@bongos/core 1.19.294 → 1.19.295

package/.bongos-core.json

@@ -2,22 +2,22 @@
   "artifact": "bongos-core",
   "manifest_schema": 1,
   "generator": "scripts/gds/package-core.js",
-  "core_version": "1.19.294",
-  "core_contract": "1.19.294",
-  "source_commit": "fffe6738492ac7d113228cc4f9b1d5eae0ed16d3",
+  "core_version": "1.19.295",
+  "core_contract": "1.19.295",
+  "source_commit": "a9c6feaf0d724e69e2c74fae890f66887a1f6052",
   "source_ref": "HEAD",
-  "built_at": "2026-08-22T17:51:40.637Z",
+  "built_at": "2026-08-22T18:22:26.661Z",
   "redaction": {
     "model": "docs-redacted+functional-verbatim",
     "docs_redacted": 321,
     "agent_docs_stubbed": 22,
-    "functional_verbatim": 1395,
+    "functional_verbatim": 1397,
     "rules": 3,
     "gate_literals": 3,
     "gate": "passed"
   },
-  "file_count": 1738,
-  "tree_sha256": "70e835883854335f17289f54d647911185cfc4cfb1ec5b17424a88e6bbd8156f",
+  "file_count": 1740,
+  "tree_sha256": "0d0f553d620644b95da343b98d6a1bb50e5e934ea015e43de5f7630c1d505842",
   "files": [
     {
       "path": ".claude/skills/blocker-review/SKILL.md",
@@ -347,12 +347,12 @@
     {
       "path": "clients/bongos-client/README.md",
       "mode": "0000644",
-      "sha256": "aaf0bb7dae10d271e9999093935fef5ae8d85c3a2e3d5b4c52e0c11fed8c581e"
+      "sha256": "c5008815c70e20b7bbc49668082bd6886f1ac406d948a4d27f5f9fd4ff70188e"
     },
     {
       "path": "clients/bongos-client/bongos-client.global.js",
       "mode": "0000644",
-      "sha256": "372a5584ddad52fb524815fc7b50d1aab9163e974aac6f2c64f479e4034914a1"
+      "sha256": "91cc8b99c22e82ef7bbcb93f4b1596e88d772bc50f1baafdd373c8fe0e9c8ce5"
     },
     {
       "path": "clients/bongos-client/examples/hello-world.mjs",
@@ -362,17 +362,17 @@
     {
       "path": "clients/bongos-client/index.cjs",
       "mode": "0000644",
-      "sha256": "7faac7fc48e714c76c2b19feaaf9c730b2c9b10ab71ddc5697c21497d02f10ef"
+      "sha256": "a7cd2351a67f71cf889601718f792b299bbbf663c62d0fbdb43babc83a83b8ba"
     },
     {
       "path": "clients/bongos-client/index.d.ts",
       "mode": "0000644",
-      "sha256": "7aba0fe1d782cb6308f57dc2e5f6fe0d5ffe0f537d4ffe846bdc7a03e0f8064d"
+      "sha256": "57dc78f1c14c72595b1efe6b269161732be2e84caa7823ebd82f045e26e4d76f"
     },
     {
       "path": "clients/bongos-client/index.mjs",
       "mode": "0000644",
-      "sha256": "5f1d221bfbf8d329f883a5dc3e84414728c67201d66faceff04d48732e44b13c"
+      "sha256": "a077e8810feaa0efbfe25234b4153db206089deaed9071b45c2ae2f42f06fdaa"
     },
     {
       "path": "clients/bongos-client/package.json",
@@ -1412,12 +1412,12 @@
     {
       "path": "docs/api-reference.md",
       "mode": "0000644",
-      "sha256": "8fb83f272ef8810df2c517d9514495f44016da2e23cdd67937463f40c0d1605d"
+      "sha256": "d501dff7e10bbb0cee28717f652c26fca962f8f756a98b3be6ff7f361a92d967"
     },
     {
       "path": "docs/api/openapi.json",
       "mode": "0000644",
-      "sha256": "f51be43a281c9609980fca57d2fa11cafb460a414e506174715d53c08cef6965"
+      "sha256": "ebef1d04e8bc3e299c24a6113b2bc0ec43a92a0e93ff60fc801087bbdbb08fab"
     },
     {
       "path": "docs/architecture.md",
@@ -1552,7 +1552,7 @@
     {
       "path": "docs/file-map.md",
       "mode": "0000644",
-      "sha256": "9762b7f69397c28e103cdb39a9987483e23bd800a827f0d83983b62ef962616b"
+      "sha256": "a1c109f23cb4916b89bbc5ba522ebee6413bcb812569a30cbc1e0a7a00f8e9bc"
     },
     {
       "path": "docs/handoff-template.md",
@@ -2807,7 +2807,7 @@
     {
       "path": "modules/dev-box/app/src/vendor/bongos-client.cjs",
       "mode": "0000644",
-      "sha256": "7faac7fc48e714c76c2b19feaaf9c730b2c9b10ab71ddc5697c21497d02f10ef"
+      "sha256": "a7cd2351a67f71cf889601718f792b299bbbf663c62d0fbdb43babc83a83b8ba"
     },
     {
       "path": "modules/dev-box/app/test/unit.mjs",
@@ -3742,7 +3742,7 @@
     {
       "path": "modules/ideas/routes/inbox.js",
       "mode": "0000644",
-      "sha256": "47c2a3beb6bed3b206ec36344950fe115189debf75a38cf202bfafaa5dbb2adb"
+      "sha256": "8b832303a87a6caf9fd4f7779967576bb615bcb893640171beeef175c8783174"
     },
     {
       "path": "modules/ideas/routing.js",
@@ -4537,12 +4537,12 @@
     {
       "path": "package-lock.json",
       "mode": "0000644",
-      "sha256": "4555259c80ad21945412441d859ab9ff5f68be5adb28d7c02b2d405b42339398"
+      "sha256": "930aad90fce5c0ac0d66ec5e44c4948f3b704a790037b9b4856fe4a022e9a08f"
     },
     {
       "path": "package.json",
       "mode": "0000644",
-      "sha256": "26ce6a3328f57b80487d9b5fd31db9cb1c200c93d8f5ec307f763b39e8b28e6e"
+      "sha256": "cbd88d46d805881d4eb8cb4f35b34b77bb1d0b22be90682bc8cd47699b445a58"
     },
     {
       "path": "public-docs/index.html",
@@ -5779,6 +5779,11 @@
       "mode": "0000644",
       "sha256": "9c3a382def8c074a37bad66d7e3deef41c7f2bb9406f02f107be0e9a7dc7bfb3"
     },
+    {
+      "path": "scripts/gds/spark.js",
+      "mode": "0000755",
+      "sha256": "27a98a84ad1682bc9d17286c675fb75d14e2ff529d7ce43f848f54a631ee99bc"
+    },
     {
       "path": "scripts/gds/start.js",
       "mode": "0000644",
@@ -6057,7 +6062,7 @@
     {
       "path": "src/bongos/route-rank-check.js",
       "mode": "0000644",
-      "sha256": "97b8345a1d891151c3bc134926124a0ac929db661e0cfb26c6760c8c6030bafc"
+      "sha256": "f2d893e0de84433cc99411e59aba98c1ca392fa8d5bd24449e1e9200f06d9ff8"
     },
     {
       "path": "src/bongos/routes.js",
@@ -6192,7 +6197,7 @@
     {
       "path": "src/module-api.js",
       "mode": "0000644",
-      "sha256": "ea4af468628d2a5b45ee1e1916622975f263fc4059cff13a49cadb898f35a4db"
+      "sha256": "e7b52e29073dcbe62ed6c069753c22f9c7cf3a69cf8987bc2f91a7b4b9571d99"
     },
     {
       "path": "src/module-loader/catalog.js",
@@ -7509,6 +7514,11 @@
       "mode": "0000644",
       "sha256": "7bea2d388fad9a6b186c4712d6921a554f1d24c70dcae5760b381782149068e7"
     },
+    {
+      "path": "tests/idea_spark_mark.mjs",
+      "mode": "0000644",
+      "sha256": "fb5af0aa1b34116114a1c734c548cafaa52eefda57bd145c0008995bc69addee"
+    },
     {
       "path": "tests/idea_task_lineage.mjs",
       "mode": "0000644",

