@bongos/core 1.20.26 → 1.20.28

package/.bongos-core.json

@@ -2,22 +2,22 @@
   "artifact": "bongos-core",
   "manifest_schema": 1,
   "generator": "scripts/gds/package-core.js",
-  "core_version": "1.20.26",
-  "core_contract": "1.20.26",
-  "source_commit": "7bf58c3913461c4383f40d27a2c2abe4b357ee85",
+  "core_version": "1.20.28",
+  "core_contract": "1.20.28",
+  "source_commit": "64dc694277165d8cd1227e09df2fda3dd99dd396",
   "source_ref": "HEAD",
-  "built_at": "2026-09-30T19:12:54.558Z",
+  "built_at": "2026-09-30T20:23:58.237Z",
   "redaction": {
     "model": "docs-redacted+functional-verbatim",
-    "docs_redacted": 560,
+    "docs_redacted": 562,
     "agent_docs_stubbed": 25,
-    "functional_verbatim": 2647,
+    "functional_verbatim": 2659,
     "rules": 3,
     "gate_literals": 3,
     "gate": "passed"
   },
-  "file_count": 3233,
-  "tree_sha256": "6cc2f111dd67610b01e2286ded5cfef7db118cdbb5afe9d134262e29262f7ade",
+  "file_count": 3247,
+  "tree_sha256": "06c076a09a9c706567f32a447e0d1600e2e07a868b9bdd4be62088a290714985",
   "files": [
     {
       "path": ".claude/skills/ask-for-help/SKILL.md",
@@ -327,12 +327,12 @@
     {
       "path": "clients/bongos-client/README.md",
       "mode": "0000644",
-      "sha256": "6142e330ccbf058cfe2d266b80d1dab1419cdd9194f39933da2f410d6e20abb1"
+      "sha256": "8dde50025e6ac0a8e9742455d62495b72c1803b87044455c48b13b95209f59a2"
     },
     {
       "path": "clients/bongos-client/bongos-client.global.js",
       "mode": "0000644",
-      "sha256": "094ba492c058258352e891a1d418fbff5777d40176e21292a6c92c0ad4c55902"
+      "sha256": "77f3e9375343c45fd538d179928628a7422858ddea7540cc60cfbdfba95a8545"
     },
     {
       "path": "clients/bongos-client/examples/hello-world.mjs",
@@ -342,17 +342,17 @@
     {
       "path": "clients/bongos-client/index.cjs",
       "mode": "0000644",
-      "sha256": "4b57358e758f2959d9564bd59dab8c8d4ecfddebba4ee972884dd19522eb0f6c"
+      "sha256": "2eea3743862e9ec173c63517b6f79073b25e71aa3cb2d0a2a19ecce95ef78ca0"
     },
     {
       "path": "clients/bongos-client/index.d.ts",
       "mode": "0000644",
-      "sha256": "c8fab17a151038309beceb2ca3e07a4dfbaa8d79f82b2b314cb3f1440882c3b6"
+      "sha256": "065abbfa7d625aa5811ae9e6c27101ca5b9c824422a6a74bba22d92e3f5d53ae"
     },
     {
       "path": "clients/bongos-client/index.mjs",
       "mode": "0000644",
-      "sha256": "007c35d80ca1e647157a3330d4791871119659228b4ad2fc8091d9f6b00b6e3b"
+      "sha256": "e2714285309adfdb0644e82319363fdcc6fc19ad9f5a2cf0e71e203da8c5e188"
     },
     {
       "path": "clients/bongos-client/package.json",
@@ -2147,7 +2147,7 @@
     {
       "path": "docs/adr/0335-an-invite-is-a-pre-approved-row-on-the-projects-own-instance.md",
       "mode": "0000644",
-      "sha256": "f22adac7e27f2e83ece9311e44fca35edb0bd571440f108d28a9088775d0b93c"
+      "sha256": "826c6c6ae6e10af9383e518ff63196e2b947bc0ecfa0c1be0288895751bc1352"
     },
     {
       "path": "docs/adr/0336-a-guilds-record-is-the-sum-of-what-its-members-already-show.md",
@@ -2237,27 +2237,37 @@
     {
       "path": "docs/adr/0353-a-hub-invite-is-a-notice-of-the-projects-own-invite.md",
       "mode": "0000644",
-      "sha256": "4445d9c306a22fb3b7e72467bedad262f4653c092bf4866f8a39410248da2724"
+      "sha256": "e4ee7809ea3f414ecfdbe0b3e6e4b435c1ccc25084fce9c3cfa3521943fe8b90"
     },
     {
       "path": "docs/adr/0354-a-builder-hosts-one-project-free-and-more-takes-the-fleet-permission.md",
       "mode": "0000644",
       "sha256": "962d868c0887244c53b53c58754f7232715a20df6feec694f30cbda707f9e17e"
     },
+    {
+      "path": "docs/adr/0355-a-soft-limit-is-a-rule-with-a-reason-and-nobody-enforces-it.md",
+      "mode": "0000644",
+      "sha256": "6ad8ab3bd8bcb4f55575232af651f108e3879a5965f5daaac42ab693d00a1f0a"
+    },
