@bongos/core 1.20.27 → 1.20.28

package/.bongos-core.json

@@ -2,22 +2,22 @@
   "artifact": "bongos-core",
   "manifest_schema": 1,
   "generator": "scripts/gds/package-core.js",
-  "core_version": "1.20.27",
-  "core_contract": "1.20.27",
-  "source_commit": "1fc525416e379b30ced8b97b9999a269eb272392",
+  "core_version": "1.20.28",
+  "core_contract": "1.20.28",
+  "source_commit": "64dc694277165d8cd1227e09df2fda3dd99dd396",
   "source_ref": "HEAD",
-  "built_at": "2026-09-30T19:45:22.316Z",
+  "built_at": "2026-09-30T20:23:58.237Z",
   "redaction": {
     "model": "docs-redacted+functional-verbatim",
-    "docs_redacted": 561,
+    "docs_redacted": 562,
     "agent_docs_stubbed": 25,
-    "functional_verbatim": 2655,
+    "functional_verbatim": 2659,
     "rules": 3,
     "gate_literals": 3,
     "gate": "passed"
   },
-  "file_count": 3242,
-  "tree_sha256": "c65b104e5fd942b276adceaae176a3d833b2fa53daebe3292ac36d278f890c2e",
+  "file_count": 3247,
+  "tree_sha256": "06c076a09a9c706567f32a447e0d1600e2e07a868b9bdd4be62088a290714985",
   "files": [
     {
       "path": ".claude/skills/ask-for-help/SKILL.md",
@@ -2147,7 +2147,7 @@
     {
       "path": "docs/adr/0335-an-invite-is-a-pre-approved-row-on-the-projects-own-instance.md",
       "mode": "0000644",
-      "sha256": "f22adac7e27f2e83ece9311e44fca35edb0bd571440f108d28a9088775d0b93c"
+      "sha256": "826c6c6ae6e10af9383e518ff63196e2b947bc0ecfa0c1be0288895751bc1352"
     },
     {
       "path": "docs/adr/0336-a-guilds-record-is-the-sum-of-what-its-members-already-show.md",
@@ -2237,7 +2237,7 @@
     {
       "path": "docs/adr/0353-a-hub-invite-is-a-notice-of-the-projects-own-invite.md",
       "mode": "0000644",
-      "sha256": "5c93de4ab1813f7641ec3b33ad620a609a77fbe6fb3cbaffd99b7e6e5f8282fa"
+      "sha256": "e4ee7809ea3f414ecfdbe0b3e6e4b435c1ccc25084fce9c3cfa3521943fe8b90"
     },
     {
       "path": "docs/adr/0354-a-builder-hosts-one-project-free-and-more-takes-the-fleet-permission.md",
@@ -2249,10 +2249,15 @@
       "mode": "0000644",
       "sha256": "6ad8ab3bd8bcb4f55575232af651f108e3879a5965f5daaac42ab693d00a1f0a"
     },
+    {
+      "path": "docs/adr/0356-a-recruit-invite-expires-30-days-after-it-is-sent-read-time.md",
+      "mode": "0000644",
+      "sha256": "ccbad5d4326b069381db47ea3fc165f9a4020485e3d6ce346393a2f6711ce1f0"
+    },
     {
       "path": "docs/adr/README.md",
       "mode": "0000644",
-      "sha256": "8258f16b11aaed9731afca21379b1ae976dc67040d6d35139987e29fd4acd360"
+      "sha256": "d21d0eb8389864b4f7394ba0f4b0d0d809182f0bef82d9fc6824edd00e174b39"
     },
     {
       "path": "docs/api-reference.md",
@@ -2262,7 +2267,7 @@
     {
       "path": "docs/api/openapi.json",
       "mode": "0000644",
-      "sha256": "545342fb2849e012cd5caca28d21659fe076a5158c0a0a4c2ca4a2b34abd34da"
+      "sha256": "27b8f6be81f9703a96a68f917dbb01a65048cc02f13adf308b414e96fb022668"
     },
     {
       "path": "docs/architecture.md",
@@ -2287,12 +2292,12 @@
     {
       "path": "docs/copy-inventory.md",
       "mode": "0000644",
-      "sha256": "3e6cb5cc724958b42912c60fa5cfe65cd6bd7baa7697c3b501534506053a5cb6"
+      "sha256": "ed9adfda17002adac03024b90ed8ee6a79a9c5a814ce88970bf6c1dfd6fa8e9f"
     },
     {
       "path": "docs/copy-registry.json",
       "mode": "0000644",
-      "sha256": "5eb31ba434dd1afbfe397ed33ae62ea76c51b71eaafca9b693bebfbe800e3b14"
+      "sha256": "68b59e9280240b604210d20279e64f47af0bddbac8e2c3344343b4ecf8e21e52"
     },
     {
       "path": "docs/design/apex-pass-2-direction.md",
@@ -2797,7 +2802,7 @@
     {
       "path": "docs/module-api-changelog.md",
       "mode": "0000644",
-      "sha256": "7360408e833d4775efb81a46a20c2b357495e93532e08468fe59766cede1b0ad"
+      "sha256": "8de783d8efc2109b60de3758da0dfd4fecaf4d4a65dc364dacd1c17e8dac4a7d"
     },
     {
       "path": "docs/modules-contract.md",
@@ -2887,7 +2892,7 @@
     {
       "path": "docs/page-readings.json",
       "mode": "0000644",
-      "sha256": "bed8eb280c3798e7def41bfff4d21ac22e8f16ded6174de18487d54e071af768"
+      "sha256": "c9722a4284b34b8773b2fed801a256277bb314833da397ae89af674ebe46acee"
     },
     {
       "path": "docs/project-context.template.md",
@@ -3979,6 +3984,11 @@
       "mode": "0000644",
       "sha256": "ea887c7bcd2863e69121bfcfa36cc62fedc77c5bd5a052e5868e2f7c99cbc103"
     },
+    {
+      "path": "migrations/core_266_access_requests_invited_login_idx.sql",
+      "mode": "0000644",
+      "sha256": "e7dcf016492ab9d011bd0021ac866edd502bf68f2fe06a04365ecb2b49ccbfaa"
+    },
     {
       "path": "modules/agents/CLAUDE.md",
       "mode": "0000644",
@@ -5752,7 +5762,7 @@
     {
       "path": "modules/hall-ui/public/watch.js",
       "mode": "0000644",
-      "sha256": "7a5ef4f34be6b0ab7f5b3fa34bf1666c17164a6331031cc908c2791109585b89"
+      "sha256": "6746170acdd097b14bdccce236ac236b4962bdd1679de2c5624ca1a10cf784d0"
     },
     {
       "path": "modules/hall-ui/public/watch.states.json",
@@ -6842,7 +6852,7 @@
     {
       "path": "modules/onboarding/routes/access-requests.js",
       "mode": "0000644",
-      "sha256": "1eaac1f70a519ca5a0ea71bb56ab6d33b582f5ff002faf5811fa6c1700480057"
+      "sha256": "7e8a63d388816b1a65ec6b24fdc20390d42efa7afa5c33cdf164d0cfca1ad5d4"
     },
     {
       "path": "modules/onboarding/routes/onboarding.js",
@@ -7092,7 +7102,7 @@
     {
       "path": "modules/platform-identity/platform-identity.js",
       "mode": "0000644",
-      "sha256": "9877fd84f74545d96473651cca9d00a76712507e76962c1891d3dd0c3d47e7b2"
+      "sha256": "8f293f2d70e61f90a381153248a748b12452d3bb984e5903f32610fad78d669f"
     },
     {
       "path": "modules/platform-identity/pollers/code-sweep.js",
@@ -7222,7 +7232,7 @@
     {
