@bongos/core 1.18.0 → 1.18.18

package/modules/hall-ui/public/task-detail.js

@@ -58,7 +58,13 @@
   // Cookie-authed PATCH; throws { status, data } on a non-2xx. The server enforces
   // the Metic+ gate (ADR 0018); the button only renders for metic+ below.
   async function patchJSON(path, body) {
-    var res = await api.request('PATCH', path, { body: body || {} });
+    return writeJSON('PATCH', path, body);
+  }
+  async function postJSON(path, body) {
+    return writeJSON('POST', path, body);
+  }
+  async function writeJSON(method, path, body) {
+    var res = await api.request(method, path, { body: body || {} });
     if (res.status === 401) { window.location.assign(API + '/auth/web/start'); throw new Error('redirecting to auth'); }
     var data = null;
     try { data = res.data; } catch (_) { /* empty / non-JSON */ }
@@ -66,6 +72,16 @@
     return data;
   }
 
+  // dom-utils.js already publishes escapeHtml on window.OTB (this file uses
+  // OTB.toast the same way) — a local copy would be its 9th byte-identical twin.
+  // The fallback keeps the file's self-contained contract if OTB hasn't loaded.
+  function esc(s) {
+    if (window.OTB && window.OTB.escapeHtml) return window.OTB.escapeHtml(s);
+    return String(s == null ? '' : s).replace(/[&<>"']/g, function (c) {
+      return { '&': '&amp;', '<': '&lt;', '>': '&gt;', '"': '&quot;', "'": '&#39;' }[c];
+    });
+  }
+
   async function fetchRef(kind, id) {
     if (kind === 'blocker') {
       var db = await getJSON(API + '/blockers/' + encodeURIComponent(id), { softAuth: true });
@@ -102,37 +118,342 @@
     }
     if (r.shipped_at) nodes.push(h('p', 'deeplink-card__note', 'Shipped ' + fmtRel(r.shipped_at)));
 
-    // task 759: Metic+ idea triage — a Discard control on an OPEN idea, right in
-    // the overlay (no /idea-triage skill / LLM in the loop). The button only
-    // renders for metic/archon; the server enforces the same gate regardless.
+    // task 759 → task 1002447: Metic+ idea triage, right in the overlay (no
+    // /idea-triage skill and no LLM in the loop). 759 shipped Discard alone;
+    // 1002447 adds the other two verbs so the whole verdict set is reachable
+    // from the browser — criterion `gcarry-bx-hall`. The panel only renders for
+    // metic/archon; the server enforces the same gate regardless.
     var rank = (viewer && viewer.rank) ? String(viewer.rank).toLowerCase() : '';
     if (kind === 'idea' && r.status === 'open' && (rank === 'metic' || rank === 'archon')) {
-      var actions = h('div', 'td-actions');
-      var discardBtn = document.createElement('button');
-      discardBtn.type = 'button';
-      discardBtn.className = 'td-btn';
-      discardBtn.textContent = 'Discard';
-      discardBtn.addEventListener('click', function () {
-        discardBtn.disabled = true;
-        discardBtn.textContent = '…';
-        patchJSON(API + '/inbox/' + encodeURIComponent(r.id), { status: 'discarded' })
-          .then(function () { toast('Idea ' + label + ' discarded.'); clearLink(); })
-          .catch(function (err) {
-            if (err && err.message === 'redirecting to auth') return;
-            var code = err && err.data && err.data.error;
-            toast(code === 'INSUFFICIENT_RANK' || err.status === 403
-              ? 'Only Metic+ can triage ideas.'
-              : 'Could not discard that idea. Try again.');
-            discardBtn.disabled = false;
-            discardBtn.textContent = 'Discard';
-          });
-      });
-      actions.appendChild(discardBtn);
-      nodes.push(actions);
+      nodes.push(triagePanel(r));
+    }
+    // A closed idea says what triage decided — otherwise the verdict is a status
+    // word with no story behind it.
+    if (kind === 'idea' && r.status === 'merged' && r.merged_into_idea_id) {
+      var m = h('p', 'deeplink-card__note');
+      m.appendChild(document.createTextNode('Merged into '));
+      var ml = h('a', 'deeplink-card__link', '#' + r.merged_into_idea_id);
+      ml.href = '#/idea/' + encodeURIComponent(r.merged_into_idea_id);
+      m.appendChild(ml);
+      nodes.push(m);
+    }
+    if (kind === 'idea' && r.triage_note) {
+      nodes.push(h('p', 'deeplink-card__note', 'Triage note: ' + r.triage_note));
     }
     return nodes;
   }
 
