@bongos/core 1.19.274 → 1.19.275

package/.bongos-core.json

@@ -2,22 +2,22 @@
   "artifact": "bongos-core",
   "manifest_schema": 1,
   "generator": "scripts/gds/package-core.js",
-  "core_version": "1.19.274",
-  "core_contract": "1.19.274",
-  "source_commit": "ec41b43ba6a9b1e32db2d3e4b5eeac6361fdb290",
+  "core_version": "1.19.275",
+  "core_contract": "1.19.275",
+  "source_commit": "0f1493b2557fe16041d30d15fb064fc7c15448d0",
   "source_ref": "HEAD",
-  "built_at": "2026-08-21T14:03:13.782Z",
+  "built_at": "2026-08-21T14:30:08.138Z",
   "redaction": {
     "model": "docs-redacted+functional-verbatim",
     "docs_redacted": 318,
     "agent_docs_stubbed": 22,
-    "functional_verbatim": 1372,
+    "functional_verbatim": 1374,
     "rules": 3,
     "gate_literals": 3,
     "gate": "passed"
   },
-  "file_count": 1712,
-  "tree_sha256": "55fc345705cf2b709b62edc5c43cc5a18b8ff6b3641f592a9cf5183904f8db3b",
+  "file_count": 1714,
+  "tree_sha256": "4f04f6243896e821ad5b920694493985f5a485aaf9684204a398105333baadb3",
   "files": [
     {
       "path": ".claude/skills/blocker-review/SKILL.md",
@@ -367,7 +367,7 @@
     {
       "path": "clients/bongos-client/index.d.ts",
       "mode": "0000644",
-      "sha256": "96bbd222f3ccbc2d57bce28e0ac89584252b0e3213bc79f5c8aad54ce10cc845"
+      "sha256": "d78827e8ec5ad4e27dfd5b0ad33fd3a9e9ef48f3fa62f28320374ba7fcc78422"
     },
     {
       "path": "clients/bongos-client/index.mjs",
@@ -1397,12 +1397,12 @@
     {
       "path": "docs/api-reference.md",
       "mode": "0000644",
-      "sha256": "3eb89e224eea00629fb69752c7606e9ffed34171ab16fcb82120e030e5db8476"
+      "sha256": "da411a477344816c800f05b84740517a14394c9cbcf985a03ef7d4c178f55161"
     },
     {
       "path": "docs/api/openapi.json",
       "mode": "0000644",
-      "sha256": "2f14ac090adc4b7de69f20948172cee0cf002e1224262d5a51ddcada95ad9489"
+      "sha256": "09784dfef8f31071e4611374c3fc592793d0194492ac51896974debbcfecdeec"
     },
     {
       "path": "docs/architecture.md",
@@ -3682,7 +3682,7 @@
     {
       "path": "modules/ideas/inbox.js",
       "mode": "0000644",
-      "sha256": "082e2598eec5645a84182d0b56f6e2ba9917d54c0af81bea3196d531099d4249"
+      "sha256": "e132a1ebab662aba91113f8bfe60c7df6a8818f4d3743b5819903904fdef52fb"
     },
     {
       "path": "modules/ideas/migrations/ideas_001_grades.sql",
@@ -3712,7 +3712,12 @@
     {
       "path": "modules/ideas/routes/inbox.js",
       "mode": "0000644",
-      "sha256": "f19fa968ad6fd08b65931039ecf3b8d4b31b1aabef56b42f62cd1a4fbd06328e"
+      "sha256": "f4f1003c7cdc0d103fb052f1dc50b76291362b53ddd6b76b561c6d872d2d7a91"
+    },
+    {
+      "path": "modules/ideas/routing.js",
+      "mode": "0000644",
+      "sha256": "25ecd991b874353b757fcd9b8773d6135a76af37f699c4f854c66e196caf06f0"
     },
     {
       "path": "modules/ideas/templates.js",
@@ -3742,7 +3747,7 @@
     {
       "path": "modules/lifecycle/db.js",
       "mode": "0000644",
-      "sha256": "b35b53b3badf7f465fe97d317cd32653518f14d98a76a03b18374c49b31db65a"
+      "sha256": "64cdde411e3fb8d1263eebf9093a353dde6ee684be2977057c8800e608b52a63"
     },
     {
       "path": "modules/lifecycle/done-when.js",
@@ -4477,12 +4482,12 @@
     {
       "path": "package-lock.json",
       "mode": "0000644",
-      "sha256": "2aa1f6741a57aabd4570045588e71afbc04bd100b19fefed328dad581d9bb4f6"
+      "sha256": "eb3ac31abdc6eef09c4a19ddca7e03320280e889792f4ccbf09004695225b8a6"
     },
     {
       "path": "package.json",
       "mode": "0000644",
-      "sha256": "edcbca0acb725c24414c2234cc1063d98913867b5ecb0f659e1b58e61e1d6a42"
+      "sha256": "f6d4dd4520d0b22fd2c0effa16c1aea034cb8e32a0520f11c27eb7b5461b4d73"
     },
     {
       "path": "public-docs/index.html",
@@ -6127,7 +6132,7 @@
     {
       "path": "src/module-api.js",
       "mode": "0000644",
-      "sha256": "f94e654fd2e4491e44dcec5ac26e4bf97f9a430bdade551f6fd243d3dee005ef"
+      "sha256": "ebdca46e67df3c28972e28e78a20bf3fb6a88d96c9763cd502e29a6e7573d545"
     },
     {
       "path": "src/module-loader/catalog.js",
@@ -7409,6 +7414,11 @@
       "mode": "0000644",
       "sha256": "51e1286235cbde1b56188f29b0e2bd12ac73a9637dbf1c16b325f10147256f27"
     },
+    {
+      "path": "tests/idea_routing.mjs",
+      "mode": "0000644",
+      "sha256": "3ba1fba0951121f23aa073b886f532dc30e0ed863c2a097db019320f70856118"
+    },
     {
       "path": "tests/idea_task_lineage.mjs",
       "mode": "0000644",

package/clients/bongos-client/index.d.ts

@@ -244,7 +244,7 @@ export interface PostGovernmentRanksRequest { rank_key: string; label: string; d
 export interface PostGovernmentRanksResponse { rank: unknown }
 export interface PostInboxIdRatifyRequest { notes_md?: string }
 export interface PostInboxIdResubmitRequest { field_values: Record<string, unknown>; template_key?: string }
-export interface PostInboxRequest { title: string; body_md?: string; kind?: string; suggested_version?: string; suggested_priority?: number; grade?: string; template_key?: string; field_values?: Record<string, unknown> }
+export interface PostInboxRequest { title: string; body_md?: string; kind?: string; suggested_version?: string; suggested_priority?: number; goal_id?: number; grade?: string; template_key?: string; field_values?: Record<string, unknown> }
 export interface PostLearningsRequest { title: string; body_md: string; tags?: string[]; related_files?: string[]; source?: string; source_ref?: string; task_id?: number }
 export interface PostLearningsResponse { skipped?: boolean; reason?: unknown; learning?: unknown }
 export interface PostLlmCacheLookupRequest { cache_key?: unknown; tokens_saved_est?: unknown }

package/docs/api/openapi.json

@@ -16610,6 +16610,10 @@
             "minimum": 0,
             "maximum": 100
           },
+          "goal_id": {
+            "type": "integer",
+            "minimum": 1
+          },
           "grade": {
             "type": "string",
             "maxLength": 16

package/docs/api-reference.md

@@ -260,7 +260,7 @@ Base path: `/api/bongos`. Ranks (enforced server-side, [ADR 0016](adr/<redacted>
 | Method | Path | Rank | Body | Description |
 |---|---|---|---|---|
 | GET | `/api/bongos/inbox` | `any-builder` | — | read open ideas; skill-friction rows filtered by viewer rank. |
-| POST | `/api/bongos/inbox` | `any-builder` | `title`, `body_md`, `kind`, `suggested_version`, `suggested_priority`, `grade`, `template_key`, `field_values` | for ordinary ideas; metic+ for kind='criterion-proposal'. |
+| POST | `/api/bongos/inbox` | `any-builder` | `title`, `body_md`, `kind`, `suggested_version`, `suggested_priority`, `goal_id`, `grade`, `template_key`, `field_values` | for ordinary ideas; metic+ for kind='criterion-proposal'. |
 | GET | `/api/bongos/inbox/:id` | `any-builder` | — | single idea read for the "#NNN" deep-link resolver (task 1047). |
 | PATCH | `/api/bongos/inbox/:id` | `metic+archon` | `status`, `kind`, `promoted_to_task_id`, `reviewed_at`, `merged_into_idea_id`, `triage_note` | Metic+ (task 360 / ADR 0018): idea triage (promote/discard/merge) shapes the backlog. |
 | POST | `/api/bongos/inbox/:id/ratify` | `metic+archon` | `notes_md` | V3.R31 (task 252) — Archon ratifies a criterion-proposal idea, atomically: - INSERT done_when_criteria row on the target version - UPDATE… |

package/modules/ideas/inbox.js

@@ -15,7 +15,11 @@
 // the shared pool through the published doorway (src/module-api.js — the only
 // core file a module may require, ADR 0083). OTB byte-identical.
 
