@bongos/core 1.20.27 → 1.20.29

package/.bongos-core.json

@@ -2,22 +2,22 @@
   "artifact": "bongos-core",
   "manifest_schema": 1,
   "generator": "scripts/gds/package-core.js",
-  "core_version": "1.20.27",
-  "core_contract": "1.20.27",
-  "source_commit": "1fc525416e379b30ced8b97b9999a269eb272392",
+  "core_version": "1.20.29",
+  "core_contract": "1.20.29",
+  "source_commit": "c6152c075da2e7e656381b46f3f9b561cf65f457",
   "source_ref": "HEAD",
-  "built_at": "2026-09-30T19:45:22.316Z",
+  "built_at": "2026-09-30T20:49:43.614Z",
   "redaction": {
     "model": "docs-redacted+functional-verbatim",
-    "docs_redacted": 561,
+    "docs_redacted": 562,
     "agent_docs_stubbed": 25,
-    "functional_verbatim": 2655,
+    "functional_verbatim": 2660,
     "rules": 3,
     "gate_literals": 3,
     "gate": "passed"
   },
-  "file_count": 3242,
-  "tree_sha256": "c65b104e5fd942b276adceaae176a3d833b2fa53daebe3292ac36d278f890c2e",
+  "file_count": 3248,
+  "tree_sha256": "91a5ebee3fc044967031c6f7dbb8e2a86b98fe305e68353f39c023c5ab042df9",
   "files": [
     {
       "path": ".claude/skills/ask-for-help/SKILL.md",
@@ -327,12 +327,12 @@
     {
       "path": "clients/bongos-client/README.md",
       "mode": "0000644",
-      "sha256": "8dde50025e6ac0a8e9742455d62495b72c1803b87044455c48b13b95209f59a2"
+      "sha256": "08c6eaeee75d4fa5a447578107738e5357ffe088bde7f64e946a5f82d1c06106"
     },
     {
       "path": "clients/bongos-client/bongos-client.global.js",
       "mode": "0000644",
-      "sha256": "77f3e9375343c45fd538d179928628a7422858ddea7540cc60cfbdfba95a8545"
+      "sha256": "808fd2048e5260dd4cc518d0e4697636b99ec393c925caa1d858976da2590baf"
     },
     {
       "path": "clients/bongos-client/examples/hello-world.mjs",
@@ -342,17 +342,17 @@
     {
       "path": "clients/bongos-client/index.cjs",
       "mode": "0000644",
-      "sha256": "2eea3743862e9ec173c63517b6f79073b25e71aa3cb2d0a2a19ecce95ef78ca0"
+      "sha256": "d6484208dc9acee624ed01503c36ad9fa4f06bd1e7b51738e2c58c1fe251ace8"
     },
     {
       "path": "clients/bongos-client/index.d.ts",
       "mode": "0000644",
-      "sha256": "065abbfa7d625aa5811ae9e6c27101ca5b9c824422a6a74bba22d92e3f5d53ae"
+      "sha256": "6298f90c0b7849ca342dd5e5235df57686e36b666cedba8db2d9018e8acb60c1"
     },
     {
       "path": "clients/bongos-client/index.mjs",
       "mode": "0000644",
-      "sha256": "e2714285309adfdb0644e82319363fdcc6fc19ad9f5a2cf0e71e203da8c5e188"
+      "sha256": "eded947e375da51b79857e9d3452f21fbfca2136e774b2a3907d1a4d51436aa9"
     },
     {
       "path": "clients/bongos-client/package.json",
@@ -2147,7 +2147,7 @@
     {
       "path": "docs/adr/0335-an-invite-is-a-pre-approved-row-on-the-projects-own-instance.md",
       "mode": "0000644",
-      "sha256": "f22adac7e27f2e83ece9311e44fca35edb0bd571440f108d28a9088775d0b93c"
+      "sha256": "826c6c6ae6e10af9383e518ff63196e2b947bc0ecfa0c1be0288895751bc1352"
     },
     {
       "path": "docs/adr/0336-a-guilds-record-is-the-sum-of-what-its-members-already-show.md",
@@ -2237,7 +2237,7 @@
     {
       "path": "docs/adr/0353-a-hub-invite-is-a-notice-of-the-projects-own-invite.md",
       "mode": "0000644",
-      "sha256": "5c93de4ab1813f7641ec3b33ad620a609a77fbe6fb3cbaffd99b7e6e5f8282fa"
+      "sha256": "e4ee7809ea3f414ecfdbe0b3e6e4b435c1ccc25084fce9c3cfa3521943fe8b90"
     },
     {
       "path": "docs/adr/0354-a-builder-hosts-one-project-free-and-more-takes-the-fleet-permission.md",
@@ -2249,20 +2249,25 @@
       "mode": "0000644",
       "sha256": "6ad8ab3bd8bcb4f55575232af651f108e3879a5965f5daaac42ab693d00a1f0a"
     },
+    {
+      "path": "docs/adr/0356-a-recruit-invite-expires-30-days-after-it-is-sent-read-time.md",
+      "mode": "0000644",
+      "sha256": "ccbad5d4326b069381db47ea3fc165f9a4020485e3d6ce346393a2f6711ce1f0"
+    },
     {
       "path": "docs/adr/README.md",
       "mode": "0000644",
-      "sha256": "8258f16b11aaed9731afca21379b1ae976dc67040d6d35139987e29fd4acd360"
+      "sha256": "d21d0eb8389864b4f7394ba0f4b0d0d809182f0bef82d9fc6824edd00e174b39"
     },
     {
       "path": "docs/api-reference.md",
       "mode": "0000644",
-      "sha256": "db03fd5370b7b592769a806607b9cd0880a56b53c64d8909ca24364feeff818e"
+      "sha256": "60243a4cf43ee8c37a06dda28bac07a9797c96eaef126cbcbda4d89c9ec9b986"
     },
     {
       "path": "docs/api/openapi.json",
       "mode": "0000644",
-      "sha256": "545342fb2849e012cd5caca28d21659fe076a5158c0a0a4c2ca4a2b34abd34da"
+      "sha256": "847818c90b206c7223114b868e32b1eb50e0cc9955ae4dd6b67c5614d1ab51d8"
     },
     {
       "path": "docs/architecture.md",
@@ -2287,12 +2292,12 @@
     {
       "path": "docs/copy-inventory.md",
       "mode": "0000644",
-      "sha256": "3e6cb5cc724958b42912c60fa5cfe65cd6bd7baa7697c3b501534506053a5cb6"
+      "sha256": "ed9adfda17002adac03024b90ed8ee6a79a9c5a814ce88970bf6c1dfd6fa8e9f"
     },
     {
       "path": "docs/copy-registry.json",
       "mode": "0000644",
-      "sha256": "5eb31ba434dd1afbfe397ed33ae62ea76c51b71eaafca9b693bebfbe800e3b14"
+      "sha256": "68b59e9280240b604210d20279e64f47af0bddbac8e2c3344343b4ecf8e21e52"