+  // ---- the triage panel (task 1002447) ---------------------------------------
+  //
+  //   Promote → POST /tasks, then PATCH the idea promoted + linked to it.
+  //   Merge   → PATCH merged, pointing at the canonical idea (core_195).
+  //   Discard → PATCH discarded, with the reason (core_195).
+  //
+  // Each verb is a disclosure: the action row swaps for a compact form and back,
+  // the goals-page invite-box idiom (goals-page.js renderInviteBox). One panel
+  // owns its mode and always rebuilds from scratch, so there is no half-updated
+  // state to reason about.
+
+  // Mirrors LIMITS.TITLE / LIMITS.DESCRIPTION (src/bongos/routes/_helpers.js):
+  // the form stops where POST /tasks stops, so a builder can't write past the
+  // server's cap and get a 400 back for it.
+  var TITLE_MAX = 200;
+  var DESCRIPTION_MAX = 50000;
+
+  // The open versions a promotion can target. POST /tasks 409s on a shipped
+  // version, so offering one would be an invitation to fail. Cached for the page.
+  var versionsCache = null;
+  async function openVersions() {
+    if (versionsCache) return versionsCache;
+    var d = await getJSON(API + '/versions?limit=200', { softAuth: true });
+    versionsCache = (d && d.versions ? d.versions : []).filter(function (v) { return v.status !== 'shipped'; });
+    return versionsCache;
+  }
+
+  // Home's attention inbox holds the same rows; tell it a verdict landed so the
+  // queue advances behind the overlay instead of going stale until a reload.
+  function announce(id, verdict) {
+    try {
+      window.dispatchEvent(new CustomEvent('otb:idea-triaged', { detail: { id: id, verdict: verdict } }));
+    } catch (_) { /* CustomEvent unsupported — the refresh is a nicety */ }
+  }
+
+  // The R01/ADR-0116 envelope is `{ error: { code, message, details } }` — the
+  // code is NESTED. Reading err.data.error directly yields the OBJECT, so every
+  // `code === '…'` test below would silently never match. The string arm is the
+  // pre-envelope shape, kept so an older server still maps.
+  function errCode(err) {
+    var d = err && err.data;
+    var e = d && d.error;
+    if (e && typeof e === 'object') return e.code || '';
+    if (typeof e === 'string') return e;
+    return (d && d.code) || '';
+  }
+  function errMessage(err) {
+    var d = err && err.data;
+    var e = d && d.error;
+    if (e && typeof e === 'object' && e.message) return e.message;
+    return (d && d.message) || '';
+  }
+
+  function triageError(err, fallback) {
+    if (err && err.message === 'redirecting to auth') return null;
+    var code = errCode(err);
+    // 'rank_forbidden' is what auth.js requireRank actually emits; the 403 arm
+    // also covers POST /tasks, which is Metic+ for the same reason.
+    if (code === 'rank_forbidden' || (err && err.status === 403)) return 'Only Metic+ can triage ideas.';
+    if (code === 'MERGE_SELF') return 'An idea can’t be merged into itself.';
+    if (code === 'MERGE_TARGET_NOT_FOUND') return 'No idea with that number.';
+    if (code === 'MERGE_TARGET_MERGED') return 'That idea was itself merged — merge into the one it folded into.';
+    if (code === 'version_closed') return 'That version has shipped and can’t take new work.';
+    if (code === 'version_not_found') return 'That version no longer exists.';
+    return errMessage(err) || fallback;
+  }
+
+  function triagePanel(idea) {
+    var box = h('div', 'td-triage');
+    var mode = 'idle';
+
+    // [data-err] marks the one paragraph errors belong in; the merge form also
+    // carries a hint paragraph, so a class-based lookup would race it.
+    function note(text) {
+      var p = box.querySelector('[data-err]');
+      if (p) p.textContent = text || '';
+    }
+    function busy(on, submitLabel) {
+      box.querySelectorAll('button, input, select').forEach(function (el) { el.disabled = on; });
+      var submit = box.querySelector('[data-submit]');
+      if (submit) submit.textContent = on ? '…' : submitLabel;
+    }
+    function go(next) { mode = next; render(); }
+
+    // A verdict that leaves nothing to look at closes the overlay; promote
+    // produces a task worth linking to, so it stays open on a result line.
+    function settled(verdict, message) {
+      announce(idea.id, verdict);
+      toast(message);
+      clearLink();
+    }
+
+    function render() {
+      if (mode === 'idle') return renderIdle();
+      if (mode === 'promote') return renderPromote();
+      if (mode === 'merge') return renderMerge();
+      if (mode === 'discard') return renderDiscard();
+    }
+
+    function renderIdle() {
+      box.innerHTML =
+        '<div class="td-actions">'
+        + '<button type="button" class="td-btn td-btn--primary" data-go="promote">Promote</button>'
+        + '<button type="button" class="td-btn" data-go="merge">Merge</button>'
+        + '<button type="button" class="td-btn" data-go="discard">Discard</button>'
+        + '</div>';
+    }
+
+    async function renderPromote() {
