@bongos/core 1.25.11 → 1.25.12

package/.bongos-core.json

@@ -2,22 +2,22 @@
   "artifact": "bongos-core",
   "manifest_schema": 1,
   "generator": "scripts/bongos/package-core.js",
-  "core_version": "1.25.11",
-  "core_contract": "1.25.11",
-  "source_commit": "194e92717e58d01a532c98aad3a1830af53c9e9b",
+  "core_version": "1.25.12",
+  "core_contract": "1.25.12",
+  "source_commit": "5eb4ec735850cf6ebc5665a9231ef3f808303216",
   "source_ref": "HEAD",
-  "built_at": "2026-11-13T14:15:49.907Z",
+  "built_at": "2026-11-13T19:09:33.917Z",
   "redaction": {
     "model": "docs-redacted+functional-verbatim",
-    "docs_redacted": 655,
-    "agent_docs_stubbed": 32,
-    "functional_verbatim": 4000,
+    "docs_redacted": 656,
+    "agent_docs_stubbed": 33,
+    "functional_verbatim": 4009,
     "rules": 3,
     "gate_literals": 3,
     "gate": "passed"
   },
-  "file_count": 4688,
-  "tree_sha256": "781d0de253334c2d9bbc539ee9323c04a0a79f299e00efb1f2c3e615f65d9cf8",
+  "file_count": 4699,
+  "tree_sha256": "39c06d7795f2cf9046050b08d20f5f8ada423a1efe3064d0791ba6a22fd03846",
   "files": [
     {
       "path": ".claude/skills/ask-for-help/SKILL.md",
@@ -332,12 +332,12 @@
     {
       "path": "clients/bongos-client/README.md",
       "mode": "0000644",
-      "sha256": "096e7b47b8ddaa1e8067b1d3d8a87d2725330e1d3b497dc51e9760eda1899bbc"
+      "sha256": "975f22a318be1e185d76e76fdcba623e00318e5dc2cbc257a36192a6df3066e4"
     },
     {
       "path": "clients/bongos-client/bongos-client.global.js",
       "mode": "0000644",
-      "sha256": "0b8b0ff1235f38c838d311580acc74b08d10e48c7973dd3022d6112d0fb772f5"
+      "sha256": "140924d60108d727a9652a94ff8ede3dc515976b508bf07a54b2c6327a2c80bc"
     },
     {
       "path": "clients/bongos-client/examples/hello-world.mjs",
@@ -347,17 +347,17 @@
     {
       "path": "clients/bongos-client/index.cjs",
       "mode": "0000644",
-      "sha256": "80e9d530f8a4aec8211460203f9b58aec5800d9ba42bdb2e50b909749854ba52"
+      "sha256": "fa491e142cfd9941d5779ca483b4032c06aed4c46365cb2c1b5d1b1ea0c73a6d"
     },
     {
       "path": "clients/bongos-client/index.d.ts",
       "mode": "0000644",
-      "sha256": "9da9ff5395c9b56a97f5834363ef859871d4e902e14dedbc974d439e8097218d"
+      "sha256": "8ffb0c1faa3c5dcd128058bdc5f127333c06e916da6daaa94d4d24ea3f37edf0"
     },
     {
       "path": "clients/bongos-client/index.mjs",
       "mode": "0000644",
-      "sha256": "b0f3cf95ef0d37ba97d7783cc0a0dfe034701e99a44a96b1aeedbba1f2ba262d"
+      "sha256": "99d5d3c4fe3265405d7446409d171e084432c4cf330c4476fdc3f5c93bc6056b"
     },
     {
       "path": "clients/bongos-client/package.json",
@@ -2489,20 +2489,25 @@
       "mode": "0000644",
       "sha256": "1d8b8c6782ca394e6f85072355140136eff97e1a26ace0fcf392f1206b7a77ec"
     },
+    {
+      "path": "docs/adr/0406-every-project-gets-a-sandbox-that-follows-main-and-live-moves-only-when-a-person-promotes.md",
+      "mode": "0000644",
+      "sha256": "aedd6b7dc8ba2955c48d44dd6d7ee24b42219b22ef034db1f1b27e23bc04f30c"
+    },
     {
       "path": "docs/adr/README.md",
       "mode": "0000644",