package/clients/bongos-client/README.md

@@ -5,7 +5,7 @@ A **generated**, zero-dependency typed client for the Bongos API — produced fr
 by hand; it regenerates when the spec changes, so it can never drift from the routes.
 
 - API version: **v1** (served at `/api/bongos/v1`)
-- 294 operations across 47 resource groups
+- 296 operations across 47 resource groups
 
 ## Install
 

package/clients/bongos-client/bongos-client.global.js

@@ -409,6 +409,10 @@ function createClient(opts = {}) {
       postInboxIdRatify: (args) => request("POST", "/inbox/{id}/ratify", { hasBody: true }, args),
       // POST /inbox/{id}/resubmit — rank: any-builder — POST /inbox/:id/resubmit
       postInboxIdResubmit: (args) => request("POST", "/inbox/{id}/resubmit", { hasBody: true }, args),
+      // DELETE /inbox/{id}/spark — rank: any-builder — DELETE /inbox/:id/spark
+      deleteInboxIdSpark: (args) => request("DELETE", "/inbox/{id}/spark", { hasBody: false }, args),
+      // POST /inbox/{id}/spark — rank: any-builder — POST /inbox/:id/spark
+      postInboxIdSpark: (args) => request("POST", "/inbox/{id}/spark", { hasBody: true }, args),
       // GET /inbox/awaiting-nod — rank: metic+archon — GET /inbox/awaiting-nod
       getInboxAwaitingNod: (args) => request("GET", "/inbox/awaiting-nod", { hasBody: false }, args),
     },

package/clients/bongos-client/index.cjs

@@ -408,6 +408,10 @@ function createClient(opts = {}) {
       postInboxIdRatify: (args) => request("POST", "/inbox/{id}/ratify", { hasBody: true }, args),
       // POST /inbox/{id}/resubmit — rank: any-builder — POST /inbox/:id/resubmit
       postInboxIdResubmit: (args) => request("POST", "/inbox/{id}/resubmit", { hasBody: true }, args),
+      // DELETE /inbox/{id}/spark — rank: any-builder — DELETE /inbox/:id/spark
+      deleteInboxIdSpark: (args) => request("DELETE", "/inbox/{id}/spark", { hasBody: false }, args),
+      // POST /inbox/{id}/spark — rank: any-builder — POST /inbox/:id/spark
+      postInboxIdSpark: (args) => request("POST", "/inbox/{id}/spark", { hasBody: true }, args),
       // GET /inbox/awaiting-nod — rank: metic+archon — GET /inbox/awaiting-nod
       getInboxAwaitingNod: (args) => request("GET", "/inbox/awaiting-nod", { hasBody: false }, args),
     },