-const { pool } = require('../../src/module-api');
+const api = require('../../src/module-api');
+const { pool } = api;
+// The landing matrix (task 1003065, BV1.R01) — pure, DB-free, its own file so
+// every cell is unit-testable without a Postgres. See ./routing.js.
+const { decideLanding, routedPriority } = require('./routing');
 
 const VALID_KINDS = [
   'feature',
@@ -48,6 +52,13 @@ const IDEA_COL_NAMES = [
   'id', 'title', 'body_md', 'kind', 'suggested_version', 'suggested_priority',
   'captured_at', 'captured_by', 'status', 'promoted_to_task_id', 'reviewed_at',
   'merged_into_idea_id', 'triage_note',
+  // core_222 (task 1003060, BV1.R02): the routing HINT — "this probably belongs
+  // to goal N" — on a row that did NOT convert. Added to the shared list because
+  // R02 shipped the column and nothing read it: /idea-triage (R13) cannot walk
+  // homeless-only work if the read that feeds it never returns the hint. Strictly
+  // advisory: no rank check, no scope wall, and no payout may read it (see the
+  // migration's own header). The BINDING home for "which goal" is tasks.goal_id.
+  'suggested_goal_id',
 ];
 const IDEA_COLS = IDEA_COL_NAMES.join(', ');
 const IDEA_COLS_Q = IDEA_COL_NAMES.map((c) => `i.${c}`).join(', ');
@@ -169,6 +180,41 @@ function classify(title, body = '') {
 // Capture
 // -------------------------------------------------------------------------
 