+      box.innerHTML = '<p class="deeplink-card__note">Loading versions…</p>';
+      // Both dead ends offer the way back through the same delegated [data-go]
+      // handler the forms use — a builder must never be stranded mid-panel.
+      function bail(message) {
+        box.innerHTML = '<p class="td-action-note">' + esc(message) + '</p>'
+          + '<div class="td-actions"><button type="button" class="td-btn" data-go="idle">Back</button></div>';
+      }
+      var versions;
+      try {
+        versions = await openVersions();
+      } catch (_) {
+        bail('Could not load the version list — try again.');
+        return;
+      }
+      if (!versions.length) {
+        bail('No open version to file this against.');
+        return;
+      }
+      var preferred = versions.some(function (v) { return v.id === idea.suggested_version; })
+        ? idea.suggested_version : versions[0].id;
+      var options = versions.map(function (v) {
+        return '<option value="' + esc(v.id) + '"' + (v.id === preferred ? ' selected' : '') + '>'
+          + esc(v.id) + ' — ' + esc(v.name || '') + '</option>';
+      }).join('');
+      // suggested_priority is accepted 0-100 on capture but tasks.priority is
+      // CHECKed 1-5, so clamp rather than let an out-of-range value match no
+      // option and leave the browser silently defaulting to P1.
+      var pri = Math.min(5, Math.max(1, Number(idea.suggested_priority) || 3));
+      var priOptions = [1, 2, 3, 4, 5].map(function (p) {
+        return '<option value="' + p + '"' + (p === pri ? ' selected' : '') + '>P' + p + '</option>';
+      }).join('');
+      box.innerHTML =
+        '<form class="td-form" data-form="promote">'
+        + '<label class="td-field td-field--wide"><span>Title</span>'
+        + '<input type="text" name="title" maxlength="' + TITLE_MAX + '" required value="' + esc(idea.title || '') + '"></label>'
+        + '<label class="td-field td-field--wide"><span>Version</span><select name="version">' + options + '</select></label>'
+        + '<label class="td-field"><span>Priority</span><select name="priority">' + priOptions + '</select></label>'
+        + '<label class="td-field"><span>Estimate (min)</span>'
+        + '<input type="number" name="est" min="0" max="100000" step="5" placeholder="—"></label>'
+        + '<label class="td-field"><span>Reward</span>'
+        + '<input type="number" name="credits" min="0" max="1000000" step="1" placeholder="0"></label>'
+        + '<div class="td-actions">'
+        + '<button type="submit" class="td-btn td-btn--primary" data-submit>Create task</button>'
+        + '<button type="button" class="td-btn" data-go="idle">Cancel</button>'
+        + '</div><p class="td-action-note" data-err></p></form>';
+      box.querySelector('[data-form="promote"]').addEventListener('submit', function (ev) {
+        ev.preventDefault();
+        submitPromote(ev.target);
+      });
+    }
+
+    async function submitPromote(form) {
+      var title = String(form.title.value || '').trim();
+      if (!title) { note('A task needs a title.'); return; }
+      note('');
+      busy(true, 'Create task');
+      // source/source_ref make the create idempotent on (source, source_ref):
+      // a retried promote resolves to the SAME task instead of minting a twin.
+      // body_md is itself capped at LIMITS.DESCRIPTION, so appending provenance
+      // to a maximal one would push the task description past the same cap.
+      var provenance = 'Promoted from idea #' + idea.id + '.';
+      var body = (idea.body_md ? idea.body_md + '\n\n' : '').slice(0, DESCRIPTION_MAX - provenance.length);
+      var payload = {
+        version_id: form.version.value,
+        title: title,
+        description: body + provenance,
+        priority: Number(form.priority.value) || 3,
+        source: 'idea_inbox',
+        source_ref: 'idea:' + idea.id,
+      };
+      if (form.est.value !== '') payload.est_minutes = Number(form.est.value);
+      if (form.credits.value !== '') payload.credits_reward = Number(form.credits.value);
+      // 'criterion-proposal' is an idea-only kind; everything else is shared with
+      // tasks.kind, so carrying it over saves the classifier a guess.
+      if (idea.kind && idea.kind !== 'criterion-proposal') payload.kind = idea.kind;
+      // Promote is two writes. If the second fails the task exists but the idea
+      // is still open — say so precisely, because "could not create that task"
+      // would send the builder to make a duplicate. Retrying is safe and is the
+      // right advice: the idempotent create returns the SAME task, then the link
+      // is attempted again.
+      var task = null;
+      try {
+        var created = await postJSON(API + '/tasks', payload);
+        task = created && created.task ? created.task : null;
+        if (!task || task.id == null) throw new Error('no task in response');
+      } catch (err) {
+        var createMsg = triageError(err, 'Could not create that task. Try again.');
+        if (createMsg === null) return;
