@bongos/core 1.19.146 → 1.19.148

package/.bongos-core.json

@@ -2,22 +2,22 @@
   "artifact": "bongos-core",
   "manifest_schema": 1,
   "generator": "scripts/gds/package-core.js",
-  "core_version": "1.19.146",
-  "core_contract": "1.19.146",
-  "source_commit": "1363fd9197780c96da219f2f1f211ccdde0d7eae",
+  "core_version": "1.19.148",
+  "core_contract": "1.19.148",
+  "source_commit": "7e339c95065a311ed8124d03557ded14bca9446a",
   "source_ref": "HEAD",
-  "built_at": "2026-08-15T19:30:54.439Z",
+  "built_at": "2026-08-16T14:24:46.637Z",
   "redaction": {
     "model": "docs-redacted+functional-verbatim",
     "docs_redacted": 304,
     "agent_docs_stubbed": 21,
-    "functional_verbatim": 1252,
+    "functional_verbatim": 1254,
     "rules": 3,
     "gate_literals": 3,
     "gate": "passed"
   },
-  "file_count": 1577,
-  "tree_sha256": "9c0baec37d19b01ae748459e7d1faaf8308002ba71fa1a6a44da74e0b4617b14",
+  "file_count": 1579,
+  "tree_sha256": "8cab3bae4120d167d296a253ea3e0b6064a55de4ea9188fa52a09217898cd086",
   "files": [
     {
       "path": ".claude/skills/blocker-review/SKILL.md",
@@ -1472,7 +1472,7 @@
     {
       "path": "docs/file-map.md",
       "mode": "0000644",
-      "sha256": "f76f816dbbab7668c7dbd1ff7406dee095e043f23262a2c6afd900ff9c59b337"
+      "sha256": "e4e3ab72c8b570e35357554e3070f6e2f78aa087811a6166e71b03c4f3e23b81"
     },
     {
       "path": "docs/handoff-template.md",
@@ -3452,7 +3452,12 @@
     {
       "path": "modules/ideas/inbox.js",
       "mode": "0000644",
-      "sha256": "8178f4f74492a933b716d6bed5a79a741d18fab14c346e7a299c61d78332434a"
+      "sha256": "5f4b91ab9eb47ca4c34b7163a2e46934c648654c6909f9623385daf3429c9a48"
+    },
+    {
+      "path": "modules/ideas/migrations/ideas_001_grades.sql",
+      "mode": "0000644",
+      "sha256": "4bdd4ebf495d19562fdb8faf508df3a4f577cb0fcc8a879a7eeb1dffd3699caa"
     },
     {
       "path": "modules/ideas/module.json",
@@ -4182,12 +4187,12 @@
     {
       "path": "package-lock.json",
       "mode": "0000644",
-      "sha256": "92ba433ccabd633bd48e20e6b2d28314ce3c83165e0250ffe943e648bb093571"
+      "sha256": "354de77e768f98c77062278cead6271a3249cfe4ed35d811fb76b497f3028d8b"
     },
     {
       "path": "package.json",
       "mode": "0000644",
-      "sha256": "9b6febaf8e44a6a540f3c248efeaf98c41a04ac649cdf609d1eb3ac5ad0f3e64"
+      "sha256": "23c72c88771c78d76a61334a4710e6ce77a146331de749c944f6bf2890602162"
     },
     {
       "path": "public-docs/index.html",
@@ -4427,7 +4432,7 @@
     {
       "path": "public-landing/assets/cosmos.css",
       "mode": "0000644",
-      "sha256": "4641a5c0c0222c0948ecdf57db9bb3cd88b5500089bbbbe735597abd4d44d4da"
+      "sha256": "611050e8599be5791e89f9711b76ef6efc5b1e8bd703e2badc6a6418a9ed432b"
     },
     {
       "path": "public-landing/buddha.png",
@@ -4437,12 +4442,12 @@
     {
       "path": "public-landing/index.html",
       "mode": "0000644",
-      "sha256": "1fa06d66fc4c1bbe3849e6fbf402852caea8b7cfc80a4c69ecad26d921d4264d"
+      "sha256": "f011cbcc82b95284f00dae9aa63600ea664f9edc5c7b79c533501c2c0c54495c"
     },
     {
       "path": "public-landing/projects.html",
       "mode": "0000644",
-      "sha256": "deae8db82f897ee77633ffb2b7f5144960d9961ba4cdb9e052346c6cb127b0c9"
+      "sha256": "5edfc22fd5d85453df0d83a531fd085b3d5d079b66c7e3f58dcb9a0261c6b4a6"
     },
     {
       "path": "public-landing/world/assets/clouds/cloud-island-large.png",
@@ -5777,7 +5782,7 @@
     {
       "path": "src/module-api.js",
       "mode": "0000644",
-      "sha256": "1ee746f8bc9aef75aaf278c5ca67dc6734ceb214a5febc44d6e27556b42dd70a"
+      "sha256": "f6ad6d7407077ad6166646472601151847a96f338de366e0de4daa692957b205"
     },
     {
       "path": "src/module-loader/catalog.js",
@@ -6884,10 +6889,15 @@
       "mode": "0000644",
       "sha256": "7d384cd84cdc93b8e7b57df291a4600a40f43346fd2a52168324ecde219f1388"
     },
+    {
+      "path": "tests/idea_grades.mjs",
+      "mode": "0000644",
+      "sha256": "07cacc97990f0e775342f8b30171c87128e0acb1abd38d64c683c3f257927ebd"
+    },
     {
       "path": "tests/idea_triage.mjs",
       "mode": "0000644",
-      "sha256": "c5bd3ece3b4193b92b6f3437a9e570bc3084def4da8d8e687079c5db1dbc16e0"
+      "sha256": "836ee90dd24736c84fede53394d0d724915f73540c9b99c41762da1d37c447b2"
     },
     {
       "path": "tests/idp_device_exchange.mjs",