-      "sha256": "567b8b3dcf30ff69de7c484aa84e142bccd2753c9c89fd1c1ab941c9519a0560"
+      "sha256": "50221b2eb63f103558dfce9e164cf2a25ea60cfbc4171d8f23d8db72ca08be97"
     },
     {
       "path": "docs/api-reference.md",
       "mode": "0000644",
-      "sha256": "1a109cf49ad611b0780cc8ca885571a5e9424b38e6b33ce005d2c03dfda07b4c"
+      "sha256": "1835d64e19290c34c53e25da3ef0fdafad5112ea39a89387aef859784523680c"
     },
     {
       "path": "docs/api/openapi.json",
       "mode": "0000644",
-      "sha256": "07123a12f24c66c7050703e3405624166c47938a936da67f48d21b11f177e702"
+      "sha256": "3b07133efee8bde9714e1e3828d5d0508e030f669e432c83ca0d60000876336b"
     },
     {
       "path": "docs/architecture.md",
@@ -3077,7 +3082,7 @@
     {
       "path": "docs/file-map.md",
       "mode": "0000644",
-      "sha256": "2964adcfd7f172aabba831b548d2a82f6f8cdbefde3302e609362d1d45517643"
+      "sha256": "4cd32a0888cf2216e43dea2ada3986d214eb6f391d7484c7ed35931d11bdd0ee"
     },
     {
       "path": "docs/handoff-template.md",
@@ -3087,7 +3092,7 @@
     {
       "path": "docs/module-api-changelog.md",
       "mode": "0000644",
-      "sha256": "c91c98112b041d25b65e75103120b2585ab83d864df137dd9c252499323b48f4"
+      "sha256": "6b0d0e8cde4b5dcd1366775407312925bf68f1fc93fad031cec90fb12dffa46e"
     },
     {
       "path": "docs/modules-contract.md",
@@ -5514,6 +5519,51 @@
       "mode": "0000644",
       "sha256": "065588e708b12864390aa4a3453f648556f3c2f9547952a9b0eb69be9cf37c2f"
     },
+    {
+      "path": "modules/front-door-guide/CLAUDE.md",
+      "mode": "0000644",
+      "sha256": "7cb9dac9cb87b679e1ae50e4112b3a7928a38ebb9902c8947a74d17bec4d9009"
+    },
+    {
+      "path": "modules/front-door-guide/claude.js",
+      "mode": "0000644",
+      "sha256": "4ef75dd80af31db062183ea3b4446358bc68d2740e111ff93a92d2640fbe5477"
+    },
+    {
+      "path": "modules/front-door-guide/db.js",
+      "mode": "0000644",
+      "sha256": "2ed6652a13137fde3aa7cdc381e299e3223551f3ba27cf4b3be5bb15b5f13a5f"
+    },
+    {
+      "path": "modules/front-door-guide/guide.js",
+      "mode": "0000644",
+      "sha256": "0264d44c5c026b65ff7be2be5cabec5b44dc0cec2c4f8c8dbef0ed39969d779b"
+    },
+    {
+      "path": "modules/front-door-guide/limits.js",
+      "mode": "0000644",
+      "sha256": "b8819228f1246bbeabb04612f1a6722ea29e63e12a371300f45e421a596b33c7"
+    },
+    {
+      "path": "modules/front-door-guide/migrations/front_door_guide_001_conversations.sql",
+      "mode": "0000644",
+      "sha256": "aad5ccdcfcdc275e5f3448d9e90c4982d5f382fb1e4d015c4709ddb4354837a7"
+    },
+    {
+      "path": "modules/front-door-guide/module.json",
+      "mode": "0000644",
+      "sha256": "7f3844d43cc45d566be8200444324815f2e5a65e33789d640d9aac14dd129861"
+    },
+    {
+      "path": "modules/front-door-guide/routes/front-door-guide.js",
+      "mode": "0000644",
+      "sha256": "798c216746610784077a50f24096d633a2443bfc80bdb862dc382471d0ff5913"
+    },
+    {
+      "path": "modules/front-door-guide/settings.js",
+      "mode": "0000644",