+        busy(false, 'Create task');
+        note(createMsg);
+        return;
+      }
+      try {
+        await patchJSON(API + '/inbox/' + encodeURIComponent(idea.id), {
+          status: 'promoted', promoted_to_task_id: Number(task.id),
+        });
+        announce(idea.id, 'promoted');
+        box.innerHTML = '<p class="deeplink-card__note">Promoted to task '
+          + '<a class="deeplink-card__link" href="' + hallBase() + '/task/' + encodeURIComponent(task.id) + '">#'
+          + esc(task.id) + '</a> — ' + esc(task.title || '') + '</p>';
+      } catch (err) {
+        if (err && err.message === 'redirecting to auth') return;
+        busy(false, 'Create task');
+        note('Task #' + task.id + ' was created, but the idea could not be marked promoted. '
+          + 'Press Create task again — it links the same task, it does not make a second one.');
+      }
+    }
+
+    function renderMerge() {
+      box.innerHTML =
+        '<form class="td-form" data-form="merge">'
+        + '<label class="td-field td-field--wide"><span>Fold this idea into #</span>'
+        + '<input type="number" name="target" min="1" step="1" required placeholder="idea number"></label>'
+        + '<p class="td-form-hint" data-target-name></p>'
+        + '<label class="td-field td-field--wide"><span>Note (optional)</span>'
+        + '<input type="text" name="note" maxlength="1000" placeholder="why these are the same"></label>'
+        + '<div class="td-actions">'
+        + '<button type="submit" class="td-btn td-btn--primary" data-submit>Merge</button>'
+        + '<button type="button" class="td-btn" data-go="idle">Cancel</button>'
+        + '</div><p class="td-action-note" data-err></p></form>';
+      // Echo the target's title so a merge is confirmed against a real idea, not
+      // a number the builder half-remembered.
+      var input = box.querySelector('[name="target"]');
+      input.addEventListener('change', async function () {
+        var out = box.querySelector('[data-target-name]');
+        var v = String(input.value || '').trim();
+        if (!out) return;
+        if (!v) { out.textContent = ''; return; }
+        try {
+          var d = await getJSON(API + '/inbox/' + encodeURIComponent(v), { softAuth: true });
+          var t = d && (d.idea || d);
+          out.textContent = t && t.title ? '→ ' + t.title : '→ no idea #' + v;
+        } catch (_) {
+          out.textContent = '→ no idea #' + v;
+        }
+      });
+      box.querySelector('[data-form="merge"]').addEventListener('submit', function (ev) {
+        ev.preventDefault();
+        submitMerge(ev.target);
+      });
+    }
+
+    async function submitMerge(form) {
+      var target = Number(form.target.value);
+      if (!Number.isInteger(target) || target < 1) { note('Give the idea number to merge into.'); return; }
+      note('');
+      busy(true, 'Merge');
+      try {
+        await patchJSON(API + '/inbox/' + encodeURIComponent(idea.id), {
+          status: 'merged',
+          merged_into_idea_id: target,
+          triage_note: String(form.note.value || '').trim() || null,
+        });
+        settled('merged', 'Idea #' + idea.id + ' merged into #' + target + '.');
+      } catch (err) {
+        var msg = triageError(err, 'Could not merge that idea. Try again.');
+        if (msg === null) return;
+        busy(false, 'Merge');
+        note(msg);
+      }
+    }
+
+    function renderDiscard() {
+      box.innerHTML =
+        '<form class="td-form" data-form="discard">'
+        + '<label class="td-field td-field--wide"><span>Reason (optional)</span>'
+        + '<input type="text" name="note" maxlength="1000" placeholder="why this isn’t worth doing"></label>'
+        + '<div class="td-actions">'
+        + '<button type="submit" class="td-btn td-btn--primary" data-submit>Discard</button>'
+        + '<button type="button" class="td-btn" data-go="idle">Cancel</button>'
+        + '</div><p class="td-action-note" data-err></p></form>';
+      box.querySelector('[data-form="discard"]').addEventListener('submit', function (ev) {
+        ev.preventDefault();
+        submitDiscard(ev.target);
+      });
+    }
+
+    async function submitDiscard(form) {
+      note('');
+      busy(true, 'Discard');
+      try {
+        await patchJSON(API + '/inbox/' + encodeURIComponent(idea.id), {
+          status: 'discarded',
+          triage_note: String(form.note.value || '').trim() || null,
+        });
+        settled('discarded', 'Idea #' + idea.id + ' discarded.');
+      } catch (err) {
+        var msg = triageError(err, 'Could not discard that idea. Try again.');
+        if (msg === null) return;
+        busy(false, 'Discard');
+        note(msg);
+      }
+    }
+
+    box.addEventListener('click', function (e) {
+      var btn = e.target.closest('[data-go]');
+      if (btn) go(btn.dataset.go);
+    });
+    render();
+    return box;
+  }
+
   function bodyFor(state) {
     var nodes = [];
     var label = '#' + state.id;