     },
     {
       "path": "docs/design/apex-pass-2-direction.md",
@@ -2797,7 +2802,7 @@
     {
       "path": "docs/module-api-changelog.md",
       "mode": "0000644",
-      "sha256": "7360408e833d4775efb81a46a20c2b357495e93532e08468fe59766cede1b0ad"
+      "sha256": "7fab447c04933dbbe8ee8f154f854f15eb834163ae656799e5ff3c8f3756fdfc"
     },
     {
       "path": "docs/modules-contract.md",
@@ -2887,7 +2892,7 @@
     {
       "path": "docs/page-readings.json",
       "mode": "0000644",
-      "sha256": "bed8eb280c3798e7def41bfff4d21ac22e8f16ded6174de18487d54e071af768"
+      "sha256": "c9722a4284b34b8773b2fed801a256277bb314833da397ae89af674ebe46acee"
     },
     {
       "path": "docs/project-context.template.md",
@@ -3979,6 +3984,11 @@
       "mode": "0000644",
       "sha256": "ea887c7bcd2863e69121bfcfa36cc62fedc77c5bd5a052e5868e2f7c99cbc103"
     },
+    {
+      "path": "migrations/core_266_access_requests_invited_login_idx.sql",
+      "mode": "0000644",
+      "sha256": "e7dcf016492ab9d011bd0021ac866edd502bf68f2fe06a04365ecb2b49ccbfaa"
+    },
     {
       "path": "modules/agents/CLAUDE.md",
       "mode": "0000644",
@@ -5752,7 +5762,7 @@
     {
       "path": "modules/hall-ui/public/watch.js",
       "mode": "0000644",
-      "sha256": "7a5ef4f34be6b0ab7f5b3fa34bf1666c17164a6331031cc908c2791109585b89"
+      "sha256": "6746170acdd097b14bdccce236ac236b4962bdd1679de2c5624ca1a10cf784d0"
     },
     {
       "path": "modules/hall-ui/public/watch.states.json",
@@ -6842,7 +6852,7 @@
     {
       "path": "modules/onboarding/routes/access-requests.js",
       "mode": "0000644",
-      "sha256": "1eaac1f70a519ca5a0ea71bb56ab6d33b582f5ff002faf5811fa6c1700480057"
+      "sha256": "7e8a63d388816b1a65ec6b24fdc20390d42efa7afa5c33cdf164d0cfca1ad5d4"
     },
     {
       "path": "modules/onboarding/routes/onboarding.js",
@@ -7092,7 +7102,7 @@
     {
       "path": "modules/platform-identity/platform-identity.js",
       "mode": "0000644",
-      "sha256": "9877fd84f74545d96473651cca9d00a76712507e76962c1891d3dd0c3d47e7b2"
+      "sha256": "8f293f2d70e61f90a381153248a748b12452d3bb984e5903f32610fad78d669f"
     },
     {
       "path": "modules/platform-identity/pollers/code-sweep.js",
@@ -7222,7 +7232,7 @@
     {
       "path": "modules/platform-identity/tests/platform-identity.mjs",
       "mode": "0000644",
-      "sha256": "d9164f9ae4188a313ce55ebc7c670531aa4e47128f85571aaa55730dbabd1dd3"
+      "sha256": "6dc7617a7d7615fc5ee51817ae77bba8089324c124a6cb1d0fe3ca9400454ee1"
     },
     {
       "path": "modules/platform-identity/ui/.gitkeep",
@@ -7272,7 +7282,7 @@
     {
       "path": "modules/provisioning/core-upgrade.js",
       "mode": "0000644",
-      "sha256": "ff2f256a550c5d83a83deb47448590fc9a8f4cfd30c52fd4e90a441223b2aaa7"
+      "sha256": "8adf8842f6058224aeac88f54202cf4e7ed26f0021c44cf9bf1f94098b12ce07"
     },
     {
       "path": "modules/provisioning/cost-ledger.js",
@@ -7444,6 +7454,11 @@
       "mode": "0000644",
       "sha256": "9726682ff47916ca8ef999fe70ed5995c3bad7680b0821b87e4cab8a74d9f867"
     },
+    {
+      "path": "modules/provisioning/migrations/provisioning_029_update_channel.sql",
+      "mode": "0000644",
+      "sha256": "b667ec5165e611bd6f0d86b09465c5d9e632de853becce139bac49f5a88e5c1e"
+    },
     {
       "path": "modules/provisioning/module.json",
       "mode": "0000644",
@@ -7537,7 +7552,7 @@
     {
       "path": "modules/provisioning/routes/core-upgrade.js",
       "mode": "0000644",
-      "sha256": "5e74192eb8c4543da8af94a362d7516b54adb8fcbe114953923905d382e5f616"
+      "sha256": "980f25a157dfde5bda6ed903c727fab944b922abdc34be05dc0ccdb5fb3650cc"
     },
     {
       "path": "modules/provisioning/routes/disconnect.js",
@@ -8962,12 +8977,12 @@
     {
       "path": "package-lock.json",
       "mode": "0000644",
-      "sha256": "b4b4420fef73f720a6180d45b5559b38b857fe80181e148715187c5f2c5ec498"
+      "sha256": "eb1cd0418a763ae11ad580a788df78980c6f19e4953d543e2111f4543d53a8ac"
     },
     {
       "path": "package.json",
       "mode": "0000644",
-      "sha256": "9c84d9545af388a0db6fed5fe78bf1c71469ffa1e69ea37386281f0c273cd656"
+      "sha256": "3aefd305535d6f2fc5f8a09ca30b7a6ae323e7f120008618e01d1c772198a363"
     },
     {
       "path": "public-docs/index.html",
@@ -8987,7 +9002,7 @@
     {
       "path": "release-notes.json",
       "mode": "0000644",
-      "sha256": "f6b10e5e103f5007ef31e7d2f53c95e146a93562f5a5465ea4e85da2baeb3c52"
+      "sha256": "84ae8d8349b19fc436952c1455536f608f5804eca0a4b934d0b66555f72baef0"
     },
     {
       "path": "scripts/bongos-mcp.js",
@@ -9557,7 +9572,7 @@
     {
       "path": "scripts/gds/fitness.js",
       "mode": "0000644",
-      "sha256": "dee3e8db3ad7fff3c1e30a59aa58bab00972cba9710bd463e10ab8a3edc71e38"
+      "sha256": "11c013412eca59780987da1db3af9db4a16202b743e55675cb28812c4091f883"
     },
     {
       "path": "scripts/gds/gate-review.js",
@@ -9782,7 +9797,7 @@
     {
       "path": "scripts/gds/login.js",
       "mode": "0000644",
-      "sha256": "0d719e43955fdbcc40aee500438db5b31c6c006490e90d99caadf31b215196f7"