+    {
+      "path": "docs/adr/0356-a-recruit-invite-expires-30-days-after-it-is-sent-read-time.md",
+      "mode": "0000644",
+      "sha256": "ccbad5d4326b069381db47ea3fc165f9a4020485e3d6ce346393a2f6711ce1f0"
+    },
     {
       "path": "docs/adr/README.md",
       "mode": "0000644",
-      "sha256": "850168519d3ef7eaf6d9658b9e2b19a80402147e9f3e8fc5318c53b7647fa9b0"
+      "sha256": "d21d0eb8389864b4f7394ba0f4b0d0d809182f0bef82d9fc6824edd00e174b39"
     },
     {
       "path": "docs/api-reference.md",
       "mode": "0000644",
-      "sha256": "0d81859e19436003332c5ee22b94c7e0a23636a61ac2a52118c15caae71fb31c"
+      "sha256": "db03fd5370b7b592769a806607b9cd0880a56b53c64d8909ca24364feeff818e"
     },
     {
       "path": "docs/api/openapi.json",
       "mode": "0000644",
-      "sha256": "ce15358f33baf4ba95f59b2e2de9bfc4a5a4a0dddde5bfc91a0bfab09e4447f9"
+      "sha256": "27b8f6be81f9703a96a68f917dbb01a65048cc02f13adf308b414e96fb022668"
     },
     {
       "path": "docs/architecture.md",
@@ -2282,12 +2292,12 @@
     {
       "path": "docs/copy-inventory.md",
       "mode": "0000644",
-      "sha256": "cc3d3c2334fabc860be82ea509588681ca03cdd34da374011e2b0d5a646b8c9a"
+      "sha256": "ed9adfda17002adac03024b90ed8ee6a79a9c5a814ce88970bf6c1dfd6fa8e9f"
     },
     {
       "path": "docs/copy-registry.json",
       "mode": "0000644",
-      "sha256": "efedc6e640a54a117e108ae85654fec0385580a108918c62a8ec96fc3b927daa"
+      "sha256": "68b59e9280240b604210d20279e64f47af0bddbac8e2c3344343b4ecf8e21e52"
     },
     {
       "path": "docs/design/apex-pass-2-direction.md",
@@ -2792,7 +2802,7 @@
     {
       "path": "docs/module-api-changelog.md",
       "mode": "0000644",
-      "sha256": "7ceae0d7b1f9b1305c7dbec25e411f80c7700a128bbcf140ae65da98d73323c9"
+      "sha256": "8de783d8efc2109b60de3758da0dfd4fecaf4d4a65dc364dacd1c17e8dac4a7d"
     },
     {
       "path": "docs/modules-contract.md",
@@ -2882,7 +2892,7 @@
     {
       "path": "docs/page-readings.json",
       "mode": "0000644",
-      "sha256": "e9b2c838868e4b23789112734c976ecae722ee3dcc4bea948482666e7a17863a"
+      "sha256": "c9722a4284b34b8773b2fed801a256277bb314833da397ae89af674ebe46acee"
     },
     {
       "path": "docs/project-context.template.md",
@@ -3974,6 +3984,11 @@
       "mode": "0000644",
       "sha256": "ea887c7bcd2863e69121bfcfa36cc62fedc77c5bd5a052e5868e2f7c99cbc103"
     },
+    {
+      "path": "migrations/core_266_access_requests_invited_login_idx.sql",
+      "mode": "0000644",
+      "sha256": "e7dcf016492ab9d011bd0021ac866edd502bf68f2fe06a04365ecb2b49ccbfaa"
+    },
     {
       "path": "modules/agents/CLAUDE.md",
       "mode": "0000644",
@@ -4527,13 +4542,18 @@
     {
       "path": "modules/government/board.js",
       "mode": "0000644",
-      "sha256": "f620a9c3cfe606955aa4b6b7dd0d194c1160bab99ee6ffc81a801edf6b3db4a6"
+      "sha256": "afb73887cf5fa3f2c3b1d963e3fd501b5d2251fe1cbe0b28ca1baacb2690410d"
     },
     {
       "path": "modules/government/catalog.js",
       "mode": "0000644",
       "sha256": "0559d78f54b4b8a89ac4e6924d6dad4e2693a7e54f943532e83e4ac966868b76"
     },
+    {
+      "path": "modules/government/charter.js",
+      "mode": "0000644",
+      "sha256": "5b0707da0b679b6b34bcca6f28354de1f4f1b31bc5255bcbca2b74eec5eaf67c"
+    },
     {
       "path": "modules/government/config.js",
       "mode": "0000644",
@@ -4717,7 +4737,7 @@
     {
       "path": "modules/government/routes/government.js",
       "mode": "0000644",
-      "sha256": "58415db3a65d68f1e30f626cab20882fc324c2575226b8d6f0a82b8f018694c4"
+      "sha256": "9e98696154986f67d20a6563d71da353359b1acd8af7d29fe98d60973c5856e4"
     },
     {
       "path": "modules/government/routes/rank-sync.js",
@@ -5237,7 +5257,7 @@
     {
       "path": "modules/hall-ui/public/government.js",