package/docs/file-map.md

@@ -113,6 +113,7 @@
 │   ├── grading/                ← CORE-DOMAIN carve (BV1.R73, default-on): the grade-a-diff adversarial worker panel + deterministic pre-passes + rubric; registers the `grade` kernel port. CLAUDE.md, module.json, routes/grade.js, grader.js, grader-rubric.json.
 │   ├── economy/                ← CORE-DOMAIN carve (BV1.R77, default-on): credit allocation + cost ledger + streaks + achievements + leaderboard; registers the `reward` kernel port. CLAUDE.md, module.json, routes/{cost,leaderboard,reward}.js, credits.js, cost.js, cost-classify.js, cost-summary-shape.js, streak.js, achievements.js, reward.js.
 │   ├── ideas/                  ← CORE-DOMAIN carve (BV1.R78, default-on): the idea_inbox capture/triage/criterion-proposal flow + the blockers queue; registers the `ideas.capture` kernel port (retired the `captureIdea` doorway leak). CLAUDE.md, module.json, routes/{inbox,blockers}.js, inbox.js, blockers.js.
+│   │   └── migrations/         ← module-owned schema (BV1.R140): ideas_001_grades.sql — the `ideas_grades` side table (quick|spark|full + the Full Idea template store + completeness score), LEFT JOINed onto the idea read path so an idea with no row reads as `quick`.
 │   ├── security/                ← CORE-DOMAIN carve (BV1.R79, default-on): red-team/vulnerability report intake + the env-aware bounty payout table (Metic+); registers the `security` kernel port the core /public/bounty-table resolves. <redacted> (permission-path-check, route-rank-check) stays kernel — this is <redacted>. CLAUDE.md, module.json, routes/{reports,scans}.js, security.js, secret-scrub.js, scan-store.js. **artifact-scan/** (goal 1000055, /scan-before-install): fetch.js (hardened clone), quarantine.js (holding pen), manifest.js (content hash), mirror.js (scrubbed reading-room), fence-local.js (vendored scrub/fence), floor.js + detectors/ (zero-LLM deterministic floor — npm-lifecycle, hooks, mcp, permissions, credentials, network, injection, dependencies, capabilities; persisted before any model reads).
 │   ├── builder-settings/        ← CORE-DOMAIN carve (BV1.R80, default-on): per-builder prefs — wandering level, per-skill model ceilings, sound/render toggles — + builder-needs. `GET /me` resolves the `builder-settings` kernel port for these slices. CLAUDE.md, module.json, routes/settings.js, wandering-prefs.js, skill-prefs.js, sound-prefs.js, event-sound-prefs.js, render-prefs.js, model-alloc-prefs.js, interaction-prefs.js, display-name.js, builder-needs.js.
 │   ├── onboarding/              ← CORE-DOMAIN carve (BV1.R81, default-on): admission (access-request → Archon approval), the server-ticked onboarding state machine, the friction analyzer, and evergreen newcomer-chore restock; registers the `onboarding` kernel port. CLAUDE.md, module.json, routes/access-requests.js, onboarding.js, onboarding-state.js, newcomer-restock.js, approval-broadcast.js.

package/modules/ideas/inbox.js

@@ -4,6 +4,8 @@
 //   idea_inbox(id, title, body_md, kind, suggested_version, suggested_priority,
 //              captured_at, captured_by, status, promoted_to_task_id, reviewed_at,
 //              merged_into_idea_id, triage_note)
+//   ideas_grades(idea_id, grade, template_key, field_values, completeness_score,
+//                created_at, updated_at)   — module-owned, ideas_001_grades.sql
 //
 // kind values match tasks.kind (feature | bug | infra | refactor | spike |
 // learning-capture | cleanup | decision | blocker-resolution | unclassified).
@@ -39,14 +41,65 @@ const VALID_STATUSES = ['open', 'promoted', 'discarded', 'merged'];
 
 // The one column list every idea read returns. Four copies had to stay in step
 // (capture / list / get / update-RETURNING); core_195 added two columns to each,
-// so it is now a constant rather than four places to forget.
-const IDEA_COLS = `id, title, body_md, kind, suggested_version, suggested_priority,
-            captured_at, captured_by, status, promoted_to_task_id, reviewed_at,
-            merged_into_idea_id, triage_note`;
+// so it is now a constant rather than four places to forget. Kept as names rather
+// than a string so the qualified form (task 1002916 joined the grade table in, and
+// an unqualified `id` is ambiguous across a join) is derived, not a fifth copy.
+const IDEA_COL_NAMES = [
+  'id', 'title', 'body_md', 'kind', 'suggested_version', 'suggested_priority',
+  'captured_at', 'captured_by', 'status', 'promoted_to_task_id', 'reviewed_at',
+  'merged_into_idea_id', 'triage_note',
+];
+const IDEA_COLS = IDEA_COL_NAMES.join(', ');
+const IDEA_COLS_Q = IDEA_COL_NAMES.map((c) => `i.${c}`).join(', ');
 
 // A discard reason / merge note is a sentence, not a document.
 const TRIAGE_NOTE_MAX = 1000;
 
+// -------------------------------------------------------------------------
+// Idea grades (task 1002916 / BV1.R140, goal 1000062)
+//
+// Three grades, from the owner's brief:
+//   quick — title + description, open to every role, aimed at turning a thought
+//           into a task fast. NOT a draft Full Idea.
+//   spark — a Quick Idea whose AUTHOR marked it as needing development. The mark
+//           is the consent that makes cross-builder development fair (R144).
+//   full  — carries the base template's five fields, scored on completeness.
+//
+// AN IDEA WITH NO ideas_grades ROW READS AS QUICK. That is the design, not a
+// fallback: every idea captured before this shipped keeps grade='quick' without
+// a row being written or a column being backfilled. The COALESCE below is where
+// that rule lives, and it is the reason the reads LEFT JOIN rather than JOIN.
+// An explicit quick row is equally legal (un-sparking writes one) and reads the
+// same, so callers never have to care which of the two they are looking at.
+const DEFAULT_GRADE = 'quick';
+const VALID_GRADES = ['quick', 'spark', 'full'];
+
+// Which template `field_values` was written against. Stored per row so a project
+// that later defines its own shape (R156) does not retro-reinterpret ideas
+// written against the base one. R141 declares what 'base-v1' actually contains —
+// this module only records which template a row used.
+const DEFAULT_TEMPLATE_KEY = 'base-v1';
+const TEMPLATE_KEY_RE = /^[a-z][a-z0-9-]*$/;
+const TEMPLATE_KEY_MAX = 64;
+
+// Mirrors ideas_grades_field_values_size_chk. Declared here too so an oversize
+// payload gets a structured 400 instead of a constraint-violation 500.
+const FIELD_VALUES_MAX = 32768;
+
+// The grade half of an idea read: the COALESCE above, plus the template-shaped
+// store and the score. `g.*` columns are NULL for an ungraded idea, which is
+// exactly right — it has no template and no score, it just has a default grade.
+const GRADE_COLS_Q = `COALESCE(g.grade, '${DEFAULT_GRADE}') AS grade,
+            g.template_key, g.field_values, g.completeness_score`;
+const IDEA_JOIN_GRADE = `LEFT JOIN ideas_grades g ON g.idea_id = i.id`;
+
+// The same projection for a row that provably has no grade row yet (a just-
+// INSERTed idea), so INSERT…RETURNING does not need a second round trip to
+// return the same shape every other read returns.
+function ungradedProjection() {
+  return { grade: DEFAULT_GRADE, template_key: null, field_values: null, completeness_score: null };
+}
+
 // -------------------------------------------------------------------------
 // Skill-friction tagging (task V3.R70 / #289)
 //
@@ -144,7 +197,10 @@ async function captureIdea({
      RETURNING ${IDEA_COLS}`,
     [title, bodyMd, resolvedKind, suggestedVersion, suggestedPriority, capturedBy]
   );
-  return rows[0];
+  // A brand-new idea has no ideas_grades row, so it is quick by definition —
+  // no join needed to know that. Grading it (R143's Full Idea capture) is a
+  // separate setIdeaGrade write against the id this returns.
+  return rows[0] ? { ...ungradedProjection(), ...rows[0] } : rows[0];
 }
 