+      "sha256": "75f3a83618340171dba4be280cf41515c341c0468f4cf5dd32e3db8adeb95c9d"
     },
     {
       "path": "scripts/gds/main-audit.js",
@@ -9947,7 +9962,7 @@
     {
       "path": "scripts/gds/provision-core-upgrade.js",
       "mode": "0000644",
-      "sha256": "53b301ac91be7028d6b1f633eb0e8cdb105d34b0e6b8c6a2cc667f1ba77e8a85"
+      "sha256": "3adfb1d93ac59f1a057bcfc55fbeb1ac1cfcb6b8148c4ce6551de9bf743c878b"
     },
     {
       "path": "scripts/gds/provision-disconnect.js",
@@ -10147,7 +10162,7 @@
     {
       "path": "scripts/gds/run-unit-tests.js",
       "mode": "0000644",
-      "sha256": "d891a37574626191f7abc01c50a64178a128e4f8b53ceb17ad6ed6d7439bc56e"
+      "sha256": "1060c8a67619c8e6c0d8168d6a26644b799ed8053ab4995fd9386b55af3660c9"
     },
     {
       "path": "scripts/gds/runner-drift.js",
@@ -10817,7 +10832,7 @@
     {
       "path": "src/bongos/db-kernel.js",
       "mode": "0000644",
-      "sha256": "f224d17792980308b3db2762e06fbbdf265bcf50c7d651662f91b818ae5ce146"
+      "sha256": "85032e00d05717fa4cde2d9db45c567d3f11772a549a458b2ae67a18274a0f91"
     },
     {
       "path": "src/bongos/db.js",
@@ -10839,6 +10854,11 @@
       "mode": "0000644",
       "sha256": "5f2e9a548f7c0cd1c8b8245be4ba50e9066edb18d07ee7ded7d72f363040ba00"
     },
+    {
+      "path": "src/bongos/invite-expiry.js",
+      "mode": "0000644",
+      "sha256": "64ae68b30656075c76f420a29e0f25b6499719d745c901580d5859f8c860ca78"
+    },
     {
       "path": "src/bongos/live-channel.js",
       "mode": "0000644",
@@ -11102,7 +11122,7 @@
     {
       "path": "src/module-api.js",
       "mode": "0000644",
-      "sha256": "b2361eff082828662c898922d47f4968192f852af7fbf5b03365c7624ffbfc55"
+      "sha256": "e8f28de6e2a1dbb5dead24503e6da1e013dd36a4a27c0dea9382480fdfdbb7e6"
     },
     {
       "path": "src/module-loader/catalog.js",
@@ -11177,7 +11197,7 @@
     {
       "path": "tests/access_requests_invite.mjs",
       "mode": "0000644",
-      "sha256": "1044d48504923ec03a8a08303fa12612b2fc02abed32d85be26bf8d5615807ad"
+      "sha256": "22f633a9216457e37fa5da47b260ce6c7aa0d5b2c500c8170a476807c426c76b"
     },
     {
       "path": "tests/accessibility_replay.mjs",
@@ -11397,7 +11417,7 @@
     {
       "path": "tests/application_lifecycle.mjs",
       "mode": "0000644",
-      "sha256": "d35db1b125eaee28d3e0af9c1354b36f589a74bca922b22b507fc29b48bb38c4"
+      "sha256": "f84e1b46315e57514f00545038eaa94a9617a83ebb8b5e4b55814fa3b063e155"
     },
     {
       "path": "tests/architect.mjs",
@@ -11702,7 +11722,7 @@
     {
       "path": "tests/bongos_login.mjs",
       "mode": "0000644",
-      "sha256": "1e95957f3c780b4054128000e0deefc76e4df41c3076da76d2fbd187b47c95d2"
+      "sha256": "091ab59bc648f1ef11b309b09283ca2730635c6f3010adfcbf81053e1abb2055"
     },
     {
       "path": "tests/branding.mjs",
@@ -12047,7 +12067,7 @@
     {
       "path": "tests/core_upgrade_door.mjs",
       "mode": "0000644",
-      "sha256": "52b55a04a99870a1501f2a422096337e3426a7624ec6e1728f291e426eb9567b"
+      "sha256": "0bbd0f6bcecfb8c88e69256470610f40eb64ec555a67502b3172d69a220fc12b"
     },
     {
       "path": "tests/core_upgrade_owner_door.mjs",
@@ -12057,7 +12077,7 @@
     {
       "path": "tests/core_upgrade_runner.mjs",
       "mode": "0000644",
-      "sha256": "c8b2ecca1681427e2e800f78961ba322443e4a2e5502d5d81fd5c2f20aeda711"
+      "sha256": "f55d142db2f3207eb1b1dc7e06c978cb22a282ff0d16792808d212948993640a"
     },
     {
       "path": "tests/cosmos_token_contrast.mjs",
@@ -13432,7 +13452,7 @@
     {
       "path": "tests/hub_invite_notices.mjs",
       "mode": "0000644",
-      "sha256": "c79b4101c944110166da2e158bada2192235897887b65bbb7b1f9fae3c61eb13"
+      "sha256": "61a4467e59582bd8d640ba82c139089933a2fadf5c3e2bd570bdfb7b11ae26c7"
     },
     {
       "path": "tests/hub_map_orb_states.mjs",
@@ -13724,6 +13744,16 @@
       "mode": "0000644",
       "sha256": "1e01a44dc1ef5d454643e81737f77b5061e577a9275a22f5b98bd05ac541f1d7"
     },
+    {
+      "path": "tests/invite_expiry.mjs",
+      "mode": "0000644",
+      "sha256": "f4e7d57306b988aa5dadb9c2fe3c55f519beb2725980a7d360caa09416b03e8c"
+    },
+    {
+      "path": "tests/invite_expiry_db.mjs",
+      "mode": "0000644",
+      "sha256": "9963890ca3f5ee6ab008079c1623e0dec11bf3ce696ff5f18621ad9e52f76a4d"
+    },
     {
       "path": "tests/join_application_note.mjs",
       "mode": "0000644",
@@ -14042,7 +14072,7 @@
     {
       "path": "tests/module_api.mjs",
       "mode": "0000644",
-      "sha256": "be32afe74b2ecd47f136a824c9997b54274b72d41dfe5cd8d1e540e9a05f83f4"
+      "sha256": "35a7e4c2e2afe2cd61e51318e7e3300e7629acd24683b515287aa9dcbe8501ae"
     },
     {
       "path": "tests/module_api_lazy.mjs",
@@ -14512,7 +14542,7 @@
     {
       "path": "tests/project_admin_console_model.mjs",
       "mode": "0000644",
-      "sha256": "5afd92ab7143b332572adcff8ddec69b544e5607b64b16ba14075d9160eec7a9"
+      "sha256": "af3664d6b4ce861f126b7f9eca87abf423f25bb5126df36a93b80312c70a218c"
     },
     {
       "path": "tests/project_catalog_backfill.mjs",