       "mode": "0000644",
-      "sha256": "4e527b94cf239b219b309d1fe7d8a7d907f42f1f610b0ef3d7edb6d4b23ab6c6"
+      "sha256": "0d584e177a095a53449611feffee2eb9a2a35751154f329e985c8102f7b4fa02"
     },
     {
       "path": "modules/hall-ui/public/government.states.json",
@@ -5742,7 +5762,7 @@
     {
       "path": "modules/hall-ui/public/watch.js",
       "mode": "0000644",
-      "sha256": "7a5ef4f34be6b0ab7f5b3fa34bf1666c17164a6331031cc908c2791109585b89"
+      "sha256": "6746170acdd097b14bdccce236ac236b4962bdd1679de2c5624ca1a10cf784d0"
     },
     {
       "path": "modules/hall-ui/public/watch.states.json",
@@ -6832,7 +6852,7 @@
     {
       "path": "modules/onboarding/routes/access-requests.js",
       "mode": "0000644",
-      "sha256": "1eaac1f70a519ca5a0ea71bb56ab6d33b582f5ff002faf5811fa6c1700480057"
+      "sha256": "7e8a63d388816b1a65ec6b24fdc20390d42efa7afa5c33cdf164d0cfca1ad5d4"
     },
     {
       "path": "modules/onboarding/routes/onboarding.js",
@@ -7064,6 +7084,11 @@
       "mode": "0000644",
       "sha256": "9b263f91ce6df19640ef8ae413f3eb40cc17589924fdf21256da7647b55631c1"
     },
+    {
+      "path": "modules/platform-identity/migrations/platform_identity_028_purge_pre_notice_invites.sql",
+      "mode": "0000644",
+      "sha256": "7af1d5f5deeae675247ace4a796482ce5a606c871d611f90e2dade905b70a5c1"
+    },
     {
       "path": "modules/platform-identity/module.json",
       "mode": "0000644",
@@ -7077,7 +7102,7 @@
     {
       "path": "modules/platform-identity/platform-identity.js",
       "mode": "0000644",
-      "sha256": "9877fd84f74545d96473651cca9d00a76712507e76962c1891d3dd0c3d47e7b2"
+      "sha256": "8f293f2d70e61f90a381153248a748b12452d3bb984e5903f32610fad78d669f"
     },
     {
       "path": "modules/platform-identity/pollers/code-sweep.js",
@@ -7207,7 +7232,7 @@
     {
       "path": "modules/platform-identity/tests/platform-identity.mjs",
       "mode": "0000644",
-      "sha256": "d9164f9ae4188a313ce55ebc7c670531aa4e47128f85571aaa55730dbabd1dd3"
+      "sha256": "6dc7617a7d7615fc5ee51817ae77bba8089324c124a6cb1d0fe3ca9400454ee1"
     },
     {
       "path": "modules/platform-identity/ui/.gitkeep",
@@ -7444,6 +7469,11 @@
       "mode": "0000644",
       "sha256": "aad8d8e8a641ebcbff9aeeed765e6c1657fa5896dc9cc3e84aa32f6d327b7db2"
     },
+    {
+      "path": "modules/provisioning/planet-physics.js",
+      "mode": "0000644",
+      "sha256": "e3b0539fff5af52fc24ea171fb6a7ee537c2952608ab59b59dc20596cfbee045"
+    },
     {
       "path": "modules/provisioning/pollers/app-liveness.js",
       "mode": "0000644",
@@ -7472,7 +7502,7 @@
     {
       "path": "modules/provisioning/provisioning.js",
       "mode": "0000644",
-      "sha256": "92e9a12c0d07d87a16f0d036369967a60c2dfaca3fb1bce78fab97ad54dac0bf"
+      "sha256": "f2dd673e30cf17abbfbadd3c0142616a1c40b3b680c865b57db8330933816405"
     },
     {
       "path": "modules/provisioning/public-refusal.js",
@@ -7507,7 +7537,7 @@
     {
       "path": "modules/provisioning/routes/body-validators.js",
       "mode": "0000644",
-      "sha256": "c59c59f842a0bab6bc45370a902d6db4a1b0e39a902eb115a12abaa59fc48dc9"
+      "sha256": "fdb68a0cf1717b861aabfb9d9b843e9cf3cc28dc4c60a58242597c821c4f8fba"
     },
     {
       "path": "modules/provisioning/routes/callback-page.js",
@@ -7532,7 +7562,7 @@
     {
       "path": "modules/provisioning/routes/provisioning.js",
       "mode": "0000644",
-      "sha256": "d0a1e16b8ba6cb03bfadf95c7a3b688007309d173812e34b4e69d6e4dc33d21f"
+      "sha256": "6269c57fd10238a0660beae9df2ab686ea62a8e777eee04bc64d15e03ca503b0"
     },
     {
       "path": "modules/provisioning/routes/render-standup.js",
@@ -7544,11 +7574,21 @@
       "mode": "0000644",
       "sha256": "6189883417ca5703c67be2a66c687d8cdf45053ed28d72ac3775f2d3770d1106"