 // -------------------------------------------------------------------------
@@ -160,21 +216,22 @@ async function captureIdea({
 // without a migration.
 async function listOpenIdeas({ kind = null, limit = 50, viewerRank = null } = {}) {
   const params = [];
-  const where = [`status = 'open'`];
+  const where = [`i.status = 'open'`];
   if (kind) {
     params.push(kind);
-    where.push(`kind = $${params.length}`);
+    where.push(`i.kind = $${params.length}`);
   }
   if (!rankCanSeeSkillFriction(viewerRank)) {
     params.push(`${SKILL_FRICTION_TAG}%`);
-    where.push(`title NOT LIKE $${params.length}`);
+    where.push(`i.title NOT LIKE $${params.length}`);
   }
   params.push(limit);
   const { rows } = await pool.query(
-    `SELECT ${IDEA_COLS}
-       FROM idea_inbox
+    `SELECT ${IDEA_COLS_Q}, ${GRADE_COLS_Q}
+       FROM idea_inbox i
+       ${IDEA_JOIN_GRADE}
       WHERE ${where.join(' AND ')}
-      ORDER BY captured_at DESC
+      ORDER BY i.captured_at DESC
       LIMIT $${params.length}`,
     params
   );
@@ -183,9 +240,10 @@ async function listOpenIdeas({ kind = null, limit = 50, viewerRank = null } = {}
 
 async function getIdea(id) {
   const { rows } = await pool.query(
-    `SELECT ${IDEA_COLS}
-       FROM idea_inbox
-      WHERE id = $1`,
+    `SELECT ${IDEA_COLS_Q}, ${GRADE_COLS_Q}
+       FROM idea_inbox i
+       ${IDEA_JOIN_GRADE}
+      WHERE i.id = $1`,
     [id]
   );
   return rows[0] ?? null;
@@ -279,17 +337,124 @@ async function updateIdea(id, { status, kind, promoted_to_task_id, reviewed_at,
   if (sets.length === 0) {
     return getIdea(id);
   }
+  // The UPDATE is wrapped in a CTE so the row comes back with its grade attached
+  // in ONE round trip. A triage verdict never changes the grade, but the idea may
+  // already BE a spark or a full — returning the ungraded default here would be a
+  // lie, and re-reading afterwards would be a second query and a second chance to
+  // race. `upd i` aliases the returned row so IDEA_COLS_Q applies unchanged.
   const { rows } = await pool.query(
-    `UPDATE idea_inbox
-        SET ${sets.join(', ')}
-      WHERE id = $1
-      RETURNING ${IDEA_COLS}`,
+    `WITH upd AS (
+       UPDATE idea_inbox
+          SET ${sets.join(', ')}
+        WHERE id = $1
+       RETURNING ${IDEA_COLS}
+     )
+     SELECT ${IDEA_COLS_Q}, ${GRADE_COLS_Q}
+       FROM upd i
+       ${IDEA_JOIN_GRADE}`,
     params
   );
   if (rows.length === 0) throw { code: 'IDEA_NOT_FOUND' };
   return rows[0];
 }
 