package/clients/bongos-client/index.d.ts

@@ -9,6 +9,7 @@ export interface DeleteBoxSshKeyIdResponse { ok: boolean; deleted: unknown }
 export interface DeleteDependenciesResponse { ok: boolean }
 export interface DeleteGovernmentAssignmentsBuilderIdRankKeyResponse { ok: boolean; builder_id: unknown; rank_key: unknown; removed: unknown }
 export interface DeleteGovernmentRanksRankKeyPermissionsPermissionKeyResponse { ok: boolean; rank_key: unknown; permission_key: unknown; removed: unknown }
+export interface DeleteInboxIdSparkResponse { idea: unknown; sparked: boolean; unchanged: boolean }
 export interface DeleteMemoryFileResponse { deleted: boolean; builder_id: unknown; path: unknown }
 export interface DeleteTasksIdCriteriaCriterionIdResponse { ok: boolean; removed: unknown }
 export interface DeleteTasksIdDependenciesDepIdResponse { ok: boolean; removed: unknown }
@@ -246,6 +247,7 @@ export interface PostGovernmentRanksRequest { rank_key: string; label: string; d
 export interface PostGovernmentRanksResponse { rank: unknown }
 export interface PostInboxIdRatifyRequest { notes_md?: string }
 export interface PostInboxIdResubmitRequest { field_values: Record<string, unknown>; template_key?: string }
+export interface PostInboxIdSparkResponse { idea: unknown; sparked: boolean; unchanged: boolean }
 export interface PostInboxRequest { title: string; body_md?: string; kind?: string; suggested_version?: string; suggested_priority?: number; goal_id?: number; grade?: string; template_key?: string; field_values?: Record<string, unknown> }
 export interface PostLearningsRequest { title: string; body_md: string; tags?: string[]; related_files?: string[]; source?: string; source_ref?: string; task_id?: number }
 export interface PostLearningsResponse { skipped?: boolean; reason?: unknown; learning?: unknown }
@@ -669,6 +671,10 @@ export interface BongosClient {
     postInboxIdRatify(args?: RequestArgs & { body?: PostInboxIdRatifyRequest }): Promise<ApiResponse>;
     /** POST /inbox/{id}/resubmit — rank: any-builder */
     postInboxIdResubmit(args: RequestArgs & { body: PostInboxIdResubmitRequest }): Promise<ApiResponse>;
+    /** DELETE /inbox/{id}/spark — rank: any-builder */
+    deleteInboxIdSpark(args?: RequestArgs): Promise<DeleteInboxIdSparkResponse>;
+    /** POST /inbox/{id}/spark — rank: any-builder */
+    postInboxIdSpark(args?: RequestArgs): Promise<PostInboxIdSparkResponse>;
     /** GET /inbox/awaiting-nod — rank: metic+archon */
     getInboxAwaitingNod(args?: RequestArgs): Promise<GetInboxAwaitingNodResponse>;
   };

package/clients/bongos-client/index.mjs

@@ -405,6 +405,10 @@ export function createClient(opts = {}) {
       postInboxIdRatify: (args) => request("POST", "/inbox/{id}/ratify", { hasBody: true }, args),
       // POST /inbox/{id}/resubmit — rank: any-builder — POST /inbox/:id/resubmit
       postInboxIdResubmit: (args) => request("POST", "/inbox/{id}/resubmit", { hasBody: true }, args),
+      // DELETE /inbox/{id}/spark — rank: any-builder — DELETE /inbox/:id/spark
+      deleteInboxIdSpark: (args) => request("DELETE", "/inbox/{id}/spark", { hasBody: false }, args),
+      // POST /inbox/{id}/spark — rank: any-builder — POST /inbox/:id/spark
+      postInboxIdSpark: (args) => request("POST", "/inbox/{id}/spark", { hasBody: true }, args),
       // GET /inbox/awaiting-nod — rank: metic+archon — GET /inbox/awaiting-nod
       getInboxAwaitingNod: (args) => request("GET", "/inbox/awaiting-nod", { hasBody: false }, args),
     },