package/modules/hall-ui/public/task.html

@@ -49,12 +49,15 @@
     <header class="app-topbar" id="app-topbar"></header>
     <div class="app-content">
       <div class="page-head">
+        <!-- task 2175: the breadcrumb sits in the page head, above the card, so a
+             deep-linked visitor (this page is deliberately not in the nav) has a
+             way back before the task body has loaded. -->
+        <a class="task-detail__back" href="/work">← Back to Tasks</a>
         <p class="page-head__sub" id="task-sub">Loading task…</p>
       </div>
 
       <main>
         <section class="scroll" id="task-scroll" aria-labelledby="task-h">
-          <a class="task-detail__back" href="/work">← Back to the Work Board</a>
           <div id="task-body">
             <p class="deeplink-card__title" id="task-h">Loading…</p>
           </div>
@@ -71,6 +74,8 @@
 <!-- The app shell (sidebar + top bar + footer). Dependency-free; runs at parse
      time so the chrome exists before the deferred page scripts execute. -->
 <script src="/builders/shell.js?v=2026-07-02-shell1"></script>
+<!-- jump palette (Ctrl/Cmd-K). Optional by design: without it the shell's slot stays hidden. -->
+<script src="/builders/palette.js" defer></script>
 <!-- shared frontend toolkit (window.OTB) — loaded FIRST so task.js can pull from it. -->
 <script src="/builders/dom-utils.js?v=2026-06-14-domutils" defer></script>
 <!-- task-detail.js still owns the #/idea/N and #/blocker/N deep-link overlay

