@bongos/core 1.19.163 → 1.19.165

package/.bongos-core.json

@@ -2,22 +2,22 @@
   "artifact": "bongos-core",
   "manifest_schema": 1,
   "generator": "scripts/gds/package-core.js",
-  "core_version": "1.19.163",
-  "core_contract": "1.19.163",
-  "source_commit": "cf29eabb9874ecd380580fa762e09cf7ab412a1e",
+  "core_version": "1.19.165",
+  "core_contract": "1.19.165",
+  "source_commit": "3765c2891e2cf0e70f9b4f0fbe112eaa2f05faaf",
   "source_ref": "HEAD",
-  "built_at": "2026-08-16T16:52:34.284Z",
+  "built_at": "2026-08-16T17:13:47.567Z",
   "redaction": {
     "model": "docs-redacted+functional-verbatim",
     "docs_redacted": 305,
     "agent_docs_stubbed": 21,
-    "functional_verbatim": 1262,
+    "functional_verbatim": 1264,
     "rules": 3,
     "gate_literals": 3,
     "gate": "passed"
   },
-  "file_count": 1588,
-  "tree_sha256": "5c874eb035676d192575fc9366d0ddb5dac5a4af849f8c7034694ddb591d421c",
+  "file_count": 1590,
+  "tree_sha256": "9462bf715e231d13175d8e0ad6eb1464cf46cc4894de3f644c025a79b6bfa78a",
   "files": [
     {
       "path": ".claude/skills/blocker-review/SKILL.md",
@@ -367,7 +367,7 @@
     {
       "path": "clients/bongos-client/index.d.ts",
       "mode": "0000644",
-      "sha256": "bca3cfecb85aa504c645ef360eb2370e72c417e34d171b40936b6e01d0d94e95"
+      "sha256": "4245c4fb82c1c4f5c87788030dc4640987fe22e0d588072d4549e9982cea7ecc"
     },
     {
       "path": "clients/bongos-client/index.mjs",
@@ -1347,12 +1347,12 @@
     {
       "path": "docs/api-reference.md",
       "mode": "0000644",
-      "sha256": "600c7a58bb59803bea046d379bf1f9c42a03a1c5f05514f4b2edac3b71956b12"
+      "sha256": "879ef6fd06bde11c040c5ef67ccf495f0be6eb95e11be6f8979c9d560a33da64"
     },
     {
       "path": "docs/api/openapi.json",
       "mode": "0000644",
-      "sha256": "0b2a7a1534b1bc4b92b3a2e939e5d5e6a7b8907fa0cd7513e5a3a6311d4318e1"
+      "sha256": "9382373e7be837c0ce4e26f23c3cd32bf20ab09858650bdee318dd90a06dedbe"
     },
     {
       "path": "docs/architecture.md",
@@ -3167,12 +3167,12 @@
     {
       "path": "modules/hall-ui/public/goals-page.js",
       "mode": "0000644",
-      "sha256": "f24cfdca48676d882cfa51754fcf1519ade4646a760cb2be1db71fbc27571bca"
+      "sha256": "7e67230de060927c37ab8680e397c994896250c9e027e920ac997a61edbd14aa"
     },
     {
       "path": "modules/hall-ui/public/goals.css",
       "mode": "0000644",
-      "sha256": "c52de393285c8ba08494799aff501b947635ccbee93c80777e961b78e2a870c5"
+      "sha256": "407e8f21b95faa725d37c5336986d00af734db351bdaaf58aac350114c58f172"
     },
     {
       "path": "modules/hall-ui/public/goals.html",
@@ -3482,12 +3482,12 @@
     {
       "path": "modules/ideas/routes/inbox.js",
       "mode": "0000644",
-      "sha256": "6c57608d1eae4159e967f9b471b20cb4c518c2b4acdf9d5ab88cad2afaf7c197"
+      "sha256": "8604c627617cc90fa3197dcf3776ce708546d754b9acc2d45c16dfea97a478cb"
     },
     {
       "path": "modules/ideas/templates.js",
       "mode": "0000644",
-      "sha256": "d2816db988207f9f2c9305971ebca9bcd87d62e594facaea115d9f6db4b5d9f0"
+      "sha256": "eade9a2d07da0a39af17c086d188a195be00c544889d61454ed3c6368d39ea04"
     },
     {
       "path": "modules/lifecycle/CLAUDE.md",
@@ -4202,12 +4202,12 @@
     {
       "path": "package-lock.json",
       "mode": "0000644",
-      "sha256": "572ae700360b73fdbc62135f01397fd335bcb5a735d113962a8343377672268c"
+      "sha256": "e02feb552451ccc0b6011326d1e44776920e00d0cde6d5f14d998e3353d7281f"
     },
     {
       "path": "package.json",
       "mode": "0000644",
-      "sha256": "1460066c89ad9a7db9dc62ae0b6766c5e11cc18d8268fb95a4ae8767325569c5"
+      "sha256": "4b5c6f1642f870b8048fcf8faf1873676e3a0a95a30a30e6cfc1fd615794f944"
     },
     {
       "path": "public-docs/index.html",
@@ -5259,6 +5259,11 @@
       "mode": "0000644",
       "sha256": "5de4203d6a764c8aec374c7802f69f659816d2c0d75bbe70144f7dfb56df2e39"
     },
+    {
+      "path": "scripts/gds/seed-bv1-privacy-invites-tasks.js",
+      "mode": "0000644",
+      "sha256": "bab0c429d0d194cc5e90bc09d59c338cf85143e0788bc3071f94297982c9a5fe"
+    },
     {
       "path": "scripts/gds/seed-bv1-profile-page-tasks.js",
       "mode": "0000644",
@@ -5802,7 +5807,7 @@
     {
       "path": "src/module-api.js",
       "mode": "0000644",
-      "sha256": "4e7edb74be33ea3e2b126dadb6a51dce083c4df6eb8c0521c0c7f484997edbe4"
+      "sha256": "188546b1d9a2f94016b5d7d8f647f9e8092781677f7370f55c78c8308879e490"
     },
     {
       "path": "src/module-loader/catalog.js",
@@ -6914,6 +6919,11 @@
       "mode": "0000644",
       "sha256": "e7b6af463185ea77f40d62408026c55c7fb077f18999b972564b3b5bc7656ca5"
     },
+    {
+      "path": "tests/idea_full_capture.mjs",
+      "mode": "0000644",
+      "sha256": "95b53f1acfa61f723741b4d33b5e882525903ccc549ae01f3094a788251a60ec"
+    },
     {
       "path": "tests/idea_grades.mjs",
       "mode": "0000644",
@@ -6922,12 +6932,12 @@
     {
       "path": "tests/idea_quick_guard.mjs",
       "mode": "0000644",
-      "sha256": "9be4414bbbbb92513a7737d4494265b24c5f5db71a67e840016cc275442df1fb"
+      "sha256": "729c511f9bb3d4a9b7fb76c7b3843e1900c8d4c9cfa30fe08e482d1e41113839"
     },
     {
       "path": "tests/idea_templates.mjs",
       "mode": "0000644",
-      "sha256": "3360dcfcccd6ada6375124108a2570d84172977046aa47e1704d4be303ad41f3"
+      "sha256": "943afa2366f92c4d6188ce9f8d68f499aac8d67930f91d6860a2cb83020642ab"
     },
     {
       "path": "tests/idea_triage.mjs",