       "path": "modules/platform-identity/tests/platform-identity.mjs",
       "mode": "0000644",
-      "sha256": "d9164f9ae4188a313ce55ebc7c670531aa4e47128f85571aaa55730dbabd1dd3"
+      "sha256": "6dc7617a7d7615fc5ee51817ae77bba8089324c124a6cb1d0fe3ca9400454ee1"
     },
     {
       "path": "modules/platform-identity/ui/.gitkeep",
@@ -8962,12 +8972,12 @@
     {
       "path": "package-lock.json",
       "mode": "0000644",
-      "sha256": "b4b4420fef73f720a6180d45b5559b38b857fe80181e148715187c5f2c5ec498"
+      "sha256": "cf64ad1f380ccd8f68a30f1f5b72aa8c03681fc37f044093ae435b7886529cc8"
     },
     {
       "path": "package.json",
       "mode": "0000644",
-      "sha256": "9c84d9545af388a0db6fed5fe78bf1c71469ffa1e69ea37386281f0c273cd656"
+      "sha256": "d79bd6231aed473960ba8f6c644b69f2c930850a0937a504635e657aa733ea89"
     },
     {
       "path": "public-docs/index.html",
@@ -8987,7 +8997,7 @@
     {
       "path": "release-notes.json",
       "mode": "0000644",
-      "sha256": "f6b10e5e103f5007ef31e7d2f53c95e146a93562f5a5465ea4e85da2baeb3c52"
+      "sha256": "2ec3010abecc3e0ed0d2a9bda13ccad173d34e91d80a13bc4ff4aecace0944e8"
     },
     {
       "path": "scripts/bongos-mcp.js",
@@ -9557,7 +9567,7 @@
     {
       "path": "scripts/gds/fitness.js",
       "mode": "0000644",
-      "sha256": "dee3e8db3ad7fff3c1e30a59aa58bab00972cba9710bd463e10ab8a3edc71e38"
+      "sha256": "11c013412eca59780987da1db3af9db4a16202b743e55675cb28812c4091f883"
     },
     {
       "path": "scripts/gds/gate-review.js",
@@ -9782,7 +9792,7 @@
     {
       "path": "scripts/gds/login.js",
       "mode": "0000644",
-      "sha256": "0d719e43955fdbcc40aee500438db5b31c6c006490e90d99caadf31b215196f7"
+      "sha256": "75f3a83618340171dba4be280cf41515c341c0468f4cf5dd32e3db8adeb95c9d"
     },
     {
       "path": "scripts/gds/main-audit.js",
@@ -10147,7 +10157,7 @@
     {
       "path": "scripts/gds/run-unit-tests.js",
       "mode": "0000644",
-      "sha256": "d891a37574626191f7abc01c50a64178a128e4f8b53ceb17ad6ed6d7439bc56e"
+      "sha256": "1060c8a67619c8e6c0d8168d6a26644b799ed8053ab4995fd9386b55af3660c9"
     },
     {
       "path": "scripts/gds/runner-drift.js",
@@ -10817,7 +10827,7 @@
     {
       "path": "src/bongos/db-kernel.js",
       "mode": "0000644",
-      "sha256": "f224d17792980308b3db2762e06fbbdf265bcf50c7d651662f91b818ae5ce146"
+      "sha256": "85032e00d05717fa4cde2d9db45c567d3f11772a549a458b2ae67a18274a0f91"
     },
     {
       "path": "src/bongos/db.js",
@@ -10839,6 +10849,11 @@
       "mode": "0000644",
       "sha256": "5f2e9a548f7c0cd1c8b8245be4ba50e9066edb18d07ee7ded7d72f363040ba00"
     },
+    {
+      "path": "src/bongos/invite-expiry.js",
+      "mode": "0000644",
+      "sha256": "64ae68b30656075c76f420a29e0f25b6499719d745c901580d5859f8c860ca78"
+    },
     {
       "path": "src/bongos/live-channel.js",
       "mode": "0000644",
@@ -11102,7 +11117,7 @@
     {
       "path": "src/module-api.js",
       "mode": "0000644",
-      "sha256": "b2361eff082828662c898922d47f4968192f852af7fbf5b03365c7624ffbfc55"
+      "sha256": "40910d211c287582e7066d72f651ff79862d9f5776be6086cd2c931e648136fd"
     },
     {
       "path": "src/module-loader/catalog.js",
@@ -11177,7 +11192,7 @@
     {
       "path": "tests/access_requests_invite.mjs",
       "mode": "0000644",
-      "sha256": "1044d48504923ec03a8a08303fa12612b2fc02abed32d85be26bf8d5615807ad"
+      "sha256": "22f633a9216457e37fa5da47b260ce6c7aa0d5b2c500c8170a476807c426c76b"
     },
     {
       "path": "tests/accessibility_replay.mjs",
@@ -11397,7 +11412,7 @@
     {
       "path": "tests/application_lifecycle.mjs",
       "mode": "0000644",
-      "sha256": "d35db1b125eaee28d3e0af9c1354b36f589a74bca922b22b507fc29b48bb38c4"
+      "sha256": "f84e1b46315e57514f00545038eaa94a9617a83ebb8b5e4b55814fa3b063e155"
     },
     {
       "path": "tests/architect.mjs",
@@ -11702,7 +11717,7 @@
     {
       "path": "tests/bongos_login.mjs",
       "mode": "0000644",
-      "sha256": "1e95957f3c780b4054128000e0deefc76e4df41c3076da76d2fbd187b47c95d2"
+      "sha256": "091ab59bc648f1ef11b309b09283ca2730635c6f3010adfcbf81053e1abb2055"
     },
     {
       "path": "tests/branding.mjs",
@@ -13432,7 +13447,7 @@
     {
       "path": "tests/hub_invite_notices.mjs",
       "mode": "0000644",
-      "sha256": "c79b4101c944110166da2e158bada2192235897887b65bbb7b1f9fae3c61eb13"
+      "sha256": "61a4467e59582bd8d640ba82c139089933a2fadf5c3e2bd570bdfb7b11ae26c7"
     },
     {
       "path": "tests/hub_map_orb_states.mjs",
@@ -13724,6 +13739,16 @@
       "mode": "0000644",
       "sha256": "1e01a44dc1ef5d454643e81737f77b5061e577a9275a22f5b98bd05ac541f1d7"
     },
+    {
+      "path": "tests/invite_expiry.mjs",
+      "mode": "0000644",
+      "sha256": "f4e7d57306b988aa5dadb9c2fe3c55f519beb2725980a7d360caa09416b03e8c"
+    },
+    {
+      "path": "tests/invite_expiry_db.mjs",
+      "mode": "0000644",
+      "sha256": "9963890ca3f5ee6ab008079c1623e0dec11bf3ce696ff5f18621ad9e52f76a4d"
+    },
     {
       "path": "tests/join_application_note.mjs",
       "mode": "0000644",
@@ -14042,7 +14067,7 @@
     {
       "path": "tests/module_api.mjs",
       "mode": "0000644",
-      "sha256": "be32afe74b2ecd47f136a824c9997b54274b72d41dfe5cd8d1e540e9a05f83f4"
+      "sha256": "35a7e4c2e2afe2cd61e51318e7e3300e7629acd24683b515287aa9dcbe8501ae"
     },
     {
       "path": "tests/module_api_lazy.mjs",
@@ -14512,7 +14537,7 @@
     {
       "path": "tests/project_admin_console_model.mjs",
       "mode": "0000644",
-      "sha256": "5afd92ab7143b332572adcff8ddec69b544e5607b64b16ba14075d9160eec7a9"
+      "sha256": "af3664d6b4ce861f126b7f9eca87abf423f25bb5126df36a93b80312c70a218c"
     },
     {
       "path": "tests/project_catalog_backfill.mjs",