package/modules/hall-ui/public/watch.html

@@ -148,6 +148,8 @@
 <!-- The app shell (sidebar + top bar). Dependency-free; loaded FIRST so the
      chrome exists before the page script runs. -->
 <script src="/builders/shell.js?v=2026-07-02-shell1"></script>
+<!-- jump palette (Ctrl/Cmd-K). Optional by design: without it the shell's slot stays hidden. -->
+<script src="/builders/palette.js" defer></script>
 <!-- shared frontend toolkit (window.OTB) — loaded before watch.js, which pulls from it. -->
 <script src="/builders/dom-utils.js?v=2026-06-14-domutils"></script>
 <!-- shared component kit (window.OTBKit) — tabs, ledger, pager (task 2166). -->

package/modules/hall-ui/public/work.html

@@ -3,7 +3,7 @@
 <head>
   <meta charset="utf-8">
   <meta name="viewport" content="width=device-width, initial-scale=1">
-  <title>Work — {{worldName}}</title>
+  <title>Tasks — {{worldName}}</title>
   <meta name="description" content="What {{worldName}} is building right now, and what waits to be claimed.">
   <link rel="icon" href="data:image/svg+xml;utf8,<svg xmlns='http://www.w3.org/2000/svg' viewBox='0 0 32 32'><text x='16' y='24' font-size='24' text-anchor='middle' font-family='sans-serif'>⌂</text></svg>">
   <link rel="preconnect" href="https://fonts.googleapis.com">
@@ -15,7 +15,7 @@
        live in style.css's hall-kit section. -->
   <link rel="stylesheet" href="/builders/work.css">
 </head>
-<body data-page="work" data-page-title="Work">
+<body data-page="work" data-page-title="Tasks">
 
 <div class="app">
   <aside class="app-sidebar" id="app-sidebar" aria-label="Primary"></aside>
@@ -24,7 +24,7 @@
     <header class="app-topbar" id="app-topbar"></header>
     <div class="app-content">
       <div class="page-head">
-        <p class="page-head__sub" id="work-sub">Loading the work board…</p>
+        <p class="page-head__sub" id="work-sub">Loading tasks…</p>
       </div>
 
       <main>
@@ -36,7 +36,7 @@
         <section class="scroll" id="gate-scroll" aria-labelledby="gate-h" hidden>
           <h2 id="gate-h" class="scroll__h">Primer required</h2>
           <p class="scroll__lede" id="gate-body">
-            The work board opens once you have read the builder primer.
+            Tasks open once you have read the builder primer.
             <a href="/primer">Read it here</a>, then mark it as read on the Home page.
           </p>
         </section>
@@ -45,12 +45,12 @@
              (OTBKit.makeTabs toggles [hidden] — the window stays the only
              scroller): Ready (default) | In Progress | Backlog | Completed.
              Deep links: /work#in-progress etc. -->
-        <nav id="work-tabs" aria-label="Work board sections"></nav>
+        <nav id="work-tabs" aria-label="Task sections"></nav>
 
         <!-- READY — the claimable queue: the page's primary object, above the
              fold as the default tab. -->
         <section class="scroll" id="claim-scroll" aria-labelledby="claim-h">
-          <h2 id="claim-h" class="scroll__h">Ready — work to do<span class="count-pill" id="ready-count" hidden></span></h2>
+          <h2 id="claim-h" class="scroll__h">Ready — tasks to do<span class="count-pill" id="ready-count" hidden></span></h2>
           <p class="scroll__lede">Click <span class="kbd">Claim</span> to take a task right here — no terminal needed. Then click <span class="kbd">📋</span> to copy the task prompt and paste it into a fresh Claude Code session to begin.</p>
 