+// -------------------------------------------------------------------------
+// Grade writes (task 1002916 / BV1.R140)
+//
+// setIdeaGrade writes the WHOLE grade row — it does not merge with what is
+// already there. That is deliberate: a partial-merge upsert reads innocently at
+// the call site and silently preserves stale field_values from a previous grade,
+// which is the bug that would make "develop this spark into a full idea" (R146)
+// quietly inherit whatever was there before. Callers that only want to move the
+// score have setIdeaCompleteness below; anyone changing the grade states the
+// whole row.
+//
+// Structured throws (not raw constraint violations) so the routes that land on
+// top of this — R143's Full Idea capture, R144's mark-as-spark — return a clean
+// 400/404 rather than a 500 with a Postgres message in it.
+function assertGradePayload({ grade, templateKey, fieldValues, completenessScore }) {
+  if (!VALID_GRADES.includes(grade)) {
+    throw { code: 'BAD_GRADE', grade, valid: VALID_GRADES };
+  }
+  if (typeof templateKey !== 'string' || !TEMPLATE_KEY_RE.test(templateKey) || templateKey.length > TEMPLATE_KEY_MAX) {
+    throw { code: 'BAD_TEMPLATE_KEY', template_key: templateKey };
+  }
+  // A map, never a scalar or an array — the scorer and the read path walk it by
+  // key. `typeof null === 'object'`, hence the explicit null check.
+  if (fieldValues === null || typeof fieldValues !== 'object' || Array.isArray(fieldValues)) {
+    throw { code: 'BAD_FIELD_VALUES' };
+  }
+  if (JSON.stringify(fieldValues).length > FIELD_VALUES_MAX) {
+    throw { code: 'FIELD_VALUES_TOO_LARGE', max: FIELD_VALUES_MAX };
+  }
+  if (completenessScore !== null) {
+    if (!Number.isInteger(completenessScore) || completenessScore < 0 || completenessScore > 100) {
+      throw { code: 'BAD_COMPLETENESS', completeness_score: completenessScore };
+    }
+  }
+}
+
+async function setIdeaGrade(ideaId, {
+  grade,
+  templateKey = DEFAULT_TEMPLATE_KEY,
+  fieldValues = {},
+  completenessScore = null,
+} = {}) {
+  assertGradePayload({ grade, templateKey, fieldValues, completenessScore });
+  try {
+    const { rows } = await pool.query(
+      `INSERT INTO ideas_grades (idea_id, grade, template_key, field_values, completeness_score)
+       VALUES ($1, $2, $3, $4::jsonb, $5)
+       ON CONFLICT (idea_id) DO UPDATE
+          SET grade              = EXCLUDED.grade,
+              template_key       = EXCLUDED.template_key,
+              field_values       = EXCLUDED.field_values,
+              completeness_score = EXCLUDED.completeness_score
+       RETURNING idea_id, grade, template_key, field_values, completeness_score,
+                 created_at, updated_at`,
+      [ideaId, grade, templateKey, JSON.stringify(fieldValues), completenessScore]
+    );
+    return rows[0];
+  } catch (err) {
+    // 23503 = FK violation on idea_id: the idea does not exist. Worth its own
+    // code because "you graded a missing idea" is a 404, not a 500.
+    if (err && err.code === '23503') throw { code: 'IDEA_NOT_FOUND', idea_id: ideaId };
+    throw err;
+  }
+}
+
+// The score-only write, so the R142 scorer never has to restate the grade and
+// the fields just to move a number (and so it cannot wipe them by forgetting).
+// Returns null when the idea has no grade row: an ungraded idea is quick, and a
+// quick idea has nothing to score — that is a no-op, not an error.
+async function setIdeaCompleteness(ideaId, completenessScore) {
+  if (completenessScore !== null && (!Number.isInteger(completenessScore) || completenessScore < 0 || completenessScore > 100)) {
+    throw { code: 'BAD_COMPLETENESS', completeness_score: completenessScore };
+  }
+  const { rows } = await pool.query(
+    `UPDATE ideas_grades
+        SET completeness_score = $2
+      WHERE idea_id = $1
+      RETURNING idea_id, grade, template_key, field_values, completeness_score,
+                created_at, updated_at`,
+    [ideaId, completenessScore]
+  );
+  return rows[0] ?? null;
+}
+
+// The grade row on its own. null = no row, which reads as grade='quick'
+// everywhere the idea itself is read (see DEFAULT_GRADE).
+async function getIdeaGrade(ideaId) {
+  const { rows } = await pool.query(
+    `SELECT idea_id, grade, template_key, field_values, completeness_score,
+            created_at, updated_at
+       FROM ideas_grades
+      WHERE idea_id = $1`,
+    [ideaId]
+  );
+  return rows[0] ?? null;
+}
+
 // -------------------------------------------------------------------------
 // Criterion-proposal ratification (V3.R31 / #252)
 //
@@ -489,6 +654,13 @@ module.exports = {
   VALID_STATUSES,
   // the triage-note cap, so the route validator declares it from one place
   TRIAGE_NOTE_MAX,
+  // idea grades (task 1002916 / BV1.R140) — the vocabulary + caps the routes
+  // and the R141 template declare against, from one place
+  VALID_GRADES,
+  DEFAULT_GRADE,
+  DEFAULT_TEMPLATE_KEY,
+  TEMPLATE_KEY_MAX,
+  FIELD_VALUES_MAX,
   // skill-friction tagging + rank visibility gate (V3.R70 / #289)
   SKILL_FRICTION_TAG,
   XENOS_RANK,
@@ -499,8 +671,11 @@ module.exports = {
   listOpenIdeas,
   getIdea,
   countOpenIdeas,
+  getIdeaGrade,
   // mutate
   updateIdea,
+  setIdeaGrade,
+  setIdeaCompleteness,
   // criterion-proposal ratification (V3.R31 / #252)
   ratifyCriterionProposal,
   parseProposalBody,