+// captureIdea — THE ONE CAPTURE CHOKEPOINT, and since task 1003065 (BV1.R01,
+// goal 1000071) also the routing one.
+//
+// WHY ROUTING LIVES HERE AND NOT IN A NEW SIBLING FUNCTION. Every filing vector
+// already funnels through this call — the hall, `capture.js`, the Discord #ideas
+// inbound (via the `ideas.capture` port), agents, seeds. Putting the conversion
+// here means all of them inherit routing by passing ONE new argument, and none of
+// them can acquire a second, attribution-free path to a task. A `captureAndRoute`
+// sibling would have been the same code with an invitation to bypass it.
+//
+// TWO SHAPES, ONE ENTRY POINT:
+//   * goalId absent, or the matrix says don't route  → EXACTLY today's behaviour:
+//     one INSERT, status='open', the idea sits in the inbox. A named-but-unrouted
+//     goal is kept as the core_222 `suggested_goal_id` HINT so /idea-triage (R13)
+//     inherits the guess instead of re-deriving it.
+//   * the matrix says route → ONE TRANSACTION writes the idea row (status
+//     'promoted'), the task (in the goal, at the matrix's status), and the
+//     ideas_task_lineage row (origin='route').
+//
+// THE TRANSACTION IS THE POINT, not an optimisation. This goal exists because
+// Discord #bugs creates tasks DIRECTLY — no captured_by, no lineage — so the
+// ideator-credit lane (goal 1000067) has nothing to pay against. A route that
+// committed the task but lost the lineage row would manufacture exactly that
+// bug, at scale, on the path whose whole promise is that attribution survives
+// (criterion C3). So all three writes commit together or none do.
+//
+// `filerRank`/`grade` are READ-ONLY INPUTS TO THE DECISION. This function never
+// checks authority: the rank floor and the goal's scope wall are separate,
+// load-bearing server-side gates (R05). A caller lying about filerRank can move a
+// bug from 'backlog' to 'ready' and nothing else — which is why R06's abuse matrix
+// tests the route, not this function.
+//
+// `deps` carries the #538 test seam (`deps.pool`, NODE_ENV==='test' only) so the
+// whole transaction is drivable by a SQL-aware fake client with no live Postgres
+// (tests/idea_routing.mjs).
 async function captureIdea({
   title,
   bodyMd = '',
@@ -176,7 +222,12 @@ async function captureIdea({
   suggestedVersion = null,
   suggestedPriority = null,
   capturedBy = null,
-}) {
+  // task 1003065 (BV1.R01) — the routing inputs. All three default to the
+  // pre-routing behaviour, so every existing caller is untouched.
+  goalId = null,
+  filerRank = null,
+  grade = null,
+}, deps = {}) {
   if (!title || typeof title !== 'string') {
     throw { code: 'TITLE_REQUIRED' };
   }
@@ -190,17 +241,184 @@ async function captureIdea({
   ) {
     throw { code: 'BAD_PRIORITY', priority: suggestedPriority };
   }
-  const { rows } = await pool.query(
+  const activePool = (deps.pool && process.env.NODE_ENV === 'test') ? deps.pool : pool;
+
+  // The decision, before any write. Pure — see ./routing.js.
+  const landing = decideLanding({ goalId, kind: resolvedKind, grade, filerRank });
+  if (landing.route) {
+    return routeIdeaToGoal({
+      title, bodyMd, resolvedKind, suggestedVersion, suggestedPriority,
+      capturedBy, goalId, landing,
+    }, activePool);
+  }
+
+  // NOT routed: the pre-routing path, plus the advisory hint. `suggested_goal_id`
+  // is written even when a goal WAS named — that is the whole reason the column
+  // exists (core_222): a Full Idea or a criterion-proposal that named a goal
+  // should carry the guess forward to triage rather than drop it on the floor.
+  const { rows } = await activePool.query(
     `INSERT INTO idea_inbox
-       (title, body_md, kind, suggested_version, suggested_priority, captured_by, status)
-     VALUES ($1, $2, $3, $4, $5, $6, 'open')
+       (title, body_md, kind, suggested_version, suggested_priority, captured_by, status,
+        suggested_goal_id)
+     VALUES ($1, $2, $3, $4, $5, $6, 'open',
+             $7)
      RETURNING ${IDEA_COLS}`,
-    [title, bodyMd, resolvedKind, suggestedVersion, suggestedPriority, capturedBy]
+    [title, bodyMd, resolvedKind, suggestedVersion, suggestedPriority, capturedBy,
+      goalId ?? null]
   );
   // A brand-new idea has no ideas_grades row, so it is quick by definition —
   // no join needed to know that. Grading it (R143's Full Idea capture) is a
   // separate setIdeaGrade write against the id this returns.
-  return rows[0] ? { ...ungradedProjection(), ...rows[0] } : rows[0];
+  const idea = rows[0] ? { ...ungradedProjection(), ...rows[0] } : rows[0];
+  // The reason is echoed so a caller (and the R15 sweep) can tell "no goal was
+  // named" from "a goal was named and the matrix declined it" without re-running
+  // the matrix. Non-enumerable would be cleaner but this row is JSON-serialised
+  // straight onto the 201 body, and the filer deserves to see why.
+  if (idea) idea.routing = { routed: false, reason: landing.reason };
+  return idea;
+}
+
+// routeIdeaToGoal — the ONE transaction behind a routed capture (task 1003065,
+// BV1.R01). Private: `captureIdea` is the only legal way in, so the matrix can
+// never be skipped.
+//
+// Order is forced by the foreign keys, not by preference: the lineage row
+// references BOTH the idea and the task, so the idea must exist before the task
+// (which carries no idea reference) and both before the lineage. That leaves
+// `promoted_to_task_id` unknowable at insert time, hence the second UPDATE —
+// the same two-step ratifyCriterionProposal takes.
+async function routeIdeaToGoal({
+  title, bodyMd, resolvedKind, suggestedVersion, suggestedPriority,
+  capturedBy, goalId, landing,
+}, activePool) {
+  const client = await activePool.connect();
+  try {
+    await client.query('BEGIN');
+
+    // a. The goal must be a REAL, LIVE HOME. All three checks are inside the
+    //    transaction and the row is locked FOR SHARE, so a goal cannot be
+    //    archived out from under a route that is mid-flight.
+    //
+    //    version status='building' is the load-bearing one, and it is the
+    //    1000771 failure this goal was filed over: Discord #bugs hardcoded a
+    //    SHIPPED version, so every reported bug landed in a shipped version's
+    //    catch-all where nobody would ever look again. A closed version cannot
+    //    receive new work — the route refuses rather than filing into a tomb.
+    const { rows: goalRows } = await client.query(
+      `SELECT g.id, g.status, g.version_id, v.status AS version_status
+         FROM goals g
+         JOIN versions v ON v.id = g.version_id
+        WHERE g.id = $1
+        FOR SHARE OF g`,
+      [goalId]
+    );
+    if (goalRows.length === 0) throw { code: 'GOAL_NOT_FOUND', goal_id: goalId };
+    const goal = goalRows[0];
+    if (goal.status !== 'open') {
+      throw { code: 'GOAL_NOT_OPEN', goal_id: goalId, status: goal.status };
+    }
+    if (goal.version_status !== 'building') {
+      throw {
+        code: 'VERSION_NOT_BUILDING',
+        goal_id: goalId,
+        version_id: goal.version_id,
+        version_status: goal.version_status,
+      };
+    }
+
+    // b. The idea row — 'promoted' from birth, because it WAS promoted, in this
+    //    same act. reviewed_at is stamped so the triage walk skips it: routing's
+    //    entire claim is that this row never needed a triage pass.
+    const { rows: ideaRows } = await client.query(
+      `INSERT INTO idea_inbox
+         (title, body_md, kind, suggested_version, suggested_priority, captured_by, status,
+          suggested_goal_id, reviewed_at)
+       VALUES ($1, $2, $3, $4, $5, $6, 'promoted',
+               $7, now())
+       RETURNING ${IDEA_COLS}`,
+      [title, bodyMd, resolvedKind, suggestedVersion, suggestedPriority, capturedBy,
+        goalId]
+    );
+    const idea = ideaRows[0];
+
+    // c. The task, through the `lifecycle` PORT — never an import of
+    //    modules/lifecycle/ (the one-way module rule, ADR 0083). Resolved at call
+    //    time; the port registers at boot. Passing `client` enlists the INSERT in
+    //    THIS transaction (the seam task 1003065 added to db.createTask).
+    //
+    //    The version is the GOAL'S, never a caller-supplied one, so
+    //    "goal belongs to the version" is true by construction rather than by
+    //    validation. (An idea's own `suggested_version` is kept on the idea row
+    //    as filed and does NOT override it — the goal is the binding home.) One
+    //    read stays outside this transaction by design: createTask's catch-all
+    //    goal fallback, which only runs when goalId is absent and so never on
+    //    this path.
+    //
+    //    What is deliberately NOT passed: `requiresRank` (createTask derives the
+    //    ADR 0084/0085 floor itself from touches + sensitivity, and an explicit
+    //    value could only raise it — a filer must not be able to lower a floor),
+    //    `creditsReward` (server default — createTask auto-assigns the capped
+    //    suggestion), and `discipline` (left 'unclassified', exactly as the other
+    //    non-authored create vectors leave it).
+    const lifecycle = api.resolveOptional && api.resolveOptional('lifecycle');
+    if (!lifecycle || !lifecycle.createTask) {
+      // A vanilla instance without the lifecycle module cannot hold tasks at all,
+      // so there is nothing to route INTO. Refuse loudly rather than silently
+      // degrading to an inbox row the caller was told became a task.
+      throw { code: 'LIFECYCLE_UNAVAILABLE' };
+    }
+    const task = await lifecycle.createTask({
+      versionId: goal.version_id,
+      title,
+      description: bodyMd,
+      status: landing.status,
+      kind: resolvedKind,
+      priority: routedPriority(suggestedPriority),
+      goalId: goal.id,
+      // The provenance pair the create-vector idempotency read keys on
+      // (db.findTaskBySourceRef): one idea can only ever mint one routed task.
+      source: 'idea-route',
+      sourceRef: `idea-${idea.id}`,
+    }, { client });
+
+    // d. The lineage row — origin='route' (ideas_003 widened the CHECK for
+    //    exactly this). THIS is the row goal 1000067's ideator credit will pay
+    //    against, and the reason all of this is one transaction.
+    await client.query(
+      `INSERT INTO ideas_task_lineage (task_id, idea_id, origin)
+       VALUES ($1, $2, 'route')
+       ON CONFLICT (task_id) DO UPDATE
+          SET idea_id = EXCLUDED.idea_id, origin = EXCLUDED.origin`,
+      [task.id, idea.id]
+    );
+
+    // e. Close the loop the FKs forced open in (b).
+    await client.query(
+      `UPDATE idea_inbox SET promoted_to_task_id = $2 WHERE id = $1`,
+      [idea.id, task.id]
+    );
+
+    await client.query('COMMIT');
+    return {
+      ...ungradedProjection(),
+      ...idea,
+      promoted_to_task_id: task.id,
+      routing: {
+        routed: true,
+        reason: landing.reason,
+        status: landing.status,
+        goal_id: goal.id,
+        version_id: goal.version_id,
+        task_id: task.id,
+      },
+      routed_task: task,
+    };
+  } catch (err) {
+    await client.query('ROLLBACK').catch(() => {});
+    throw err;
+  } finally {
+    client.release();
+  }
 }
 
 // -------------------------------------------------------------------------

package/modules/ideas/routes/inbox.js

@@ -46,6 +46,11 @@ module.exports = function buildInboxRouter() {
       kind: { type: 'string', maxLength: 64 },
       suggested_version: { type: 'string', maxLength: 64 },
       suggested_priority: { type: 'integer', min: 0, max: 100 },
+      // task 1003065 (BV1.R01, goal 1000071) — CAPTURE-TIME ROUTING. Naming a
+      // goal is what turns a filing into a task in that goal, in this one
+      // request. Optional by design: omit it and this endpoint behaves exactly
+      // as it did before routing existed.
+      goal_id: { type: 'integer', min: 1 },
       // Full Idea capture (R143) — ALL OPTIONAL: omitting every one of these is
       // exactly the pre-grade quick capture (tests/idea_quick_guard.mjs pins
       // that title stays the only required field).
@@ -102,6 +107,14 @@ module.exports = function buildInboxRouter() {
         suggestedVersion: body.suggested_version ?? null,
         suggestedPriority: body.suggested_priority ?? null,
         capturedBy: req.builder.id,
+        // task 1003065 (BV1.R01): the routing inputs. The rank comes from the
+        // AUTHENTICATED builder — never from the body — so a filer cannot claim
+        // a tier they do not hold to hard-land a bug. `grade` is read by the
+        // matrix only (a Full Idea never auto-routes); the grade ROW is still
+        // written below, unchanged.
+        goalId: body.goal_id ?? null,
+        filerRank: req.builder?.rank ?? null,
+        grade,
       });
       let grade_warning;
       if (grade === 'full') {
@@ -190,13 +203,33 @@ module.exports = function buildInboxRouter() {
         }
       }
       const open_count = await inbox.countOpenIdeas({ viewerRank: req.builder?.rank ?? null });
-      res.status(201).json({ idea, open_count, kind_auto: !body.kind, ...(grade_warning ? { grade_warning } : {}) });
+      // task 1003065 (BV1.R01): a routed capture returns the TASK it became, at
+      // the top level, so a client does not have to dig it out of the idea row to
+      // link to it. `idea.routing` carries the verdict either way — including the
+      // reason a named goal did NOT route, which is what makes a declined route
+      // debuggable instead of mysterious.
+      const routed_task = idea && idea.routed_task ? idea.routed_task : undefined;
+      if (idea) delete idea.routed_task;
+      res.status(201).json({
+        idea, open_count, kind_auto: !body.kind,
+        ...(routed_task ? { routed_task } : {}),
+        ...(grade_warning ? { grade_warning } : {}),
+      });
     } catch (err) {
       if (err && err.code) {
         const status =
           err.code === 'TITLE_REQUIRED' ? 400 :
           err.code === 'BAD_KIND' ? 400 :
           err.code === 'BAD_PRIORITY' ? 400 :
+          // task 1003065 (BV1.R01) — the routing refusals. A named goal that is
+          // not a live home is the FILER'S mistake to fix (pick another goal, or
+          // omit it and file to the inbox), so these are 4xx with the offending
+          // id echoed: 404 for "no such goal", 409 for "that goal/version is
+          // closed" (a conflict with live state, not a malformed request).
+          err.code === 'GOAL_NOT_FOUND' ? 404 :
+          err.code === 'GOAL_NOT_OPEN' ? 409 :
+          err.code === 'VERSION_NOT_BUILDING' ? 409 :
+          err.code === 'LIFECYCLE_UNAVAILABLE' ? 503 :
           500;
         return res.fail(err.code, status, { ...err });
       }