package/docs/adr/0335-an-invite-is-a-pre-approved-row-on-the-projects-own-instance.md

@@ -55,7 +55,7 @@ There is no new table. The sign-in gate (`hasInvitedAccessRequest` → `firstTim
 2. **`created_by` → `builders(id)`, set on invite rows only.** This is the inviter. It needs its own column because a rescind overwrites `resolved_by_builder_id` (ADR 0201 D4.2 records whoever acted last). Without it, a rescinded invite forgets who sent it.
 3. **`note` needs no new column.** The existing column holds the inviter's note on an invite row, and `kind` says whose words they are.
 4. **The backfill is exact.** The current invite route sets `resolved_at = now()` in the same statement whose default fills `created_at`, so every row it wrote has `created_at = resolved_at`. No approved application can match that, because an application is always resolved after it was filed. So the migration sets `kind='invite'` and `created_by = resolved_by_builder_id` on `status='invited'` rows where `created_at = resolved_at`. The one case it cannot catch is a direct invite that was later rescinded, because the rescind changes `resolved_at`. That row stays `'application'`, which makes it look like a declined application. It admits nobody either way. The only effect comes after R3: a recruiter who holds `project.recruit` but not `access_request.review` and re-invites that login gets the D3.4 refusal, so a reviewer has to send the invite. That leaves the door stricter, never looser, and applies only to invites rescinded before R2 ships.
-5. **`kind` and `created_by` never enter an admission read.** This is the same rule `core_230` set for the vouch column. An invite and an approved application admit through the identical `status = 'invited'` read. `tests/project_admin_console_model.mjs` checks this.
+5. **`kind` and `created_by` never enter an admission read.** This is the same rule `core_230` set for the vouch column. An invite and an approved application admit through the identical `status = 'invited'` read. `tests/project_admin_console_model.mjs` checks this. **Amended by [ADR 0356](0356-a-recruit-invite-expires-30-days-after-it-is-sent-read-time.md) (task 1002969):** `kind` now enters admission in one place, the invite expiry, which can close an invite's door after 30 days and never opens one. `created_by` still never enters.
 6. **Expiry is not part of this.** The 30-day read-time expiry (ADR 0201 D4.3) covers every invited row, whatever its `kind`. Task 1002969 owns it.
 
 ### D3 — One new grantable atom, `project.recruit` (floor archon), says which rank may recruit; the verdict stays with `access_request.review`

package/docs/adr/0353-a-hub-invite-is-a-notice-of-the-projects-own-invite.md

@@ -58,7 +58,7 @@ The two notice routes are **new**. An older hub answers 404, the sender swallows
 - **Rows written before this change are untouched.** Pending rows the old hub invite wrote still render as **Open project →**, and on a door other than `open` they still lead to the project's gate. The invitee can decline them, and the project can clear one by inviting and then rescinding. Deleting them at deploy would need a data migration, and it would also delete notices that do work (on `open` doors). That is left to the owner (see the task's handoff), not done silently here. **Amended (task 1004408):** the owner chose to delete them. Migration `<redacted>` deletes every `pending` row older than the hub's first upgrade to core 1.20.22 (the first release carrying this ADR), read from the `core_upgrades` ledger, or every `pending` row if there is no such upgrade. Old rows on `open` doors go too; those invitees can still sign in to the project, and the inviter can re-invite from the project's hall. Proof: `tests/pending_invite_purge_db.mjs`.
 - **The hub's invite now reaches people with no platform account.** The project's own invite takes any GitHub login, so the old `account_not_found` refusal is gone. Such an invitee sees no hub notice, because there is no account to show it to, but they are admitted when they sign in.
 - **Three things still bypass the notice**, all by scope: the reviewer queue's approve (`PATCH` pending → invited), the Discord approval reaction, and R3's future recruiter rescind route. The first two are approvals of an application the applicant already knows about. R3 (task 1002815) must call the same port when it adds its rescind.
-- **The 30-day invite expiry** (task 1002969) is read-time on the instance. An expired invite's hub notice stays until the invitee declines it or the project re-invites and rescinds. Task 1002969 owns closing that.
+- **The 30-day invite expiry** (task 1002969) is read-time on the instance. An expired invite's hub notice stays until the invitee declines it or the project re-invites and rescinds. Task 1002969 owns closing that. **Closed by [ADR 0356](0356-a-recruit-invite-expires-30-days-after-it-is-sent-read-time.md):** the hub stops listing a notice 30 days after it was sent, and a re-invite restamps it.
 