     },
+    {
+      "path": "modules/provisioning/screening.js",
+      "mode": "0000644",
+      "sha256": "7c707281978f54483029743268f2280b77f3ebcd12a083dce51f81a1d9cfb963"
+    },
     {
       "path": "modules/provisioning/seams.js",
       "mode": "0000644",
       "sha256": "68ba324773bbd9a347ef682c5b1f105b447c6760f24595b8850590ed6d64d78e"
     },
+    {
+      "path": "modules/provisioning/soft-limits.js",
+      "mode": "0000644",
+      "sha256": "03991cd9683c3fc2b4a9fda9e359dcd40a1e782800884b33b49b1d6e1fd9637d"
+    },
     {
       "path": "modules/provisioning/starter-bundles.js",
       "mode": "0000644",
@@ -8932,12 +8972,12 @@
     {
       "path": "package-lock.json",
       "mode": "0000644",
-      "sha256": "60d6f4672fc29b5851546d35e5a6f14c6323d7e5946908d1c2bbe301bb3a0dfa"
+      "sha256": "cf64ad1f380ccd8f68a30f1f5b72aa8c03681fc37f044093ae435b7886529cc8"
     },
     {
       "path": "package.json",
       "mode": "0000644",
-      "sha256": "9bb1f16462f06299a105da0895a24faac4f1c5bb689c5c9045deeb4bb97fb5bc"
+      "sha256": "d79bd6231aed473960ba8f6c644b69f2c930850a0937a504635e657aa733ea89"
     },
     {
       "path": "public-docs/index.html",
@@ -8957,7 +8997,7 @@
     {
       "path": "release-notes.json",
       "mode": "0000644",
-      "sha256": "1e79c9b3c2692c720aac6166d50e881f8069d94be738e57e6eef882ea2ec9d4a"
+      "sha256": "2ec3010abecc3e0ed0d2a9bda13ccad173d34e91d80a13bc4ff4aecace0944e8"
     },
     {
       "path": "scripts/bongos-mcp.js",
@@ -9527,7 +9567,7 @@
     {
       "path": "scripts/gds/fitness.js",
       "mode": "0000644",
-      "sha256": "dee3e8db3ad7fff3c1e30a59aa58bab00972cba9710bd463e10ab8a3edc71e38"
+      "sha256": "11c013412eca59780987da1db3af9db4a16202b743e55675cb28812c4091f883"
     },
     {
       "path": "scripts/gds/gate-review.js",
@@ -9752,7 +9792,7 @@
     {
       "path": "scripts/gds/login.js",
       "mode": "0000644",
-      "sha256": "0d719e43955fdbcc40aee500438db5b31c6c006490e90d99caadf31b215196f7"
+      "sha256": "75f3a83618340171dba4be280cf41515c341c0468f4cf5dd32e3db8adeb95c9d"
     },
     {
       "path": "scripts/gds/main-audit.js",
@@ -10117,7 +10157,7 @@
     {
       "path": "scripts/gds/run-unit-tests.js",
       "mode": "0000644",
-      "sha256": "8a7b0e6b5d899bc2706d952d2383ee5b45758810b7f7d5bd5b7ebc2fc547e43e"
+      "sha256": "1060c8a67619c8e6c0d8168d6a26644b799ed8053ab4995fd9386b55af3660c9"
     },
     {
       "path": "scripts/gds/runner-drift.js",
@@ -10787,7 +10827,7 @@
     {
       "path": "src/bongos/db-kernel.js",
       "mode": "0000644",
-      "sha256": "f224d17792980308b3db2762e06fbbdf265bcf50c7d651662f91b818ae5ce146"
+      "sha256": "85032e00d05717fa4cde2d9db45c567d3f11772a549a458b2ae67a18274a0f91"
     },
     {
       "path": "src/bongos/db.js",
@@ -10809,6 +10849,11 @@
       "mode": "0000644",
       "sha256": "5f2e9a548f7c0cd1c8b8245be4ba50e9066edb18d07ee7ded7d72f363040ba00"
     },
+    {
+      "path": "src/bongos/invite-expiry.js",
+      "mode": "0000644",
+      "sha256": "64ae68b30656075c76f420a29e0f25b6499719d745c901580d5859f8c860ca78"
+    },
     {
       "path": "src/bongos/live-channel.js",
       "mode": "0000644",
@@ -10927,7 +10972,7 @@
     {
       "path": "src/bongos/route-rank-check.js",
       "mode": "0000644",
-      "sha256": "0a4448143b5673781ab21a3ec982a3a183c410caeb7e3afd3ba5d69586de06b2"
+      "sha256": "c7809ca26bf270ff260b79bf83f9c7dec27616c375ff8e9db78867a2a26a63eb"
     },
     {
       "path": "src/bongos/routes.js",
@@ -11072,7 +11117,7 @@
     {
       "path": "src/module-api.js",
       "mode": "0000644",
-      "sha256": "3e5ca31fb6e6c2fc7f351aa64ef4946c206050c6c34df748946a794011cd6f66"
+      "sha256": "40910d211c287582e7066d72f651ff79862d9f5776be6086cd2c931e648136fd"
     },
     {