package/modules/ideas/routing.js

@@ -0,0 +1,121 @@
+'use strict';
+
+// modules/ideas/routing.js — THE LANDING MATRIX (task 1003065, BV1.R01,
+// goal 1000071 "Idea routing — work that has a home lands in it").
+// Spec: docs/specs/bongos-v1-idea-routing.md §"Landing matrix (C1/C2/C4)".
+//
+// THE PROBLEM THIS ANSWERS. Most filed "ideas" are really bug tasks or
+// goal-bound feature tasks. Today they park in idea_inbox and wait for a human
+// triage pass that, when it finally promotes them, drops the task into a version
+// catch-all — because nothing in the idea path ever names a goal. Routing makes
+// the home real: work that HAS a home lands in it at filing time, and the inbox
+// keeps only work that doesn't.
+//
+// This file is the DECISION and nothing else: given what was filed and who filed
+// it, does it route, and if so at what status. It is PURE — no DB, no clock, no
+// rank lookup — so every cell of the matrix is pinned by a DB-free unit test
+// (tests/idea_routing.mjs). The transaction that acts on the decision lives in
+// inbox.captureIdea; keeping them apart is what makes the matrix auditable
+// without a Postgres.
+//
+// FAIL-CLOSED IS THE POSTURE HERE, and it is the opposite of the advisory
+// modules' fail-open. An advisory that misfires prints a wrong sentence; a
+// landing decision that misfires puts UNVETTED WORK IN THE CLAIMABLE QUEUE.
+// So every uncertainty resolves toward "don't route" or "route to backlog",
+// never toward 'ready': an unrecognised kind soft-lands, an unknown/absent
+// filer rank soft-lands, and anything the matrix has no opinion about stays in
+// the inbox exactly as it does today.
+
+// The one rule the owner interview (2026-08-17, Q1) settled: BUGS ARE
+// URGENT-TRUE, THE REST GETS A NOD. A bug filed by a trusted builder is
+// claimable the moment it is reported — that is the whole "no triage stop
+// between reported and in the work queue" claim of criterion C1. Everything
+// else — feature, cleanup, refactor, infra — soft-lands at 'backlog', one
+// Metic+ promote from claimable, because those reshape what gets built and a
+// filer should not be able to set the queue's agenda alone.
+const HARD_LAND_KINDS = new Set(['bug']);
+
+// Kinds that are JUDGMENT WORK and must never auto-route, no matter who files
+// them with what goal. A criterion-proposal reshapes a version's scope-truth and
+// is ratified by an Archon (POST /inbox/:id/ratify); a decision is a question
+// awaiting an answer, not a unit of work. Converting either into a task would
+// turn "we should think about this" into "someone should go do this".
+const NEVER_ROUTE_KINDS = new Set(['criterion-proposal', 'decision']);
+
+// The trusted tier, spelled here rather than imported so this file stays pure and
+// DB-free. It is the same Metic+ boundary docs/canonical-permissions.md draws and
+// the routes enforce; this module only READS a rank string it was handed. It
+// grants nothing — the server-side rank floor and the goal's scope wall are
+// separate, load-bearing gates (R05), and this decision is subordinate to both.
+const METIC_PLUS = new Set(['metic', 'archon']);
+
+// A Full Idea (grade='full') is the Board Room's subject — it is ratified by
+// peers (goal 1000069), not converted into a task by its own filer. 'spark' and
+// 'quick' carry no such meaning and route normally.
+const NEVER_ROUTE_GRADE = 'full';
+
+// decideLanding — the matrix, as one pure function.
+//
+// Returns { route: false, reason } when the thing belongs in the inbox, or
+// { route: true, status, reason } when it becomes a task. `reason` is a stable
+// machine token (not prose): the route echoes it, /idea-triage reads it, and the
+// R15 reclassification sweep counts by it. Never throws.
+function decideLanding(input) {
+  // Destructured defaults only fire on `undefined`, so an explicit `null` — what
+  // a caller spreading an absent object hands over — would throw. A landing
+  // decision that CRASHES is the worst of the three outcomes: it takes down the
+  // capture that was supposed to fail closed. Normalise first, decide after.
+  const { goalId = null, kind = null, grade = null, filerRank = null } = input || {};
+  // No goal named ⇒ the inbox is exactly right, and this is the DEFAULT PATH.
+  // Every capture vector that never learns about goals keeps working unchanged;
+  // routing is strictly additive (criterion C1 testable #5).
+  if (goalId == null || goalId === '') return { route: false, reason: 'no_goal' };
+
+  if (String(grade || '').toLowerCase() === NEVER_ROUTE_GRADE) {
+    return { route: false, reason: 'full_idea_never_routes' };
+  }
+  if (NEVER_ROUTE_KINDS.has(kind)) {
+    return { route: false, reason: 'judgment_kind' };
+  }
+
+  if (HARD_LAND_KINDS.has(kind)) {
+    // The rank split. An absent/unknown rank is NOT treated as trusted — see the
+    // fail-closed note above. This is the DECISION only; R05 adds the
+    // server-side enforcement (auto-derived requires_rank floor + scope wall).
+    return METIC_PLUS.has(String(filerRank || '').toLowerCase())
+      ? { route: true, status: 'ready', reason: 'bug_trusted_filer' }
+      : { route: true, status: 'backlog', reason: 'bug_awaiting_nod' };
+  }
+
+  // Everything else with a home: it lands IN that home, at backlog. Note this
+  // deliberately swallows an unrecognised kind into the soft landing rather than
+  // refusing it — a task in a real goal at backlog is strictly better than a row
+  // rotting in the inbox, and 'backlog' means a human still says go.
+  return { route: true, status: 'backlog', reason: 'soft_landing' };
+}
+
+// The default priority for a routed task when the filer suggested none. 3 is the
+// middle of the 1–5 band — a routed task is not automatically urgent, and not
+// automatically bottom-of-queue either. (Decided without interview and recorded
+// in the spec: "routed-task priority defaults to the idea's suggested_priority
+// else 3".)
+const DEFAULT_ROUTED_PRIORITY = 3;
+
+// routedPriority — the idea's own suggestion, clamped to the task band. An idea's
+// suggested_priority column is validated 1..5 at capture, but a routed idea can
+// arrive from a vector that never validated it (Discord inbound, a seed), so this
+// re-clamps rather than trusting the input. Out-of-band or absent ⇒ the default.
+function routedPriority(suggestedPriority) {
+  const p = Number(suggestedPriority);
+  if (!Number.isInteger(p) || p < 1 || p > 5) return DEFAULT_ROUTED_PRIORITY;
+  return p;
+}
+
+module.exports = {
+  decideLanding,
+  routedPriority,
+  DEFAULT_ROUTED_PRIORITY,
+  HARD_LAND_KINDS,
+  NEVER_ROUTE_KINDS,
+  METIC_PLUS,
+};

package/modules/lifecycle/db.js

@@ -1421,7 +1421,7 @@ async function createTask({
   // (requiresRank stays null for the goal vector → derived purely from touches +
   // sensitivity), so goal_id never influences the requires_rank clamp.
   goalId = null,
-}) {
+}, deps = {}) { // deps.client enlists this INSERT in the CALLER'S transaction (task 1003065, BV1.R01); the argument for it is at modules/ideas/inbox.js routeIdeaToGoal
   // task 1498 / ADR 0085: every task carries a deliberate rank floor. Derive it
   // from touches + sensitivity, then let an explicit requiresRank override only
   // UPWARD (highestRank) — a requested rank below the derived floor is clamped
@@ -1456,7 +1456,7 @@ async function createTask({
   if (goalIdEffective == null) {
     goalIdEffective = await generalGoalIdForVersion(versionId);
   }
-  const { rows } = await pool.query(
+  const { rows } = await (deps.client || pool).query(
     `INSERT INTO tasks (version_id, title, description, status, touches,
                         est_minutes, est_cost_usd, manual_degree, priority,
                         automation_tag, credits_reward, source, source_ref, value_summary,