 ## Alternatives considered
 

package/docs/adr/0356-a-recruit-invite-expires-30-days-after-it-is-sent-read-time.md

@@ -0,0 +1,46 @@
+# ADR 0356 — A recruit invite expires 30 days after it is sent, decided at read time
+
+- **Status:** accepted
+- **Date:** 2026-09-30
+- **Task:** [task 1002969](https://cloudbongos.com/builders#/task/1002969) (goal 1000110)
+- **Builds on:** privacy spec D4 (`docs/specs/<redacted>.md`; the owner signed the 30 days), [ADR 0335](0335-an-invite-is-a-pre-approved-row-on-the-projects-own-instance.md) D2 (an invite is a `kind='invite'` row on the project's own instance), [ADR 0353](0353-a-hub-invite-is-a-notice-of-the-projects-own-invite.md) (the hub's `pending` row is a notice of that invite)
+- **Amends:** ADR 0335 D2.5 ("no admission path reads `kind`")
+- **Decided with:** the owner split the original task on 2026-09-30. `seen_at` is [task 1004443](https://cloudbongos.com/builders#/task/1004443); the decline relay is [task 1004444](https://cloudbongos.com/builders#/task/1004444).
+
+## Context
+
+An invite writes an `invited` row, and the sign-in gate admits any login holding one. Nothing ever closed it, so an invite sent months ago still let its login walk in. Spec D4 says a recruit invite's door closes after 30 days, enforced when it is read: no sweeper and no cron. ADR 0353 left the hub side of the same question to this task, because an expired invite's hub notice still said "Open project →".
+
+## Decision
+
+**D1 — One definition, computed at read time.** `src/bongos/invite-expiry.js` holds `INVITE_EXPIRY_DAYS` (30) and the SQL for "this row is an invite past its window", `kind = 'invite' AND created_at <= now() - interval '30 days'`. The sign-in gate (`hasInvitedAccessRequest`), the waiting-page probe (`accessStateByLogin`), the onboarding routes and the hub all read it: core directly, and modules through the doorway's `inviteExpiry`. Nothing is stored, so the day a door closes cannot drift between readers, and nothing has to run for it to close.
+
+**D2 — Only invites expire.** An approved application (`kind = 'application'`) stays open: its applicant asked, and D4 is about invites. Goal invites get no expiry either.
+
+**D3 — The gate now reads `kind`, and only to be stricter (amends ADR 0335 D2.5).** D2.5 kept `kind` out of admission because it was descriptive. It is now read in one place, inside the expiry unit, and that unit can only close a door. A row that is anything but an invite behaves exactly as before, so a mis-kinded row fails toward the old gate and never past it. Only server code writes `kind`: the public POST cannot set it. `created_by` is still never read. `tests/application_lifecycle.mjs` enforces both: its admission statements may mention `kind` only inside the expiry unit.
+
+**D4 — What an expired invite looks like.**
+- The gate refuses it. The public "already approved?" check and the standing-invite probe no longer count it, so the invitee may apply and the recruiter can re-invite.
+- A re-invite writes a fresh row, which opens a fresh door. The expired row stays as history.
+- The queue marks it `expired` with `expires_at`. The outstanding-invite list keeps it so the sender knows to invite again, and drops it once a newer invite for that login is live. The hall's queue shows "Invite expired" and offers no rescind.
+- The public status probe answers `expired` (`admitted: false`), and `bongos login` stops waiting on it. An older CLI treats an unknown status as "wait" and times out, which is no worse than before.
+- A rescind that leaves only expired rows clears the hub notice.
+
+**D5 — The hub's notice follows the door.** `listPendingInvitesForAccount` hides a `pending` notice older than the same 30 days (its `joined_at` is when the project sent the notice). `inviteToProject` restamps `joined_at` only on a `pending` row that is already past the window, so a re-invite shows again. A re-send while the invite is live changes nothing, and a real membership is never touched.
+
+## Consequences
+
+- **Invites already older than 30 days close at deploy.** That is the spec's rule applied to existing rows. Their senders re-invite.
+- **Wire skew (ADR 0352).** A newer hub with an older instance hides a notice after 30 days while that instance's door stays open. Only the nudge is lost. An older hub with a newer instance keeps showing an expired notice, which is today's behaviour.
+- **The hub's clock is the notice's, not the invite's.** A notice healed by a late re-send (the hub missed the first) can outlive its invite by up to the gap between them. A lost clear can hide a live notice early. In both cases the next re-invite fixes it.
+- **The outstanding list's cost stays that of its own scan.** "Does this login have a live invite" is a window (`bool_or … OVER (PARTITION BY lower(github_login))`) over the rows the list already reads, not a correlated lookup per row: `access_requests` has no index on `lower(github_login)` outside pending rows, and invite rows are kept as history. The sender filter (`?mine=1`) sits outside the window. Migration `core_266` adds the index those reads lacked, partial on `status = 'invited'` over `lower(github_login)`, which serves the sign-in gate, the standing-invite probe and this list. The owner approved it on 2026-09-30 after a grader finding.
+- **Declining still closes only the hub's notice.** The project's row stays open until it expires. Task 1004444 owns the relay.
+
+## Alternatives considered
+
+- **A sweeper that flips expired rows to `dismissed`.** Spec D4 rules it out. It would also mislabel an expiry as a decline in the history.
+- **Expire every `invited` row, applications included.** That is wider than D4, and at deploy it would lock out every applicant approved more than 30 days ago.
+- **Dismiss the expired row when re-inviting.** That keeps the list tidy, but the hall renders `dismissed` as "Declined", which would be false.
+- **Carry the invite's `created_at` to the hub in a header, making its clock exact.** That is a new wire field on the notify route for an edge case a re-invite already heals.
+
+Proof: `tests/invite_expiry.mjs` (the definition), `tests/application_lifecycle.mjs` (the gate, queues, probe, re-invite and notice clear, interpreted), `tests/invite_expiry_db.mjs` (the same statements on real Postgres, plus the hub's notice), `tests/hub_invite_notices.mjs` and `modules/platform-identity/tests/platform-identity.mjs` (the notice statement's shape), `tests/bongos_login.mjs` (the CLI stops on `expired`).