+      "sha256": "dcb4af540fe925eedb9a3e28f5118fbe70c379b9b328c02a1bf026491d8b652a"
+    },
     {
       "path": "modules/government/CLAUDE.md",
       "mode": "0000644",
@@ -10322,7 +10372,7 @@
     {
       "path": "modules/provisioning/starter-bundles.js",
       "mode": "0000644",
-      "sha256": "8e27e15ccd19497eb68186c3b4ea086859954887484a29578d75fa9565807874"
+      "sha256": "7b7f866a439b873f28f6ae6667964eb98c886d02ff1ffcc51067aaf2ef5a4cbb"
     },
     {
       "path": "modules/provisioning/terms-ack.js",
@@ -12247,12 +12297,12 @@
     {
       "path": "package-lock.json",
       "mode": "0000644",
-      "sha256": "4e138ed0a63ae44467b6568659c5a2e210b16c90ec0c866ed74b235f31962d3c"
+      "sha256": "222aede17920090083f580d3f9e9163bee43e6a268ca31638253a55f53695874"
     },
     {
       "path": "package.json",
       "mode": "0000644",
-      "sha256": "90fd7072761eace69417b0db93d0227b963f7c1ed6929b87bd377d47be816231"
+      "sha256": "47b5416c11fe0fd7b4475f39909b9891b9f3aa0ab3490498e2191803cb1f4b99"
     },
     {
       "path": "public-docs/index.html",
@@ -12272,7 +12322,7 @@
     {
       "path": "release-notes.json",
       "mode": "0000644",
-      "sha256": "bec8a9ace282975f751a0806533b89abae33008ca8a26e422f1b481fd51b2c3f"
+      "sha256": "7ff1f4117ef6c899824b56c4780177db1cd5979234db26b70e27d932ba58e29f"
     },
     {
       "path": "scripts/bongos/CLAUDE.md",
@@ -13407,7 +13457,7 @@
     {
       "path": "scripts/bongos/publish-manifest.js",
       "mode": "0000644",
-      "sha256": "7229ea4d05d216d9b4f8b410467c0ca4638e2e0ea215e45157491d57311cdd2d"
+      "sha256": "d7d803f0b61423ae35a2db5d06b2a04850f0055d2d0aba38c17ad78c463892e9"
     },
     {
       "path": "scripts/bongos/publish-watch.js",
@@ -15927,7 +15977,7 @@
     {
       "path": "src/bongos/module-scope-map.js",
       "mode": "0000644",
-      "sha256": "7c8c4ba9e2ddcbeb3736457a00af6f5796ae900fc12d961442d3987de155af42"
+      "sha256": "74b9c7908fd548adb9a718cc3c4daa8d3d0c13ac5a9d5367e726632c34dadfb1"
     },
     {
       "path": "src/bongos/module-store.js",
@@ -16282,7 +16332,7 @@
     {
       "path": "src/module-api.js",
       "mode": "0000644",
-      "sha256": "e9d40aa4560009177bab1b5aa23788bbf758ce884741267cd7c7fbb9fd83c2ea"
+      "sha256": "32107c8946e5617f4daf8a8974065aa78a010471b7d8c1f4fdac155df7bae0e1"
     },
     {
       "path": "src/module-loader/catalog.js",
@@ -18279,6 +18329,11 @@
       "mode": "0000644",
       "sha256": "37e3cfc000f7ab17b04a5b145a8d209bfe911664bbb272340aabbe7152ad6c3a"
     },
+    {
+      "path": "tests/front_door_guide.mjs",
+      "mode": "0000644",
+      "sha256": "d4f0af7817c3e0f031fc00d8b77d2b94ddb994a39d6a03e3ba9badabae362f7a"
+    },
     {
       "path": "tests/funded_project_pays_proof_db.mjs",
       "mode": "0000644",
@@ -20637,7 +20692,7 @@
     {
       "path": "tests/module_loader.mjs",
       "mode": "0000644",
-      "sha256": "3e5e7056784924718922c442894e6f66574fdb3aae67a4412cb7b1a128a9db92"
+      "sha256": "5321c7c72df0c6901b78d6d099e30eeca3e9a7858e47c12c81edb647fa9cf515"
     },
     {
       "path": "tests/module_manifest.mjs",