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.274",
+  "version": "1.19.275",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.19.274",
+      "version": "1.19.275",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.274",
+  "version": "1.19.275",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/src/module-api.js

@@ -975,8 +975,10 @@ const { validateOrRespond, LIMITS, parseId, asyncHandler, corsPublicGet, parsePa
 //         landed since 1.19.272 with no explicit bump. run 32441024959. (task 1002620)
 //   1.19.274 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
 //         landed since 1.19.273 with no explicit bump. run 32490024209. (task 1002620)
+//   1.19.275 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+//         landed since 1.19.274 with no explicit bump. run 32492414871. (task 1002620)
 // ---------------------------------------------------------------------------
-const CORE_VERSION = '1.19.274'; // CI auto-patch carrier (ADR 0161); see changelog above
+const CORE_VERSION = '1.19.275'; // CI auto-patch carrier (ADR 0161); see changelog above
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('dev-box'); log.info('mounted');

package/tests/idea_routing.mjs

@@ -0,0 +1,571 @@
+// tests/idea_routing.mjs
+//
+// The CAPTURE-TIME ROUTING CORE — task 1003065 (BV1.R01, goal 1000071 "Idea
+// routing — work that has a home lands in it"). Spec:
+// docs/specs/bongos-v1-idea-routing.md.
+//
+// TWO THINGS UNDER TEST, and the split is the design:
+//   1. modules/ideas/routing.js — the landing matrix. PURE, so every cell is
+//      pinned here directly, with no Postgres and no fixture.
+//   2. modules/ideas/inbox.js captureIdea — the ONE TRANSACTION a routed capture
+//      runs. Driven through the #538 `deps.pool` seam (NODE_ENV==='test' only)
+//      with a SQL-aware fake client, the tests/goal_tier.mjs posture: we assert
+//      the STATEMENT SEQUENCE and the bound params, because the sequence IS the
+//      contract — an idea row, a task, and a lineage row that commit together or
+//      not at all.
+//
+// WHY THE ROLLBACK CASES ARE THE HEART OF THIS FILE. This goal exists because
+// Discord #bugs creates tasks with no idea row and no lineage, so the ideator
+// credit lane (goal 1000067) has nothing to pay against. A routed capture that
+// committed a task and lost its lineage row would manufacture that exact bug on
+// the path whose whole promise is that attribution survives (criterion C3). So
+// "a failure after the task insert leaves NOTHING behind" is not an edge case
+// here — it is the property.
+//
+// Run:  node tests/idea_routing.mjs
+
+import { strict as assert } from 'node:assert';
+import { createRequire } from 'node:module';
+import { makeRunner, makeSqlAwareClient } from './helpers.mjs';
+
+process.env.NODE_ENV = 'test';
+
+const require = createRequire(import.meta.url);
+const routing = require('../modules/ideas/routing.js');
+const { decideLanding, routedPriority, DEFAULT_ROUTED_PRIORITY } = routing;
+
+// The lifecycle port is how the ideas module reaches createTask (never an
+// import — the one-way module rule, ADR 0083). Register a stub provider, the
+// production wiring, exactly as tests/onboarding_route_signals.mjs does.
+const seams = require('../src/module-seams.js');
+seams._reset();
+let createTaskCalls = [];
+let createTaskImpl = async () => ({ id: 9001, status: 'backlog', goal_id: 7 });
+seams.registerProvider('lifecycle', {
+  createTask: async (args, deps) => {
+    createTaskCalls.push({ args, deps });
+    return createTaskImpl(args, deps);
+  },
+});
+
+const inbox = require('../modules/ideas/inbox.js');
+const { captureIdea } = inbox;
+
+const { test, summary } = makeRunner();
+
+const norm = (sql) => String(sql).replace(/\s+/g, ' ').trim();
+const find = (queries, re) => queries.find((q) => re.test(norm(q.sql)));
+const seq = (queries) => queries.map((q) => norm(q.sql));
+
+// A routable goal: open, on a version that is still building.
+const LIVE_GOAL = { id: 7, status: 'open', version_id: 'BONGOS-V1', version_status: 'building' };
+const IDEA_ROW = {
+  id: 555, title: 'the thing is broken', body_md: 'steps', kind: 'bug',
+  suggested_version: null, suggested_priority: null, captured_at: 'T0', captured_by: 42,
+  status: 'promoted', promoted_to_task_id: null, reviewed_at: 'T0',
+  merged_into_idea_id: null, triage_note: null, suggested_goal_id: 7,
+};
+
+// A fake pool whose `connect()` and `query()` share ONE call log, so a test can
+// assert the whole transaction in order. Mirrors tests/goal_tier.mjs's fakePool.
+function fakePool(handler) {
+  const c = makeSqlAwareClient(handler);
+  return {
+    query: (sql, params) => c._client.query(sql, params),
+    connect: c.connect,
+    queries: c._client.queries,
+  };
+}
+
+// The happy-path handler: a live goal, an idea row, and empty results elsewhere.
+function routableHandler(overrides = {}) {
+  return (s) => {
+    if (/FROM goals g JOIN versions v/.test(s)) {
+      return { rows: overrides.goalRows ?? [LIVE_GOAL] };
+    }
+    if (/INSERT INTO idea_inbox/.test(s)) return { rows: [{ ...IDEA_ROW, ...(overrides.idea || {}) }] };
+    return null;
+  };
+}
+
+function reset() {
+  createTaskCalls = [];
+  createTaskImpl = async () => ({ id: 9001, status: 'backlog', goal_id: 7 });
+}
+
+// =========================================================================
+// 1. The landing matrix — pure, every cell
+// =========================================================================
+
+await test('matrix: NO GOAL means the inbox, and that is the default path', () => {
+  for (const goalId of [null, undefined, '']) {
+    const d = decideLanding({ goalId, kind: 'bug', filerRank: 'archon' });
+    assert.equal(d.route, false, `goalId=${JSON.stringify(goalId)} must not route`);
+    assert.equal(d.reason, 'no_goal');
+  }
+  // A bug filed by an Archon is the MOST routable thing there is — proving it
+  // still stays put without a goal is what pins "routing is strictly additive".
+});
+
+await test('matrix: a bug from a trusted filer HARD-LANDS at ready (criterion C1)', () => {
+  for (const rank of ['metic', 'archon', 'ARCHON', 'Metic']) {
+    const d = decideLanding({ goalId: 7, kind: 'bug', filerRank: rank });
+    assert.deepEqual(d, { route: true, status: 'ready', reason: 'bug_trusted_filer' }, `rank ${rank}`);
+  }
+});
+
+await test('matrix: a bug from a sub-Metic filer soft-lands, awaiting a nod', () => {
+  for (const rank of ['xenos', 'thetes', 'XENOS']) {
+    const d = decideLanding({ goalId: 7, kind: 'bug', filerRank: rank });
+    assert.deepEqual(d, { route: true, status: 'backlog', reason: 'bug_awaiting_nod' }, `rank ${rank}`);
+  }
+});
+
+await test('matrix: FAIL-CLOSED — an absent or unrecognised rank never hard-lands', () => {
+  // The property that matters: no rank input can reach 'ready' except a real
+  // trusted tier. A landing decision that misfires puts unvetted work in the
+  // claimable queue, so every uncertainty resolves downward.
+  for (const rank of [null, undefined, '', 'archon-ish', 'admin', 'root', 0, {}, []]) {
+    const d = decideLanding({ goalId: 7, kind: 'bug', filerRank: rank });
+    assert.equal(d.status, 'backlog', `rank ${JSON.stringify(rank)} must not reach ready`);