package/docs/adr/README.md

@@ -474,3 +474,4 @@ These 20 numbers are each shared by exactly two files. They are **accepted histo
 | 0353 | [**A hub invite is a notice of the project's own invite, and signing in accepts it** ([task 1002818](https://cloudbongos.com/builders#/task/1002818), goal 1000110 — R6 of the admin console wave). The hub's own invite wrote a `pending` membership that no project reads, so an "accepted" invite met a locked door (new projects default to `apply`). **D1:** that row is now a NOTICE the PROJECT writes: its invite route calls `POST /sso/invites/notify` and a dismissal that leaves no invited row calls `/sso/invites/clear` (client credentials, pending rows only, always `{ ok: true }` so no account oracle); core's `notifyHubOfInvite` is fire-and-forget. **D2:** the hub-side accept route is deleted; signing in to the project accepts, and the hub's own sign-in witness turns the row into a membership. **D3 (owner):** `POST /projects/invite` writes nothing and answers `{ invited: false, invite_url }`, the project's hall invite link (`/builders/watch?invite=<login>`, which only pre-fills); the signed-assertion relay is deferred. **D4:** new routes, so an older hub 404s and only the notice is lost (ADR 0352).](0353-a-hub-invite-is-a-notice-of-the-projects-own-invite.md) | platform identity / federation |
 | 0354 | [**A builder hosts one project for free, and more takes the fleet permission** ([task 1004412](https://cloudbongos.com/builders#/task/1004412), goal 1000106 — working area 1, the owner's ruling of 2026-09-30). The create wizard always asks for `cloud-host`, which task 1003370 had gated behind `provisioning.fleet.manage`, so every new (Xenos) user was refused at "Create my project" — against ADR 0345 decision 1. **D1:** a builder's first live `cloud-host` project needs no permission; a further one needs the fleet permission (a retry of your own slug is the same project; only `torn_down` frees the place; an unreadable count refuses). **D2:** one first-free request per builder at a time (409 `create_in_progress`), held as a Postgres advisory lock so it holds across processes. **D3:** the wizard states `permission_forbidden` and `box_full` in plain words. Nothing yet caps a hosted project's memory.](0354-a-builder-hosts-one-project-free-and-more-takes-the-fleet-permission.md) | provisioning / security / project creation |
 | 0355 | [**A soft limit is a rule with a reason, and nobody enforces it** ([task 1004416](https://cloudbongos.com/builders#/task/1004416), goal 1000121 — BV2.PS02). The startup flow's seven planet-physics answers and what they rule out. **D1:** the answers are more provisioning `detail` keys under `team_shape`'s contract (no defaults, refused loudly, `null` un-answers), with two new kinds — a list (`many`) and a whole number (`count`); the country is a closed ISO list. **D2:** answers must agree only within one request, so a merge patch's edit order never matters. **D3:** one declarative soft-limit table (`soft-limits.js`) — data conditions, `hide`/`grey`/`note`, a reason on every rule — and every resolution says `enforced: false`. **D4:** screening is a seam (`screening.js`) with a deliberately small rule set; a stop is 422 `screened_out` before anything exists. **D5:** the edit route screens a new description too.](0355-a-soft-limit-is-a-rule-with-a-reason-and-nobody-enforces-it.md) | provisioning / project startup |
+| 0356 | [**A recruit invite expires 30 days after it is sent, decided at read time** ([task 1002969](https://cloudbongos.com/builders#/task/1002969), goal 1000110 — privacy spec D4, owner-signed). **D1:** one definition, `src/bongos/invite-expiry.js` (`INVITE_EXPIRY_DAYS` + the SQL), read by the sign-in gate, the waiting-page probe, the onboarding routes and, through the doorway's `inviteExpiry`, the hub. Nothing is stored and nothing sweeps. **D2:** only `kind='invite'` rows expire; approved applications and goal invites do not. **D3:** amends ADR 0335 D2.5: the gate reads `kind` only inside the expiry unit, which can close a door and never open one. **D4:** an expired invite is refused, marked `expired` + `expires_at` in the queues, reported `expired` by the status probe (the CLI stops), and replaced by a re-invite's fresh row. **D5:** the hub hides a `pending` notice past 30 days and a re-invite restamps it. Split out: `seen_at` (task 1004443), the decline relay (task 1004444).](0356-a-recruit-invite-expires-30-days-after-it-is-sent-read-time.md) | platform identity / admission / invites |

package/docs/api/openapi.json

@@ -440,7 +440,7 @@
           "access-requests"
         ],
         "summary": "GET /access-requests/invites",
-        "description": "GET /access-requests/invites[?mine=1] — the outstanding invites: kind='invite', still 'invited' (not rescinded), and no builder row yet (not yet accepted by signing in), each naming its sender; ?mine=1 keeps only the caller's own (ADR 0335 D2; task 1002814). Rescind one with PATCH /access-requests/:id. rank: archon — it names logins that are not members yet.\n\n**Rank:** `archon` — Archon only (rank and identity management + the escalation keys — the trust boundary).\n\n**Permissions:** `access_request.review` (all required).",
+        "description": "GET /access-requests/invites[?mine=1] — the outstanding invites: kind='invite', still 'invited' (not rescinded), and no builder row yet (not yet accepted by signing in), each naming its sender; ?mine=1 keeps only the caller's own (ADR 0335 D2; task 1002814). Rescind one with PATCH /access-requests/:id. Each carries `expires_at`, and `expired` once its 30 days are up (task 1002969): listed so the sender knows to invite again, and dropped once a newer invite for the same login is live, since that one already replaced it. rank: archon — it names logins that are not members yet.\n\n**Rank:** `archon` — Archon only (rank and identity management + the escalation keys — the trust boundary).\n\n**Permissions:** `access_request.review` (all required).",
         "x-rank": "archon",
         "x-source": "modules/onboarding/routes/access-requests.js",
         "x-permissions": [
@@ -481,7 +481,7 @@
           "access-requests"
         ],
         "summary": "GET /access-requests/status",
-        "description": "GET /access-requests/status?github_login=X — PUBLIC. The `bongos login` CLI polls this after filing a request: the device flow's not_approved is TERMINAL (the device_code is spent), so the CLI can't re-poll the flow — it polls this instead, then restarts sign-in once admitted. Exposes nothing the public POST above doesn't already reveal through its 409s (already_member / already_approved). status ∈ member | invited | pending | dismissed | none; admitted = member||invited. rank: public — a would-be builder is by definition outside the system. Declared BEFORE `GET /access-requests` so the literal `/status` path is matched as its own route (not swallowed as a query on the list route). RATE-LIMITED (task 1003339 / ADR 0209). Public + unthrottled, this was a login→membership oracle an attacker could script at line rate to learn who builds here. accountExistenceReadRateLimit is the doorway's SHARED 120/60s per-IP budget: core's GET /auth/web/admission-status (the boolean twin of this answer) mounts the very same instance, so the two cannot be alternated for double the rate. The limiter runs before the queries, so a refused probe costs no DB work. Whether the ANSWER should also collapse — so a caller who is not the subject cannot tell pending/dismissed/none apart — is the owner's call and is filed as a blocker, not decided here.\n\n**Rank:** `public` — No authentication — any caller.",
+        "description": "GET /access-requests/status?github_login=X — PUBLIC. The `bongos login` CLI polls this after filing a request: the device flow's not_approved is TERMINAL (the device_code is spent), so the CLI can't re-poll the flow — it polls this instead, then restarts sign-in once admitted. Exposes nothing the public POST above doesn't already reveal through its 409s (already_member / already_approved). status ∈ member | invited | expired | pending | dismissed | none; admitted = member||invited. `expired` is an invite past its 30 days (task 1002969): the door is shut, and the CLI stops waiting rather than polling a door that will not open. rank: public — a would-be builder is by definition outside the system. Declared BEFORE `GET /access-requests` so the literal `/status` path is matched as its own route (not swallowed as a query on the list route). RATE-LIMITED (task 1003339 / ADR 0209). Public + unthrottled, this was a login→membership oracle an attacker could script at line rate to learn who builds here. accountExistenceReadRateLimit is the doorway's SHARED 120/60s per-IP budget: core's GET /auth/web/admission-status (the boolean twin of this answer) mounts the very same instance, so the two cannot be alternated for double the rate. The limiter runs before the queries, so a refused probe costs no DB work. Whether the ANSWER should also collapse — so a caller who is not the subject cannot tell pending/dismissed/none apart — is the owner's call and is filed as a blocker, not decided here.\n\n**Rank:** `public` — No authentication — any caller.",
         "x-rank": "public",
         "x-source": "modules/onboarding/routes/access-requests.js",
         "responses": {