package/clients/bongos-client/README.md

@@ -5,7 +5,7 @@ A **generated**, zero-dependency typed client for the Bongos API — produced fr
 by hand; it regenerates when the spec changes, so it can never drift from the routes.
 
 - API version: **v1** (served at `/api/bongos/v1`)
-- 702 operations across 85 resource groups
+- 706 operations across 86 resource groups
 
 ## Use it from your project
 

package/clients/bongos-client/bongos-client.global.js

@@ -486,6 +486,16 @@ function createClient(opts = {}) {
       // POST /founding/start — rank: any-builder — POST /founding/start
       postFoundingStart: (args) => request("POST", "/founding/start", { hasBody: true }, args),
     },
+    "frontDoorGuide": {
+      // POST /front-door-guide/conversations — rank: public — POST /front-door-guide/conversations
+      postFrontDoorGuideConversations: (args) => request("POST", "/front-door-guide/conversations", { hasBody: true }, args),
+      // GET /front-door-guide/conversations/{id} — rank: public — GET /front-door-guide/conversations/:id
+      getFrontDoorGuideConversationsId: (args) => request("GET", "/front-door-guide/conversations/{id}", { hasBody: false }, args),
+      // POST /front-door-guide/conversations/{id}/messages — rank: public — POST /front-door-guide/conversations/:id/messages
+      postFrontDoorGuideConversationsIdMessages: (args) => request("POST", "/front-door-guide/conversations/{id}/messages", { hasBody: true }, args),
+      // GET /front-door-guide/status — rank: public — GET /front-door-guide/status
+      getFrontDoorGuideStatus: (args) => request("GET", "/front-door-guide/status", { hasBody: false }, args),
+    },
     "github": {
       // GET /github/orgs — rank: any-builder — GET /github/orgs
       getGithubOrgs: (args) => request("GET", "/github/orgs", { hasBody: false }, args),

package/clients/bongos-client/index.cjs

@@ -485,6 +485,16 @@ function createClient(opts = {}) {
       // POST /founding/start — rank: any-builder — POST /founding/start
       postFoundingStart: (args) => request("POST", "/founding/start", { hasBody: true }, args),
     },
+    "frontDoorGuide": {
+      // POST /front-door-guide/conversations — rank: public — POST /front-door-guide/conversations
+      postFrontDoorGuideConversations: (args) => request("POST", "/front-door-guide/conversations", { hasBody: true }, args),
+      // GET /front-door-guide/conversations/{id} — rank: public — GET /front-door-guide/conversations/:id
+      getFrontDoorGuideConversationsId: (args) => request("GET", "/front-door-guide/conversations/{id}", { hasBody: false }, args),
+      // POST /front-door-guide/conversations/{id}/messages — rank: public — POST /front-door-guide/conversations/:id/messages
+      postFrontDoorGuideConversationsIdMessages: (args) => request("POST", "/front-door-guide/conversations/{id}/messages", { hasBody: true }, args),
+      // GET /front-door-guide/status — rank: public — GET /front-door-guide/status
+      getFrontDoorGuideStatus: (args) => request("GET", "/front-door-guide/status", { hasBody: false }, args),
+    },
     "github": {
       // GET /github/orgs — rank: any-builder — GET /github/orgs
       getGithubOrgs: (args) => request("GET", "/github/orgs", { hasBody: false }, args),

package/clients/bongos-client/index.d.ts

@@ -75,6 +75,7 @@ export interface GetCoreUpgradesResponse { ok: boolean; running: unknown; limit:
 export interface GetDiscordChannelsPlanResponse { ok: boolean; guild_id: unknown; op_count: unknown; ops: unknown; warnings: unknown }
 export interface GetDiscordChannelsSnapshotResponse { ok: boolean; guild_id: unknown; config: unknown; warnings: unknown }
 export interface GetDoneWhenPendingReviewResponse { criteria: unknown; count: unknown }
+export interface GetFrontDoorGuideConversationsIdResponse { ok: boolean; conversation: unknown; transcript: unknown }
 export interface GetGithubOrgsOrgResponse { org: unknown }
 export interface GetGithubRepoResponse { ok: boolean; repo: unknown; private_deployable: boolean }
 export interface GetGithubReposResponse { repos: unknown }
@@ -389,6 +390,8 @@ export interface PostDoneWhenCriterionIdUnsatisfyResponse { criterion: unknown }
 export interface PostFeedbackReceiptRequest { sha256: string; kind?: "bug" | "idea" }
 export interface PostFeedbackReceiptResponse { ok: boolean; receipt: unknown; hub: unknown }
 export interface PostFoundingPlanRequest { days?: Record<string, unknown>; passes?: number; advisors?: string; government?: string; expected_builders?: number; existing?: boolean }
+export interface PostFrontDoorGuideConversationsIdMessagesRequest { token: string; text: string; website?: string }
+export interface PostFrontDoorGuideConversationsRequest { website?: string }
 export interface PostGithubRepoInviteRequest { github_login: string; permission?: string }
 export interface PostGithubRepoVisibilityRequest { repo: string; visibility: "public" | "private" }
 export interface PostGithubRepoVisibilityResponse { ok: boolean; repo: unknown; private_deployable: boolean }
@@ -1158,6 +1161,16 @@ export interface BongosClient {
     /** POST /founding/start — rank: any-builder */
     postFoundingStart(args?: RequestArgs): Promise<ApiResponse>;
   };
+  "frontDoorGuide": {
+    /** POST /front-door-guide/conversations — rank: public */
+    postFrontDoorGuideConversations(args?: RequestArgs & { body?: PostFrontDoorGuideConversationsRequest }): Promise<ApiResponse>;
+    /** GET /front-door-guide/conversations/{id} — rank: public */
+    getFrontDoorGuideConversationsId(args?: RequestArgs): Promise<GetFrontDoorGuideConversationsIdResponse>;
+    /** POST /front-door-guide/conversations/{id}/messages — rank: public */
+    postFrontDoorGuideConversationsIdMessages(args: RequestArgs & { body: PostFrontDoorGuideConversationsIdMessagesRequest }): Promise<ApiResponse>;
+    /** GET /front-door-guide/status — rank: public */
+    getFrontDoorGuideStatus(args?: RequestArgs): Promise<ApiResponse>;
+  };
   "github": {
     /** GET /github/orgs — rank: any-builder */
     getGithubOrgs(args?: RequestArgs): Promise<ApiResponse>;