       "path": "src/module-loader/catalog.js",
@@ -11147,7 +11192,7 @@
     {
       "path": "tests/access_requests_invite.mjs",
       "mode": "0000644",
-      "sha256": "1044d48504923ec03a8a08303fa12612b2fc02abed32d85be26bf8d5615807ad"
+      "sha256": "22f633a9216457e37fa5da47b260ce6c7aa0d5b2c500c8170a476807c426c76b"
     },
     {
       "path": "tests/accessibility_replay.mjs",
@@ -11367,7 +11412,7 @@
     {
       "path": "tests/application_lifecycle.mjs",
       "mode": "0000644",
-      "sha256": "d35db1b125eaee28d3e0af9c1354b36f589a74bca922b22b507fc29b48bb38c4"
+      "sha256": "f84e1b46315e57514f00545038eaa94a9617a83ebb8b5e4b55814fa3b063e155"
     },
     {
       "path": "tests/architect.mjs",
@@ -11672,7 +11717,7 @@
     {
       "path": "tests/bongos_login.mjs",
       "mode": "0000644",
-      "sha256": "1e95957f3c780b4054128000e0deefc76e4df41c3076da76d2fbd187b47c95d2"
+      "sha256": "091ab59bc648f1ef11b309b09283ca2730635c6f3010adfcbf81053e1abb2055"
     },
     {
       "path": "tests/branding.mjs",
@@ -12874,6 +12919,11 @@
       "mode": "0000644",
       "sha256": "ba1c95ca55d8d8e256ba03f2543e44cee4272b9652742343617e35cebefe3ab9"
     },
+    {
+      "path": "tests/government_charter_forms.mjs",
+      "mode": "0000644",
+      "sha256": "0e6e006ad15a39e34b22793be7c6987a8602690f48b65998da04358fd8be3449"
+    },
     {
       "path": "tests/government_charter_library.mjs",
       "mode": "0000644",
@@ -13397,7 +13447,7 @@
     {
       "path": "tests/hub_invite_notices.mjs",
       "mode": "0000644",
-      "sha256": "c79b4101c944110166da2e158bada2192235897887b65bbb7b1f9fae3c61eb13"
+      "sha256": "61a4467e59582bd8d640ba82c139089933a2fadf5c3e2bd570bdfb7b11ae26c7"
     },
     {
       "path": "tests/hub_map_orb_states.mjs",
@@ -13689,6 +13739,16 @@
       "mode": "0000644",
       "sha256": "1e01a44dc1ef5d454643e81737f77b5061e577a9275a22f5b98bd05ac541f1d7"
     },
+    {
+      "path": "tests/invite_expiry.mjs",
+      "mode": "0000644",
+      "sha256": "f4e7d57306b988aa5dadb9c2fe3c55f519beb2725980a7d360caa09416b03e8c"
+    },
+    {
+      "path": "tests/invite_expiry_db.mjs",
+      "mode": "0000644",
+      "sha256": "9963890ca3f5ee6ab008079c1623e0dec11bf3ce696ff5f18621ad9e52f76a4d"
+    },
     {
       "path": "tests/join_application_note.mjs",
       "mode": "0000644",
@@ -14007,7 +14067,7 @@
     {
       "path": "tests/module_api.mjs",
       "mode": "0000644",
-      "sha256": "be32afe74b2ecd47f136a824c9997b54274b72d41dfe5cd8d1e540e9a05f83f4"
+      "sha256": "35a7e4c2e2afe2cd61e51318e7e3300e7629acd24683b515287aa9dcbe8501ae"
     },
     {
       "path": "tests/module_api_lazy.mjs",
@@ -14349,6 +14409,11 @@
       "mode": "0000644",
       "sha256": "6c623a5abe9aadf4821ad8ca291fb5d7805a7a5bc874bfc3cd7e51e83de289d2"
     },
+    {
+      "path": "tests/pending_invite_purge_db.mjs",
+      "mode": "0000644",
+      "sha256": "afc10a1fa260b41133399037cc7c6b1acdde91f9ffac5d62fa7d84f680138b8b"
+    },
     {
       "path": "tests/permission_path.mjs",
       "mode": "0000644",
@@ -14472,7 +14537,7 @@
     {
       "path": "tests/project_admin_console_model.mjs",
       "mode": "0000644",
-      "sha256": "5afd92ab7143b332572adcff8ddec69b544e5607b64b16ba14075d9160eec7a9"
+      "sha256": "af3664d6b4ce861f126b7f9eca87abf423f25bb5126df36a93b80312c70a218c"
     },
     {
       "path": "tests/project_catalog_backfill.mjs",
@@ -14754,6 +14819,11 @@
       "mode": "0000644",
       "sha256": "c9fa4aa59e6e47c139277e3c57298ca441180c4d4752ca6994c72678219df8c8"
     },
+    {
+      "path": "tests/provisioning_planet_physics.mjs",
+      "mode": "0000644",
+      "sha256": "febbdbf82e7521ef80fb00d48a0a5fa9edf063ec20efbb39ddf59051c5cad4b2"
+    },
     {
       "path": "tests/provisioning_public_refusal.mjs",
       "mode": "0000644",