package/modules/ideas/migrations/ideas_001_grades.sql

@@ -0,0 +1,131 @@
+-- ideas_001_grades.sql — the grade axis for ideas (task 1002916, BV1.R140, goal 1000062).
+--
+-- Three grades of idea, from the owner's Holy Workshop Trinity brief:
+--   quick — title + description, open to every role. Its job is turning a thought
+--           into a task fast. It is NOT a draft Full Idea.
+--   spark — a Quick Idea whose AUTHOR has explicitly marked it as needing
+--           development. That mark is the consent that makes cross-builder
+--           development fair (task 1002920 / R144).
+--   full  — a developed idea carrying the base template's fields, scored on
+--           completeness (tasks 1002917 / R141, 1002918 / R142).
+--
+-- ONE TABLE, KEYED BY IDEA, AND NO ROW MEANS QUICK.
+-- `ideas_grades` is a SIDE table joined to `idea_inbox` by id — never columns on
+-- idea_inbox itself. Two reasons, and only the second is a preference:
+--
+--   1. It is the only shape that is legal here. `idea_inbox` is a CORE table
+--      (migrations/006_pms_v2.sql), and this goal's scope wall is `ideas` +
+--      `hall-ui`. Repo-root migrations/ resolves to the PROTECTED `lifecycle`
+--      key, so a core migration is out; and a module migration may not ALTER a
+--      table outside its own `ideas_` namespace (ADR 0083 §Decision #5, enforced
+--      by fitness.js Check 11). A namespaced side table is what is left, and it
+--      is also what is right. (Task 1002953 corrected the original instruction
+--      on this task, which asked for something neither gate would accept.)
+--
+--   2. An idea with NO row here reads as grade='quick'. That is the DESIGN, not
+--      a fallback: every idea captured before today keeps grade='quick' without
+--      a single row being written or a column being defaulted, so the task's
+--      "no data change" done-when is met exactly rather than by a backfill. The
+--      COALESCE lives in modules/ideas/inbox.js's LEFT JOIN; a quick row may
+--      also exist explicitly (un-sparking writes one), and both read the same.
+--
+-- THE TEMPLATE IS DATA, NOT COLUMNS. The five base fields (Purpose / Big Picture
+-- / Why you had it / Why it matters / How it fits) are stored as `field_values`
+-- jsonb against a `template_key`, not as five hard-coded columns. The owner's
+-- design philosophy for this platform, recorded on goal 1000062: ship the best
+-- possible simple base, already designed to be altered — so a project founder can
+-- define its own idea shape (task 1002932 / R156) without a schema change. R141
+-- declares what 'base-v1' means; this migration only stores which template a row
+-- was written against.
+--
+-- COMPLETENESS IS STORED, NOT COMPUTED HERE. `completeness_score` is written by
+-- the deterministic scorer (R142) — field presence + substance, no LLM, so the
+-- number is free, instant and reproducible. Nullable: scoring must never block
+-- capture, so an unscored full idea is a legal row, not an error.
+--
+-- Module migrations are ADDITIVE and NAMESPACED (ADR 0083 §Decision #5): every
+-- object is ideas_-prefixed, there is no down-migration, and the filename carries
+-- the module key so its stem never collides across repos (ADR 0108 §5).
+-- Idempotent: safe to re-run.
+
+BEGIN;
+
+CREATE TABLE IF NOT EXISTS ideas_grades (
+  -- The idea this grades. PRIMARY KEY, not just a FK: one grade per idea, and
+  -- the join in inbox.js is a lookup rather than a scan. CASCADE because a grade
+  -- for a deleted idea is not history worth keeping — unlike a ledger row, it
+  -- describes the idea rather than recording an event.
+  idea_id             bigint PRIMARY KEY REFERENCES idea_inbox(id) ON DELETE CASCADE,
+
+  -- The axis. Text + CHECK rather than a Postgres enum TYPE: the vocabulary is
+  -- pinned closed today (an unknown grade is refused, never silently stored),
+  -- and widening it later is a one-line constraint change in a subsequent
+  -- ideas_* migration instead of an enum-type migration.
+  grade               text NOT NULL,
+
+  -- WHICH shape `field_values` was written against. Stored per row, so a project
+  -- that later defines its own template does not retro-reinterpret ideas written
+  -- against the base one.
+  template_key        text NOT NULL DEFAULT 'base-v1',
+
+  -- The template-shaped store. An object of field-key → text. Empty for a quick
+  -- or spark row; the five base fields for a full one.
+  --
+  -- jsonb, NOT json — so the CHECKs below can inspect it and a later query can
+  -- index into it. The one consequence to know: jsonb does not preserve key
+  -- order (values round-trip byte-identical; the ORDER does not). DISPLAY ORDER
+  -- MUST THEREFORE COME FROM THE TEMPLATE DECLARATION (R141), never from
+  -- Object.keys() over what comes back — otherwise the five fields render in
+  -- whatever order Postgres chose.
+  field_values        jsonb NOT NULL DEFAULT '{}'::jsonb,
+
+  -- 0–100, written by the R142 scorer. NULL = not scored yet, which is a legal
+  -- state by design (scoring never gates capture).
+  completeness_score  integer,
+
+  created_at          timestamptz NOT NULL DEFAULT now(),
+  updated_at          timestamptz NOT NULL DEFAULT now(),
+
+  CONSTRAINT ideas_grades_grade_chk
+    CHECK (grade IN ('quick', 'spark', 'full')),
+  -- Same safe-in-a-filename/URL/CLI shape a module key must take, so a
+  -- project-defined template key stays addressable.
+  CONSTRAINT ideas_grades_template_key_fmt_chk
+    CHECK (template_key ~ '^[a-z][a-z0-9-]*$' AND length(template_key) <= 64),
+  -- field_values is a MAP, never a scalar or an array — the read path and the
+  -- scorer both walk it by key.
+  CONSTRAINT ideas_grades_field_values_shape_chk
+    CHECK (jsonb_typeof(field_values) = 'object'),
+  -- Defense in depth with the domain-layer cap: these are five prose fields
+  -- authored by a person and later rendered to other people, not a payload.
+  CONSTRAINT ideas_grades_field_values_size_chk
+    CHECK (length(field_values::text) <= 32768),
+  CONSTRAINT ideas_grades_completeness_range_chk
+    CHECK (completeness_score IS NULL OR completeness_score BETWEEN 0 AND 100)
+);
+
+-- The two reads this table exists to serve, from one index:
+--   • "what sparks are awaiting development?" — the spark queue (R145)
+--   • "order the triage queue so well-formed thinking surfaces first" (R148)
+-- NULLS LAST so an unscored idea sorts behind a scored one rather than ahead of
+-- everything, which is what a naive DESC would do.
+CREATE INDEX IF NOT EXISTS ideas_grades_grade_score_idx
+  ON ideas_grades (grade, completeness_score DESC NULLS LAST);
+
+-- A grade row IS mutated after insert — a quick idea is marked as a spark, a
+-- spark is developed into a full idea, a full idea is re-scored. Without a real
+-- trigger updated_at silently equals created_at forever and "when was this last
+-- developed" becomes unanswerable. Idempotent: OR REPLACE + DROP IF EXISTS.
+CREATE OR REPLACE FUNCTION ideas_touch_updated_at() RETURNS trigger AS $$
+BEGIN
+  NEW.updated_at = now();
+  RETURN NEW;
+END;
+$$ LANGUAGE plpgsql;
+
+DROP TRIGGER IF EXISTS ideas_grades_updated_at ON ideas_grades;
+CREATE TRIGGER ideas_grades_updated_at
+  BEFORE UPDATE ON ideas_grades
+  FOR EACH ROW EXECUTE FUNCTION ideas_touch_updated_at();
+
+COMMIT;

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.146",
+  "version": "1.19.148",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.19.146",
+      "version": "1.19.148",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.146",
+  "version": "1.19.148",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/public-landing/assets/cosmos.css

@@ -218,6 +218,10 @@ body{font-family:var(--font-body);color:var(--ink);background:var(--page-bg);min
 .top-right{display:flex;align-items:center;gap:clamp(10px,2vw,18px);}
 .who{display:flex;align-items:center;gap:10px;font-size:14px;font-weight:600;color:var(--chrome-ink-dim);min-height:34px;text-shadow:var(--chrome-glow);}
 .who img{width:30px;height:30px;border-radius:50%;border:2px solid rgba(255,255,255,0.85);box-shadow:var(--ava-shadow);}
+/* sign-out rides inside the identity chip, so it exists exactly when a session
+   does — the same glass voice as .btn-space, one size down (task 1002952) */
+.who .signout{font-family:var(--font-display);font-weight:700;font-size:12.5px;color:var(--glass-ink);background:var(--glass-bg);border:1.5px solid var(--glass-border);border-radius:999px;padding:5px 12px;text-decoration:none;text-shadow:var(--chrome-glow);backdrop-filter:blur(4px);}
+.who .signout:hover{border-color:var(--chrome-accent);color:var(--chrome-accent);}
 .btn-space{display:inline-flex;align-items:center;gap:8px;cursor:pointer;font-family:var(--font-display);font-weight:700;font-size:13.5px;color:var(--glass-ink);background:var(--glass-bg);border:1.5px solid var(--glass-border);border-radius:999px;padding:8px 16px;text-decoration:none;text-shadow:var(--chrome-glow);backdrop-filter:blur(4px);}
 .btn-space:hover{border-color:var(--chrome-accent);color:var(--chrome-accent);}
 /* the light/dark switch — same glass voice as .btn-space, icon-only */

package/public-landing/index.html

@@ -483,9 +483,30 @@ h1.big{font-family:var(--font-display);font-weight:700;font-size:clamp(33px,5.4v
 
   var API = '/api/bongos';
 