package/docs/api/openapi.json

@@ -6601,6 +6601,108 @@
         ]
       }
     },
+    "/inbox/{id}/spark": {
+      "post": {
+        "operationId": "post_inbox_id_spark",
+        "tags": [
+          "inbox"
+        ],
+        "summary": "POST /inbox/:id/spark",
+        "description": "Mark a Quick Idea as a Big Idea Spark — \"I have the spark but not the full picture, someone develop this\". AUTHOR-ONLY: the mark is the author's consent to have their idea developed, so only they can set it. A Full Idea is refused (409) and a non-open idea cannot be newly marked; re-marking is a 200 no-op.\n\n**Rank:** `any-builder` — Any authenticated builder (row-level ownership enforced in-handler).",
+        "x-rank": "any-builder",
+        "x-source": "modules/ideas/routes/inbox.js",
+        "parameters": [
+          {
+            "name": "id",
+            "in": "path",
+            "required": true,
+            "schema": {
+              "type": "string"
+            },
+            "description": "Path parameter `id`."
+          }
+        ],
+        "responses": {
+          "200": {
+            "description": "Success.",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/PostInboxIdSparkResponse"
+                }
+              }
+            }
+          },
+          "400": {
+            "$ref": "#/components/responses/BadRequest"
+          },
+          "401": {
+            "$ref": "#/components/responses/Unauthorized"
+          },
+          "403": {
+            "$ref": "#/components/responses/Forbidden"
+          },
+          "404": {
+            "$ref": "#/components/responses/NotFound"
+          }
+        },
+        "security": [
+          {
+            "builderSession": []
+          }
+        ]
+      },
+      "delete": {
+        "operationId": "delete_inbox_id_spark",
+        "tags": [
+          "inbox"
+        ],
+        "summary": "DELETE /inbox/:id/spark",
+        "description": "Withdraw the Big Idea Spark mark — the reversibility half of R144. AUTHOR-ONLY like the mark itself, and legal at ANY status so a stale mark on a promoted or discarded idea can always be cleared. Writes an explicit grade='quick' row, which reads identically to no grade row at all. Un-marking a quick idea is a 200 no-op; a Full Idea is refused (409) — it is not a withdrawn spark.\n\n**Rank:** `any-builder` — Any authenticated builder (row-level ownership enforced in-handler).",
+        "x-rank": "any-builder",
+        "x-source": "modules/ideas/routes/inbox.js",
+        "parameters": [
+          {
+            "name": "id",
+            "in": "path",
+            "required": true,
+            "schema": {
+              "type": "string"
+            },
+            "description": "Path parameter `id`."
+          }
+        ],
+        "responses": {
+          "200": {
+            "description": "Success.",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/DeleteInboxIdSparkResponse"
+                }
+              }
+            }
+          },
+          "400": {
+            "$ref": "#/components/responses/BadRequest"
+          },
+          "401": {
+            "$ref": "#/components/responses/Unauthorized"
+          },
+          "403": {
+            "$ref": "#/components/responses/Forbidden"
+          },
+          "404": {
+            "$ref": "#/components/responses/NotFound"
+          }
+        },
+        "security": [
+          {
+            "builderSession": []
+          }
+        ]
+      }
+    },
     "/instance": {
       "get": {
         "operationId": "get_instance",
@@ -13412,6 +13514,23 @@
           "removed"
         ]
       },
+      "DeleteInboxIdSparkResponse": {
+        "type": "object",
+        "properties": {
+          "idea": {},
+          "sparked": {
+            "type": "boolean"
+          },
+          "unchanged": {
+            "type": "boolean"
+          }
+        },
+        "required": [
+          "idea",
+          "sparked",
+          "unchanged"
+        ]
+      },
       "DeleteMemoryFileResponse": {
         "type": "object",
         "properties": {
@@ -16855,6 +16974,23 @@
         ],
         "additionalProperties": false
       },
+      "PostInboxIdSparkResponse": {
+        "type": "object",
+        "properties": {
+          "idea": {},
+          "sparked": {
+            "type": "boolean"
+          },
+          "unchanged": {
+            "type": "boolean"
+          }
+        },
+        "required": [
+          "idea",
+          "sparked",
+          "unchanged"
+        ]
+      },
       "PostInboxRequest": {
         "type": "object",
         "properties": {
@@ -18571,9 +18707,9 @@
       "description": "A required dependency/feature is not configured or is temporarily down."
     }
   },
-  "x-endpoint-count": 294,
-  "x-schema-count": 327,
+  "x-endpoint-count": 296,
+  "x-schema-count": 329,
   "x-undocumented-bodies": 8,
-  "x-response-schemas": 218,
+  "x-response-schemas": 220,
   "x-generated-by": "scripts/gds/gen-api-docs.js"
 }

package/docs/api-reference.md

@@ -2,7 +2,7 @@
 
 # Bongos API reference
 
-> **Generated from the live route files** — the route file is authoritative. 294 endpoints across 47 route files.
+> **Generated from the live route files** — the route file is authoritative. 296 endpoints across 47 route files.
 > Machine-readable spec: [`docs/api/openapi.json`](api/openapi.json) (OpenAPI 3.1). Rendered docs site: **`/docs`** (e.g. `cloudbongos.com/docs`).
 
 Base path: `/api/bongos`. Ranks (enforced server-side, [ADR 0016](adr/<redacted>.md)): `public` < `any-builder` < `metic+archon` < `archon`.
@@ -258,7 +258,7 @@ Base path: `/api/bongos`. Ranks (enforced server-side, [ADR 0016](adr/<redacted>
 |---|---|---|---|---|
 | GET | `/api/bongos/healthz` | `public` | — | liveness probe; status.example.com hits this anonymously. |
 