+    assert.equal(d.reason, 'bug_awaiting_nod');
+  }
+});
+
+await test('matrix: every non-bug kind soft-lands, whoever files it (interview Q1)', () => {
+  // "Bugs are urgent-true; the rest gets a nod." cleanup/refactor/infra were the
+  // open question the owner settled — they soft-land like features, not like bugs.
+  for (const kind of ['feature', 'cleanup', 'refactor', 'infra', 'learning-capture',
+    'blocker-resolution', 'unclassified', 'spike']) {
+    const d = decideLanding({ goalId: 7, kind, filerRank: 'archon' });
+    assert.deepEqual(d, { route: true, status: 'backlog', reason: 'soft_landing' }, `kind ${kind}`);
+  }
+});
+
+await test('matrix: a Full Idea never auto-routes — it is the Board Room\'s subject', () => {
+  for (const grade of ['full', 'FULL', 'Full']) {
+    const d = decideLanding({ goalId: 7, kind: 'feature', grade, filerRank: 'archon' });
+    assert.deepEqual(d, { route: false, reason: 'full_idea_never_routes' }, `grade ${grade}`);
+  }
+  // ...while quick/spark/absent route exactly as their kind says.
+  for (const grade of ['quick', 'spark', null, undefined]) {
+    assert.equal(decideLanding({ goalId: 7, kind: 'feature', grade }).route, true, `grade ${grade}`);
+  }
+});
+
+await test('matrix: judgment kinds never auto-route', () => {
+  for (const kind of ['criterion-proposal', 'decision']) {
+    assert.deepEqual(
+      decideLanding({ goalId: 7, kind, filerRank: 'archon' }),
+      { route: false, reason: 'judgment_kind' },
+      `kind ${kind}`
+    );
+  }
+});
+
+await test('matrix: decideLanding never throws, on any input', () => {
+  for (const args of [undefined, {}, null && {}, { goalId: 7 }, { goalId: 7, kind: null }]) {
+    assert.doesNotThrow(() => decideLanding(args));
+  }
+  assert.equal(decideLanding().route, false, 'no args ⇒ no route');
+});
+
+await test('routedPriority: the filer\'s suggestion when sane, else the middle of the band', () => {
+  for (const p of [1, 2, 3, 4, 5]) assert.equal(routedPriority(p), p);
+  for (const p of [0, 6, -1, 99, null, undefined, 'high', 2.5, NaN]) {
+    assert.equal(routedPriority(p), DEFAULT_ROUTED_PRIORITY, `${JSON.stringify(p)} ⇒ default`);
+  }
+  assert.equal(DEFAULT_ROUTED_PRIORITY, 3);
+});
+
+// =========================================================================
+// 2. captureIdea — the NON-routing path is byte-for-byte today's behaviour
+// =========================================================================
+
+await test('capture with no goal: ONE insert, status open, no transaction at all', async () => {
+  reset();
+  const pool = fakePool((s) => (/INSERT INTO idea_inbox/.test(s)
+    ? { rows: [{ ...IDEA_ROW, status: 'open', suggested_goal_id: null, reviewed_at: null }] }
+    : null));
+  const idea = await captureIdea({ title: 'a thought', capturedBy: 42 }, { pool });
+  const sqls = seq(pool.queries);
+  assert.equal(sqls.filter((q) => /^BEGIN$/.test(q)).length, 0, 'no transaction is opened');
+  assert.equal(sqls.length, 1, 'exactly one statement');
+  assert.match(sqls[0], /INSERT INTO idea_inbox/);
+  assert.match(sqls[0], /'open'/, "status is 'open'");
+  assert.equal(createTaskCalls.length, 0, 'no task is created');
+  assert.deepEqual(idea.routing, { routed: false, reason: 'no_goal' });
+});
+
+await test('a named goal the matrix DECLINES is kept as the core_222 hint, not dropped', async () => {
+  reset();
+  const pool = fakePool((s) => (/INSERT INTO idea_inbox/.test(s)
+    ? { rows: [{ ...IDEA_ROW, kind: 'decision', status: 'open' }] } : null));
+  const idea = await captureIdea(
+    { title: 'which cache?', kind: 'decision', goalId: 7, capturedBy: 42, filerRank: 'archon' },
+    { pool }
+  );
+  const ins = find(pool.queries, /INSERT INTO idea_inbox/);
+  assert.match(norm(ins.sql), /suggested_goal_id/, 'the hint column is written');
+  assert.equal(ins.params[6], 7, 'the declined goal is carried forward as the hint');
+  assert.equal(createTaskCalls.length, 0, 'a judgment kind mints no task');
+  assert.deepEqual(idea.routing, { routed: false, reason: 'judgment_kind' },
+    'and the reason says WHY it declined, so a filer is not left guessing');
+});
+
+await test('the pre-routing validations still fire before any write', async () => {
+  reset();
+  const pool = fakePool(() => null);
+  await assert.rejects(() => captureIdea({ title: '', goalId: 7 }, { pool }),
+    (e) => e.code === 'TITLE_REQUIRED');
+  await assert.rejects(() => captureIdea({ title: 'x', kind: 'nonsense', goalId: 7 }, { pool }),
+    (e) => e.code === 'BAD_KIND');
+  await assert.rejects(() => captureIdea({ title: 'x', suggestedPriority: 9, goalId: 7 }, { pool }),
+    (e) => e.code === 'BAD_PRIORITY');
+  assert.equal(pool.queries.length, 0, 'a bad payload touches the database zero times');
+});
+
+// =========================================================================
+// 3. captureIdea — the ROUTED path: one transaction, in order
+// =========================================================================
+
+await test('a routed bug: idea + task + lineage in ONE transaction, in FK order', async () => {
+  reset();
+  createTaskImpl = async () => ({ id: 9001, status: 'ready', goal_id: 7, version_id: 'BONGOS-V1' });
+  const pool = fakePool(routableHandler());
+  const out = await captureIdea(
+    { title: 'the thing is broken', bodyMd: 'steps', kind: 'bug', goalId: 7, capturedBy: 42, filerRank: 'archon' },
+    { pool }
+  );
+  const sqls = seq(pool.queries);
+  assert.equal(sqls[0], 'BEGIN', 'opens a transaction first');
+  assert.equal(sqls[sqls.length - 1], 'COMMIT', 'and commits last');
+
+  // The order is forced by the foreign keys, not by taste: lineage references
+  // BOTH rows, so idea → task → lineage is the only legal sequence.
+  const iGoal = sqls.findIndex((q) => /FROM goals g JOIN versions v/.test(q));
+  const iIdea = sqls.findIndex((q) => /INSERT INTO idea_inbox/.test(q));
+  const iLin = sqls.findIndex((q) => /INSERT INTO ideas_task_lineage/.test(q));
+  const iUpd = sqls.findIndex((q) => /UPDATE idea_inbox SET promoted_to_task_id/.test(q));
+  assert.ok(iGoal > 0 && iGoal < iIdea, 'the goal is validated BEFORE anything is written');
+  assert.ok(iIdea < iLin, 'the idea row exists before the lineage row references it');
+  assert.ok(iLin < iUpd, 'and promoted_to_task_id is closed out last');
+
+  // The idea is 'promoted' from birth — routing's claim is that it never needed
+  // a triage pass, and reviewed_at is stamped so the triage walk skips it.
+  const ins = find(pool.queries, /INSERT INTO idea_inbox/);
+  assert.match(norm(ins.sql), /'promoted'/, "status is 'promoted', not 'open'");
+  assert.match(norm(ins.sql), /reviewed_at/, 'reviewed_at is stamped');
+
+  // origin='route' — the third provenance ideas_003 widened the CHECK for.
+  const lin = find(pool.queries, /INSERT INTO ideas_task_lineage/);
+  assert.match(norm(lin.sql), /'route'/, "origin is 'route', not 'promote'");
+  assert.deepEqual(lin.params, [9001, 555], 'lineage binds (task_id, idea_id)');
+
+  assert.equal(out.routing.routed, true);
+  assert.equal(out.routing.task_id, 9001);
+  assert.equal(out.promoted_to_task_id, 9001, 'the returned row already reflects the link');