package/clients/bongos-client/README.md

@@ -5,7 +5,7 @@ A **generated**, zero-dependency typed client for the Bongos API — produced fr
 by hand; it regenerates when the spec changes, so it can never drift from the routes.
 
 - API version: **v1** (served at `/api/bongos/v1`)
-- 465 operations across 70 resource groups
+- 466 operations across 70 resource groups
 
 ## Use it from your project
 

package/clients/bongos-client/bongos-client.global.js

@@ -843,6 +843,8 @@ function createClient(opts = {}) {
       patchProvisioningInstancesIdSettings: (args) => request("PATCH", "/provisioning/instances/{id}/settings", { hasBody: true }, args),
       // POST /provisioning/instances/{id}/teardown — rank: any-builder — POST /provisioning/instances/:id/teardown
       postProvisioningInstancesIdTeardown: (args) => request("POST", "/provisioning/instances/{id}/teardown", { hasBody: true }, args),
+      // POST /provisioning/instances/{id}/update-channel — rank: archon — POST /provisioning/instances/:id/update-channel
+      postProvisioningInstancesIdUpdateChannel: (args) => request("POST", "/provisioning/instances/{id}/update-channel", { hasBody: true }, args),
       // GET /provisioning/onboard-plan — rank: public — GET /provisioning/onboard-plan
       getProvisioningOnboardPlan: (args) => request("GET", "/provisioning/onboard-plan", { hasBody: false }, args),
       // GET /provisioning/recommendations — rank: public — GET /provisioning/recommendations

package/clients/bongos-client/index.cjs

@@ -842,6 +842,8 @@ function createClient(opts = {}) {
       patchProvisioningInstancesIdSettings: (args) => request("PATCH", "/provisioning/instances/{id}/settings", { hasBody: true }, args),
       // POST /provisioning/instances/{id}/teardown — rank: any-builder — POST /provisioning/instances/:id/teardown
       postProvisioningInstancesIdTeardown: (args) => request("POST", "/provisioning/instances/{id}/teardown", { hasBody: true }, args),
+      // POST /provisioning/instances/{id}/update-channel — rank: archon — POST /provisioning/instances/:id/update-channel
+      postProvisioningInstancesIdUpdateChannel: (args) => request("POST", "/provisioning/instances/{id}/update-channel", { hasBody: true }, args),
       // GET /provisioning/onboard-plan — rank: public — GET /provisioning/onboard-plan
       getProvisioningOnboardPlan: (args) => request("GET", "/provisioning/onboard-plan", { hasBody: false }, args),
       // GET /provisioning/recommendations — rank: public — GET /provisioning/recommendations

