answer;
   }
   return { set, clear };
 }
@@ -1445,7 +1465,7 @@ module.exports = {
   SETTINGS_APPLY_FROM, SETTINGS_APPLY_SHAPES,
   RESTART_FROM, RESTART_SHAPES,
   TIER_MONTHLY_USD, CERT_ELIGIBLE_STATES,
-  SETTINGS_VOCAB, DEFAULT_SETTINGS, SETTINGS_COMPANION_ENV, PROJECT_DETAIL_VOCAB, DESCRIPTION_MAX,
+  SETTINGS_VOCAB, DEFAULT_SETTINGS, SETTINGS_COMPANION_ENV, PROJECT_DETAIL_VOCAB, PROJECT_DETAIL_QUESTIONS, DESCRIPTION_MAX,
   PLANET_TEMPLATES, PLANET_ACCENTS, PLANET_VOCAB,
   // pure
   isValidSlug, costEstimateUsd, DEFAULT_DEDICATED_TIER, publicInstance, normalizeHostname,
@@ -1453,7 +1473,7 @@ module.exports = {
   settingsPushOwed,
   // pure — the artist gate's non-retroactivity stamp (ADR 0241 §5, task 1003575)
   ARTIST_GATE_STRICT_SINCE_KEY, artistGateStrictSince, artistGateStamp,
-  normalizeDescription, normalizeProjectDetail, projectDetailPatch, projectDetail,
+  normalizeDescription, normalizeProjectDetail, projectDetailPatch, projectDetail, softLimitsFor,
   // pure — GitHub App Manifest flow (task 2080)
   githubAppName, buildGithubAppManifest, manifestPostUrl, publicGithubApp,
   // pure — the address race's database backstop (task 1002901, provisioning_015)

package/modules/provisioning/routes/body-validators.js

@@ -15,6 +15,8 @@
 
 const provisioning = require('../provisioning');
 const { ALWAYS_ON_CORE, OPTIONAL_MODULES } = require('../starter-bundles');
+const { canonicalAnswer, answerFaultMessage, crossAnswerFault } = require('../planet-physics');
+const { screenProject, STOP_MESSAGE } = require('../screening');
 
 // The project-detail answers, validated LOUDLY (task 1002334). `detail` arrives as
 // a nested object, and the strict body validator only reaches top-level fields — so
@@ -28,21 +30,37 @@ function badProjectDetail(detail) {
   if (typeof detail !== 'object' || Array.isArray(detail)) {
     return { code: 'bad_detail', message: 'detail must be an object of answers.' };
   }
-  const vocab = provisioning.PROJECT_DETAIL_VOCAB;
+  const questions = provisioning.PROJECT_DETAIL_QUESTIONS;
   for (const [key, value] of Object.entries(detail)) {
-    if (!Object.prototype.hasOwnProperty.call(vocab, key)) {
-      return { code: 'bad_detail', message: `Unknown detail answer "${key}" — the interview asks: ${Object.keys(vocab).join(', ')}.` };
+    if (!Object.prototype.hasOwnProperty.call(questions, key)) {
+      return { code: 'bad_detail', message: `Unknown detail answer "${key}" — the interview asks: ${Object.keys(questions).join(', ')}.` };
     }
     // An explicit null is the UN-ANSWER, not an off-vocabulary value (task 1003577):
     // the merge-patch way back to "never answered". Only null — an empty string or any
     // other sentinel stays a typo, so a caller trying to SET one is never silently
     // read as having erased their answer.
     if (value === null) continue;
-    if (!vocab[key].includes(value)) {
-      return { code: 'bad_detail', message: `"${key}" must be one of: ${vocab[key].join(', ')} — or null to un-answer it.` };
+    // Every kind of question (planet-physics.js, task 1004416) — a single answer, a
+    // list of members, or a whole number — refuses with a sentence naming its own shape.
+    if (canonicalAnswer(questions[key], value) === undefined) {
+      return { code: 'bad_detail', message: answerFaultMessage(key, questions[key]) };
     }
   }
-  return null;
+  const crossFault = crossAnswerFault(detail);
+  return crossFault ? { code: 'bad_detail', message: crossFault } : null;
+}
+
+// The screening hook (BV2.PS02, task 1004416) at the boundary: the project's own words,
+// screened BEFORE anything is created — the canvas's stop screen ("nothing has been set
+// up"). 422, because the body is well-formed and the refusal is about what it describes.
+// Neither the sentence nor `details` names the rule: a gate that says which rule it
+// tripped teaches a caller how to reword around it (the task 1004416 review).
+// Returns null when clean, or the res.fail options to stop with. The rules and the seam
+// a real classifier replaces are in ../screening.js.
+function screenedOut(description) {
+  const verdict = screenProject({ description });
+  if (!verdict.stop) return null;
+  return { status: 422, message: STOP_MESSAGE, details: { screened: true } };
 }
 