+  /* ── sign out. The logout endpoint is POST + cookie-gated, so a plain-anchor
+     GET navigation would 404 and leave the session live — the exact hall bug
+     task 1002245 fixed; its shell.js doLogout is the contract mirrored here.
+     The POST is also the only place the federated single-logout fan-out fires
+     (ADR 0144). Whether it lands or the network drops, still expire both
+     session cookies in BOTH the host-only and apex-scoped Domain forms (#726 —
+     a Max-Age=0 only matches the cookie whose Domain attribute it names), so
+     this browser at least is signed out, then reload into the signed-out page. ── */
+  function doLogout() {
+    var finish = function () {
+      var apex = location.hostname.split('.').slice(-2).join('.');
+      ['gds_session', 'pms_session'].forEach(function (name) {
+        document.cookie = name + '=; Max-Age=0; path=/';
+        document.cookie = name + '=; Max-Age=0; path=/; Domain=.' + apex;
+      });
+      window.location.assign(location.pathname);
+    };
+    fetch(API + '/auth/logout', { method: 'POST', credentials: 'same-origin' }).then(finish, finish);
+  }
+
   /* ── the identity chip. Signed out (401) leaves it empty — the header's own
      doors are the signed-out affordance. Built with createElement/textContent,
-     never innerHTML: the same rule the status UI keeps. ── */
+     never innerHTML: the same rule the status UI keeps. Signed in it carries
+     the one session control the page owes its visitor: Sign out (task 1002952). ── */
   fetch(API + '/me', { credentials: 'same-origin' })
     .then(function (res) { return res.ok ? res.json() : null; })
     .then(function (data) {
@@ -498,6 +519,12 @@ h1.big{font-family:var(--font-display);font-weight:700;font-size:clamp(33px,5.4v
         host.appendChild(img);
       }
       host.appendChild(document.createTextNode(me.github_login));
+      var out = document.createElement('a');
+      out.className = 'signout';
+      out.href = API + '/auth/logout'; /* honest hover target; the click upgrades it to the real POST */
+      out.textContent = 'Sign out';
+      out.addEventListener('click', function (e) { e.preventDefault(); doLogout(); });
+      host.appendChild(out);
     })
     .catch(function () { /* signed out or offline — the chip stays empty */ });
 

package/public-landing/projects.html

@@ -3904,13 +3904,44 @@ h1[tabindex="-1"]:focus{outline:none;}
   function renderWho() {
     var w = $('who');
     if (me) {
+      /* the chip carries the one session control this page owes its visitor:
+         Sign out (task 1002952). The anchor's href is the honest hover target;
+         the delegated click below upgrades it to the real POST. */
       w.innerHTML = (me.avatar_url ? '<img src="' + esc(me.avatar_url) + '" alt="">' : '') +
-        '<span>' + esc(me.github_login || 'signed in') + '</span>';
+        '<span>' + esc(me.github_login || 'signed in') + '</span>' +
+        '<a class="signout" href="' + API + '/auth/logout">Sign out</a>';
     } else {
       w.innerHTML = '';
     }
   }
 
+  /* Sign out. The logout endpoint is POST + cookie-gated, so a plain-anchor GET
+     would 404 and leave the session live — the exact hall bug task 1002245
+     fixed; its shell.js doLogout is the contract mirrored here. The POST is
+     also the only place the federated single-logout fan-out fires (ADR 0144).
+     Whether it lands or the network drops, still expire both session cookies
+     in BOTH the host-only and apex-scoped Domain forms (#726 — a Max-Age=0
+     only matches the cookie whose Domain attribute it names), then reload the
+     bare path: the boot re-runs and paints the signed-out shell. Delegated on
+     the chip because renderWho rewrites its innerHTML. */
+  function doLogout() {
+    var finish = function () {
+      var apex = location.hostname.split('.').slice(-2).join('.');
+      ['gds_session', 'pms_session'].forEach(function (name) {
+        document.cookie = name + '=; Max-Age=0; path=/';
+        document.cookie = name + '=; Max-Age=0; path=/; Domain=.' + apex;
+      });
+      window.location.assign(location.pathname);
+    };
+    fetch(API + '/auth/logout', { method: 'POST', credentials: 'same-origin' }).then(finish, finish);
+  }
+  $('who').addEventListener('click', function (ev) {
+    var a = ev.target.closest && ev.target.closest('a.signout');
+    if (!a) return;
+    ev.preventDefault();
+    doLogout();
+  });
+
   function load() {
     fetch(API + '/provisioning/instances', { credentials: 'same-origin' })
       .then(function (res) {

package/src/module-api.js

@@ -719,8 +719,12 @@ const { validateOrRespond, LIMITS, parseId, asyncHandler, corsPublicGet, parsePa
 //         landed since 1.19.144 with no explicit bump. run 31895007353. (task 1002620)
 //   1.19.146 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
 //         landed since 1.19.145 with no explicit bump. run 31904091158. (task 1002620)
+//   1.19.147 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+//         landed since 1.19.146 with no explicit bump. run 31950807165. (task 1002620)
+//   1.19.148 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+//         landed since 1.19.147 with no explicit bump. run 31952592623. (task 1002620)
 // ---------------------------------------------------------------------------
-const CORE_VERSION = '1.19.146'; // CI auto-patch carrier (ADR 0161); see changelog above
+const CORE_VERSION = '1.19.148'; // CI auto-patch carrier (ADR 0161); see changelog above
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('dev-box'); log.info('mounted');