-## `inbox` (8)
+## `inbox` (10)
 
 | Method | Path | Rank | Body | Description |
 |---|---|---|---|---|
@@ -269,6 +269,8 @@ Base path: `/api/bongos`. Ranks (enforced server-side, [ADR 0016](adr/<redacted>
 | PATCH | `/api/bongos/inbox/:id/body` | `any-builder` | `body_md` | Metic+ (task 360 / ADR 0018): idea triage (promote/discard/merge) shapes the backlog. |
 | POST | `/api/bongos/inbox/:id/ratify` | `metic+archon` | `notes_md` | V3.R31 (task 252) — Archon ratifies a criterion-proposal idea, atomically: - INSERT done_when_criteria row on the target version - UPDATE… |
 | POST | `/api/bongos/inbox/:id/resubmit` | `any-builder` | `field_values`, `template_key` | RESUBMIT a Full Idea after a rejection (R13 of goal 1000069, criterion C2: an idea never dies and never stalls). |
+| POST | `/api/bongos/inbox/:id/spark` | `any-builder` | — | Mark a Quick Idea as a Big Idea Spark — "I have the spark but not the full picture, someone develop this". |
+| DELETE | `/api/bongos/inbox/:id/spark` | `any-builder` | — | Withdraw the Big Idea Spark mark — the reversibility half of R144. |
 | GET | `/api/bongos/inbox/awaiting-nod` | `metic+archon` | — | GET /inbox/awaiting-nod — the NOD QUEUE (task 1003066, BV1.R05). |
 
 ## `instance` (1)

package/docs/file-map.md

@@ -175,6 +175,7 @@
 │       ├── smoke-box.sh         ← (#598) hermetic box-lifecycle smoke (no DB/DO/network): runs tests/boxes.mjs + tests/cf_tunnel.mjs (#771 named tunnel) + route-rank + module-load
 │       ├── recall.js            ← `/recall` CLI: two-call progressive-disclosure search (summary → `--expand <id>`) over Bongos retrieval layer (ADR 0060); `node scripts/gds/recall.js <query>`
 │       ├── capture.js           ← file an idea_inbox row from the CLI (the ideas.capture kernel port); backs the "capture a tangent" flow across skills
+│       ├── spark.js            ← (task 1002920 / R144) mark one of your OWN quick ideas as a Big Idea Spark — "someone develop this"; `--undo` withdraws it. Author-only server-side (the mark is the consent); its own command because sparking acts on an EXISTING idea, which is why capture.js refuses grade='spark'
 │       ├── worktree.js          ← (task 1002809) junction-safe worktree add/remove/list — outside-repo worktrees get a node_modules junction via node (no shell quoting), removed BEFORE `git worktree remove`
 │       ├── learning-capture.js  ← file a `learnings` row (DB-backed short-form rule capture, replacing hand-edited recipe files for a single gotcha)
 │       ├── docs-entropy.js      ← ([#…] docs-entropy) markdown-corpus linter: broken internal links + cross-file duplicate-prose detector across every tracked `.md`; `--verbose` / `--file-ideas`

package/modules/dev-box/app/src/vendor/bongos-client.cjs

@@ -408,6 +408,10 @@ function createClient(opts = {}) {
       postInboxIdRatify: (args) => request("POST", "/inbox/{id}/ratify", { hasBody: true }, args),
       // POST /inbox/{id}/resubmit — rank: any-builder — POST /inbox/:id/resubmit
       postInboxIdResubmit: (args) => request("POST", "/inbox/{id}/resubmit", { hasBody: true }, args),
+      // DELETE /inbox/{id}/spark — rank: any-builder — DELETE /inbox/:id/spark
+      deleteInboxIdSpark: (args) => request("DELETE", "/inbox/{id}/spark", { hasBody: false }, args),
+      // POST /inbox/{id}/spark — rank: any-builder — POST /inbox/:id/spark
+      postInboxIdSpark: (args) => request("POST", "/inbox/{id}/spark", { hasBody: true }, args),
       // GET /inbox/awaiting-nod — rank: metic+archon — GET /inbox/awaiting-nod
       getInboxAwaitingNod: (args) => request("GET", "/inbox/awaiting-nod", { hasBody: false }, args),
     },

package/modules/ideas/routes/inbox.js

@@ -443,6 +443,119 @@ module.exports = function buildInboxRouter() {
     }
   });
 