package/clients/bongos-client/index.d.ts

@@ -222,8 +222,7 @@ export interface PostGovernanceRolesRequest { role_key: string; label: string; d
 export interface PostGovernanceRolesResponse { role: unknown }
 export interface PostGovernanceRolesRoleKeyResetResponse { ok: boolean; role_key: unknown; seeded_rank: unknown; permission_count: unknown }
 export interface PostInboxIdRatifyRequest { notes_md?: string }
-export interface PostInboxRequest { title: string; body_md?: string; kind?: string; suggested_version?: string; suggested_priority?: number }
-export interface PostInboxResponse { idea: unknown; open_count: unknown; kind_auto: unknown }
+export interface PostInboxRequest { title: string; body_md?: string; kind?: string; suggested_version?: string; suggested_priority?: number; grade?: string; template_key?: string; field_values?: Record<string, unknown> }
 export interface PostLearningsRequest { title: string; body_md: string; tags?: string[]; related_files?: string[]; source?: string; source_ref?: string; task_id?: number }
 export interface PostLearningsResponse { skipped?: boolean; reason?: unknown; learning?: unknown }
 export interface PostLlmCacheLookupRequest { cache_key?: unknown; tokens_saved_est?: unknown }
@@ -607,7 +606,7 @@ export interface BongosClient {
     /** GET /inbox — rank: any-builder */
     getInbox(args?: RequestArgs): Promise<GetInboxResponse>;
     /** POST /inbox — rank: any-builder */
-    postInbox(args: RequestArgs & { body: PostInboxRequest }): Promise<PostInboxResponse>;
+    postInbox(args: RequestArgs & { body: PostInboxRequest }): Promise<ApiResponse>;
     /** GET /inbox/{id} — rank: any-builder */
     getInboxId(args?: RequestArgs): Promise<GetInboxIdResponse>;
     /** PATCH /inbox/{id} — rank: metic+archon */

package/docs/api/openapi.json

@@ -5686,14 +5686,7 @@
         },
         "responses": {
           "200": {
-            "description": "Success.",
-            "content": {
-              "application/json": {
-                "schema": {
-                  "$ref": "#/components/schemas/PostInboxResponse"
-                }
-              }
-            }
+            "description": "Success."
           },
           "400": {
             "$ref": "#/components/responses/ValidationFailed"
@@ -15422,6 +15415,16 @@
             "type": "integer",
             "minimum": 0,
             "maximum": 100
+          },
+          "grade": {
+            "type": "string",
+            "maxLength": 16
+          },
+          "template_key": {
+            "type": "string"
+          },
+          "field_values": {
+            "type": "object"
           }
         },
         "required": [
@@ -15429,19 +15432,6 @@
         ],
         "additionalProperties": false
       },
-      "PostInboxResponse": {
-        "type": "object",
-        "properties": {
-          "idea": {},
-          "open_count": {},
-          "kind_auto": {}
-        },
-        "required": [
-          "idea",
-          "open_count",
-          "kind_auto"
-        ]
-      },
       "PostLearningsRequest": {
         "type": "object",
         "properties": {
@@ -17109,8 +17099,8 @@
     }
   },
   "x-endpoint-count": 271,
-  "x-schema-count": 304,
+  "x-schema-count": 303,
   "x-undocumented-bodies": 8,
-  "x-response-schemas": 206,
+  "x-response-schemas": 205,
   "x-generated-by": "scripts/gds/gen-api-docs.js"
 }

package/docs/api-reference.md

@@ -245,7 +245,7 @@ Base path: `/api/bongos`. Ranks (enforced server-side, [ADR 0016](adr/<redacted>
 | Method | Path | Rank | Body | Description |
 |---|---|---|---|---|
 | GET | `/api/bongos/inbox` | `any-builder` | — | read open ideas; skill-friction rows filtered by viewer rank. |
-| POST | `/api/bongos/inbox` | `any-builder` | `title`, `body_md`, `kind`, `suggested_version`, `suggested_priority` | for ordinary ideas; metic+ for kind='criterion-proposal'. |
+| POST | `/api/bongos/inbox` | `any-builder` | `title`, `body_md`, `kind`, `suggested_version`, `suggested_priority`, `grade`, `template_key`, `field_values` | for ordinary ideas; metic+ for kind='criterion-proposal'. |
 | GET | `/api/bongos/inbox/:id` | `any-builder` | — | single idea read for the "#NNN" deep-link resolver (task 1047). |
 | PATCH | `/api/bongos/inbox/:id` | `metic+archon` | `status`, `kind`, `promoted_to_task_id`, `reviewed_at`, `merged_into_idea_id`, `triage_note` | Metic+ (task 360 / ADR 0018): idea triage (promote/discard/merge) shapes the backlog. |
 | POST | `/api/bongos/inbox/:id/ratify` | `metic+archon` | `notes_md` | V3.R31 (task 252) — Archon ratifies a criterion-proposal idea, atomically: - INSERT done_when_criteria row on the target version - UPDATE… |

package/modules/hall-ui/public/goals-page.js

@@ -91,6 +91,12 @@
     // from GET /tasks?version=…&include=deps. Empty on an older server (the
     // include=deps enrichment 404s gracefully → the list falls back to plain cards).
     rollups: new Map(),
+    // task 1002965 — goal_id → ms of the LAST WORK DONE on the goal: the newest
+    // activity timestamp across its tasks. Filled by loadRollups from the same
+    // per-version task fetch the readiness rollups ride on, so the "recently
+    // active" sort costs no extra request. A goal with no tasks is absent here
+    // and falls back to its own goals.updated_at (see goalActivityMs).
+    activity: new Map(),
   };
 
   async function getJSON(path) {
@@ -174,6 +180,39 @@
   const EMPTY_ROLLUP = { done: 0, active: 0, ready: 0, blocked: 0, backlog: 0, cut: 0, total: 0, nextReady: null };
   const rollupOf = (goalId) => state.rollups.get(String(goalId)) || EMPTY_ROLLUP;
 