package/clients/bongos-client/index.mjs

@@ -482,6 +482,16 @@ export function createClient(opts = {}) {
       // POST /founding/start — rank: any-builder — POST /founding/start
       postFoundingStart: (args) => request("POST", "/founding/start", { hasBody: true }, args),
     },
+    "frontDoorGuide": {
+      // POST /front-door-guide/conversations — rank: public — POST /front-door-guide/conversations
+      postFrontDoorGuideConversations: (args) => request("POST", "/front-door-guide/conversations", { hasBody: true }, args),
+      // GET /front-door-guide/conversations/{id} — rank: public — GET /front-door-guide/conversations/:id
+      getFrontDoorGuideConversationsId: (args) => request("GET", "/front-door-guide/conversations/{id}", { hasBody: false }, args),
+      // POST /front-door-guide/conversations/{id}/messages — rank: public — POST /front-door-guide/conversations/:id/messages
+      postFrontDoorGuideConversationsIdMessages: (args) => request("POST", "/front-door-guide/conversations/{id}/messages", { hasBody: true }, args),
+      // GET /front-door-guide/status — rank: public — GET /front-door-guide/status
+      getFrontDoorGuideStatus: (args) => request("GET", "/front-door-guide/status", { hasBody: false }, args),
+    },
     "github": {
       // GET /github/orgs — rank: any-builder — GET /github/orgs
       getGithubOrgs: (args) => request("GET", "/github/orgs", { hasBody: false }, args),

package/docs/adr/0406-every-project-gets-a-sandbox-that-follows-main-and-live-moves-only-when-a-person-promotes.md