+  // -----------------------------------------------------------------------
+  // The Big Idea Spark mark (task 1002920 / BV1.R144, goal 1000062)
+  //
+  // "I have the spark but not the full picture — someone develop this."
+  //
+  // AUTHOR-ONLY, AND THAT IS THE WHOLE POINT. The owner's decision: this mark IS
+  // the consent that makes cross-builder development fair. Without it a Quick
+  // Idea is simply NOT available for someone else to develop — a quick idea is
+  // for turning a thought into a task fast, and it is explicitly *not* an
+  // unfinished Full Idea waiting to be finished by a stranger. So the gate is
+  // not "who is senior enough", it is "whose thought is this": enforced
+  // in-handler against `captured_by`, the same ownership posture as
+  // POST /inbox/:id/resubmit above and PATCH /inbox/:id/body below.
+  //
+  // A MARK, MODELLED AS A RESOURCE: POST puts it on, DELETE takes it off. The
+  // done-when requires the mark be REVERSIBLE, and un-sparking is the plain
+  // reading of that — an author who marked a thought as needing development may
+  // decide they had the full picture after all. Un-sparking writes an EXPLICIT
+  // grade='quick' row, which the R140 design states reads identically to having
+  // no row at all, so a reversal leaves no residue a reader has to interpret.
+  //
+  // ONLY A QUICK IDEA CAN BE SPARKED. A Full Idea already carries the developed
+  // picture (the five template fields + a score); asking for it to be developed
+  // is a contradiction, and sparking it would hand setIdeaGrade a `spark` write
+  // whose empty fieldValues would WIPE that work — exactly the stale/lost-field
+  // hazard setIdeaGrade's whole-row contract warns about. Refused 409, before
+  // any write.
+  //
+  // Both directions are IDEMPOTENT: sparking a spark, or un-sparking a quick,
+  // reports `unchanged` at 200 rather than erroring. A double-click on the R154
+  // hall control is not a failure, and the caller's intent is already satisfied.
+  //
+  // rank: any-builder (requireBuilder) + the in-handler author gate.
+  // Pinned in route-rank-check.MODULE_EXPECTED_RANKS['ideas'].
+
+  // Shared by both directions: load the idea, prove ownership, and refuse a
+  // grade this mark has no business touching. Returns the idea, or null when it
+  // has already answered the request (so the caller just returns).
+  async function loadSparkable(req, res, { requireOpen }) {
+    const id = parseId(req, res, { code: 'bad_id', positiveInt: true });
+    if (id === null) return null;
+    const idea = await inbox.getIdea(id);
+    if (!idea) { res.fail('idea_not_found', 404); return null; }
+    // Authority first, and it leaks nothing: any builder can already read this
+    // idea from the inbox, so a 403 here reveals only that they are not its author.
+    if (idea.captured_by == null || String(idea.captured_by) !== String(req.builder.id)) {
+      res.fail('not_your_idea', 403, {
+        reason: 'the spark mark is the AUTHOR\'s consent to have their idea developed; only they can give or withdraw it',
+      });
+      return null;
+    }
+    if (idea.grade === 'full') {
+      res.fail('not_a_quick_idea', 409, {
+        grade: idea.grade,
+        reason: 'a Full Idea already carries the developed picture; the spark mark asks for one',
+      });
+      return null;
+    }
+    // Only MARKING requires an open idea. A promoted or discarded idea is not
+    // awaiting development, and admitting it would seed the R145 spark queue
+    // with work nobody can pick up. WITHDRAWING the mark stays legal at any
+    // status — clearing a stale mark is housekeeping, and blocking it would be
+    // the one way to leave a permanent spark on a dead idea.
+    if (requireOpen && idea.status !== 'open') {
+      res.fail('idea_not_open', 409, {
+        status: idea.status,
+        reason: 'only an open idea can be marked as awaiting development',
+      });
+      return null;
+    }
+    return idea;
+  }
+
+  // Mark a Quick Idea as a Big Idea Spark — "I have the spark but not the full
+  // picture, someone develop this". AUTHOR-ONLY: the mark is the author's consent
+  // to have their idea developed, so only they can set it. A Full Idea is refused
+  // (409) and a non-open idea cannot be newly marked; re-marking is a 200 no-op.
+  router.post('/inbox/:id/spark', api.requireBuilder, api.asyncHandler('POST /inbox/:id/spark', async (req, res) => {
+    const idea = await loadSparkable(req, res, { requireOpen: true });
+    if (!idea) return;
+    if (idea.grade === 'spark') {
+      return res.json({ idea, sparked: true, unchanged: true });
+    }
+    // grade only — a spark carries no template fields and no score (the R140
+    // migration's own shape: field_values is for a Full Idea). setIdeaGrade's
+    // defaults say exactly that, so they are left to speak for themselves.
+    const row = await inbox.setIdeaGrade(idea.id, { grade: 'spark' });
+    return res.json({
+      idea: { ...idea, grade: row.grade, template_key: row.template_key, field_values: row.field_values, completeness_score: row.completeness_score },
+      sparked: true,
+      unchanged: false,
+    });
+  }, { errorCode: 'idea_spark_failed' }));
+
+  // Withdraw the Big Idea Spark mark — the reversibility half of R144. AUTHOR-ONLY
+  // like the mark itself, and legal at ANY status so a stale mark on a promoted or
+  // discarded idea can always be cleared. Writes an explicit grade='quick' row,
+  // which reads identically to no grade row at all. Un-marking a quick idea is a
+  // 200 no-op; a Full Idea is refused (409) — it is not a withdrawn spark.
+  router.delete('/inbox/:id/spark', api.requireBuilder, api.asyncHandler('DELETE /inbox/:id/spark', async (req, res) => {
+    const idea = await loadSparkable(req, res, { requireOpen: false });
+    if (!idea) return;
+    if (idea.grade !== 'spark') {
+      return res.json({ idea, sparked: false, unchanged: true });
+    }
+    const row = await inbox.setIdeaGrade(idea.id, { grade: 'quick' });
+    return res.json({
+      idea: { ...idea, grade: row.grade, template_key: row.template_key, field_values: row.field_values, completeness_score: row.completeness_score },
+      sparked: false,
+      unchanged: false,
+    });
+  }, { errorCode: 'idea_unspark_failed' }));
+
   // Metic+ (#360 / ADR 0018): idea triage (promote/discard/merge) shapes the
   // backlog. Criterion C2 assigns triage to Metic, so this widened from
   // archon-only to metic+archon when the three-rank model went live. Any

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.294",
+  "version": "1.19.295",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.19.294",
+      "version": "1.19.295",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.294",
+  "version": "1.19.295",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/scripts/gds/spark.js