+  // ---- goal ordering (task 1002965) -----------------------------------------
+  // The list is ordered by the Archon's within-version priority (sort_order,
+  // task 1760) unless the builder picks a date sort. Two dates are offered:
+  //   created  — goals.created_at, straight off GET /goals (GOAL_COLS)
+  //   activity — the LAST WORK DONE on the goal: the newest task-activity
+  //              timestamp under it (state.activity, filled by loadRollups),
+  //              falling back to the goal row's own updated_at when the goal
+  //              has no tasks at all, so a task-less goal still orders sanely
+  //              instead of sinking to the bottom forever.
+  const msOf = (iso) => { const t = iso ? Date.parse(iso) : NaN; return Number.isNaN(t) ? 0 : t; };
+  const taskActivityMs = (t) => Math.max(msOf(t.updated_at), msOf(t.shipped_at));
+  const goalCreatedMs = (g) => msOf(g.created_at);
+  const goalActivityMs = (g) => state.activity.get(String(g.id)) || msOf(g.updated_at);
+
+  // value → { label, cmp, stamp } — `stamp` is what the row's meta line shows
+  // for that sort (null = show nothing extra, the priority default).
+  const GOAL_SORTS = {
+    priority: { label: 'priority (version order)', cmp: null, stamp: null },
+    newest: { label: 'newest first', cmp: (a, b) => goalCreatedMs(b) - goalCreatedMs(a), stamp: (g) => ({ label: 'created', ms: goalCreatedMs(g) }) },
+    oldest: { label: 'oldest first', cmp: (a, b) => goalCreatedMs(a) - goalCreatedMs(b), stamp: (g) => ({ label: 'created', ms: goalCreatedMs(g) }) },
+    active: { label: 'recently active', cmp: (a, b) => goalActivityMs(b) - goalActivityMs(a), stamp: (g) => ({ label: 'last work', ms: goalActivityMs(g) }) },
+  };
+  const GOAL_SORT_PREF = 'otb.goals.sort';
+  const currentGoalSort = () => GOAL_SORTS[$('#f-goal-order')?.value] || GOAL_SORTS.priority;
+
+  // Stable: filteredGoals already returns the server's priority order, and
+  // Array#sort is stable in every browser this hall supports — so goals sharing
+  // a timestamp (or both missing one) keep their priority order as the tiebreak.
+  function sortGoals(rows) {
+    const { cmp } = currentGoalSort();
+    return cmp ? rows.slice().sort(cmp) : rows;
+  }
+
   // Fetch every task for the versions the goals span (one request each, with dep
   // summaries) and fold into per-goal rollups. Failure-tolerant: an older server
   // that doesn't honor include=deps just yields empty rollups and the list falls
@@ -185,6 +224,7 @@
       getJSON(`${API}/tasks?version=${encodeURIComponent(v)}&include=deps`)
         .then((r) => r.tasks || []).catch(() => [])));
     const roll = new Map();
+    const activity = new Map();
     for (const t of lists.flat()) {
       if (t.goal_id == null) continue;
       const key = String(t.goal_id);
@@ -194,8 +234,16 @@
       r[bucket] += 1;
       if (bucket !== 'cut') r.total += 1;
       if (bucket === 'ready' && !r.nextReady) r.nextReady = t;
+      // task 1002965 — ANY task activity counts (owner call), not just ships: a
+      // goal being worked right now should read as active before anything lands.
+      // updated_at moves on every task write (claim, status flip, edit), so it
+      // dominates in practice; shipped_at is folded in because a task can be
+      // shipped by a path that stamps it without touching updated_at.
+      const ts = taskActivityMs(t);
+      if (ts && ts > (activity.get(key) || 0)) activity.set(key, ts);
     }
     state.rollups = roll;
+    state.activity = activity;
   }
 
   /* ---------------- list view ---------------- */
@@ -263,6 +311,16 @@
   // task 1002439 — one goal, rendered as a rollup row: criteria ring · title +
   // meta + readiness rollup · one next action (claim the next ready task, drill
   // into what's blocking, or a review/achieved note).
+  // task 1002965 — under a date sort, the row states the date it was ordered on
+  // ("created Aug 4" / "last work Aug 16"); under the priority default it shows
+  // nothing extra, so the row is unchanged for anyone who never touches Sort.
+  function goalStampHtml(g) {
+    const { stamp } = currentGoalSort();
+    if (!stamp) return '';
+    const { label, ms } = stamp(g);
+    return ` · ${escapeHtml(label)} ${escapeHtml(ms ? fmtDate(new Date(ms).toISOString()) : '—')}`;
+  }
+
   function goalRowHtml(g) {
     const d = state.details.get(String(g.id));
     const crit = d ? (d.criteria || []) : [];
@@ -292,7 +350,7 @@
       <div class="gr-ringcol">${ringHtml}</div>
       <div class="gr-main">
         <a class="gr-title" href="${goalHref}">${escapeHtml(g.title || 'Untitled goal')}</a>
-        <div class="gr-meta">#${escapeHtml(String(g.id))} · ${escapeHtml(g.version_id || '')}${(achieved || g.status === 'open') ? '' : ' · ' + escapeHtml(g.status)}</div>
+        <div class="gr-meta">#${escapeHtml(String(g.id))} · ${escapeHtml(g.version_id || '')}${(achieved || g.status === 'open') ? '' : ' · ' + escapeHtml(g.status)}${goalStampHtml(g)}</div>
         ${achieved ? '' : goalRollLine(r)}
       </div>
       <div class="gr-right">${right}</div>
@@ -323,11 +381,14 @@
       const r = rollupOf(g.id);
       return g.status === 'open' && r.ready === 0 && r.active === 0 && r.blocked > 0;
     };
-    const achieved = rows.filter((g) => g.status === 'achieved');
-    const archived = rows.filter((g) => g.status === 'archived');
+    // task 1002965 — the Sort choice orders goals WITHIN each group; the
+    // Active / Blocked / Achieved / Archived grouping (task 1002439's momentum
+    // layout) is what the page is for and is never re-ordered away.
+    const achieved = sortGoals(rows.filter((g) => g.status === 'achieved'));
+    const archived = sortGoals(rows.filter((g) => g.status === 'archived'));
     const openRows = rows.filter((g) => g.status !== 'achieved' && g.status !== 'archived');
-    const blocked = openRows.filter(isBlocked);
-    const active = openRows.filter((g) => !isBlocked(g));
+    const blocked = sortGoals(openRows.filter(isBlocked));
+    const active = sortGoals(openRows.filter((g) => !isBlocked(g)));
 
     let R = 0, A = 0, B = 0;
     openRows.forEach((g) => { const r = rollupOf(g.id); R += r.ready; A += r.active; B += r.blocked; });
@@ -339,7 +400,16 @@
 