@@ -0,0 +1,108 @@
+# 0406 — Every project gets a sandbox that follows main, and live moves only when a person promotes
+
+- **Status:** Accepted. The model is settled; §6 lists two cost choices the gated tasks ask the owner when they reach them, and neither changes the model.
+- **Date:** 2026-11-13
+- **Task:** [task 1005288](https://cloudbongos.com/builders#/task/1005288) (goal 1000106 — working area 1, Project creation)
+- **Decided by:** the owner's direction of 2026-11-13 (quoted in §1), with the shape checked against the code and Render's own docs by Claude, who wrote the record.
+- **Builds on:** [ADR 0345](0345-we-host-every-projects-hall-and-its-app-deploys-where-the-owner-chooses.md) (we host the hall; the app runs on the owner's Render account) · [ADR 0327](0327-a-cloud-host-runs-on-the-owners-account-and-the-key-is-borrowed.md) (the Render key is borrowed, never stored) · [ADR 0161](0161-publish-on-merge.md) (for Cloud Bongos itself a merge is not live until a pin moves) · [ADR 0369](0369-ship-mode-decides-who-starts-a-ship-not-how-it-lands.md) (ship mode says who starts a ship, not where it lands)
+- **Distinct from:** [ADR 0044](0044-per-box-live-game-preview.md) / [ADR 0046](0046-sandbox-first-review-gate.md) — the builder's private **local preview** (`scripts/bongos/sandbox-stage.js`, `scripts/bongos/local-preview.js`). That is one builder's look *before* shipping, on their own machine. This ADR is about the project's shared, hosted sandbox *after* work lands.
+- **Gates:** [task 1005289](https://cloudbongos.com/builders#/task/1005289) (set it up) · [task 1005290](https://cloudbongos.com/builders#/task/1005290) (land on the sandbox, promote to live) · [task 1005291](https://cloudbongos.com/builders#/task/1005291) (safety) · [task 1005292](https://cloudbongos.com/builders#/task/1005292) (Cloud Bongos's own) · [task 1005293](https://cloudbongos.com/builders#/task/1005293) (the walk)
+
+## 1. The owner's words
+
+> "each project would have a sandbox, so yes cloudbongos would have one, but so would every site someone creates. maybe its a second github or just a different branch and we host it on the render free version... essentially a local host but has fake data or sandbox keys that dont actually change anything. maybe it uses the real keys for the data but is gated to not actually send anything back."
+
+## 2. The decision
+
+Every project whose app runs on Render has **two apps from one repository**:
+
+| | **Sandbox** | **Live (the main site)** |
+|---|---|---|
+| What it runs | whatever has landed on `main`, automatically | the commit a person last promoted |
+| Render service | a second web service on the owner's account, **free plan** | the owner's existing service, on the plan they chose |
+| Updates when | every merge (Render auto-deploy from `main`) | only when a person presses **promote** (auto-deploy switched off) |
+| Data | its own database with seeded fake data (§4) | the real data |
+| Keys | each provider's sandbox/test keys; real keys only when lent, behind the gate (§5) | the real keys |
+| Marked | every page carries a visible "sandbox" band | — |
+
+**Promotion is a person's act.** The owner (or whoever the project's rules allow) sees which landed commits are on the sandbox and not on live, and presses promote. That asks Render to deploy that exact commit to the live service. It needs the owner's Render key typed in for that one request, as every Render action already does (`modules/render-deploy/render.js`, ADR 0327 §2) — so no stored credential can ever move live by itself. This is the project law *"Land only. Ask before going live"* made physical: agents land, and landing reaches only the sandbox.
+
+**Ship mode is untouched.** Auto mode still ships hands-off and Manual still asks before each ship (ADR 0369). Both only ever land, and landing now reaches the sandbox; neither can promote.
+
+## 3. Why "the sandbox follows main" and not a sandbox branch
+
+The starting point offered a `sandbox` branch, promoted by merging it into `main`. Checked against the code, that is the costlier shape:
+
+- **Everything already lands on `main`.** `ship.js`, the grader, the merge queue, the strand fixer and the release pipeline all key on `main`. A sandbox branch means every one of them learns a second target, and every promotion is a merge that can conflict.
+- **Render can already deploy a chosen commit.** A service set to `autoDeploy: no` is deployed by an explicit request that names the commit. The client has `triggerDeploy`, `listDeploys` and `rollbackTo` today (`scripts/bongos/render-api.js`); promotion adds a commit id to the first.
+- **It is the model Cloud Bongos already runs.** For the platform, a merge is not live until a published release carries it and the hub's pin moves (ADR 0161, [`docs/recipes/core-release-pipeline.md`](../recipes/core-release-pipeline.md)). "The sandbox follows what landed; live holds a pin a person moves" is the same rule, so the platform and every project now share one model (§7).
+
+So: **one repository, no second repository, no sandbox branch.** The owner's "maybe a second github" is declined for the reason the brief gave — two copies drift and double the upkeep.
+
+What changes in code (for [task 1005289](https://cloudbongos.com/builders#/task/1005289) and [task 1005290](https://cloudbongos.com/builders#/task/1005290)): today the one service is created with `branch: 'main'` and `autoDeploy: 'yes'` (`scripts/bongos/render-payload.js`), so every merge already goes straight to the main site. Under this ADR the sandbox service takes that payload, and the live service is switched to `autoDeploy: 'no'`.
+
+## 4. The sandbox's database
+
+Render's free database is **not** usable here (Render docs, read 2026-11-13: [render.com/docs/free](https://render.com/docs/free)):
+
+- it **expires 30 days after creation**, with 14 days' grace before Render deletes it;
+- a workspace may have **only one** free database;
+- it has no backups.
+
+The platform already refuses it for the same reasons (`modules/provisioning/render-standup.js`: "The database has no free plan here"). So:
+
+- **The app has a paid database** → the sandbox gets **a second database inside that same database server**, filled with seeded fake data. No extra Render bill; it shares the server's capacity. ([task 1005289](https://cloudbongos.com/builders#/task/1005289) confirms on a real account that Render allows a second database in one server; if it does not, the fallback is the owner's choice in §6.)
+- **The app has no database** → the sandbox has none either.
+- The sandbox **never** points at the live database. Its writes would be real writes.
+
+## 5. Safety: fake by default, and a gate when real keys are lent