@@ -0,0 +1,103 @@
+#!/usr/bin/env node
+// Mark one of YOUR OWN quick ideas as a Big Idea Spark — "I have the spark but
+// not the full picture, someone develop this" (task 1002920 / BV1.R144, goal
+// 1000062).
+//
+// The mark is the CONSENT that makes cross-builder development fair: until an
+// author sets it, their quick idea is not available for someone else to develop.
+// So this command only ever works on ideas you filed — the server enforces that
+// against idea_inbox.captured_by, and no rank can override it.
+//
+// It exists as its own command rather than a flag on capture.js because sparking
+// is an act on an EXISTING idea, not a way to file one (capture refuses
+// grade='spark' for the same reason). The builders-hall control is R154; this is
+// the terminal path, and the two hit the same route.
+//
+// Usage:
+//   node scripts/gds/spark.js 123              # mark idea 123 as a spark
+//   node scripts/gds/spark.js 123 --undo       # withdraw the mark (back to quick)
+//
+// Exit codes:
+//   0  the idea now carries the grade you asked for (including when it already did)
+//   1  api / network error, or the server refused (not yours / not a quick idea)
+//   2  bad invocation
+
+const { cliClient, requireSession, hasFlag } = require('./cli-lib');
+
+// The server's refusals, in the ideator's own words. Anything unmapped falls
+// through to the raw envelope — a new server-side rule should be visible, not
+// swallowed by a generic "failed".
+const REFUSALS = {
+  not_your_idea: (d) =>
+    'That idea is not yours to mark. The spark mark is the author\'s consent to have their\n'
+    + 'idea developed, so only the builder who filed it can give or withdraw it.',
+  not_a_quick_idea: (d) =>
+    `That idea is already a Full Idea (grade=${d.grade || 'full'}). It carries the developed\n`
+    + 'picture the spark mark asks for — there is nothing to hand off.',
+  idea_not_open: (d) =>
+    `That idea is ${d.status || 'no longer open'}, so it is not awaiting development.\n`
+    + '(You can still withdraw an existing mark with --undo.)',
+  idea_not_found: () => 'No idea with that id.',
+};
+
+// The envelope is ADR 0116's { error: { code, message, details } } — the extras a
+// route passes as res.fail's third argument land under `details`, NOT spread onto
+// `error`. Reading them off the wrong level is a silent "undefined" in the
+// message rather than a crash, so tests/idea_spark_mark.mjs pins explain()
+// against the real envelope() builder.
+function explain(status, data) {
+  const err = data && data.error;
+  const code = err && typeof err === 'object' ? err.code : err;
+  const detail = (err && typeof err === 'object' && err.details) || {};
+  const say = typeof code === 'string' ? REFUSALS[code] : null;
+  if (say) return say(detail);
+  let rendered;
+  try { rendered = JSON.stringify(data, null, 2); } catch { rendered = String(data); }
+  return `spark failed (${status}): ${rendered}`;
+}
+
+async function main() {
+  await requireSession();
+
+  const positional = process.argv.slice(2).filter((a) => !a.startsWith('-'));
+  const id = Number(positional[0]);
+  const undo = hasFlag('--undo');
+
+  if (!Number.isInteger(id) || id <= 0) {
+    console.error('usage: node scripts/gds/spark.js <idea-id> [--undo]');
+    process.exit(2);
+  }
+
+  const api = await cliClient();
+  const r = undo
+    ? await api.inbox.deleteInboxIdSpark({ id })
+    : await api.inbox.postInboxIdSpark({ id, body: {} });
+
+  if (!r.ok) {
+    console.error(explain(r.status, r.data));
+    process.exit(1);
+  }
+
+  const { idea, sparked, unchanged } = r.data;
+  const title = idea && idea.title ? ` — ${idea.title}` : '';
+  if (unchanged) {
+    console.log(`Idea ${id} was already ${sparked ? 'a spark' : 'a quick idea'}${title}. Nothing changed.`);
+  } else if (sparked) {
+    console.log(`Idea ${id} is now a Big Idea Spark${title}.`);
+    console.log('Another builder can develop it into a Full Idea; you keep the attribution.');
+  } else {
+    console.log(`Idea ${id} is a quick idea again${title}. The mark is withdrawn.`);
+  }
+}
+
+// Only explain() is exported — tests/idea_spark_mark.mjs pins its message layer
+// against the real envelope. REFUSALS stays private: it is the message table,
+// reachable through explain(), and a second export would be dead surface.
+module.exports = { explain };
+
+if (require.main === module) {
+  main().catch((err) => {
+    console.error('fatal:', err);
+    process.exit(1);
+  });
+}

package/src/bongos/route-rank-check.js

@@ -416,6 +416,15 @@ const MODULE_EXPECTED_RANKS = {
     // requireBuilder + an in-handler author|triage gate. Deliberately a separate
     // route from the triage-gated PATCH /inbox/:id, which keeps its own rank.
     'PATCH /inbox/:id/body': 'any-builder',
+    // task 1002920 (BV1.R144): the Big Idea Spark mark is AUTHOR-ONLY, which is a
+    // narrower rule than any rank expresses — the gate is "whose thought is this",
+    // enforced in-handler against captured_by. Pinned 'any-builder' for the same
+    // reason POST /goals/:id/members is: the pin's job here is to catch an
+    // accidental TIGHTENING to a rank floor (which would lock authors out of their
+    // own ideas and break the consent the mark exists to record) as loudly as it
+    // catches a gate being dropped.
+    'POST /inbox/:id/spark': 'any-builder',
+    'DELETE /inbox/:id/spark': 'any-builder',
     'POST /inbox/:id/ratify': 'perm:idea.ratify',
   },
   // Cross-builder memory READS — the counterpart to the BFG cross-builder WRITE the