     const sec = (label, n) => `<div class="gr-sec"><b>${label}</b><span class="gr-sec__n">${n}</span></div>`;
     const listOf = (arr) => `<div class="gr-list">${arr.map(goalRowHtml).join('')}</div>`;
-    const pill = (g) => `<a class="gr-pill" href="#/goal/${escapeHtml(String(g.id))}"><span class="gr-pill__ok">✓</span><b>${escapeHtml(g.title || 'Untitled')}</b><span class="gr-pill__id">#${escapeHtml(String(g.id))}</span></a>`;
+    // task 1002965 — an achieved/archived goal is a compact pill, so its sort
+    // date rides as its own muted span (the row's `gr-meta` equivalent). The
+    // pills row already wraps, so the extra text can't widen the page.
+    const pillWhen = (g) => {
+      const { stamp } = currentGoalSort();
+      if (!stamp) return '';
+      const { label, ms } = stamp(g);
+      return `<span class="gr-pill__when">${escapeHtml(label)} ${escapeHtml(ms ? fmtDate(new Date(ms).toISOString()) : '—')}</span>`;
+    };
+    const pill = (g) => `<a class="gr-pill" href="#/goal/${escapeHtml(String(g.id))}"><span class="gr-pill__ok">✓</span><b>${escapeHtml(g.title || 'Untitled')}</b><span class="gr-pill__id">#${escapeHtml(String(g.id))}</span>${pillWhen(g)}</a>`;
 
     grid.innerHTML = summary
       + (active.length ? sec('Active', active.length) + listOf(active) : '')
@@ -1810,17 +1880,34 @@
   }
 
   // task 1932 — any list filter change re-paginates the grid from page 1.
-  const onListFilterChange = () => { pagers.list.page = 1; renderList(); };
+  // task 1002965 — and the Sort choice is remembered, so a builder who prefers
+  // "recently active" doesn't re-pick it on every visit. localStorage (not the
+  // kit's `url` mode): this page owns the #/goal/N hash route and its own boot
+  // reads it, so keeping the pref off the URL leaves deep links shareable and
+  // unchanged. Private-mode writes throw — swallowed, the pref is a nicety.
+  const onListFilterChange = () => {
+    try { window.localStorage.setItem(GOAL_SORT_PREF, $('#f-goal-order')?.value || 'priority'); } catch (_) { /* private mode */ }
+    pagers.list.page = 1;
+    renderList();
+  };
   // task 2171 — the list filter bar is a kit filterBar: Version / Status /
   // Membership, all primary (no overflow needed). Control ids are unchanged
   // (f-goal-version, f-goal-status, f-goal-mine) so filteredGoals' reads +
   // populateVersionFilter's dynamic option fill keep working untouched.
+  // task 1002965 adds Sort (f-goal-order — NOT f-goal-sort, which is already
+  // taken by the goal-detail To-do bar further down this file).
+  let savedGoalSort = null;
+  try { savedGoalSort = window.localStorage.getItem(GOAL_SORT_PREF); } catch (_) { /* private mode */ }
   makeFilterBar({
     mount: $('#goals-filters'),
     primary: [
       { id: 'f-goal-version', label: 'Version', options: [{ value: '', label: '— any —' }] },
       { id: 'f-goal-status', label: 'Status', options: [{ value: '', label: '— any —' }, 'open', 'achieved', 'archived'] },
       { id: 'f-goal-mine', label: 'Membership', options: [{ value: '', label: 'All goals' }, { value: 'mine', label: 'My goals' }] },
+      { id: 'f-goal-order',
+        label: 'Sort',
+        value: GOAL_SORTS[savedGoalSort] ? savedGoalSort : undefined,
+        options: Object.entries(GOAL_SORTS).map(([value, { label }]) => ({ value, label })) },
     ],
     onChange: onListFilterChange,
   });

package/modules/hall-ui/public/goals.css

@@ -251,6 +251,9 @@ a.goal-card:hover { text-decoration: none; border-color: var(--border-strong); b
 .gr-pill b { color: var(--ink); font-weight: 600; }
 .gr-pill__ok { width: 17px; height: 17px; border-radius: 50%; background: var(--ok-weak); color: var(--ok); display: grid; place-items: center; font-size: 10px; font-weight: 800; }
 .gr-pill__id { color: var(--ink-faint); font-variant-numeric: tabular-nums; }
+/* task 1002965 — the date an achieved/archived pill was ordered on, shown only
+   while a date sort is active (the pill's counterpart to .gr-meta). */
+.gr-pill__when { color: var(--ink-faint); font-variant-numeric: tabular-nums; }
 .gr-pills--muted { opacity: .6; }
 
 @media (max-width: 640px) {

package/modules/ideas/routes/inbox.js

@@ -4,6 +4,10 @@ const express = require('express');
 // sibling — a module never requires a core internal.
 const api = require('../../../src/module-api');
 const inbox = require('../inbox');
+// Full Idea capture (task 1002919 / BV1.R143): the template validator (R141)
+// and the deterministic scorer (R142) — both pure, both walk the declaration.
+const { validateFieldValues } = require('../templates');
+const { completenessScore } = require('../completeness');
 const { validateOrRespond, LIMITS, parseId } = api;
 