+  assert.equal(out.routed_task.id, 9001, 'and the task itself comes back');
+});
+
+await test('the task INSERT is ENLISTED in the transaction — the whole point', async () => {
+  reset();
+  const pool = fakePool(routableHandler());
+  await captureIdea(
+    { title: 'broken', kind: 'bug', goalId: 7, capturedBy: 42, filerRank: 'metic' },
+    { pool }
+  );
+  assert.equal(createTaskCalls.length, 1);
+  const { args, deps } = createTaskCalls[0];
+  assert.ok(deps && deps.client, 'createTask is handed the tx client, not left on the pool');
+  assert.equal(typeof deps.client.query, 'function');
+  // If this ever regresses to a pool write, the task commits independently of
+  // its lineage row and we have rebuilt the Discord #bugs bug.
+});
+
+await test('the routed task carries the goal, the matrix status, and honest provenance', async () => {
+  reset();
+  const pool = fakePool(routableHandler());
+  await captureIdea(
+    { title: 'broken', bodyMd: 'the body', kind: 'bug', goalId: 7, capturedBy: 42, filerRank: 'archon' },
+    { pool }
+  );
+  const { args } = createTaskCalls[0];
+  assert.equal(args.goalId, 7, 'in the goal it was filed against');
+  assert.equal(args.versionId, 'BONGOS-V1', "on the GOAL'S version, never a caller-supplied one");
+  assert.equal(args.status, 'ready', 'at the matrix status');
+  assert.equal(args.kind, 'bug');
+  assert.equal(args.title, 'broken');
+  assert.equal(args.description, 'the body');
+  assert.equal(args.source, 'idea-route');
+  assert.equal(args.sourceRef, 'idea-555', 'keyed to the idea, so one idea mints one task');
+  // Deliberately absent: an explicit rank floor and a reward. createTask derives
+  // the ADR 0084/0085 floor itself and auto-assigns the capped reward; a filer
+  // must not be able to hand either one in.
+  assert.equal(args.requiresRank, undefined, 'no filer-supplied rank floor');
+  assert.equal(args.creditsReward, undefined, 'no filer-supplied reward');
+});
+
+await test('priority: the filer\'s suggestion rides through, else the band middle', async () => {
+  reset();
+  let pool = fakePool(routableHandler({ idea: { suggested_priority: 1 } }));
+  await captureIdea({ title: 'x', kind: 'bug', goalId: 7, suggestedPriority: 1, filerRank: 'archon' }, { pool });
+  assert.equal(createTaskCalls[0].args.priority, 1);
+
+  reset();
+  pool = fakePool(routableHandler());
+  await captureIdea({ title: 'x', kind: 'bug', goalId: 7, filerRank: 'archon' }, { pool });
+  assert.equal(createTaskCalls[0].args.priority, DEFAULT_ROUTED_PRIORITY);
+});
+
+// =========================================================================
+// 4. The refusals — a named goal that is not a LIVE HOME
+// =========================================================================
+
+await test('a goal that does not exist: 404-shaped refusal, nothing written', async () => {
+  reset();
+  const pool = fakePool(routableHandler({ goalRows: [] }));
+  await assert.rejects(
+    () => captureIdea({ title: 'x', kind: 'bug', goalId: 404, filerRank: 'archon' }, { pool }),
+    (e) => e.code === 'GOAL_NOT_FOUND' && e.goal_id === 404
+  );
+  assert.equal(find(pool.queries, /INSERT INTO idea_inbox/), undefined, 'no idea row');
+  assert.equal(createTaskCalls.length, 0, 'no task');
+  assert.ok(find(pool.queries, /^ROLLBACK$/), 'and the transaction is rolled back');
+});
+
+await test('an achieved or archived goal is not a home', async () => {
+  for (const status of ['achieved', 'archived']) {
+    reset();
+    const pool = fakePool(routableHandler({ goalRows: [{ ...LIVE_GOAL, status }] }));
+    await assert.rejects(
+      () => captureIdea({ title: 'x', kind: 'bug', goalId: 7, filerRank: 'archon' }, { pool }),
+      (e) => e.code === 'GOAL_NOT_OPEN' && e.status === status,
+      `goal status ${status}`
+    );
+    assert.equal(createTaskCalls.length, 0);
+    assert.ok(find(pool.queries, /^ROLLBACK$/));
+  }
+});
+
+await test('THE 1000771 FAILURE: a non-building version can never receive routed work', async () => {
+  // The bug this whole goal was filed over — Discord #bugs hardcoded a SHIPPED
+  // version, so every reported bug landed in a shipped version's catch-all where
+  // nobody would look again. A route refuses rather than filing into a tomb.
+  for (const version_status of ['shipped', 'planning', 'frozen']) {
+    reset();
+    const pool = fakePool(routableHandler({ goalRows: [{ ...LIVE_GOAL, version_status }] }));
+    await assert.rejects(
+      () => captureIdea({ title: 'x', kind: 'bug', goalId: 7, filerRank: 'archon' }, { pool }),
+      (e) => e.code === 'VERSION_NOT_BUILDING' && e.version_status === version_status,
+      `version status ${version_status}`
+    );
+    assert.equal(createTaskCalls.length, 0, `no task on a ${version_status} version`);
+  }
+});
+
+// =========================================================================
+// 5. Atomicity — the property, not an edge case
+// =========================================================================
+
+await test('a task-create failure leaves NO orphan idea row (rollback)', async () => {
+  reset();
+  createTaskImpl = async () => { throw new Error('tasks table is on fire'); };
+  const pool = fakePool(routableHandler());
+  await assert.rejects(
+    () => captureIdea({ title: 'x', kind: 'bug', goalId: 7, filerRank: 'archon' }, { pool }),
+    /on fire/
+  );
+  assert.ok(find(pool.queries, /INSERT INTO idea_inbox/), 'the insert was attempted...');
+  assert.ok(find(pool.queries, /^ROLLBACK$/), '...and then rolled back');
+  assert.equal(find(pool.queries, /^COMMIT$/), undefined, 'never committed');
+});
+
+await test('a LINEAGE failure rolls the task back too — attribution or nothing (C3)', async () => {
+  reset();
+  const pool = fakePool((s) => {
+    if (/INSERT INTO ideas_task_lineage/.test(s)) throw new Error('lineage check violated');
+    return routableHandler()(s);
+  });
+  await assert.rejects(
+    () => captureIdea({ title: 'x', kind: 'bug', goalId: 7, filerRank: 'archon' }, { pool }),
+    /lineage/
+  );
+  assert.ok(find(pool.queries, /^ROLLBACK$/));
+  assert.equal(find(pool.queries, /^COMMIT$/), undefined,
+    'a task with no lineage row IS the bug this goal abolishes — it must not commit');
+});
+
+await test('the goal row is LOCKED, so it cannot be archived mid-route', async () => {
+  reset();
+  const pool = fakePool(routableHandler());
+  await captureIdea({ title: 'x', kind: 'bug', goalId: 7, filerRank: 'archon' }, { pool });
+  const sel = find(pool.queries, /FROM goals g JOIN versions v/);
+  assert.match(norm(sel.sql), /FOR SHARE OF g/, 'the goal row is held for the transaction');
+  assert.match(norm(sel.sql), /v\.status AS version_status/,
+    'and the version status is read in the SAME statement, not a second round trip');
+});
+
+await test('no lifecycle port ⇒ a loud refusal, never a silent inbox row', async () => {
+  reset();
+  const saved = seams.resolveOptional('lifecycle');
+  seams._reset();
+  try {
+    const pool = fakePool(routableHandler());
+    await assert.rejects(
+      () => captureIdea({ title: 'x', kind: 'bug', goalId: 7, filerRank: 'archon' }, { pool }),
+      (e) => e.code === 'LIFECYCLE_UNAVAILABLE'
+    );
+    assert.ok(find(pool.queries, /^ROLLBACK$/));