+
+1. **Default:** seeded fake data and each provider's sandbox/test keys (Stripe test mode, and so on). Nothing the sandbox does can reach a real customer.
+2. **Real keys, only when the owner lends them** (so the sandbox can show real data), and then:
+   - **Prefer a read-only key.** Where the provider offers a restricted or read-only key, that is the key to lend. This is the only part of the gate that cannot be coded around, so it is the floor.
+   - **The outbound gate.** The project's app runs with `BONGOS_SANDBOX=1`, and the project's starter carries a small outbound wrapper that, for each known provider, lets reads through and refuses sends, charges and writes, logging each refusal where the owner can see it.
+   - **Said plainly:** the app is the owner's own code. The gate covers calls that go through the wrapper; code written to bypass it is not caught. That is why a read-only key comes first.
+3. A side effect worth knowing: Render's free plan already blocks outgoing mail ports (25, 465, 587), so a sandbox on the free plan cannot send email over SMTP at all.
+
+## 6. Cost, and what the owner chooses
+
+**Cost to the owner** (Render's docs, read 2026-11-13):
+
+- **Sandbox app: $0.** Free plan: 0.1 CPU, 512 MB memory. It **sleeps after 15 minutes with no visitors and takes about a minute to wake**, which is fine for a place to look at work before it goes live. Free apps share **750 running hours a month per Render workspace**; a sleeping app uses none. Past that, every free app on the workspace pauses until the next month. Local files are lost on every sleep and restart (no disks), which is why the sandbox's data lives in the database.
+- **Sandbox database: $0** when it sits inside the app's existing paid database (§4).
+- Free apps count against the workspace's shared bandwidth and build minutes; a busy sandbox could use some of them up.
+
+**Cost to us: nothing in hosting** — the sandbox runs on the owner's account (ADR 0327, ADR 0345). Our cost is the runner's time setting it up and the work in the sibling tasks.
+
+🔀 **Owner choices still open** (not blocking this ADR; each is asked in the task that needs it):
+
+1. **If Render will not hold a second database in one server**, the sandbox's database is either (a) the cheapest paid Render database, a few dollars a month on the owner's bill, *(recommended)*, or (b) none — the sandbox shows the app with no data. Asked in [task 1005289](https://cloudbongos.com/builders#/task/1005289).
+2. **Where Cloud Bongos's own sandbox runs** (§7): (a) on the box the hub already uses — no new spend, but it takes memory from the box every project hall shares — or (b) a small separate server, a few dollars a month. Asked in [task 1005292](https://cloudbongos.com/builders#/task/1005292). Recommended: (b), because the shared box is already near its memory wall ([task 1003875](https://cloudbongos.com/builders#/task/1003875)).
+
+## 7. Cases
+
+- **A project with no app yet** gets no hosted sandbox. There is nothing to run. Its builders keep the private local preview, and the sandbox is set up the moment the app is connected to Render, at creation or later from settings ([task 1005289](https://cloudbongos.com/builders#/task/1005289)).
+- **An app that deploys somewhere other than Render** (ADR 0345 lets the owner choose) gets no automatic sandbox. The model is the same, but we only set it up on Render.
+- **An app linked to an existing Render service** ("adopt") keeps that service as live; the sandbox is a new free service copying its build settings.
+- **Tearing a project down** removes the sandbox service and the sandbox database only — never the owner's live service (ADR 0327 §3: we never destroy an owner's infrastructure without being asked).
+- **Cloud Bongos itself** runs the same rule one level up. Its "main" is the published core release (ADR 0161). Its sandbox is a second Cloud Bongos instance that takes **every** release as it is published and carries a throwaway test project ([`modules/provisioning/test-project.js`](../../modules/provisioning/test-project.js)), so a full project-creation walk costs nothing real. The live hub moves its pin only when a person promotes. Today the hub's patch subscription moves its pin to each patch release by itself (task 1005020); once the sandbox exists, whether patches still go live hands-off is the owner's call in [task 1005292](https://cloudbongos.com/builders#/task/1005292).
+
+## 8. Considered and not done
+
+- **A second repository.** Doubles upkeep and drifts.
+- **A `sandbox` branch, promoted by merge.** Every landing tool would need a second target, and promotions could conflict (§3).
+- **Render's free database for the sandbox.** Expires in 30 days, one per workspace (§4).
+- **The sandbox reading the live database.** Any write would be real.
+- **An outbound gate with no read-only key behind it, sold as "safe".** It only covers code that goes through it; we say so instead (§5).
+
+## 9. The sibling tasks, re-read against this record (2026-11-13)
+
+Each sibling task's description now opens with a dated note, *"Re-read against ADR 0406 … What the decision changes here"*, written through `PATCH /api/bongos/tasks/<id>`; the owner's original words are kept below it.
+
+| Task | What changed |
+|---|---|
+| [task 1005289](https://cloudbongos.com/builders#/task/1005289) | Retitled *"Give every project a sandbox: a free Render app that follows main, at creation or later"* (the sandbox branch is gone). Note: free service auto-deploys from `main`, live switched to `autoDeploy: 'no'`; never Render's free database, a second database in the paid server instead (confirm first, else owner choice 1); adopt, no-app and teardown cases. |
+| [task 1005290](https://cloudbongos.com/builders#/task/1005290) | Landing stays on `main`; promote deploys one chosen commit to live, `triggerDeploy` gains a commit id, the owner types the Render key for that request, each promotion is recorded; ship mode untouched. |
+| [task 1005291](https://cloudbongos.com/builders#/task/1005291) | A read-only key is the floor; the gate is an outbound wrapper in the starter active under `BONGOS_SANDBOX=1`, with its limit said plainly; free plan blocks mail ports. |
+| [task 1005292](https://cloudbongos.com/builders#/task/1005292) | Same rule over the release pin; a second instance takes every release and carries a throwaway test project; owner choice 2 and the patch auto-move question are asked here. |
+| [task 1005293](https://cloudbongos.com/builders#/task/1005293) | Added checks: no live deploy after a ship, promote refuses without the key, the sandbox band shows, sandbox data is fake, and the lent key is confirmed read-only. |