 const INBOX_STATUS_VALUES = ['open', 'promoted', 'discarded', 'merged'];
@@ -42,6 +46,12 @@ module.exports = function buildInboxRouter() {
       kind: { type: 'string', maxLength: 64 },
       suggested_version: { type: 'string', maxLength: 64 },
       suggested_priority: { type: 'integer', min: 0, max: 100 },
+      // Full Idea capture (R143) — ALL OPTIONAL: omitting every one of these is
+      // exactly the pre-grade quick capture (tests/idea_quick_guard.mjs pins
+      // that title stays the only required field).
+      grade: { type: 'string', maxLength: 16 },
+      template_key: { type: 'string', maxLength: inbox.TEMPLATE_KEY_MAX },
+      field_values: { type: 'object' },
     })) return;
     const body = req.body || {};
     if (body.kind === 'criterion-proposal') {
@@ -50,6 +60,40 @@ module.exports = function buildInboxRouter() {
         return res.fail('rank_forbidden', 403, { required: ['metic', 'archon'], actual: rank, reason: "kind='criterion-proposal' is a planning-session write; Metic+ only." });
       }
     }
+    // Full Idea capture (task 1002919 / BV1.R143). Only 'full' means anything
+    // at capture: 'quick' is the default (explicit or omitted — no grade row
+    // either way, the R140 absence-is-quick design), and 'spark' is REFUSED
+    // here because sparking is the author's later, deliberate act on an
+    // EXISTING quick idea (R144's surface) — an idea does not arrive pre-marked.
+    const grade = body.grade ?? null;
+    if (grade !== null && grade !== 'quick' && grade !== 'full') {
+      return res.fail('bad_grade_at_capture', 400, {
+        grade, allowed: ['quick', 'full'],
+        reason: "capture accepts grade 'quick' (the default) or 'full'; a spark is made from an existing idea, not captured as one.",
+      });
+    }
+    const templateKey = body.template_key ?? undefined;
+    if (grade === 'full') {
+      // Validate BEFORE any write, so a bad payload is a named 400 and no
+      // orphan idea lands. Each error carries { field, reason } — the
+      // "clear error naming the missing field" the task's done-when demands.
+      //
+      // WRAPPED IN try/catch as defence in depth. templateFor's own-property
+      // guard already keeps validateFieldValues from throwing on a hostile
+      // template_key (the R143 grader's blocker), but this validation runs
+      // OUTSIDE the capture try/catch below, so a future consumer that
+      // reintroduces a throw would again escape as an unhandled rejection and
+      // crash the process. Catching here means the boundary holds regardless:
+      // a validator that throws is a 400, never a downed server.
+      let v;
+      try {
+        v = validateFieldValues(body.field_values ?? {}, templateKey ? { templateKey } : undefined);
+      } catch (validationErr) {
+        console.error('[gds] POST /inbox field-values validation threw:', validationErr);
+        return res.fail('invalid_field_values', 400, { errors: [{ field: null, reason: 'unvalidatable' }], template_key: templateKey ?? null });
+      }
+      if (!v.ok) return res.fail('invalid_field_values', 400, { errors: v.errors, template_key: templateKey ?? null });
+    }
     try {
       const idea = await inbox.captureIdea({
         title: body.title,
@@ -59,8 +103,30 @@ module.exports = function buildInboxRouter() {
         suggestedPriority: body.suggested_priority ?? null,
         capturedBy: req.builder.id,
       });
+      let grade_warning;
+      if (grade === 'full') {
+        // The idea is captured; from here every failure is FAIL-OPEN (the
+        // task's contract: a scoring/grading hiccup never blocks capture —
+        // the idea still lands, as quick, with a named warning).
+        try {
+          // completenessScore never throws (R142's contract) — null = unscorable.
+          const row = await inbox.setIdeaGrade(idea.id, {
+            grade: 'full',
+            ...(templateKey ? { templateKey } : {}),
+            fieldValues: body.field_values,
+            completenessScore: completenessScore(body.field_values, templateKey ? { templateKey } : undefined),
+          });
+          idea.grade = row.grade;
+          idea.template_key = row.template_key;
+          idea.field_values = row.field_values;
+          idea.completeness_score = row.completeness_score;
+        } catch (gradeErr) {
+          console.error('[gds] POST /inbox full-grade write failed (idea captured, landing as quick):', gradeErr);
+          grade_warning = 'captured_but_ungraded';
+        }
+      }
       const open_count = await inbox.countOpenIdeas({ viewerRank: req.builder?.rank ?? null });
-      res.status(201).json({ idea, open_count, kind_auto: !body.kind });
+      res.status(201).json({ idea, open_count, kind_auto: !body.kind, ...(grade_warning ? { grade_warning } : {}) });
     } catch (err) {
       if (err && err.code) {
         const status =

package/modules/ideas/templates.js

@@ -74,7 +74,21 @@ if (BASE_TEMPLATE.key !== DEFAULT_TEMPLATE_KEY) {
 // whether that is a 400 (capture) or a render-as-raw fallback (display).
 function templateFor(key, registry = BUILTIN_TEMPLATES) {
   if (typeof key !== 'string' || !key) return null;
-  return registry[key] || null;
+  // OWN-PROPERTY LOOKUP, never a bare `registry[key]`. `template_key` is
+  // attacker-controlled at capture (POST /inbox, R143) and only length-checked,
+  // so a key like 'constructor' / '__proto__' / 'toString' would otherwise
+  // resolve up the prototype chain to an Object.prototype member — a truthy
+  // non-template whose `.fields` is undefined, and fieldOrder(template) then
+  // throws a synchronous TypeError from inside the pure validator, OUTSIDE the
+  // route's try/catch → an unhandled rejection that crashes the process. One
+  // authenticated request, any rank. Object.hasOwn confines resolution to keys
+  // the registry actually declares. (Found by the R143 grader.)
+  if (!Object.hasOwn(registry, key)) return null;
+  const t = registry[key];
+  // Defence in depth: even an own key must resolve to a real template shape
+  // before any consumer reads `.fields`. A malformed entry is a null, never a
+  // throw.
+  return t && Array.isArray(t.fields) ? t : null;
 }
 
 // The one legal source of field display order (see header). Returns key order

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.163",
+  "version": "1.19.165",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.19.163",
+      "version": "1.19.165",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.163",
+  "version": "1.19.165",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/scripts/gds/seed-bv1-privacy-invites-tasks.js