package/tests/idea_grades.mjs

@@ -0,0 +1,225 @@
+// tests/idea_grades.mjs
+//
+// task 1002916 (BV1.R140, goal 1000062) — the grade axis on ideas.
+//
+// The rule these tests exist to protect: AN IDEA WITH NO ideas_grades ROW READS
+// AS grade='quick'. That is what lets the grade axis ship without touching a
+// single existing row, and it is a claim about the SQL — a LEFT JOIN with a
+// COALESCE. A plain JOIN, or a COALESCE dropped from one of the read paths,
+// would make every pre-existing idea vanish from the inbox or come back with a
+// null grade, and nothing else in the suite would notice.
+//
+// The other half is the payload guards on setIdeaGrade: they are what stand
+// between an API caller and a raw Postgres constraint violation, so they must
+// refuse BEFORE the query runs, not after.
+//
+// DB-free, the same way tests/idea_triage.mjs is: modules/ideas/inbox.js
+// destructures `pool` off the doorway at require time, so patching pool.query on
+// that object BEFORE requiring inbox.js intercepts every query.
+//
+// Run:  node tests/idea_grades.mjs
+
+import { strict as assert } from 'node:assert';
+import { createRequire } from 'node:module';
+
+const require = createRequire(import.meta.url);
+
+const api = require('../src/module-api.js');
+
+let queries = [];
+// What the fake DB hands back. Set per-test; defaults to one plausible row so a
+// read has something to return.
+let nextRows = [];
+
+api.pool.query = async (sql, params = []) => {
+  queries.push({ sql, params });
+  return { rows: nextRows };
+};
+
+const inbox = require('../modules/ideas/inbox.js');
+
+let passed = 0;
+let failed = 0;
+
+async function test(name, fn) {
+  queries = [];
+  nextRows = [{ id: '1', title: 'an idea', status: 'open', grade: 'quick' }];
+  try {
+    await fn();
+    passed += 1;
+    console.log(`  ok  ${name}`);
+  } catch (err) {
+    failed += 1;
+    console.log(`  FAIL  ${name}\n      ${err.message}`);
+  }
+}
+
+async function rejectsWith(code, fn) {
+  try {
+    await fn();
+  } catch (err) {
+    assert.equal(err.code, code, `expected ${code}, got ${err.code || err.message}`);
+    return err;
+  }
+  throw new Error(`expected ${code}, but the call resolved`);
+}
+
+// A LEFT JOIN onto ideas_grades whose grade is COALESCEd to 'quick'. Asserted as
+// one shape rather than three loose substring checks, because it is the
+// combination that carries the rule: an inner join loses ungraded ideas, and a
+// bare g.grade returns null for them.
+function assertReadsGradeWithDefault(sql, where) {
+  assert.match(sql, /LEFT JOIN\s+ideas_grades\s+g\s+ON\s+g\.idea_id\s*=\s*i\.id/i,
+    `${where}: not a LEFT JOIN onto ideas_grades — ungraded ideas would drop out of the result`);
+  assert.match(sql, /COALESCE\(\s*g\.grade\s*,\s*'quick'\s*\)\s+AS\s+grade/i,
+    `${where}: grade is not COALESCEd to 'quick' — an ungraded idea would read back as null`);
+  assert.match(sql, /g\.template_key/i, `${where}: template_key missing from the projection`);
+  assert.match(sql, /g\.field_values/i, `${where}: field_values missing from the projection`);
+  assert.match(sql, /g\.completeness_score/i, `${where}: completeness_score missing from the projection`);
+}
+
+// -- the read paths carry the grade ----------------------------------------
+
+await test('getIdea reads the grade, defaulting an ungraded idea to quick', async () => {
+  await inbox.getIdea('1');
+  assertReadsGradeWithDefault(queries[0].sql, 'getIdea');
+});
+
+await test('listOpenIdeas reads the grade, defaulting an ungraded idea to quick', async () => {
+  nextRows = [];
+  await inbox.listOpenIdeas({ limit: 5 });
+  assertReadsGradeWithDefault(queries[0].sql, 'listOpenIdeas');
+});
+
+// The join makes a bare `id`/`status` ambiguous. This is the failure that would
+// only ever show up against a real Postgres, so it is worth pinning in SQL text.
+await test('the joined reads qualify every idea column', async () => {
+  nextRows = [];
+  await inbox.listOpenIdeas({ kind: 'feature', limit: 5, viewerRank: 'xenos' });
+  const { sql } = queries[0];
+  assert.match(sql, /i\.id/, 'id is unqualified — ambiguous across the join');
+  assert.match(sql, /i\.status\s*=\s*'open'/i, 'the status filter is unqualified');
+  assert.match(sql, /i\.kind\s*=\s*\$/i, 'the kind filter is unqualified');
+  assert.match(sql, /i\.title NOT LIKE/i, 'the skill-friction filter is unqualified');
+  assert.match(sql, /ORDER BY\s+i\.captured_at/i, 'the ordering column is unqualified');
+});
+
+await test('a triage update returns the row with its grade attached, in one query', async () => {
+  await inbox.updateIdea('1', { status: 'discarded' });
+  assert.equal(queries.length, 1, 'the update took more than one round trip');
+  assert.match(queries[0].sql, /WITH upd AS/i, 'the update is not CTE-wrapped');
+  assert.match(queries[0].sql, /UPDATE\s+idea_inbox/i);
+  assertReadsGradeWithDefault(queries[0].sql, 'updateIdea');
+});
+
+// A just-INSERTed idea provably has no grade row, so capture skips the join —
+// but it must still return the SAME shape every other read returns, or a caller
+// that reads `.grade` off a POST response gets undefined.
+await test('a freshly captured idea comes back as quick without a second query', async () => {
+  nextRows = [{ id: '9', title: 'brand new', status: 'open' }];
+  const idea = await inbox.captureIdea({ title: 'brand new', kind: 'feature' });
+  assert.equal(queries.length, 1, 'capture took a second round trip to learn it was quick');
+  assert.equal(idea.grade, 'quick');
+  assert.equal(idea.template_key, null);
+  assert.equal(idea.field_values, null);
+  assert.equal(idea.completeness_score, null);
+  assert.equal(idea.title, 'brand new', 'the real row did not survive the projection merge');
+});
+
+// -- setIdeaGrade: the guards run BEFORE the DB does -----------------------
+
+await test('a full idea round-trips its field values', async () => {
+  const fields = {
+    purpose: 'give the ideator craft a real output',
+    big_picture: 'a scope of work others can deliver against',
+    why_you_had_it: 'ideas kept dying as one-liners',
+    why_it_matters: 'no re-interviewing the person who had the thought',
+    how_it_fits: 'the first shipped goal of the ABI set',
+  };
+  nextRows = [{ idea_id: '1', grade: 'full', template_key: 'base-v1', field_values: fields, completeness_score: null }];
+  const row = await inbox.setIdeaGrade('1', { grade: 'full', fieldValues: fields });
+  const { sql, params } = queries[0];
+  assert.match(sql, /INSERT INTO ideas_grades/i);
+  assert.match(sql, /ON CONFLICT \(idea_id\) DO UPDATE/i, 'grading twice would violate the PK instead of updating');
+  // The jsonb goes down as a serialized string with an explicit ::jsonb cast —
+  // handing pg a bare JS object binds it as a Postgres record, not json.
+  assert.match(sql, /\$4::jsonb/, 'field_values is not cast to jsonb');
+  assert.equal(params[3], JSON.stringify(fields));
+  assert.equal(params[2], 'base-v1', 'the template key did not default to base-v1');
+  assert.deepEqual(row.field_values, fields);
+});
+
+await test('an unknown grade is refused before it reaches the DB', async () => {
+  const err = await rejectsWith('BAD_GRADE', () => inbox.setIdeaGrade('1', { grade: 'brilliant' }));
+  assert.deepEqual(err.valid, ['quick', 'spark', 'full']);
+  assert.equal(queries.length, 0, 'a rejected grade still hit the database');
+});
+
+await test('a malformed template key is refused before it reaches the DB', async () => {
+  await rejectsWith('BAD_TEMPLATE_KEY', () =>
+    inbox.setIdeaGrade('1', { grade: 'full', templateKey: 'Base V1' }));
+  assert.equal(queries.length, 0);
+});
+
+// typeof null === 'object' and typeof [] === 'object', so both need naming.
+await test('field_values must be a map, not a scalar or an array', async () => {
+  await rejectsWith('BAD_FIELD_VALUES', () => inbox.setIdeaGrade('1', { grade: 'full', fieldValues: null }));
+  await rejectsWith('BAD_FIELD_VALUES', () => inbox.setIdeaGrade('1', { grade: 'full', fieldValues: ['a'] }));
+  await rejectsWith('BAD_FIELD_VALUES', () => inbox.setIdeaGrade('1', { grade: 'full', fieldValues: 'purpose' }));
+  assert.equal(queries.length, 0);
+});
+
+await test('an oversize field_values payload is refused before it reaches the DB', async () => {
+  const err = await rejectsWith('FIELD_VALUES_TOO_LARGE', () =>
+    inbox.setIdeaGrade('1', { grade: 'full', fieldValues: { purpose: 'x'.repeat(40000) } }));
+  assert.equal(err.max, 32768, 'the cap reported to the caller drifted from the DB constraint');
+  assert.equal(queries.length, 0);
+});
+
+await test('an out-of-range completeness score is refused before it reaches the DB', async () => {
+  await rejectsWith('BAD_COMPLETENESS', () => inbox.setIdeaGrade('1', { grade: 'full', completenessScore: 101 }));
+  await rejectsWith('BAD_COMPLETENESS', () => inbox.setIdeaGrade('1', { grade: 'full', completenessScore: -1 }));
+  await rejectsWith('BAD_COMPLETENESS', () => inbox.setIdeaGrade('1', { grade: 'full', completenessScore: 55.5 }));
+  assert.equal(queries.length, 0);
+});
+
+// Grading an idea that does not exist trips the FK. It is a 404's worth of
+// information, so it must not surface as an opaque 500.
+await test('grading a missing idea surfaces as IDEA_NOT_FOUND, not a raw FK error', async () => {
+  api.pool.query = async () => { const e = new Error('violates foreign key constraint'); e.code = '23503'; throw e; };
+  await rejectsWith('IDEA_NOT_FOUND', () => inbox.setIdeaGrade('999', { grade: 'spark' }));
+  api.pool.query = async (sql, params = []) => { queries.push({ sql, params }); return { rows: nextRows }; };
+});
+
+// -- setIdeaCompleteness: the score-only write ----------------------------
+
+await test('setIdeaCompleteness moves only the score', async () => {
+  nextRows = [{ idea_id: '1', grade: 'full', completeness_score: 80 }];
+  await inbox.setIdeaCompleteness('1', 80);
+  const { sql, params } = queries[0];
+  assert.match(sql, /UPDATE ideas_grades/i);
+  // Scoped to the SET clause: field_values and grade are legitimately in
+  // RETURNING (the caller gets the whole row back), so a whole-statement scan
+  // would pass for the wrong reason. What must not happen is either column
+  // being ASSIGNED — that is the R146 "develop a spark" wipe footgun.
+  const setClause = sql.slice(sql.search(/\bSET\b/i), sql.search(/\bWHERE\b/i));
+  assert.match(setClause, /completeness_score = \$2/i);
+  assert.doesNotMatch(setClause, /field_values/i, 'a score-only write assigns field_values — the R146 wipe footgun');
+  assert.doesNotMatch(setClause, /\bgrade\s*=/i, 'a score-only write reassigns the grade');
+  assert.deepEqual(params, ['1', 80]);
+});
+
+// An idea with no grade row is quick, and a quick idea has nothing to score.
+// That is a no-op, not an error — scoring must never block anything.
+await test('scoring an ungraded idea is a no-op, not an error', async () => {
+  nextRows = [];
+  assert.equal(await inbox.setIdeaCompleteness('1', 80), null);
+});
+
+await test('an out-of-range score is refused by the score-only write too', async () => {
+  await rejectsWith('BAD_COMPLETENESS', () => inbox.setIdeaCompleteness('1', 200));
+  assert.equal(queries.length, 0);
+});
+
+console.log(`\nIdea grade tests: ${passed} passed, ${failed} failed`);
+process.exit(failed === 0 ? 0 : 1);