package/clients/bongos-client/index.d.ts

@@ -1274,6 +1274,8 @@ export interface BongosClient {
     patchProvisioningInstancesIdSettings(args?: RequestArgs): Promise<PatchProvisioningInstancesIdSettingsResponse>;
     /** POST /provisioning/instances/{id}/teardown — rank: any-builder */
     postProvisioningInstancesIdTeardown(args?: RequestArgs): Promise<PostProvisioningInstancesIdTeardownResponse>;
+    /** POST /provisioning/instances/{id}/update-channel — rank: archon */
+    postProvisioningInstancesIdUpdateChannel(args?: RequestArgs): Promise<ApiResponse>;
     /** GET /provisioning/onboard-plan — rank: public */
     getProvisioningOnboardPlan(args?: RequestArgs): Promise<GetProvisioningOnboardPlanResponse>;
     /** GET /provisioning/recommendations — rank: public */

package/clients/bongos-client/index.mjs

@@ -839,6 +839,8 @@ export function createClient(opts = {}) {
       patchProvisioningInstancesIdSettings: (args) => request("PATCH", "/provisioning/instances/{id}/settings", { hasBody: true }, args),
       // POST /provisioning/instances/{id}/teardown — rank: any-builder — POST /provisioning/instances/:id/teardown
       postProvisioningInstancesIdTeardown: (args) => request("POST", "/provisioning/instances/{id}/teardown", { hasBody: true }, args),
+      // POST /provisioning/instances/{id}/update-channel — rank: archon — POST /provisioning/instances/:id/update-channel
+      postProvisioningInstancesIdUpdateChannel: (args) => request("POST", "/provisioning/instances/{id}/update-channel", { hasBody: true }, args),
       // GET /provisioning/onboard-plan — rank: public — GET /provisioning/onboard-plan
       getProvisioningOnboardPlan: (args) => request("GET", "/provisioning/onboard-plan", { hasBody: false }, args),
       // GET /provisioning/recommendations — rank: public — GET /provisioning/recommendations

package/docs/adr/0335-an-invite-is-a-pre-approved-row-on-the-projects-own-instance.md

@@ -55,7 +55,7 @@ There is no new table. The sign-in gate (`hasInvitedAccessRequest` → `firstTim
 2. **`created_by` → `builders(id)`, set on invite rows only.** This is the inviter. It needs its own column because a rescind overwrites `resolved_by_builder_id` (ADR 0201 D4.2 records whoever acted last). Without it, a rescinded invite forgets who sent it.
 3. **`note` needs no new column.** The existing column holds the inviter's note on an invite row, and `kind` says whose words they are.
 4. **The backfill is exact.** The current invite route sets `resolved_at = now()` in the same statement whose default fills `created_at`, so every row it wrote has `created_at = resolved_at`. No approved application can match that, because an application is always resolved after it was filed. So the migration sets `kind='invite'` and `created_by = resolved_by_builder_id` on `status='invited'` rows where `created_at = resolved_at`. The one case it cannot catch is a direct invite that was later rescinded, because the rescind changes `resolved_at`. That row stays `'application'`, which makes it look like a declined application. It admits nobody either way. The only effect comes after R3: a recruiter who holds `project.recruit` but not `access_request.review` and re-invites that login gets the D3.4 refusal, so a reviewer has to send the invite. That leaves the door stricter, never looser, and applies only to invites rescinded before R2 ships.
-5. **`kind` and `created_by` never enter an admission read.** This is the same rule `core_230` set for the vouch column. An invite and an approved application admit through the identical `status = 'invited'` read. `tests/project_admin_console_model.mjs` checks this.
+5. **`kind` and `created_by` never enter an admission read.** This is the same rule `core_230` set for the vouch column. An invite and an approved application admit through the identical `status = 'invited'` read. `tests/project_admin_console_model.mjs` checks this. **Amended by [ADR 0356](0356-a-recruit-invite-expires-30-days-after-it-is-sent-read-time.md) (task 1002969):** `kind` now enters admission in one place, the invite expiry, which can close an invite's door after 30 days and never opens one. `created_by` still never enters.
 6. **Expiry is not part of this.** The 30-day read-time expiry (ADR 0201 D4.3) covers every invited row, whatever its `kind`. Task 1002969 owns it.
 
 ### D3 — One new grantable atom, `project.recruit` (floor archon), says which rank may recruit; the verdict stays with `access_request.review`

package/docs/adr/0353-a-hub-invite-is-a-notice-of-the-projects-own-invite.md

@@ -58,7 +58,7 @@ The two notice routes are **new**. An older hub answers 404, the sender swallows
 - **Rows written before this change are untouched.** Pending rows the old hub invite wrote still render as **Open project →**, and on a door other than `open` they still lead to the project's gate. The invitee can decline them, and the project can clear one by inviting and then rescinding. Deleting them at deploy would need a data migration, and it would also delete notices that do work (on `open` doors). That is left to the owner (see the task's handoff), not done silently here. **Amended (task 1004408):** the owner chose to delete them. Migration `<redacted>` deletes every `pending` row older than the hub's first upgrade to core 1.20.22 (the first release carrying this ADR), read from the `core_upgrades` ledger, or every `pending` row if there is no such upgrade. Old rows on `open` doors go too; those invitees can still sign in to the project, and the inviter can re-invite from the project's hall. Proof: `tests/pending_invite_purge_db.mjs`.
 - **The hub's invite now reaches people with no platform account.** The project's own invite takes any GitHub login, so the old `account_not_found` refusal is gone. Such an invitee sees no hub notice, because there is no account to show it to, but they are admitted when they sign in.
 - **Three things still bypass the notice**, all by scope: the reviewer queue's approve (`PATCH` pending → invited), the Discord approval reaction, and R3's future recruiter rescind route. The first two are approvals of an application the applicant already knows about. R3 (task 1002815) must call the same port when it adds its rescind.
-- **The 30-day invite expiry** (task 1002969) is read-time on the instance. An expired invite's hub notice stays until the invitee declines it or the project re-invites and rescinds. Task 1002969 owns closing that.
+- **The 30-day invite expiry** (task 1002969) is read-time on the instance. An expired invite's hub notice stays until the invitee declines it or the project re-invites and rescinds. Task 1002969 owns closing that. **Closed by [ADR 0356](0356-a-recruit-invite-expires-30-days-after-it-is-sent-read-time.md):** the hub stops listing a notice 30 days after it was sent, and a re-invite restamps it.
 