 // The creation picker's module selection, validated LOUDLY (BV1.R20, task
@@ -91,4 +109,4 @@ function badProjectType(type) {
   return null;
 }
 
-module.exports = { badProjectDetail, badModuleSelection, badProjectType };
+module.exports = { badProjectDetail, badModuleSelection, badProjectType, screenedOut };

package/modules/provisioning/routes/provisioning.js

@@ -61,7 +61,7 @@ const catalogBridge = require('../catalog-bridge');
 const capacity = require('../capacity');   // the box's slot ceiling (ADR 0285, task 1003927)
 const { callbackPage } = require('./callback-page');
 // the LOUD body validators (task 1003504) — lifted out when this file hit the size ratchet
-const { badProjectDetail, badModuleSelection, badProjectType } = require('./body-validators');
+const { badProjectDetail, badModuleSelection, badProjectType, screenedOut } = require('./body-validators');
 const { failFrom } = require('../public-refusal');   // every catch: a declared refusal reaches the owner, anything else stays opaque (task 1004126)
 // the kernel ports this module provides (moved out at the size ratchet, task 1003578)
 const { registerProvisioningSeams } = require('../seams');
@@ -330,6 +330,8 @@ module.exports = function provisioningRoutes() {
     if (detailFault) return res.fail(detailFault.code, { status: 400, message: detailFault.message });
     const modulesFault = badModuleSelection(body.modules);
     if (modulesFault) return res.fail(modulesFault.code, { status: 400, message: modulesFault.message });
+    const screened = screenedOut(body.description); // the stop screen (task 1004416): before anything exists
+    if (screened) return res.fail('screened_out', screened);
     const slug = String(body.slug || '').trim().toLowerCase();
     if (!provisioning.isValidSlug(slug)) {
       return res.fail('bad_slug', 400, { reason: 'lowercase, 2–40 chars of [a-z0-9-], no leading/trailing/double dash' });
@@ -698,6 +700,8 @@ module.exports = function provisioningRoutes() {
     if (detailFault) return res.fail(detailFault.code, { status: 400, message: detailFault.message });
     const modulesFault = badModuleSelection(body.modules);
     if (modulesFault) return res.fail(modulesFault.code, { status: 400, message: modulesFault.message });
+    const screened = screenedOut(body.description); // the stop screen (task 1004416): before anything exists
+    if (screened) return res.fail('screened_out', screened);
     // `type: null` reaches here because the kernel validator reads null as ABSENT —
     // which is exactly why the refusal has to be its own check and not an enum rule.
     const typeFault = badProjectType(Object.prototype.hasOwnProperty.call(body, 'type') ? body.type : undefined);
@@ -731,11 +735,12 @@ module.exports = function provisioningRoutes() {
       // one CLEARED here has to leave it, which is why the hub assigns `description`
       // rather than COALESCEing it.
       await catalogBridge.publishInstanceToCatalog(pool, updated).catch(() => {});
+      const detail = provisioning.projectDetail(updated);
       res.json({
         ok: true,
         description: updated.description || null,
-        detail: provisioning.projectDetail(updated),
-        options: provisioning.PROJECT_DETAIL_VOCAB,
+        detail, options: provisioning.PROJECT_DETAIL_VOCAB,
+        soft_limits: provisioning.softLimitsFor(detail), // advice, never enforced (task 1004416)
         // The whole point of the step, answered in the same breath (R16, task
         // 1002335): an owner who just wrote a description learns HERE that the
         // project is now on the map, and one who cleared it learns it just left.