+    // The alternative — degrading to an inbox row — would tell the filer their
+    // bug became a task when it did not. Refusing is the honest failure.
+  } finally {
+    seams._reset();
+    seams.registerProvider('lifecycle', saved);
+  }
+});
+
+// =========================================================================
+// 6. THE ROUTE — POST /inbox, through the real handler
+//
+// The layer test above proves the transaction. This proves the CONTRACT a client
+// sees: where the filer's rank comes from, what the refusals look like, and that
+// omitting goal_id leaves the endpoint exactly as it was. Driven the
+// tests/idea_full_capture.mjs way — patch the doorway pool, pull the real
+// handler off the mounted router, stub req/res — so the same validator and the
+// same error map a client hits are the ones under test.
+// =========================================================================
+
+const apiDoorway = require('../src/module-api.js');
+
+let routeGoalRows = [LIVE_GOAL];
+apiDoorway.pool.query = async (sql) => {
+  if (/SELECT COUNT|count\(/i.test(String(sql))) return { rows: [{ n: '3', count: '3' }] };
+  if (/INSERT INTO idea_inbox/i.test(String(sql))) {
+    return { rows: [{ ...IDEA_ROW, status: 'open', suggested_goal_id: null }] };
+  }
+  return { rows: [] };
+};
+apiDoorway.pool.connect = async () => makeSqlAwareClient((s) => {
+  if (/FROM goals g JOIN versions v/.test(s)) return { rows: routeGoalRows };
+  if (/INSERT INTO idea_inbox/.test(s)) return { rows: [IDEA_ROW] };
+  return null;
+}).connect();
+
+const postInbox = (() => {
+  const router = require('../modules/ideas/routes/inbox.js')({});
+  const layer = router.stack.find((l) => l.route && l.route.path === '/inbox' && l.route.methods.post);
+  const handlers = layer.route.stack.map((h) => h.handle);
+  return handlers[handlers.length - 1]; // past requireBuilder
+})();
+
+// The res double the ADR 0116 envelope needs: res.fail is what every refusal in
+// this module calls, so a test that only implements .json would see a crash
+// instead of the 4xx a client gets.
+function call(body, builder = { id: '42', rank: 'archon' }) {
+  return new Promise((resolve) => {
+    const out = { status: 200, body: null };
+    const res = {
+      status(c) { out.status = c; return this; },
+      json(b) { out.body = b; resolve(out); return this; },
+      fail(code, statusOrOpts, details) {
+        const st = typeof statusOrOpts === 'number' ? statusOrOpts : (statusOrOpts && statusOrOpts.status) || 400;
+        out.status = st;
+        out.body = { error: { code, details: details || null } };
+        resolve(out);
+        return this;
+      },
+    };
+    Promise.resolve(postInbox({ body, builder, query: {} }, res)).catch((e) => {
+      out.status = 500; out.body = { threw: String(e && e.message) }; resolve(out);
+    });
+  });
+}
+
+await test('route: POST /inbox with a goal_id returns the TASK it became', async () => {
+  reset();
+  routeGoalRows = [LIVE_GOAL];
+  createTaskImpl = async () => ({ id: 9001, status: 'ready', goal_id: 7, version_id: 'BONGOS-V1' });
+  const r = await call({ title: 'the thing is broken', kind: 'bug', goal_id: 7 });
+  assert.equal(r.status, 201, JSON.stringify(r.body));
+  assert.equal(r.body.routed_task.id, 9001, 'the task is at the TOP level, not buried in the idea');
+  assert.equal(r.body.idea.routing.routed, true);
+  assert.equal(r.body.idea.routing.reason, 'bug_trusted_filer');
+  assert.equal(r.body.idea.routed_task, undefined, 'and is not duplicated inside the idea row');
+});
+
+await test('route: THE FILER\'S RANK COMES FROM AUTH, never from the body', async () => {
+  // The property that decides whether filing can outrun rank (criterion C4),
+  // asserted from both sides.
+  //
+  // (a) A forged rank in the body is refused outright — the BV1.R109c
+  //     unknown-field validator answers before the handler runs. A stronger
+  //     answer than ignoring it, and it means the matrix never sees the value.
+  reset();
+  routeGoalRows = [LIVE_GOAL];
+  const forged = await call({ title: 'broken', kind: 'bug', goal_id: 7, rank: 'archon' }, { id: '99', rank: 'xenos' });
+  assert.equal(forged.status, 400, JSON.stringify(forged.body));
+  assert.equal(forged.body.error.code, 'validation_failed');
+  assert.deepEqual(forged.body.error.details, [{ field: 'rank', reason: 'unknown_field' }]);
+  assert.equal(createTaskCalls.length, 0, 'and nothing was created');
+
+  // (b) With an IDENTICAL legal body, the landing differs purely by the
+  //     authenticated builder's rank — which is the positive proof that
+  //     req.builder.rank is what reaches the matrix.
+  const body = { title: 'broken', kind: 'bug', goal_id: 7 };
+  reset();
+  createTaskImpl = async (a) => ({ id: 1, status: a.status, goal_id: 7 });
+  const asArchon = await call({ ...body }, { id: '1', rank: 'archon' });
+  assert.equal(asArchon.status, 201, JSON.stringify(asArchon.body));
+  assert.equal(asArchon.body.idea.routing.status, 'ready');
+
+  reset();
+  createTaskImpl = async (a) => ({ id: 2, status: a.status, goal_id: 7 });
+  const asXenos = await call({ ...body }, { id: '2', rank: 'xenos' });
+  assert.equal(asXenos.status, 201, JSON.stringify(asXenos.body));
+  assert.equal(asXenos.body.idea.routing.status, 'backlog',
+    'same request, lower rank ⇒ soft landing: filing cannot outrun rank');
+});
+
+await test('route: a sub-Metic filer\'s bug lands at backlog, awaiting a nod', async () => {
+  reset();
+  routeGoalRows = [LIVE_GOAL];
+  createTaskImpl = async (a) => ({ id: 9002, status: a.status, goal_id: 7 });
+  const r = await call({ title: 'broken', kind: 'bug', goal_id: 7 }, { id: '99', rank: 'thetes' });
+  assert.equal(r.status, 201, JSON.stringify(r.body));
+  assert.equal(r.body.idea.routing.status, 'backlog');
+  assert.equal(r.body.idea.routing.reason, 'bug_awaiting_nod');
+});
+
+await test('route: the refusals map to 404 / 409, with the offending id echoed', async () => {
+  reset();
+  routeGoalRows = [];
+  let r = await call({ title: 'x', kind: 'bug', goal_id: 4040 });
+  assert.equal(r.status, 404, JSON.stringify(r.body));
+  assert.equal(r.body.error.code, 'GOAL_NOT_FOUND');
+
+  reset();
+  routeGoalRows = [{ ...LIVE_GOAL, status: 'archived' }];
+  r = await call({ title: 'x', kind: 'bug', goal_id: 7 });
+  assert.equal(r.status, 409, JSON.stringify(r.body));
+  assert.equal(r.body.error.code, 'GOAL_NOT_OPEN');
+
+  reset();
+  routeGoalRows = [{ ...LIVE_GOAL, version_status: 'shipped' }];
+  r = await call({ title: 'x', kind: 'bug', goal_id: 7 });
+  assert.equal(r.status, 409, JSON.stringify(r.body));
+  assert.equal(r.body.error.code, 'VERSION_NOT_BUILDING');
+});
+
+await test('route: NO goal_id is still the plain old capture — 201, no task', async () => {
+  reset();
+  const r = await call({ title: 'just a thought' });
+  assert.equal(r.status, 201, JSON.stringify(r.body));
+  assert.equal(r.body.routed_task, undefined, 'nothing routed');
+  assert.equal(createTaskCalls.length, 0, 'no task created');
+  assert.equal(r.body.idea.routing.reason, 'no_goal');
+  assert.ok('open_count' in r.body, 'and the pre-routing response shape is intact');
+  assert.ok('kind_auto' in r.body);
+});
+
+summary('idea_routing');