package/clients/bongos-client/README.md

@@ -5,7 +5,7 @@ A **generated**, zero-dependency typed client for the Bongos API — produced fr
 by hand; it regenerates when the spec changes, so it can never drift from the routes.
 
 - API version: **v1** (served at `/api/bongos/v1`)
-- 464 operations across 70 resource groups
+- 465 operations across 70 resource groups
 
 ## Use it from your project
 

package/clients/bongos-client/bongos-client.global.js

@@ -465,6 +465,8 @@ function createClient(opts = {}) {
       postGovernmentAssignments: (args) => request("POST", "/government/assignments", { hasBody: true }, args),
       // DELETE /government/assignments/{builderId}/{rankKey} — rank: archon — DELETE /government/assignments/:builderId/:rankKey
       deleteGovernmentAssignmentsBuilderIdRankKey: (args) => request("DELETE", "/government/assignments/{builderId}/{rankKey}", { hasBody: false }, args),
+      // POST /government/board/charter — rank: metic+archon — POST /government/board/charter
+      postGovernmentBoardCharter: (args) => request("POST", "/government/board/charter", { hasBody: true }, args),
       // GET /government/board/genesis-stages — rank: any-builder — GET /government/board/genesis-stages
       getGovernmentBoardGenesisStages: (args) => request("GET", "/government/board/genesis-stages", { hasBody: false }, args),
       // GET /government/board/items — rank: any-builder — GET /government/board/items

package/clients/bongos-client/index.cjs

@@ -464,6 +464,8 @@ function createClient(opts = {}) {
       postGovernmentAssignments: (args) => request("POST", "/government/assignments", { hasBody: true }, args),
       // DELETE /government/assignments/{builderId}/{rankKey} — rank: archon — DELETE /government/assignments/:builderId/:rankKey
       deleteGovernmentAssignmentsBuilderIdRankKey: (args) => request("DELETE", "/government/assignments/{builderId}/{rankKey}", { hasBody: false }, args),
+      // POST /government/board/charter — rank: metic+archon — POST /government/board/charter
+      postGovernmentBoardCharter: (args) => request("POST", "/government/board/charter", { hasBody: true }, args),
       // GET /government/board/genesis-stages — rank: any-builder — GET /government/board/genesis-stages
       getGovernmentBoardGenesisStages: (args) => request("GET", "/government/board/genesis-stages", { hasBody: false }, args),
       // GET /government/board/items — rank: any-builder — GET /government/board/items

package/clients/bongos-client/index.d.ts

@@ -219,7 +219,7 @@ export interface PatchProjectsIdFeaturedResponse { project: unknown }
 export interface PatchProjectsIdStatusRequest { status: string }
 export interface PatchProjectsIdStatusResponse { project: unknown }
 export interface PatchProvisioningInstancesIdDetailRequest { description?: string; detail?: Record<string, unknown>; modules?: string[]; type?: string }
-export interface PatchProvisioningInstancesIdDetailResponse { ok: boolean; description: unknown; detail: unknown; options: unknown; publish: unknown; modules: unknown; type: unknown }
+export interface PatchProvisioningInstancesIdDetailResponse { ok: boolean; description: unknown; detail: unknown; options: unknown; soft_limits: unknown; publish: unknown; modules: unknown; type: unknown }
 export interface PatchProvisioningInstancesIdEnvManifestVarIdRequest { name?: string; description?: string; environments?: unknown[]; required?: boolean }
 export interface PatchProvisioningInstancesIdEnvManifestVarIdResponse { ok: boolean; env_var: unknown; values_held: boolean }
 export interface PatchProvisioningInstancesIdSettingsResponse { ok: boolean; saved: unknown; planet: unknown; push: unknown }
@@ -330,6 +330,8 @@ export interface PostGoalsReorderResponse { ok: boolean; goals: unknown }
 export interface PostGoalsRequest { version_id: string; title: string; subtitle?: string; description?: string; scope_modules?: string[]; succeeds_goal_id?: number; category_id?: number; admit_reason?: string }
 export interface PostGoalsResponse { ok: boolean; goal: unknown; succeeds_goal_id: unknown; category_advisory: unknown; admitted: unknown }
 export interface PostGovernmentAssignmentsRequest { builder_id: number; rank_key: string }
+export interface PostGovernmentBoardCharterRequest { form?: string; franchise?: string; council_rank?: string; pass_rule?: string; rationale_md?: string; acknowledge_self_removal?: boolean }
+export interface PostGovernmentBoardCharterResponse { ok: boolean; amendment: unknown; item: unknown; reads_as: unknown }
 export interface PostGovernmentBoardItemsItemIdVotesRequest { direction: string; reason_md?: string; section_key?: string }
 export interface PostGovernmentBoardItemsRequest { subject_type: string; proposal: Record<string, unknown>; rationale_md?: string; acknowledge_self_removal?: boolean }
 export interface PostGovernmentBoardItemsResponse { ok: boolean; amendment: unknown; item: unknown }
@@ -894,6 +896,8 @@ export interface BongosClient {
     postGovernmentAssignments(args: RequestArgs & { body: PostGovernmentAssignmentsRequest }): Promise<ApiResponse>;
     /** DELETE /government/assignments/{builderId}/{rankKey} — rank: archon */
     deleteGovernmentAssignmentsBuilderIdRankKey(args?: RequestArgs): Promise<DeleteGovernmentAssignmentsBuilderIdRankKeyResponse>;
+    /** POST /government/board/charter — rank: metic+archon */
+    postGovernmentBoardCharter(args?: RequestArgs & { body?: PostGovernmentBoardCharterRequest }): Promise<PostGovernmentBoardCharterResponse>;
     /** GET /government/board/genesis-stages — rank: any-builder */
     getGovernmentBoardGenesisStages(args?: RequestArgs): Promise<ApiResponse>;
     /** GET /government/board/items — rank: any-builder */