package/modules/provisioning/screening.js

@@ -0,0 +1,62 @@
+// modules/provisioning/screening.js — the screening hook that can stop a project
+// before anything is created (BV2.PS02, task 1004416; the canvas's "this can't be
+// built on Cloud Bongos" stop screen).
+//
+// WHAT IT SCREENS. The words an owner uses to say what the project is: the idea text
+// for a new planet, and the description of the work that already exists for an
+// existing one. Both arrive as `description` today (the canvas asks one question, "what
+// is your project, and what do you want Bongos to do for you?"), so the hook takes an
+// object of named texts — a later field is one more key, not a new call site.
+//
+// THE SEAM. `screenProject(texts, rules)` is the whole contract: texts in, a verdict
+// out, `{ stop: false }` or `{ stop: true, rule }`. The real classifier is out of scope
+// (spec, PS02); when it exists it replaces SCREENING_RULES or this function's body, and
+// no caller changes.
+//
+// THE RULE SET IS DELIBERATELY SMALL. A keyword rule that stops an honest project is a
+// worse failure than one that misses a bad one — the classifier is the real answer, and
+// the stop screen always offers "contact us". So each rule names something no
+// legitimate project is built to BE, and a defensive project that merely talks about it
+// (a ransomware detector, a phishing-awareness course) carries an `unless` that lets it
+// through. When in doubt, a rule does not belong here.
+//
+// PURE — no I/O, no requires.
+
+'use strict';
+
+const SCREENING_RULES = Object.freeze([
+  Object.freeze({
+    id: 'child-sexual-abuse',
+    match: /\b(csam|child (sexual abuse|porn\w*)|(sexual|nude|explicit) (images?|photos?|videos?|content) of (children|minors|kids))\b/i,
+    unless: null,
+  }),
+  Object.freeze({
+    id: 'malware',
+    match: /\b(build|make|create|write|develop|sell|spread|distribute|deploy)\w*\b[^.!?\n]{0,40}\b(ransomware|keyloggers?|info-?stealers?|credential stealers?|botnets?)\b/i,
+    unless: /\b(detect\w*|defen[cs]\w*|protect\w*|prevent\w*|block\w*|remov\w*|scann\w*|research\w*|against|anti-?\w+)\b/i,
+  }),
+  Object.freeze({
+    id: 'phishing',
+    match: /\b(build|make|create|write|develop|sell|run|host|launch)\w*\b[^.!?\n]{0,40}\bphishing (kits?|pages?|sites?|campaigns?)\b/i,
+    unless: /\b(awareness|training|simulat\w*|detect\w*|report\w*|defen[cs]\w*|protect\w*|against)\b/i,
+  }),
+]);
+
+// The verdict for one project's texts. `texts` is `{ description, … }`; anything that is
+// not a string is skipped, so an unanswered field can never stop a project. PURE.
+function screenProject(texts, rules = SCREENING_RULES) {
+  const given = texts && typeof texts === 'object' ? texts : {};
+  const words = Object.values(given).filter((t) => typeof t === 'string' && t.trim()).join('\n');
+  if (!words) return { stop: false };
+  for (const rule of rules) {
+    if (rule.match.test(words) && !(rule.unless && rule.unless.test(words))) return { stop: true, rule: rule.id };
+  }
+  return { stop: false };
+}
+
+// The owner-facing sentence the stop screen shows — the canvas's own copy. It names no
+// rule, and nothing else in the reply does either: the person who answers "contact us"
+// reads the description itself.
+const STOP_MESSAGE = "What you described isn't something we can help create, so we've stopped here. Nothing has been set up. If you think we've read it wrong, contact us and a person will look at it.";
+
+module.exports = { SCREENING_RULES, STOP_MESSAGE, screenProject };