@@ -0,0 +1,133 @@
+// Seed the privacy-model + invite-inbox build tasks the 1002785 spike scoped,
+// under goal 1000045 "Public builder profiles" (BONGOS-V1, internal).
+//
+// Source of truth: docs/specs/bongos-v1-privacy-and-invites.md (owner-signed
+// 2026-08-16 on the sliver + expiry decisions). Idempotent on source_ref
+// bv1-privacy-PVnn; safe to re-run. PV4 stays backlog deliberately — its
+// instance-invite half attaches to the console wave's R2/R6 (spike 1002786),
+// which seeds into its own goal; only PV6 is promoted (fully independent).
+//
+// Run: node scripts/gds/seed-bv1-privacy-invites-tasks.js
+
+const { apiCall } = require('./cli-lib');
+
+const VER = 'BONGOS-V1';
+const GOAL = 1000045;
+const SRC = 'planning-session';
+const SPEC = 'docs/specs/bongos-v1-privacy-and-invites.md';
+
+// Existing tasks referenced by id (seed-bv1-profiles-tasks.js).
+const R02 = 1002278, R03 = 1002279;
+
+const sleep = (ms) => new Promise((r) => setTimeout(r, ms));
+
+// Throttled + 429-aware wrapper (same shape as the sibling seeders).
+async function api(method, path, body, _tries = 0) {
+  await sleep(1500);
+  const r = await apiCall(method, `/api/gds${path}`, body);
+  if (r.status === 429 && _tries < 8) {
+    const wait = (r.data?.error?.details?.retry_after_seconds || 30) + 1;
+    console.log(`  …rate-limited, waiting ${wait}s`);
+    await sleep(wait * 1000);
+    return api(method, path, body, _tries + 1);
+  }
+  return r;
+}
+
+const NEW_TASKS = [
+  {
+    ref: 'PV1', kind: 'feature', prio: 3, est: 120, crit: ['C2'], deps: [R03],
+    title: 'Privacy flags: account_visibility + recruiter_discoverable on platform accounts',
+    desc: `Add account_visibility ('public'|'private', default 'public') and recruiter_discoverable (boolean NULL — tri-state; effective = COALESCE(flag, visibility='public')) to platform_identity_accounts via an additive platform_identity_* migration. Extend the own-scoped PATCH write path task ${R03} (R03) establishes for hide_stats to cover both, and add the two settings rows to the profile rail (coordinate P04, task 1002800). The discoverable toggle's copy must state exactly what it grants: the D3 sliver (name, disciplines, active-recently), name-only if stats are hidden. Model + defaults: ${SPEC} D1.`,
+  },
+  {
+    ref: 'PV2', kind: 'feature', prio: 3, est: 180, crit: ['C1', 'C2'], deps: [R02],
+    title: 'Effective-visibility enforcement: one shared predicate across every public read',
+    desc: `One helper (SQL predicate + port function, the ADR 0171 D2 "enforced next to the data" pattern) that every public surface uses: /u/<handle> returns 404 (never 403) for private accounts TO EVERYONE INCLUDING SELF on the public read (the page renders self-view via the own-scope side door instead — D2's viewer-independence reconciliation); private accounts absent from search, leaderboards, sitemap; the rollup predicate extends profile_state='active' AND NOT hide_stats with visibility. No surface writes its own variant — drift here is a privacy leak. Matrix: ${SPEC} D2. Also depends on PV1 (bv1-privacy-PV1).`,
+  },
+  {
+    ref: 'PV3', kind: 'feature', prio: 3, est: 120, crit: ['C2', 'C5'], deps: [],
+    title: 'getRecruiterSliver port + recruiting-surface gating (the pre-accept boundary)',
+    desc: `The owner-signed D3 sliver: handle, display name, avatar, disciplines union, active-in-last-30-days boolean — nothing else, name-only when hide_stats is true, never for provisional accounts, never a profile-page link. Authorization-scoped port getRecruiterSliver(githubId) beside getPublicProfileExtras, whitelist-shaped inside platform-identity, its own planted-sentinel leak test (tests/profile_route.mjs pattern), route-gated by project.recruit (the console wave's atom — coordinate spike 1002786 R3). Depends on PV1+PV2 (bv1-privacy-PV1/PV2). Boundary: ${SPEC} D3.`,
+  },
+  {
+    ref: 'PV4', kind: 'feature', prio: 3, est: 120, crit: ['C3'], deps: [],
+    title: 'Invite lifecycle: 30-day read-time expiry, seen_at, decline closes the door',
+    desc: `Owner-signed: a recruit invite's pre-approved sign-in door expires 30 days after creation, enforced READ-TIME (the sign-in gate's invited-check + every queue view compute created_at + 30 days; no sweeper). seen_at lands on the hub notification row (set on first inbox render) and on goal_membership_requests for parity (goal invites get NO expiry — not an admission door). Decline in the inbox relays a door-close to the instance (invite row → dismissed) so no declined invite leaves a live door. COORDINATION: the invite storage itself is the console wave's R2 (access_requests kind='invite') and rescind-cleans-both-sides is its R6 (spike 1002786) — this task lands the states on whatever R2/R6 ship, which is why it stays backlog until that wave seeds. Lifecycle: ${SPEC} D4.`,
+  },
+  {
+    ref: 'PV5', kind: 'feature', prio: 3, est: 90, crit: ['C3'], deps: [],
+    title: 'Hub inbox project slice: recruit invites in the attention card',
+    desc: `A project slice in the EXISTING attention card (goal-inbox.js slice pattern + window.OTBAttention.refresh()), on the hub hall + apex home, fed by the existing GET /my-projects/invites. Accept = "open <project> — sign in" link (clicking through IS acceptance, console D2); Decline = the PV4 door-close path. No parallel inbox; federated instances' halls link out only (V1). Notification path IS the inbox — SSE/email explicitly deferred. Depends on PV4 (bv1-privacy-PV4). Shape: ${SPEC} D5.`,
+  },
+  {
+    ref: 'PV6', kind: 'feature', prio: 4, est: 90, crit: [], deps: [], ready: true,
+    title: 'Private goals: accepting_requests toggle + owner rescind-pending-invite route',
+    desc: `goals.accepting_requests boolean default true — a private goal with it false refuses join-requests with honest copy ("this goal isn't taking requests right now"); invitations unaffected; UI shows the toggle only on private goals. Plus the missing half of core_188's 'cancelled' state: an owner/manager route to rescind a PENDING invitation (only requester-withdraw exists today — modules/lifecycle/routes/goals.js). Design: ${SPEC} D6.`,
+  },
+  {
+    ref: 'PV7', kind: 'feature', prio: 3, est: 90, crit: ['C4'], deps: [],
+    title: 'Applications carry the applicant profile: note through the relay, live render in the queue',
+    desc: `One rule, no new disclosure class: the reviewer sees what the applicant's profile rules would show them + the applicant's note, evaluated LIVE at review time (never a snapshot — hide takes effect on next render, C2). Public account → public profile view; private account → the D3 sliver (the apply UI states "your application shares: …"). Plumbing: POST /my-projects/join gains an applicant-supplied note (capped ~500 chars, sanitized; replaces the hardcoded 'via platform My Projects'), and the reviewer queue (console R4's page — spike 1002786) resolves the profile from the hub at render. Depends on PV3 (bv1-privacy-PV3). Rule: ${SPEC} D7.`,
+  },
+  {
+    ref: 'PV8', kind: 'verify', prio: 3, est: 60, crit: ['C2'], deps: [],
+    title: 'PROOF: the privacy matrix as a test',
+    desc: `The D2 matrix, asserted: a private account's /u/<handle> public read 404s to a stranger AND to its own authenticated session (the page self-view comes from the own-scope endpoint — assert both halves, this is P10 task 1002806 sharpened); hidden stats never appear in any response (planted sentinels); the recruiter sliver is exactly D3's shape (leak test on the port); an expired invite refuses sign-in; a declined invite's door is closed instance-side. Depends on PV2+PV3+PV4 (bv1-privacy-PV2/PV3/PV4). Matrix: ${SPEC} D2.`,
+  },
+];
+
+(async () => {
+  console.log(`Seeding privacy+invites tasks under goal ${GOAL} (${VER})…`);
+  const idByRef = {};
+  let created = 0, existing = 0;
+
+  for (const t of NEW_TASKS) {
+    const r = await api('POST', '/tasks', {
+      version_id: VER,
+      goal_id: GOAL,
+      title: t.title,
+      description: t.desc,
+      kind: t.kind,
+      discipline: 'engineer',
+      priority: t.prio,
+      est_minutes: t.est,
+      criterion_ids: t.crit,
+      source: SRC,
+      source_ref: `bv1-privacy-${t.ref}`,
+    });
+    if (!r.ok) { console.log(`  ${t.ref}: FAILED ${r.status} ${JSON.stringify(r.data)}`); continue; }
+    const task = r.data.task || r.data;
+    idByRef[t.ref] = Number(task.id);
+    if (r.data.idempotent || r.data.existing) existing++; else created++;
+    console.log(`  ${t.ref} → task ${task.id} (${t.kind}, P${t.prio})`);
+  }
+
+  console.log('Wiring dependencies…');
+  const DEP_SETS = [
+    ['PV1', [R03]],
+    ['PV2', [R02, idByRef.PV1]],
+    ['PV3', [idByRef.PV1, idByRef.PV2]],
+    ['PV5', [idByRef.PV4]],
+    ['PV7', [idByRef.PV3]],
+    ['PV8', [idByRef.PV2, idByRef.PV3, idByRef.PV4]],
+  ];
+  for (const [ref, deps] of DEP_SETS) {
+    const id = idByRef[ref];
+    const clean = deps.filter(Boolean);
+    if (!id || !clean.length) continue;
+    const r = await api('PUT', `/tasks/${id}/dependencies`, { depends_on_task_ids: clean });
+    console.log(`  ${ref} (task ${id}) depends on [${clean.join(', ')}]: ${r.ok ? 'ok' : 'FAILED ' + r.status + ' ' + JSON.stringify(r.data).slice(0, 160)}`);
+  }
+
+  console.log('Promoting the independent root…');
+  for (const t of NEW_TASKS.filter((x) => x.ready)) {
+    const id = idByRef[t.ref];
+    if (!id) continue;
+    const r = await api('POST', `/tasks/${id}/promote`, {});
+    console.log(`  ${t.ref} (task ${id}): ${r.ok ? 'ready' : 'promote note ' + JSON.stringify(r.data).slice(0, 120)}`);
+  }
+
+  console.log(`\nDONE. created=${created} existing=${existing}.`);
+  console.log('ref→id:', JSON.stringify(idByRef));
+})();