package/docs/copy-inventory.md

@@ -4,13 +4,13 @@
 > Deterministic on a given tree — regenerate and commit rather than hand-editing.
 > Machine-readable twin: [`copy-registry.json`](copy-registry.json).
 
-**2188 strings** across 3 surfaces · 1888 distinct pieces of copy · 2188 certain, 0 heuristic · 207 shown in more than one place.
+**2189 strings** across 3 surfaces · 1889 distinct pieces of copy · 2189 certain, 0 heuristic · 207 shown in more than one place.
 
 ## Surfaces
 
 | surface | lives at | files | strings |
 |---|---|---|---|
-| `builders-hall` | `modules/hall-ui/public` | 109 | 1617 |
+| `builders-hall` | `modules/hall-ui/public` | 109 | 1618 |
 | `status-dashboard` | `modules/status-ui/public` | 4 | 100 |
 | `landing` | `modules/public-landing/public` | 6 | 471 |
 
@@ -78,7 +78,7 @@ Identical copy within one surface. Sometimes right (a repeated button), sometime
 | `064c72453555` | 3x | goals · | modules/hall-ui/public/roadmap.js:218, modules/hall-ui/public/sky-interaction.js:38, modules/hall-ui/public/sky-interaction.js:129 |
 | … | | _167 more in the JSON registry_ | |
 