package/clients/bongos-client/index.mjs

@@ -461,6 +461,8 @@ export function createClient(opts = {}) {
       postGovernmentAssignments: (args) => request("POST", "/government/assignments", { hasBody: true }, args),
       // DELETE /government/assignments/{builderId}/{rankKey} — rank: archon — DELETE /government/assignments/:builderId/:rankKey
       deleteGovernmentAssignmentsBuilderIdRankKey: (args) => request("DELETE", "/government/assignments/{builderId}/{rankKey}", { hasBody: false }, args),
+      // POST /government/board/charter — rank: metic+archon — POST /government/board/charter
+      postGovernmentBoardCharter: (args) => request("POST", "/government/board/charter", { hasBody: true }, args),
       // GET /government/board/genesis-stages — rank: any-builder — GET /government/board/genesis-stages
       getGovernmentBoardGenesisStages: (args) => request("GET", "/government/board/genesis-stages", { hasBody: false }, args),
       // GET /government/board/items — rank: any-builder — GET /government/board/items

package/docs/adr/0335-an-invite-is-a-pre-approved-row-on-the-projects-own-instance.md

@@ -55,7 +55,7 @@ There is no new table. The sign-in gate (`hasInvitedAccessRequest` → `firstTim
 2. **`created_by` → `builders(id)`, set on invite rows only.** This is the inviter. It needs its own column because a rescind overwrites `resolved_by_builder_id` (ADR 0201 D4.2 records whoever acted last). Without it, a rescinded invite forgets who sent it.
 3. **`note` needs no new column.** The existing column holds the inviter's note on an invite row, and `kind` says whose words they are.
 4. **The backfill is exact.** The current invite route sets `resolved_at = now()` in the same statement whose default fills `created_at`, so every row it wrote has `created_at = resolved_at`. No approved application can match that, because an application is always resolved after it was filed. So the migration sets `kind='invite'` and `created_by = resolved_by_builder_id` on `status='invited'` rows where `created_at = resolved_at`. The one case it cannot catch is a direct invite that was later rescinded, because the rescind changes `resolved_at`. That row stays `'application'`, which makes it look like a declined application. It admits nobody either way. The only effect comes after R3: a recruiter who holds `project.recruit` but not `access_request.review` and re-invites that login gets the D3.4 refusal, so a reviewer has to send the invite. That leaves the door stricter, never looser, and applies only to invites rescinded before R2 ships.
-5. **`kind` and `created_by` never enter an admission read.** This is the same rule `core_230` set for the vouch column. An invite and an approved application admit through the identical `status = 'invited'` read. `tests/project_admin_console_model.mjs` checks this.
+5. **`kind` and `created_by` never enter an admission read.** This is the same rule `core_230` set for the vouch column. An invite and an approved application admit through the identical `status = 'invited'` read. `tests/project_admin_console_model.mjs` checks this. **Amended by [ADR 0356](0356-a-recruit-invite-expires-30-days-after-it-is-sent-read-time.md) (task 1002969):** `kind` now enters admission in one place, the invite expiry, which can close an invite's door after 30 days and never opens one. `created_by` still never enters.
 6. **Expiry is not part of this.** The 30-day read-time expiry (ADR 0201 D4.3) covers every invited row, whatever its `kind`. Task 1002969 owns it.
 
 ### D3 — One new grantable atom, `project.recruit` (floor archon), says which rank may recruit; the verdict stays with `access_request.review`

package/docs/adr/0353-a-hub-invite-is-a-notice-of-the-projects-own-invite.md

@@ -55,10 +55,10 @@ The two notice routes are **new**. An older hub answers 404, the sender swallows
 ## Consequences
 