package/src/module-api.js

@@ -753,8 +753,12 @@ const { validateOrRespond, LIMITS, parseId, asyncHandler, corsPublicGet, parsePa
 //         landed since 1.19.161 with no explicit bump. run 31959496815. (task 1002620)
 //   1.19.163 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
 //         landed since 1.19.162 with no explicit bump. run 31959864781. (task 1002620)
+//   1.19.164 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+//         landed since 1.19.163 with no explicit bump. run 31960518012. (task 1002620)
+//   1.19.165 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+//         landed since 1.19.164 with no explicit bump. run 31960929146. (task 1002620)
 // ---------------------------------------------------------------------------
-const CORE_VERSION = '1.19.163'; // CI auto-patch carrier (ADR 0161); see changelog above
+const CORE_VERSION = '1.19.165'; // CI auto-patch carrier (ADR 0161); see changelog above
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('dev-box'); log.info('mounted');

package/tests/idea_full_capture.mjs

@@ -0,0 +1,146 @@
+// tests/idea_full_capture.mjs
+//
+// task 1002919 (BV1.R143, goal 1000062) — POST /inbox accepts a Full Idea.
+//
+// The done-when, as assertions: a Full Idea round-trips with its fields and
+// score intact; an invalid field set is a 400 NAMING the field, refused BEFORE
+// any write; a grade-write failure never blocks capture (fail-open: the idea
+// lands as quick with a named warning); 'spark' is refused at capture (sparking
+// is R144's act on an EXISTING idea); and the quick path stays byte-identical
+// (the deep version of that lives in tests/idea_quick_guard.mjs).
+//
+// DB-free the idea_grades.mjs way (pool.query patched on the doorway before the
+// modules load), driving the REAL route handler through a stub req/res — the
+// same validator, the same error map a client sees.
+//
+// Run:  node tests/idea_full_capture.mjs
+
+import { strict as assert } from 'node:assert';
+import { createRequire } from 'node:module';
+
+const require = createRequire(import.meta.url);
+const api = require('../src/module-api.js');
+
+let queries = [];
+let failNextGradeWrite = false;
+api.pool.query = async (sql, params = []) => {
+  queries.push({ sql, params });
+  if (/INSERT INTO ideas_grades/i.test(sql)) {
+    if (failNextGradeWrite) { failNextGradeWrite = false; throw new Error('synthetic grade-write outage'); }
+    return { rows: [{ idea_id: params[0], grade: params[1], template_key: params[2], field_values: JSON.parse(params[3]), completeness_score: params[4] }] };
+  }
+  if (/INSERT INTO idea_inbox/i.test(sql)) {
+    return { rows: [{ id: '77', title: params[0], status: 'open' }] };
+  }
+  if (/SELECT COUNT/i.test(sql) || /count/i.test(sql)) return { rows: [{ n: '3', count: '3' }] };
+  return { rows: [] };
+};
+
+const { BASE_TEMPLATE } = require('../modules/ideas/templates.js');
+const routesFactory = require('../modules/ideas/routes/inbox.js');
+
+// Pull the real POST /inbox handler off the mounted router.
+const router = routesFactory({});
+const layer = router.stack.find((l) => l.route && l.route.path === '/inbox' && l.route.methods.post);
+const handlers = layer.route.stack.map((s) => s.handle);
+const postInbox = handlers[handlers.length - 1]; // after requireBuilder
+
+function call(bodyIn) {
+  return new Promise((resolve) => {
+    const req = { body: bodyIn, builder: { id: '9', rank: 'metic' }, query: {} };
+    const res = {
+      statusCode: 200,
+      status(c) { this.statusCode = c; return this; },
+      json(payload) { resolve({ status: this.statusCode, payload }); },
+      fail(code, status, extra) {
+        const s = typeof status === 'number' ? status : (status && status.status) || 500;
+        resolve({ status: s, payload: { error: code, ...(extra || {}) } });
+      },
+    };
+    postInbox(req, res);
+  });
+}
+
+const FULL = Object.fromEntries(
+  BASE_TEMPLATE.fields.map((f) => [f.key, `A substantive answer for ${f.key}, long enough to clear the floor.`]),
+);
+
+let passed = 0;
+let failed = 0;
+async function test(name, fn) {
+  queries = [];
+  try { await fn(); passed++; console.log(`  ok  ${name}`); }
+  catch (err) { failed++; console.error(`  FAIL ${name}\n    ${err.message}`); }
+}
+
+await test('a Full Idea round-trips: 201 with grade, fields and score intact', async () => {
+  const r = await call({ title: 'a full idea', grade: 'full', field_values: FULL });
+  assert.equal(r.status, 201);
+  assert.equal(r.payload.idea.grade, 'full');
+  assert.deepEqual(r.payload.idea.field_values, FULL);
+  assert.equal(r.payload.idea.completeness_score, 100, 'scored via R142 at capture');
+  assert.ok(queries.some((q) => /INSERT INTO idea_inbox/i.test(q.sql)));
+  assert.ok(queries.some((q) => /INSERT INTO ideas_grades/i.test(q.sql)));
+});
+
+await test('an invalid field set is a 400 naming the field — and NOTHING is written', async () => {
+  const r = await call({ title: 'bad full', grade: 'full', field_values: { ...FULL, rogue: 'x' } });
+  assert.equal(r.status, 400);
+  assert.equal(r.payload.error, 'invalid_field_values');
+  assert.deepEqual(r.payload.errors, [{ field: 'rogue', reason: 'unknown_field' }]);
+  assert.equal(queries.length, 0, 'refused before any write — no orphan idea');
+});
+
+await test('a missing required field is named the same way', async () => {
+  const { fit, ...four } = FULL;
+  const r = await call({ title: 'incomplete full', grade: 'full', field_values: four });
+  assert.equal(r.status, 400);
+  assert.ok(r.payload.errors.some((e) => e.field === 'fit' && e.reason === 'missing_required'));
+});
+
+await test("'spark' is refused at capture — sparking is an act on an existing idea (R144)", async () => {
+  const r = await call({ title: 'pre-marked?', grade: 'spark' });
+  assert.equal(r.status, 400);
+  assert.equal(r.payload.error, 'bad_grade_at_capture');
+  assert.deepEqual(r.payload.allowed, ['quick', 'full']);
+  assert.equal(queries.length, 0);
+});
+
+await test('a grade-write failure never blocks capture: idea lands, named warning returned', async () => {
+  failNextGradeWrite = true;
+  const r = await call({ title: 'resilient full', grade: 'full', field_values: FULL });
+  assert.equal(r.status, 201, 'the capture still succeeds');
+  assert.equal(r.payload.grade_warning, 'captured_but_ungraded');
+  assert.ok(queries.some((q) => /INSERT INTO idea_inbox/i.test(q.sql)), 'the idea landed');
+});
+
+await test('the quick path is untouched: a bare capture writes idea_inbox only', async () => {
+  const r = await call({ title: 'just a thought' });
+  assert.equal(r.status, 201);
+  // since R140 every new idea reads grade='quick' BY DEFINITION (the absence
+  // design) — what the guard forbids is a grade-table statement, not the label
+  assert.equal(r.payload.idea.grade, 'quick');
+  assert.ok(!queries.some((q) => /ideas_grades/i.test(q.sql)), 'zero grade statements');
+});
+
+await test("an explicit grade:'quick' is the same no-op quick capture", async () => {
+  const r = await call({ title: 'explicitly quick', grade: 'quick' });
+  assert.equal(r.status, 201);
+  assert.ok(!queries.some((q) => /ideas_grades/i.test(q.sql)));
+});
+
+await test('SECURITY (R143 grader blocker): a hostile template_key is a 400, the process survives', async () => {
+  // The exact crash the grader found: template_key:'constructor' with grade:full.
+  // Pre-fix this threw a synchronous TypeError out of the async handler (an
+  // unhandled rejection → process down). Now it is a clean 400 and NOTHING is
+  // written. Proven at the route layer, over the real handler.
+  for (const hostile of ['constructor', '__proto__', 'toString']) {
+    const r = await call({ title: 'attack', grade: 'full', field_values: FULL, template_key: hostile });
+    assert.equal(r.status, 400, `template_key='${hostile}' must be a 400, not a crash`);
+    assert.equal(r.payload.error, 'invalid_field_values');
+    assert.equal(queries.length, 0, 'refused before any write');
+  }
+});
+
+console.log(`\nidea_full_capture: ${passed} passed, ${failed} failed`);
+if (failed > 0) process.exit(1);