           <!-- task 2170: the filter bar is built by OTBKit.makeFilterBar —
@@ -129,6 +129,8 @@
 <!-- The app shell (sidebar + top bar + footer). Dependency-free; runs at parse
      time so the chrome exists before the deferred page scripts execute. -->
 <script src="/builders/shell.js?v=2026-07-02-shell1"></script>
+<!-- jump palette (Ctrl/Cmd-K). Optional by design: without it the shell's slot stays hidden. -->
+<script src="/builders/palette.js" defer></script>
 <!-- shared frontend toolkit (window.OTB) — loaded FIRST so work.js can pull from it. -->
 <script src="/builders/dom-utils.js?v=2026-06-14-domutils" defer></script>
 <!-- shared component kit (window.OTBKit) — tabs, pager, filter bar (task 2166). -->

package/modules/hall-ui/public/work.js

@@ -384,7 +384,7 @@
           </div>
           <div class="task__credits">
             <span class="task__credits-num">${fmtNum(window.OTBBranding?.taskCreditValue?.(t) ?? t.credits_reward)}</span>
-            <span class="task__credits-label">${window.OTBBranding?.taskCreditLabel?.(t) ?? ((window.OTBBranding?.currencyLabel?.() ?? 'credits') + ' Est.')}</span>
+            <span class="task__credits-label" title="${window.OTBBranding?.rewardModeNote?.() ?? ''}">${window.OTBBranding?.taskCreditLabel?.(t) ?? ((window.OTBBranding?.currencyLabel?.() ?? 'credits') + ' Est.')}</span>
           </div>
           <div class="task__actions">
             <button class="task__claim" type="button" data-task-id="${t.id}" aria-label="Claim task ${t.id}">Claim</button>

package/modules/ideas/inbox.js

@@ -1,8 +1,9 @@
 // GDS idea_inbox helpers — structured replacement for free-form generative-ideas.md.
 //
-// Schema (migration 006_pms_v2.sql):
+// Schema (migration 006_pms_v2.sql, + core_195_idea_triage_provenance.sql):
 //   idea_inbox(id, title, body_md, kind, suggested_version, suggested_priority,
-//              captured_at, captured_by, status, promoted_to_task_id, reviewed_at)
+//              captured_at, captured_by, status, promoted_to_task_id, reviewed_at,
+//              merged_into_idea_id, triage_note)
 //
 // kind values match tasks.kind (feature | bug | infra | refactor | spike |
 // learning-capture | cleanup | decision | blocker-resolution | unclassified).
@@ -36,6 +37,16 @@ const VALID_KINDS = [
 ];
 const VALID_STATUSES = ['open', 'promoted', 'discarded', 'merged'];
 
+// The one column list every idea read returns. Four copies had to stay in step
+// (capture / list / get / update-RETURNING); core_195 added two columns to each,
+// so it is now a constant rather than four places to forget.
+const IDEA_COLS = `id, title, body_md, kind, suggested_version, suggested_priority,
+            captured_at, captured_by, status, promoted_to_task_id, reviewed_at,
+            merged_into_idea_id, triage_note`;
+
+// A discard reason / merge note is a sentence, not a document.
+const TRIAGE_NOTE_MAX = 1000;
+
 // -------------------------------------------------------------------------
 // Skill-friction tagging (task V3.R70 / #289)
 //
@@ -130,8 +141,7 @@ async function captureIdea({
     `INSERT INTO idea_inbox
        (title, body_md, kind, suggested_version, suggested_priority, captured_by, status)
      VALUES ($1, $2, $3, $4, $5, $6, 'open')
-     RETURNING id, title, body_md, kind, suggested_version, suggested_priority,
-               captured_at, captured_by, status, promoted_to_task_id, reviewed_at`,
+     RETURNING ${IDEA_COLS}`,
     [title, bodyMd, resolvedKind, suggestedVersion, suggestedPriority, capturedBy]
   );
   return rows[0];
@@ -161,8 +171,7 @@ async function listOpenIdeas({ kind = null, limit = 50, viewerRank = null } = {}
   }
   params.push(limit);
   const { rows } = await pool.query(
-    `SELECT id, title, body_md, kind, suggested_version, suggested_priority,
-            captured_at, captured_by, status, promoted_to_task_id, reviewed_at
+    `SELECT ${IDEA_COLS}
        FROM idea_inbox
       WHERE ${where.join(' AND ')}
       ORDER BY captured_at DESC
@@ -174,8 +183,7 @@ async function listOpenIdeas({ kind = null, limit = 50, viewerRank = null } = {}
 
 async function getIdea(id) {
   const { rows } = await pool.query(
-    `SELECT id, title, body_md, kind, suggested_version, suggested_priority,
-            captured_at, captured_by, status, promoted_to_task_id, reviewed_at
+    `SELECT ${IDEA_COLS}
        FROM idea_inbox
       WHERE id = $1`,
     [id]
@@ -206,7 +214,40 @@ async function countOpenIdeas({ viewerRank = null } = {}) {
 // Update / merge
 // -------------------------------------------------------------------------
 