 - **The done-when holds for every invite created from now on.** A hub notice exists only because the project wrote an `invited` row, and a rescind that closes the door removes the notice. The hub's own invite creates no row at all.
-- **Rows written before this change are untouched.** Pending rows the old hub invite wrote still render as **Open project →**, and on a door other than `open` they still lead to the project's gate. The invitee can decline them, and the project can clear one by inviting and then rescinding. Deleting them at deploy would need a data migration, and it would also delete notices that do work (on `open` doors). That is left to the owner (see the task's handoff), not done silently here.
+- **Rows written before this change are untouched.** Pending rows the old hub invite wrote still render as **Open project →**, and on a door other than `open` they still lead to the project's gate. The invitee can decline them, and the project can clear one by inviting and then rescinding. Deleting them at deploy would need a data migration, and it would also delete notices that do work (on `open` doors). That is left to the owner (see the task's handoff), not done silently here. **Amended (task 1004408):** the owner chose to delete them. Migration `<redacted>` deletes every `pending` row older than the hub's first upgrade to core 1.20.22 (the first release carrying this ADR), read from the `core_upgrades` ledger, or every `pending` row if there is no such upgrade. Old rows on `open` doors go too; those invitees can still sign in to the project, and the inviter can re-invite from the project's hall. Proof: `tests/pending_invite_purge_db.mjs`.
 - **The hub's invite now reaches people with no platform account.** The project's own invite takes any GitHub login, so the old `account_not_found` refusal is gone. Such an invitee sees no hub notice, because there is no account to show it to, but they are admitted when they sign in.
 - **Three things still bypass the notice**, all by scope: the reviewer queue's approve (`PATCH` pending → invited), the Discord approval reaction, and R3's future recruiter rescind route. The first two are approvals of an application the applicant already knows about. R3 (task 1002815) must call the same port when it adds its rescind.
-- **The 30-day invite expiry** (task 1002969) is read-time on the instance. An expired invite's hub notice stays until the invitee declines it or the project re-invites and rescinds. Task 1002969 owns closing that.
+- **The 30-day invite expiry** (task 1002969) is read-time on the instance. An expired invite's hub notice stays until the invitee declines it or the project re-invites and rescinds. Task 1002969 owns closing that. **Closed by [ADR 0356](0356-a-recruit-invite-expires-30-days-after-it-is-sent-read-time.md):** the hub stops listing a notice 30 days after it was sent, and a re-invite restamps it.
 
 ## Alternatives considered
 

package/docs/adr/0355-a-soft-limit-is-a-rule-with-a-reason-and-nobody-enforces-it.md

@@ -0,0 +1,30 @@
+# ADR 0355 — A soft limit is a rule with a reason, and nobody enforces it
+
+- **Status:** accepted
+- **Date:** 2026-09-30
+- **Task:** [task 1004416](https://cloudbongos.com/builders#/task/1004416) (BV2.PS02, goal 1000121)
+- **Interacts with:** [ADR 0239](0239-a-recommendation-is-a-table-that-carries-its-own-reason.md) (a recommendation is a table that carries its own reason), the spec [`docs/specs/<redacted>.md`](../specs/<redacted>.md) decision D6
+
+## Context
+
+The new startup flow asks seven "planet physics" questions before any technical setup: state, geography, ages, entity, builders, rewards and framing. The answers carry legal weight. An individual has no shares to give, cash payouts to EU builders are not available yet, and 13 to 15 year olds join non-monetary tracks only. Spec decision D6 says the flow should grey or hide options that clearly do not apply, each with a line saying why. It also says nothing enforces these limits yet, and no screen may claim otherwise.
+
+The flow also needs a stop screen: a project whose description is something Cloud Bongos will not help build is stopped before anything is created. The real classifier is out of scope.
+
+## Decision
+
+**D1: The answers are more `detail` keys.** They ride the provisioning `detail` jsonb under the same contract as `team_shape`: no defaults, an unknown value refused loudly at the route, and `null` to un-answer. Two new kinds of question join the closed single answer. A `many` question takes a list of members, stored de-duplicated in the vocabulary's order. A `count` question takes a whole number in a range. `PROJECT_DETAIL_QUESTIONS` is the whole contract. `PROJECT_DETAIL_VOCAB` stays the closed answer lists, so every existing reader and the `options` reply keep their shape. The country is a closed ISO 3166-1 list rather than a two-letter pattern, so a typo like `ZZ` is refused instead of stored.
+
+**D2: Answers must agree only within one request.** The main kind of work must be one of the existing kinds, and the region must be inside the country, when both arrive in the same body. A merge patch may change one half now and the other later, and refusing a write because it disagrees with a stored answer would make the order of edits matter.
+
+**D3: The soft limits are one declarative table, and every resolution says `enforced: false`.** Each rule has a `when` (data, never a function), the options it names, an effect (`hide`, `grey` or `note`) and an owner-facing reason. Because conditions are data, a test can check every rule against the vocabulary, and a browser could evaluate the same table. An unanswered key never matches, so no rule fires on an answer nobody gave. `note` exists because some options apply only in part: cash is still available to builders outside the EU, so greying it would be wrong. The resolution rides every owner read of a project and the `PATCH …/detail` reply. A test fails any reason worded as if the limit were enforced.
+
+**D4: Screening is a seam with a deliberately small rule set.** `screenProject(texts, rules)` takes the project's own words and returns `{ stop }`. The real classifier replaces the rules or the function body, and no caller changes. A keyword rule that stops an honest project is worse than one that misses a bad one, so each rule names something no legitimate project is built to be. An `unless` lets a defensive project through (a ransomware detector, a phishing-awareness course). A stop is a 422 `screened_out` with the canvas's own sentence. Nothing in the reply names the rule, because a gate that says which rule it tripped teaches a caller how to reword around it. Whoever answers "contact us" reads the description itself.
+
+**D5: The screen runs on the edit route too.** The stop happens on create before any row or intent exists. `PATCH …/detail` screens a new description as well. Otherwise a project could be created with no description and given the stopped one straight afterwards.
+
+## Consequences
+
+- No migration: `detail` is a dumb jsonb store, so new questions cost none.
+- The age tiers and payout geography are stored facts, not policy. Server-side enforcement is a later goal, and it will read these keys.
+- The screen's false positives are the risk to watch. Until the classifier exists, a rule should be added only when it cannot plausibly describe an honest project.