package/tests/idea_quick_guard.mjs

@@ -13,9 +13,10 @@
 //      title is the only requirement, and its INSERT touches idea_inbox alone:
 //      ZERO statements against ideas_grades. A quick idea is quick because no
 //      grade row exists (the R140 design), not because one was written.
-//   2. THE ROUTE SCHEMA — POST /inbox's validator declares exactly the pre-grade
-//      field set. No grade / template_key / field_values key exists in it, so no
-//      client is asked for (or may smuggle) grade-era input on the quick path.
+//   2. THE ROUTE SCHEMA — the five pre-grade keys survive and title stays the
+//      ONLY required field. (R143 later added grade-era keys as OPTIONALS —
+//      the promise was never "the schema can't grow", it is "no new REQUIRED
+//      field appears on the quick path".)
 //   3. THE READ — an idea with no grade row reads back grade='quick' with null
 //      template/score, via the LEFT JOIN + COALESCE (idea_grades.mjs owns the
 //      deep version of this; here it is asserted once as part of the contract).
@@ -97,15 +98,18 @@ await test('capture: the title requirement is the SAME refusal it always was', a
 
 // ── 2. the route schema ─────────────────────────────────────────────────────
 
-await test('POST /inbox declares the pre-grade field set — nothing grade-era, nothing newly required', () => {
+await test('POST /inbox: the pre-grade fields survive and title stays the ONLY requirement', () => {
+  // R143 legitimately added grade / template_key / field_values as OPTIONAL
+  // keys — the promise this guard protects (R150's done-when) was never "the
+  // schema can't grow", it is "no new REQUIRED field appears on the quick
+  // path". So the pin is: the five original keys remain, and required is
+  // exactly ['title'] — a grade-era key turning required fails here by name.
   const src = fs.readFileSync(path.join(__dirname, '..', 'modules', 'ideas', 'routes', 'inbox.js'), 'utf8');
   const post = src.slice(src.indexOf("router.post('/inbox'"), src.indexOf('captureIdea('));
   const schema = post.slice(post.indexOf('{', post.indexOf('validateOrRespond')), post.indexOf('})') + 1);
   for (const key of ['title', 'body_md', 'kind', 'suggested_version', 'suggested_priority']) {
     assert.ok(schema.includes(key), `the quick path still accepts ${key}`);
   }
-  assert.doesNotMatch(schema, /grade|template|field_values|completeness/,
-    'no grade-era key in the quick capture schema');
   const required = [...schema.matchAll(/(\w+):\s*\{[^}]*required:\s*true/g)].map((m) => m[1]);
   assert.deepEqual(required, ['title'], 'title is the ONLY required field, as it always was');
 });

package/tests/idea_templates.mjs

@@ -62,6 +62,22 @@ test('templateFor: base key resolves, unknown/blank/non-string do not', () => {
   assert.equal(T.templateFor(null), null);
 });
 
+test('SECURITY (R143 grader blocker): a prototype-chain key resolves to null, never a crash', () => {
+  // template_key is attacker-controlled at capture and only length-checked, so
+  // a bare registry[key] would resolve 'constructor' / '__proto__' / 'toString'
+  // up the prototype chain to a truthy Object.prototype member — a non-template
+  // whose .fields is undefined — and validateFieldValues would then throw a
+  // synchronous TypeError, crashing the process. Own-property lookup returns
+  // null for every one of these, and the validator path stays a clean refusal.
+  for (const hostile of ['constructor', '__proto__', 'toString', 'valueOf', 'hasOwnProperty', 'isPrototypeOf']) {
+    assert.equal(T.templateFor(hostile), null, `templateFor('${hostile}') must be null`);
+    assert.doesNotThrow(() => T.validateFieldValues({}, { templateKey: hostile }),
+      `validateFieldValues must not throw on template_key='${hostile}'`);
+    assert.deepEqual(T.validateFieldValues({}, { templateKey: hostile }).errors,
+      [{ field: null, reason: 'unknown_template' }]);
+  }
+});
+
 // ── validation follows the declaration ──────────────────────────────────────
 
 test('a complete five-field payload validates', () => {