-async function updateIdea(id, { status, kind, promoted_to_task_id, reviewed_at } = {}) {
+// merged_into_idea_id records WHICH idea a merge folded into — the thing
+// `status='merged'` alone never said. It cannot reuse promoted_to_task_id
+// (that column is REFERENCES tasks(id)), hence core_195. Guarded here rather
+// than left to the constraints so the caller gets a structured 400/404/409
+// instead of a violation 500.
+//
+// The invariant, also enforced by the core_195 CHECK: a target exists IFF the
+// idea is merged. Without the status half, two ordinary PATCHes build the chain
+// the no-chains guard exists to stop — set A's target with no status (A stays
+// open), then merge C into A, whose status still reads 'open'. So the chain
+// guard tests the TARGET COLUMN, not the target's status, and a target write
+// must carry status='merged'.
+async function updateIdea(id, { status, kind, promoted_to_task_id, reviewed_at, merged_into_idea_id, triage_note } = {}) {
+  if (merged_into_idea_id !== undefined && merged_into_idea_id !== null) {
+    if (status !== 'merged') {
+      throw { code: 'MERGE_STATUS_REQUIRED', merged_into_idea_id };
+    }
+    if (String(merged_into_idea_id) === String(id)) {
+      throw { code: 'MERGE_SELF', merged_into_idea_id };
+    }
+    const target = await getIdea(merged_into_idea_id);
+    if (!target) throw { code: 'MERGE_TARGET_NOT_FOUND', merged_into_idea_id };
+    if (target.merged_into_idea_id != null) {
+      throw { code: 'MERGE_TARGET_MERGED', merged_into_idea_id, merged_into: target.merged_into_idea_id };
+    }
+  }
+  // Clearing the link is the un-merge: it must move the idea off 'merged' too,
+  // or the row claims to be merged into nothing.
+  if (merged_into_idea_id === null && status === 'merged') {
+    throw { code: 'MERGE_STATUS_REQUIRED', merged_into_idea_id: null };
+  }
+  if (triage_note !== undefined && triage_note !== null && String(triage_note).length > TRIAGE_NOTE_MAX) {
+    throw { code: 'TRIAGE_NOTE_TOO_LONG', max: TRIAGE_NOTE_MAX };
+  }
   const sets = [];
   const params = [id];
   if (status !== undefined) {
@@ -227,6 +268,14 @@ async function updateIdea(id, { status, kind, promoted_to_task_id, reviewed_at }
     params.push(reviewed_at);
     sets.push(`reviewed_at = $${params.length}`);
   }
+  if (merged_into_idea_id !== undefined) {
+    params.push(merged_into_idea_id);
+    sets.push(`merged_into_idea_id = $${params.length}`);
+  }
+  if (triage_note !== undefined) {
+    params.push(triage_note);
+    sets.push(`triage_note = $${params.length}`);
+  }
   if (sets.length === 0) {
     return getIdea(id);
   }
@@ -234,8 +283,7 @@ async function updateIdea(id, { status, kind, promoted_to_task_id, reviewed_at }
     `UPDATE idea_inbox
         SET ${sets.join(', ')}
       WHERE id = $1
-      RETURNING id, title, body_md, kind, suggested_version, suggested_priority,
-                captured_at, captured_by, status, promoted_to_task_id, reviewed_at`,
+      RETURNING ${IDEA_COLS}`,
     params
   );
   if (rows.length === 0) throw { code: 'IDEA_NOT_FOUND' };
@@ -439,6 +487,8 @@ module.exports = {
   classify,
   VALID_KINDS,
   VALID_STATUSES,
+  // the triage-note cap, so the route validator declares it from one place
+  TRIAGE_NOTE_MAX,
   // skill-friction tagging + rank visibility gate (V3.R70 / #289)
   SKILL_FRICTION_TAG,
   XENOS_RANK,