package/tests/idea_triage.mjs

@@ -34,8 +34,12 @@ api.pool.query = async (sql, params = []) => {
     const row = rows.get(String(params[0]));
     return { rows: row ? [row] : [] };
   }
-  // UPDATE … RETURNING — apply nothing, just echo a plausible row back so the
-  // caller's return value is shaped right.
+  // The update — apply nothing, just echo a plausible row back so the caller's
+  // return value is shaped right. Since task 1002916 the update arrives as
+  // `WITH upd AS (UPDATE … RETURNING …) SELECT … LEFT JOIN ideas_grades`, so it
+  // does NOT start with SELECT and correctly falls through to here; the
+  // assertions below match `UPDATE idea_inbox` rather than anchoring at the
+  // start of the statement.
   const row = rows.get(String(params[0]));
   return { rows: row ? [{ ...row }] : [] };
 };
@@ -89,7 +93,7 @@ await test('merging into an already-merged idea is refused (no chains)', async (
 
 await test('merging into a live idea writes both the status and the target', async () => {
   await inbox.updateIdea('1', { status: 'merged', merged_into_idea_id: 2, triage_note: 'same ask' });
-  const update = queries.find((q) => /^\s*UPDATE/i.test(q.sql));
+  const update = queries.find((q) => /UPDATE\s+idea_inbox/i.test(q.sql));
   assert.ok(update, 'no UPDATE ran');
   assert.match(update.sql, /merged_into_idea_id = \$\d+/);
   assert.match(update.sql, /triage_note = \$\d+/);
@@ -102,7 +106,7 @@ await test('merging into a live idea writes both the status and the target', asy
 await test('clearing the merge link with null skips the target guards', async () => {
   await inbox.updateIdea('1', { status: 'open', merged_into_idea_id: null });
   assert.equal(queries.filter((q) => /^\s*SELECT/i.test(q.sql)).length, 0, 'looked up a null target');
-  const update = queries.find((q) => /^\s*UPDATE/i.test(q.sql));
+  const update = queries.find((q) => /UPDATE\s+idea_inbox/i.test(q.sql));
   assert.ok(update.params.includes(null));
 });
 
@@ -131,7 +135,7 @@ await test('the no-chains guard reads the target COLUMN, not the target status',
 
 await test('a discard reason is written as the triage note', async () => {
   await inbox.updateIdea('1', { status: 'discarded', triage_note: 'superseded by the new gate' });
-  const update = queries.find((q) => /^\s*UPDATE/i.test(q.sql));
+  const update = queries.find((q) => /UPDATE\s+idea_inbox/i.test(q.sql));
   assert.ok(update.params.includes('superseded by the new gate'));
 });