-## `builders-hall` — 1617 strings
+## `builders-hall` — 1618 strings
 
 | id | conf | text | where |
 |---|---|---|---|
@@ -190,7 +190,7 @@ Identical copy within one surface. Sometimes right (a repeated button), sometime
 | `688cc6dd38ee` | certain | Asked of you | `modules/hall-ui/public/collab.html:48` |
 | `688cc6dd38ee` | certain | Asked of you | `modules/hall-ui/public/collab.html:122` |
 | `b2656d0b2402` | certain | Asked {…} | `modules/hall-ui/public/collab.js:91` |
-| `b2656d0b2402` | certain | Asked {…} | `modules/hall-ui/public/watch.js:511` |
+| `b2656d0b2402` | certain | Asked {…} | `modules/hall-ui/public/watch.js:517` |
 | `8c8ec2597036` | certain | Assigned {…} to builder {…}. | `modules/hall-ui/public/government.js:463` |
 | `46714066f2da` | certain | Audit log | `modules/hall-ui/public/watch.html:141` |
 | `d7c574ba6b2a` | certain | Autobongos runner | `modules/hall-ui/public/gate.html:53` |
@@ -309,8 +309,8 @@ Identical copy within one surface. Sometimes right (a repeated button), sometime
 | `e269ff7b3144` | certain | Could not add that builder just now. | `modules/hall-ui/public/goals-render.js:1311` |
 | `7bcaeffb742f` | certain | Could not approve: {…} | `modules/hall-ui/public/gate.js:123` |
 | `c922293e668c` | certain | Could not assign: {…} | `modules/hall-ui/public/government.js:468` |
-| `e1fc7cedf4e7` | certain | Could not change rank: {…} | `modules/hall-ui/public/watch.js:883` |
-| `b9e53fbd90e6` | certain | Could not change standing: {…} | `modules/hall-ui/public/watch.js:909` |
+| `e1fc7cedf4e7` | certain | Could not change rank: {…} | `modules/hall-ui/public/watch.js:889` |
+| `b9e53fbd90e6` | certain | Could not change standing: {…} | `modules/hall-ui/public/watch.js:915` |
 | `1ef1efc15b6c` | certain | Could not change that just now. | `modules/hall-ui/public/goals-render.js:1357` |
 | `6214998a5ebe` | certain | Could not check for a newer version: {…}. | `modules/hall-ui/public/settings-software-update.js:135` |
 | `9ab613a308d6` | certain | Could not check for updates: {…}. | `modules/hall-ui/public/settings-software-update.js:180` |
@@ -334,7 +334,7 @@ Identical copy within one surface. Sometimes right (a repeated button), sometime
 | `8b69e445592a` | certain | Could not load the question labels; showing the answers as stored. | `modules/hall-ui/public/idea.js:458` |
 | `edd5bafbe075` | certain | Could not load the queue just now. | `modules/hall-ui/public/ideas.js:885` |
 | `02bb0570996a` | certain | Could not load the ranks. | `modules/hall-ui/public/ranks.js:197` |
-| `2878778cf9f3` | certain | Could not load this page. | `modules/hall-ui/public/watch.js:1345` |
+| `2878778cf9f3` | certain | Could not load this page. | `modules/hall-ui/public/watch.js:1351` |
 | `df4c2f78a3f6` | certain | Could not load this project’s skills — {…} | `modules/hall-ui/public/settings-specialities.js:311` |
 | `4b0c8d94541c` | certain | Could not load your account. Reload the page to try again. | `modules/hall-ui/public/settings.js:1156` |
 | `2a9fb4046bc4` | certain | Could not load your rank. Return to the hall and try again. | `modules/hall-ui/public/ranks.js:196` |
@@ -343,7 +343,7 @@ Identical copy within one surface. Sometimes right (a repeated button), sometime
 | `de244c45d916` | certain | Could not load {…} | `modules/hall-ui/public/task.js:1027` |
 | `2366356926b4` | certain | Could not mark the primer just now. Try again. | `modules/hall-ui/public/primer.js:259` |
 | `753987b5da13` | certain | Could not reach the submit endpoint. | `modules/hall-ui/public/modules.js:298` |
-| `6f500726f0ac` | certain | Could not read the report: {…} | `modules/hall-ui/public/watch.js:663` |
+| `6f500726f0ac` | certain | Could not read the report: {…} | `modules/hall-ui/public/watch.js:669` |
 | `21c2f33168a3` | certain | Could not read this project's deploy state: {…} | `modules/hall-ui/public/deploy.js:449` |
 | `21a782f1af26` | certain | Could not read what this would bring in: {…}. The check below still applies. | `modules/hall-ui/public/deploy.js:368` |
 | `8b470cebf53d` | certain | Could not remove your key. Try again. | `modules/hall-ui/public/settings.js:977` |
@@ -375,7 +375,7 @@ Identical copy within one surface. Sometimes right (a repeated button), sometime
 | `e65b392144ac` | certain | Could not set up storage. Try again. | `modules/hall-ui/public/settings.js:956` |
 | `d4601887a058` | certain | Could not sign out everywhere: {…} | `modules/hall-ui/public/settings-sessions.js:102` |
 | `3db890b074a7` | certain | Could not update visibility just now. | `modules/hall-ui/public/goals-render.js:1341` |
-| `112d12b24879` | certain | Could not verify your access. Go back and try again. | `modules/hall-ui/public/watch.js:1344` |
+| `112d12b24879` | certain | Could not verify your access. Go back and try again. | `modules/hall-ui/public/watch.js:1350` |
 | `6bd74fd20311` | certain | Could not verify your access. Try again. | `modules/hall-ui/public/sessions.js:436` |
 | `278e8281c82f` | certain | Could not vote: {…} | `modules/hall-ui/public/board-room.js:396` |
 | `a48e9f098392` | certain | Could not {…} just now. | `modules/hall-ui/public/goals-render.js:1327` |
@@ -574,6 +574,7 @@ Identical copy within one surface. Sometimes right (a repeated button), sometime
 | `dad3388b49c9` | certain | Invitation rescinded. | `modules/hall-ui/public/goals-page.js:689` |
 | `12561be47da9` | certain | Invitation sent — they join once they accept. | `modules/hall-ui/public/goals-render.js:1270` |
 | `24f9e88c21f6` | certain | Invite by GitHub username | `modules/hall-ui/public/watch.js:295` |
+| `33a35c77d372` | certain | Invite expired {…} — invite them again to reopen the door | `modules/hall-ui/public/watch.js:501` |
 | `b9cb720ad5d1` | certain | Invited? Sign in | `modules/hall-ui/public/hall-render.js:286` |
 | `0e48bb2c8c94` | certain | Island index | `modules/hall-ui/public/atlas.html:76` |
 | `2170b74c6526` | certain | Isometric map of the repository | `modules/hall-ui/public/atlas.html:54` |
@@ -801,7 +802,7 @@ Identical copy within one surface. Sometimes right (a repeated button), sometime
 | `a2bd76ae030d` | certain | Opens this project's upgrade{…}: you see what would move, confirm it, and it installs, checks itself, and roll | `modules/hall-ui/public/settings-software-update.js:85` |
 | `569980a263ae` | certain | Optional. This is the ledger link — a copy change ships as a task like every other change. | `modules/hall-ui/public/copy-desk.html:130` |
 | `f2e9e8f21e8e` | certain | Or add someone without asking… | `modules/hall-ui/public/goals-render.js:1234` |
-| `d89d1923ecf9` | certain | Over the last {…} days | `modules/hall-ui/public/watch.js:1182` |
+| `d89d1923ecf9` | certain | Over the last {…} days | `modules/hall-ui/public/watch.js:1188` |
 | `695ffff13730` | certain | Over time | `modules/hall-ui/public/profile.html:72` |
 | `5ded44da0cc5` | certain | Override requests | `modules/hall-ui/public/watch.html:136` |
 | `0046e08db06a` | certain | Owner’s bill / month (est.) | `modules/hall-ui/public/fleet-costs.js:70` |
@@ -852,7 +853,7 @@ Identical copy within one surface. Sometimes right (a repeated button), sometime
 | `3f85bdc47099` | certain | Protected module scope — join by request; an Archon admits members | `modules/hall-ui/public/goals-render.js:856` |
 | `e5c292c8b361` | certain | Provides (seams) | `modules/hall-ui/public/atlas.js:288` |
 | `4de232a05888` | certain | Raise after | `modules/hall-ui/public/project-settings.js:113` |
-| `b9c6def6b120` | certain | Rank set to {…}. | `modules/hall-ui/public/watch.js:877` |
+| `b9c6def6b120` | certain | Rank set to {…}. | `modules/hall-ui/public/watch.js:883` |
 | `ff50a1395cbc` | certain | Rank: {…} | `modules/hall-ui/public/profile.js:50` |