 ## Alternatives considered
 

package/docs/adr/0356-a-recruit-invite-expires-30-days-after-it-is-sent-read-time.md

@@ -0,0 +1,46 @@
+# ADR 0356 — A recruit invite expires 30 days after it is sent, decided at read time
+
+- **Status:** accepted
+- **Date:** 2026-09-30
+- **Task:** [task 1002969](https://cloudbongos.com/builders#/task/1002969) (goal 1000110)
+- **Builds on:** privacy spec D4 (`docs/specs/<redacted>.md`; the owner signed the 30 days), [ADR 0335](0335-an-invite-is-a-pre-approved-row-on-the-projects-own-instance.md) D2 (an invite is a `kind='invite'` row on the project's own instance), [ADR 0353](0353-a-hub-invite-is-a-notice-of-the-projects-own-invite.md) (the hub's `pending` row is a notice of that invite)
+- **Amends:** ADR 0335 D2.5 ("no admission path reads `kind`")
+- **Decided with:** the owner split the original task on 2026-09-30. `seen_at` is [task 1004443](https://cloudbongos.com/builders#/task/1004443); the decline relay is [task 1004444](https://cloudbongos.com/builders#/task/1004444).
+
+## Context
+
+An invite writes an `invited` row, and the sign-in gate admits any login holding one. Nothing ever closed it, so an invite sent months ago still let its login walk in. Spec D4 says a recruit invite's door closes after 30 days, enforced when it is read: no sweeper and no cron. ADR 0353 left the hub side of the same question to this task, because an expired invite's hub notice still said "Open project →".
+
+## Decision
+
+**D1 — One definition, computed at read time.** `src/bongos/invite-expiry.js` holds `INVITE_EXPIRY_DAYS` (30) and the SQL for "this row is an invite past its window", `kind = 'invite' AND created_at <= now() - interval '30 days'`. The sign-in gate (`hasInvitedAccessRequest`), the waiting-page probe (`accessStateByLogin`), the onboarding routes and the hub all read it: core directly, and modules through the doorway's `inviteExpiry`. Nothing is stored, so the day a door closes cannot drift between readers, and nothing has to run for it to close.
+
+**D2 — Only invites expire.** An approved application (`kind = 'application'`) stays open: its applicant asked, and D4 is about invites. Goal invites get no expiry either.
+
+**D3 — The gate now reads `kind`, and only to be stricter (amends ADR 0335 D2.5).** D2.5 kept `kind` out of admission because it was descriptive. It is now read in one place, inside the expiry unit, and that unit can only close a door. A row that is anything but an invite behaves exactly as before, so a mis-kinded row fails toward the old gate and never past it. Only server code writes `kind`: the public POST cannot set it. `created_by` is still never read. `tests/application_lifecycle.mjs` enforces both: its admission statements may mention `kind` only inside the expiry unit.
+
+**D4 — What an expired invite looks like.**
+- The gate refuses it. The public "already approved?" check and the standing-invite probe no longer count it, so the invitee may apply and the recruiter can re-invite.
+- A re-invite writes a fresh row, which opens a fresh door. The expired row stays as history.
+- The queue marks it `expired` with `expires_at`. The outstanding-invite list keeps it so the sender knows to invite again, and drops it once a newer invite for that login is live. The hall's queue shows "Invite expired" and offers no rescind.
+- The public status probe answers `expired` (`admitted: false`), and `bongos login` stops waiting on it. An older CLI treats an unknown status as "wait" and times out, which is no worse than before.
+- A rescind that leaves only expired rows clears the hub notice.
+
+**D5 — The hub's notice follows the door.** `listPendingInvitesForAccount` hides a `pending` notice older than the same 30 days (its `joined_at` is when the project sent the notice). `inviteToProject` restamps `joined_at` only on a `pending` row that is already past the window, so a re-invite shows again. A re-send while the invite is live changes nothing, and a real membership is never touched.
+
+## Consequences
+
+- **Invites already older than 30 days close at deploy.** That is the spec's rule applied to existing rows. Their senders re-invite.
+- **Wire skew (ADR 0352).** A newer hub with an older instance hides a notice after 30 days while that instance's door stays open. Only the nudge is lost. An older hub with a newer instance keeps showing an expired notice, which is today's behaviour.
+- **The hub's clock is the notice's, not the invite's.** A notice healed by a late re-send (the hub missed the first) can outlive its invite by up to the gap between them. A lost clear can hide a live notice early. In both cases the next re-invite fixes it.
+- **The outstanding list's cost stays that of its own scan.** "Does this login have a live invite" is a window (`bool_or … OVER (PARTITION BY lower(github_login))`) over the rows the list already reads, not a correlated lookup per row: `access_requests` has no index on `lower(github_login)` outside pending rows, and invite rows are kept as history. The sender filter (`?mine=1`) sits outside the window. Migration `core_266` adds the index those reads lacked, partial on `status = 'invited'` over `lower(github_login)`, which serves the sign-in gate, the standing-invite probe and this list. The owner approved it on 2026-09-30 after a grader finding.
+- **Declining still closes only the hub's notice.** The project's row stays open until it expires. Task 1004444 owns the relay.
+
+## Alternatives considered
+
+- **A sweeper that flips expired rows to `dismissed`.** Spec D4 rules it out. It would also mislabel an expiry as a decline in the history.
+- **Expire every `invited` row, applications included.** That is wider than D4, and at deploy it would lock out every applicant approved more than 30 days ago.
+- **Dismiss the expired row when re-inviting.** That keeps the list tidy, but the hall renders `dismissed` as "Declined", which would be false.
+- **Carry the invite's `created_at` to the hub in a header, making its clock exact.** That is a new wire field on the notify route for an edge case a re-invite already heals.
+
+Proof: `tests/invite_expiry.mjs` (the definition), `tests/application_lifecycle.mjs` (the gate, queues, probe, re-invite and notice clear, interpreted), `tests/invite_expiry_db.mjs` (the same statements on real Postgres, plus the hub's notice), `tests/hub_invite_notices.mjs` and `modules/platform-identity/tests/platform-identity.mjs` (the notice statement's shape), `tests/bongos_login.mjs` (the CLI stops on `expired`).