package/docs/adr/README.md

@@ -521,3 +521,4 @@ These 20 numbers are each shared by exactly two files. They are **accepted histo
 | 0403 | [**In game mode the visor is the control and the scene is the view** ([task 1005203](https://cloudbongos.com/builders#/task/1005203), goal 1000142; owner 2026-11-11). Every main call to action you can see in game mode lives on the visor (the accent button, the key hints, the Actions sheet); the city, the sky and Home only show the project and can be moved through, never carry buttons of their own. A scene offers its actions to the visor through `OTBVisor.scene`. Found not yet keeping it: the city's decide button and door, the sky's top row and composer, Home's gallery links, the Artist's feedback tab.](0403-in-game-mode-the-visor-is-the-control-and-the-scene-is-the-view.md) | hall / game frame |
 | 0404 | [**A party is a room, and rooms register as kinds** ([task 1005220](https://cloudbongos.com/builders#/task/1005220), goal 1000148). Any group that talks together is a room: a free-form party (cap 8), a chain party (ADR 0400), a scoping session (cap 40, owned by `lifecycle`) or a decision room (cap 40, `government`). Each owner contributes its kind to the `room.kinds` contribution point (a port is single-provider, so four owners would fail the boot) with `members`/`isMember`/optional `invite`/`accept`, and fires `room.opened`/`room.member.joined`/`room.member.left`/`room.closed`; consumers never read an owner's tables and reconcile against `members()`. Free-form party: one per builder, leader handover to the longest-standing member, disband on last leave. A chain room follows an open `chain_party` row. Unlinked players get everything but voice. V3 polls (3 s, cursor + 304, paused when hidden, per-builder limiter) rather than pushing through `/live`. With discord off, no voice key or voice state; chat still works. A room is never authority. Rejected: one port, a port per kind, a rooms module reading other modules' tables, a second party roster, push via `/live`, speaking indicators.](0404-a-party-is-a-room-and-rooms-register-as-kinds.md) | game frame / modules / Discord |
 | 0405 | [**Each character has one colour, and the visor wears it** ([task 1005218](https://cloudbongos.com/builders#/task/1005218), goal 1000142; owner 2026-11-12). The Artisan is ember (the accent), the Artist violet, the Patron gold, each mixed from the hall’s tokens and none typed in. In game mode the visor’s lines, name, picture rim and accent are the held character’s colour, and your picture on the glass is your character wearing the visor. The characters are redrawn at 64 by 64 as two-animal aliens, drawn by a script.](0405-each-character-has-one-colour-and-the-visor-wears-it.md) | hall / game frame |
+| 0406 | [**Every project gets a sandbox that follows main, and live moves only when a person promotes** ([task 1005288](https://cloudbongos.com/builders#/task/1005288), goal 1000106; owner 2026-11-13). One repository, no sandbox branch: a second Render web service on the free plan auto-deploys every landing on `main`, and the live service stops auto-deploying and takes only the commit a person promotes (with the Render key typed in for that request). Fake data and test keys by default; lent real keys should be read-only, behind an outbound gate that refuses sends, charges and writes. Render's free database expires in 30 days, so the sandbox gets a second database in the app's paid one. A project with no app gets no hosted sandbox; Cloud Bongos runs the same rule over its release pin.](0406-every-project-gets-a-sandbox-that-follows-main-and-live-moves-only-when-a-person-promotes.md) | provisioning / hosting |