 | `6824ec470f99` | certain | Ranks — {{worldName}} | `modules/hall-ui/public/ranks.html:6` |
 | `6824ec470f99` | certain | Ranks — {{worldName}} | `modules/hall-ui/public/ranks.html:6` |
@@ -860,7 +861,7 @@ Identical copy within one surface. Sometimes right (a repeated button), sometime
 | `101a51902f53` | certain | Re-issue failed: {…} | `modules/hall-ui/public/settings.js:780` |
 | `fae2f90927bd` | certain | Read an idea, then decide. An objection needs a reason and the section it faults. | `modules/hall-ui/public/board-room.html:51` |
 | `b03e17693dcd` | certain | Read it as a table | `modules/hall-ui/public/drachmae.js:148` |
-| `b03e17693dcd` | certain | Read it as a table | `modules/hall-ui/public/watch.js:1155` |
+| `b03e17693dcd` | certain | Read it as a table | `modules/hall-ui/public/watch.js:1161` |
 | `b6fcfdd652a7` | certain | Read it here | `modules/hall-ui/public/work.html:45` |
 | `053df132e22c` | certain | Read the full ask | `modules/hall-ui/public/collab.js:133` |
 | `c5f19a888a15` | certain | Read the handoff notes | `modules/hall-ui/public/task.js:490` |
@@ -897,7 +898,7 @@ Identical copy within one surface. Sometimes right (a repeated button), sometime
 | `7d4149cee474` | certain | Repo Atlas — a self-drawing map of the codebase | `modules/hall-ui/public/atlas.html:6` |
 | `4d40a68605e1` | certain | Repo atlas | `modules/hall-ui/public/atlas.html:30` |
 | `52d7d4309540` | certain | Repo health | `modules/hall-ui/public/watch.html:104` |
-| `e6629398d47c` | certain | Report {…}. | `modules/hall-ui/public/watch.js:597` |
+| `e6629398d47c` | certain | Report {…}. | `modules/hall-ui/public/watch.js:603` |
 | `ab456f09c0f6` | certain | Request access | `modules/hall-ui/public/hall-render.js:294` |
 | `ab456f09c0f6` | certain | Request access | `modules/hall-ui/public/hall-render.js:470` |
 | `820f47ce5f16` | certain | Request sent | `modules/hall-ui/public/profile-connections.js:95` |
@@ -916,7 +917,7 @@ Identical copy within one surface. Sometimes right (a repeated button), sometime
 | `0887725744f2` | certain | Restricted. | `modules/hall-ui/public/board-room.js:526` |
 | `0887725744f2` | certain | Restricted. | `modules/hall-ui/public/gate.js:234` |
 | `0887725744f2` | certain | Restricted. | `modules/hall-ui/public/government.js:890` |
-| `0887725744f2` | certain | Restricted. | `modules/hall-ui/public/watch.js:1294` |
+| `0887725744f2` | certain | Restricted. | `modules/hall-ui/public/watch.js:1300` |
 | `b99a71747432` | certain | Retire task {…}? It leaves the claimable queue. Promote restores it to the backlog. | `modules/hall-ui/public/task.js:966` |
 | `b33dde402434` | certain | Retire this goal — you will be asked what happens to any unfinished work | `modules/hall-ui/public/goals-render.js:936` |
 | `d0d5b4300f28` | certain | Retire this task | `modules/hall-ui/public/task.js:802` |
@@ -1030,7 +1031,7 @@ Identical copy within one surface. Sometimes right (a repeated button), sometime
 | `a1482eff4ead` | certain | Suggested for you | `modules/hall-ui/public/settings-specialities.js:384` |
 | `1e40f33483eb` | certain | Switch theme | `modules/hall-ui/public/shell.js:491` |
 | `93fa2e97dd35` | certain | System default for this skill | `modules/hall-ui/public/settings.js:72` |
-| `4894b1d9b0de` | certain | System oversight: people, operations and security. | `modules/hall-ui/public/watch.js:1358` |
+| `4894b1d9b0de` | certain | System oversight: people, operations and security. | `modules/hall-ui/public/watch.js:1364` |
 | `aa8da34fe237` | certain | Take the next page, or pick one from the studio. | `modules/hall-ui/public/tweak-editor.js:564` |
 | `e604fc3ace79` | certain | Task # | `modules/hall-ui/public/blockers.js:139` |
 | `a0f384b022fd` | certain | Task dependencies | `modules/hall-ui/public/goals.html:140` |
@@ -1057,7 +1058,7 @@ Identical copy within one surface. Sometimes right (a repeated button), sometime
 | `c0e28f30524d` | certain | That project's own standing, as reported by that project. | `modules/hall-ui/public/profile.js:314` |
 | `e99d4a811e92` | certain | That request is no longer available. | `modules/hall-ui/public/profile-connections.js:314` |
 | `34017119ce22` | certain | That work is genuinely gone | `modules/hall-ui/public/goal-inbox.js:374` |
-| `6e5a324b2972` | certain | That's you | `modules/hall-ui/public/watch.js:826` |
+| `6e5a324b2972` | certain | That's you | `modules/hall-ui/public/watch.js:832` |
 | `50198c465225` | certain | The 16-value rank enum in three bands, which ranks are live, and the permissions each rank holds. | `modules/hall-ui/public/diagrams.html:59` |
 | `c5e6bdd32fe3` | certain | The Board Room is open to the builders this project’s constitution seats on its board. | `modules/hall-ui/public/board-room.js:529` |
 | `6e93ef49d63f` | certain | The adversarial panel. Each worker reports pass, concerns or fail on its own; the gating workers must all pass | `modules/hall-ui/public/task.js:440` |
@@ -1313,7 +1314,7 @@ Identical copy within one surface. Sometimes right (a repeated button), sometime
 | `6dadadffa36e` | certain | Your name cannot be blank. | `modules/hall-ui/public/settings.js:606` |
 | `bd77210a8c90` | certain | Your name must be {…} characters or fewer. | `modules/hall-ui/public/settings.js:611` |
 | `c0a01a95e97e` | certain | Your own idea. You may vote, but it can’t be decided by your vote alone, and a vote on your own idea earns no  | `modules/hall-ui/public/board-room.js:366` |
-| `5e0ec4cd1cfe` | certain | Your own row carries no controls. Nobody can change their own rank or standing — that guard is what stops the  | `modules/hall-ui/public/watch.js:858` |
+| `5e0ec4cd1cfe` | certain | Your own row carries no controls. Nobody can change their own rank or standing — that guard is what stops the  | `modules/hall-ui/public/watch.js:864` |
 | `8fc605026acf` | certain | Your pending join {…}: {…} — awaiting approval. | `modules/hall-ui/public/goal-inbox.js:88` |
 | `e91418db3962` | certain | Your preferences, {…}. | `modules/hall-ui/public/settings.js:630` |
 | `e91418db3962` | certain | Your preferences, {…}. | `modules/hall-ui/public/settings.js:1173` |
@@ -1526,7 +1527,7 @@ Identical copy within one surface. Sometimes right (a repeated button), sometime
 | `4d8ee7d68974` | certain | task {…} | `modules/hall-ui/public/idea.js:234` |
 | `4d8ee7d68974` | certain | task {…} | `modules/hall-ui/public/ideas.js:201` |
 | `4d8ee7d68974` | certain | task {…} | `modules/hall-ui/public/ideas.js:782` |
-| `4d8ee7d68974` | certain | task {…} | `modules/hall-ui/public/watch.js:1265` |
+| `4d8ee7d68974` | certain | task {…} | `modules/hall-ui/public/watch.js:1271` |
 | `e4e423344746` | certain | task · {…} | `modules/hall-ui/public/sky-interaction.js:36` |
 | `e4e423344746` | certain | task · {…} | `modules/hall-ui/public/sky-panel.js:95` |
 | `a41659dc2bee` | certain | tasks remaining | `modules/hall-ui/public/roadmap.js:298` |
@@ -1634,7 +1635,7 @@ Identical copy within one surface. Sometimes right (a repeated button), sometime
 | `1a8a6267e490` | certain | {…} unfinished task{…} — say what happens to each | `modules/hall-ui/public/goals-render.js:1015` |
 | `3ad8f32dd43b` | certain | {…} you have sent | `modules/hall-ui/public/profile-connections.js:146` |
 | `8186b562553a` | certain | {…} {…} waiting | `modules/hall-ui/public/work.js:432` |
-| `0d4016a5531c` | certain | {…} {…}{…} | `modules/hall-ui/public/watch.js:497` |
+| `0d4016a5531c` | certain | {…} {…}{…} | `modules/hall-ui/public/watch.js:503` |
 | `0d4016a5531c` | certain | {…} {…}{…} | `modules/hall-ui/public/work.js:265` |
 | `b3757ba3bb46` | certain | {…} · Stored encrypted; never shown again after saving. | `modules/hall-ui/public/settings.js:834` |
 | `a6e4ed98fbea` | certain | {…} · revoke it any time under Active sessions. | `modules/hall-ui/public/settings.js:766` |