package/docs/adr/README.md

@@ -474,3 +474,4 @@ These 20 numbers are each shared by exactly two files. They are **accepted histo
 | 0353 | [**A hub invite is a notice of the project's own invite, and signing in accepts it** ([task 1002818](https://cloudbongos.com/builders#/task/1002818), goal 1000110 — R6 of the admin console wave). The hub's own invite wrote a `pending` membership that no project reads, so an "accepted" invite met a locked door (new projects default to `apply`). **D1:** that row is now a NOTICE the PROJECT writes: its invite route calls `POST /sso/invites/notify` and a dismissal that leaves no invited row calls `/sso/invites/clear` (client credentials, pending rows only, always `{ ok: true }` so no account oracle); core's `notifyHubOfInvite` is fire-and-forget. **D2:** the hub-side accept route is deleted; signing in to the project accepts, and the hub's own sign-in witness turns the row into a membership. **D3 (owner):** `POST /projects/invite` writes nothing and answers `{ invited: false, invite_url }`, the project's hall invite link (`/builders/watch?invite=<login>`, which only pre-fills); the signed-assertion relay is deferred. **D4:** new routes, so an older hub 404s and only the notice is lost (ADR 0352).](0353-a-hub-invite-is-a-notice-of-the-projects-own-invite.md) | platform identity / federation |
 | 0354 | [**A builder hosts one project for free, and more takes the fleet permission** ([task 1004412](https://cloudbongos.com/builders#/task/1004412), goal 1000106 — working area 1, the owner's ruling of 2026-09-30). The create wizard always asks for `cloud-host`, which task 1003370 had gated behind `provisioning.fleet.manage`, so every new (Xenos) user was refused at "Create my project" — against ADR 0345 decision 1. **D1:** a builder's first live `cloud-host` project needs no permission; a further one needs the fleet permission (a retry of your own slug is the same project; only `torn_down` frees the place; an unreadable count refuses). **D2:** one first-free request per builder at a time (409 `create_in_progress`), held as a Postgres advisory lock so it holds across processes. **D3:** the wizard states `permission_forbidden` and `box_full` in plain words. Nothing yet caps a hosted project's memory.](0354-a-builder-hosts-one-project-free-and-more-takes-the-fleet-permission.md) | provisioning / security / project creation |
 | 0355 | [**A soft limit is a rule with a reason, and nobody enforces it** ([task 1004416](https://cloudbongos.com/builders#/task/1004416), goal 1000121 — BV2.PS02). The startup flow's seven planet-physics answers and what they rule out. **D1:** the answers are more provisioning `detail` keys under `team_shape`'s contract (no defaults, refused loudly, `null` un-answers), with two new kinds — a list (`many`) and a whole number (`count`); the country is a closed ISO list. **D2:** answers must agree only within one request, so a merge patch's edit order never matters. **D3:** one declarative soft-limit table (`soft-limits.js`) — data conditions, `hide`/`grey`/`note`, a reason on every rule — and every resolution says `enforced: false`. **D4:** screening is a seam (`screening.js`) with a deliberately small rule set; a stop is 422 `screened_out` before anything exists. **D5:** the edit route screens a new description too.](0355-a-soft-limit-is-a-rule-with-a-reason-and-nobody-enforces-it.md) | provisioning / project startup |
+| 0356 | [**A recruit invite expires 30 days after it is sent, decided at read time** ([task 1002969](https://cloudbongos.com/builders#/task/1002969), goal 1000110 — privacy spec D4, owner-signed). **D1:** one definition, `src/bongos/invite-expiry.js` (`INVITE_EXPIRY_DAYS` + the SQL), read by the sign-in gate, the waiting-page probe, the onboarding routes and, through the doorway's `inviteExpiry`, the hub. Nothing is stored and nothing sweeps. **D2:** only `kind='invite'` rows expire; approved applications and goal invites do not. **D3:** amends ADR 0335 D2.5: the gate reads `kind` only inside the expiry unit, which can close a door and never open one. **D4:** an expired invite is refused, marked `expired` + `expires_at` in the queues, reported `expired` by the status probe (the CLI stops), and replaced by a re-invite's fresh row. **D5:** the hub hides a `pending` notice past 30 days and a re-invite restamps it. Split out: `seen_at` (task 1004443), the decline relay (task 1004444).](0356-a-recruit-invite-expires-30-days-after-it-is-sent-read-time.md) | platform identity / admission / invites |

package/docs/api/openapi.json

@@ -440,7 +440,7 @@
           "access-requests"
         ],
         "summary": "GET /access-requests/invites",
-        "description": "GET /access-requests/invites[?mine=1] — the outstanding invites: kind='invite', still 'invited' (not rescinded), and no builder row yet (not yet accepted by signing in), each naming its sender; ?mine=1 keeps only the caller's own (ADR 0335 D2; task 1002814). Rescind one with PATCH /access-requests/:id. rank: archon — it names logins that are not members yet.\n\n**Rank:** `archon` — Archon only (rank and identity management + the escalation keys — the trust boundary).\n\n**Permissions:** `access_request.review` (all required).",
+        "description": "GET /access-requests/invites[?mine=1] — the outstanding invites: kind='invite', still 'invited' (not rescinded), and no builder row yet (not yet accepted by signing in), each naming its sender; ?mine=1 keeps only the caller's own (ADR 0335 D2; task 1002814). Rescind one with PATCH /access-requests/:id. Each carries `expires_at`, and `expired` once its 30 days are up (task 1002969): listed so the sender knows to invite again, and dropped once a newer invite for the same login is live, since that one already replaced it. rank: archon — it names logins that are not members yet.\n\n**Rank:** `archon` — Archon only (rank and identity management + the escalation keys — the trust boundary).\n\n**Permissions:** `access_request.review` (all required).",
         "x-rank": "archon",
         "x-source": "modules/onboarding/routes/access-requests.js",
         "x-permissions": [
@@ -481,7 +481,7 @@
           "access-requests"
         ],
         "summary": "GET /access-requests/status",
-        "description": "GET /access-requests/status?github_login=X — PUBLIC. The `bongos login` CLI polls this after filing a request: the device flow's not_approved is TERMINAL (the device_code is spent), so the CLI can't re-poll the flow — it polls this instead, then restarts sign-in once admitted. Exposes nothing the public POST above doesn't already reveal through its 409s (already_member / already_approved). status ∈ member | invited | pending | dismissed | none; admitted = member||invited. rank: public — a would-be builder is by definition outside the system. Declared BEFORE `GET /access-requests` so the literal `/status` path is matched as its own route (not swallowed as a query on the list route). RATE-LIMITED (task 1003339 / ADR 0209). Public + unthrottled, this was a login→membership oracle an attacker could script at line rate to learn who builds here. accountExistenceReadRateLimit is the doorway's SHARED 120/60s per-IP budget: core's GET /auth/web/admission-status (the boolean twin of this answer) mounts the very same instance, so the two cannot be alternated for double the rate. The limiter runs before the queries, so a refused probe costs no DB work. Whether the ANSWER should also collapse — so a caller who is not the subject cannot tell pending/dismissed/none apart — is the owner's call and is filed as a blocker, not decided here.\n\n**Rank:** `public` — No authentication — any caller.",
+        "description": "GET /access-requests/status?github_login=X — PUBLIC. The `bongos login` CLI polls this after filing a request: the device flow's not_approved is TERMINAL (the device_code is spent), so the CLI can't re-poll the flow — it polls this instead, then restarts sign-in once admitted. Exposes nothing the public POST above doesn't already reveal through its 409s (already_member / already_approved). status ∈ member | invited | expired | pending | dismissed | none; admitted = member||invited. `expired` is an invite past its 30 days (task 1002969): the door is shut, and the CLI stops waiting rather than polling a door that will not open. rank: public — a would-be builder is by definition outside the system. Declared BEFORE `GET /access-requests` so the literal `/status` path is matched as its own route (not swallowed as a query on the list route). RATE-LIMITED (task 1003339 / ADR 0209). Public + unthrottled, this was a login→membership oracle an attacker could script at line rate to learn who builds here. accountExistenceReadRateLimit is the doorway's SHARED 120/60s per-IP budget: core's GET /auth/web/admission-status (the boolean twin of this answer) mounts the very same instance, so the two cannot be alternated for double the rate. The limiter runs before the queries, so a refused probe costs no DB work. Whether the ANSWER should also collapse — so a caller who is not the subject cannot tell pending/dismissed/none apart — is the owner's call and is filed as a blocker, not decided here.\n\n**Rank:** `public` — No authentication — any caller.",
         "x-rank": "public",
         "x-source": "modules/onboarding/routes/access-requests.js",
         "responses": {
@@ -15676,6 +15676,54 @@
         ]
       }
     },
+    "/provisioning/instances/{id}/update-channel": {
+      "post": {
+        "operationId": "post_provisioning_instances_id_update_channel",
+        "tags": [
+          "provisioning"
+        ],
+        "summary": "POST /provisioning/instances/:id/update-channel",
+        "description": "POST /provisioning/instances/:id/update-channel — set the project's update rule (task 1004445). Body: { channel: \"pinned\" | \"patch\" | \"minor\" }. rank: `core.pin.move`, OR THE PROJECT'S OWN OWNER — the same two doors as the move, because the rule decides which moves the runner will perform: whoever may press Move may choose how far it reaches, and nobody else may. The platform's own row stays on the atom alone (OWNER_SHAPES excludes it), exactly as for the move.\n\n**Rank:** `archon` — Archon only (rank and identity management + the escalation keys — the trust boundary).\n\n**Permissions:** `core.pin.move` (all required).",
+        "x-rank": "archon",
+        "x-source": "modules/provisioning/routes/core-upgrade.js",
+        "x-permissions": [
+          "core.pin.move"
+        ],
+        "parameters": [
+          {
+            "name": "id",
+            "in": "path",
+            "required": true,
+            "schema": {
+              "type": "string"
+            },
+            "description": "Path parameter `id`."
+          }
+        ],
+        "responses": {
+          "200": {
+            "description": "Success."
+          },
+          "400": {
+            "$ref": "#/components/responses/BadRequest"
+          },
+          "401": {
+            "$ref": "#/components/responses/Unauthorized"
+          },
+          "403": {
+            "$ref": "#/components/responses/Forbidden"
+          },
+          "404": {
+            "$ref": "#/components/responses/NotFound"
+          }
+        },
+        "security": [
+          {
+            "builderSession": []
+          }
+        ]
+      }
+    },
     "/provisioning/onboard-plan": {
       "get": {
         "operationId": "get_provisioning_onboard_plan",
@@ -29763,7 +29811,7 @@
       "description": "A required dependency/feature is not configured or is temporarily down."
     }
   },
-  "x-endpoint-count": 465,
+  "x-endpoint-count": 466,
   "x-schema-count": 498,
   "x-undocumented-bodies": 12,
   "x-response-schemas": 337,