package/src/module-api.js

@@ -1015,8 +1015,10 @@ const { validateOrRespond, LIMITS, parseId, asyncHandler, corsPublicGet, parsePa
 //         landed since 1.19.292 with no explicit bump. run 32586174253. (task 1002620)
 //   1.19.294 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
 //         landed since 1.19.293 with no explicit bump. run 32588977219. (task 1002620)
+//   1.19.295 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+//         landed since 1.19.294 with no explicit bump. run 32590508145. (task 1002620)
 // ---------------------------------------------------------------------------
-const CORE_VERSION = '1.19.294'; // CI auto-patch carrier (ADR 0161); see changelog above
+const CORE_VERSION = '1.19.295'; // CI auto-patch carrier (ADR 0161); see changelog above
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('dev-box'); log.info('mounted');

package/tests/idea_spark_mark.mjs

@@ -0,0 +1,231 @@
+// tests/idea_spark_mark.mjs
+//
+// task 1002920 (BV1.R144, goal 1000062) — mark a Quick Idea as a Big Idea Spark.
+//
+// The done-when, as assertions: ONLY the original author can mark their idea
+// (the mark is the consent that makes cross-builder development fair, so a
+// non-author is a 403 and writes NOTHING); the mark is REVERSIBLE (DELETE puts
+// the idea back to quick); and a spark is visibly DISTINCT from both a quick and
+// a full idea (the grade comes back on the row, and a Full Idea is refused
+// rather than being flattened into a spark).
+//
+// DB-free the idea_full_capture.mjs way (pool.query patched on the doorway
+// before the modules load), driving the REAL route handlers through a stub
+// req/res — the same author gate, the same error map a client sees.
+//
+// Run:  node tests/idea_spark_mark.mjs
+
+import { strict as assert } from 'node:assert';
+import { createRequire } from 'node:module';
+
+const require = createRequire(import.meta.url);
+const api = require('../src/module-api.js');
+
+// The one idea every test reads, reshaped per-test. `captured_by: '9'` is the
+// stub builder below, so the default row IS author-owned.
+let idea = null;
+let queries = [];
+
+api.pool.query = async (sql, params = []) => {
+  queries.push({ sql, params });
+  if (/INSERT INTO ideas_grades/i.test(sql)) {
+    return { rows: [{ idea_id: params[0], grade: params[1], template_key: params[2], field_values: JSON.parse(params[3]), completeness_score: params[4] }] };
+  }
+  // Any read of idea_inbox is getIdea — return the row under test (or nothing).
+  if (/FROM idea_inbox/i.test(sql)) {
+    return { rows: idea ? [idea] : [] };
+  }
+  return { rows: [] };
+};
+
+const routesFactory = require('../modules/ideas/routes/inbox.js');
+const router = routesFactory({});
+
+// Pull the real handlers off the mounted router — the last handler in each
+// stack, i.e. after requireBuilder.
+function handlerFor(pathStr, method) {
+  const layer = router.stack.find((l) => l.route && l.route.path === pathStr && l.route.methods[method]);
+  assert.ok(layer, `route ${method.toUpperCase()} ${pathStr} is not mounted`);
+  const stack = layer.route.stack.map((s) => s.handle);
+  return stack[stack.length - 1];
+}
+const postSpark = handlerFor('/inbox/:id/spark', 'post');
+const deleteSpark = handlerFor('/inbox/:id/spark', 'delete');
+
+function call(handler, { builderId = '9' } = {}) {
+  return new Promise((resolve, reject) => {
+    const req = { params: { id: '77' }, body: {}, query: {}, builder: { id: builderId, rank: 'xenos' } };
+    const res = {
+      statusCode: 200,
+      status(c) { this.statusCode = c; return this; },
+      json(payload) { resolve({ status: this.statusCode, payload }); },
+      fail(code, status, extra) {
+        const s = typeof status === 'number' ? status : (status && status.status) || 500;
+        resolve({ status: s, payload: { error: code, ...(extra || {}) } });
+      },
+    };
+    // asyncHandler owns the catch in production; surface a throw as a failure here.
+    Promise.resolve(handler(req, res, (err) => reject(err || new Error('next() called')))).catch(reject);
+  });
+}
+
+const gradeWrites = () => queries.filter((q) => /INSERT INTO ideas_grades/i.test(q.sql));
+
+let passed = 0;
+let failed = 0;
+async function test(name, fn) {
+  queries = [];
+  idea = { id: '77', title: 'a thought', status: 'open', captured_by: '9', grade: 'quick', template_key: null, field_values: null, completeness_score: null };
+  try { await fn(); passed++; console.log(`  ok  ${name}`); }
+  catch (err) { failed++; console.error(`  FAIL ${name}\n    ${err.message}`); }
+}
+
+// --- the author gate: the whole point of the mark ------------------------
+
+await test('the AUTHOR can mark their quick idea as a spark', async () => {
+  const r = await call(postSpark);
+  assert.equal(r.status, 200);
+  assert.equal(r.payload.sparked, true);
+  assert.equal(r.payload.unchanged, false);
+  assert.equal(r.payload.idea.grade, 'spark', 'the row comes back carrying its new grade');
+  const w = gradeWrites();
+  assert.equal(w.length, 1);
+  assert.equal(w[0].params[1], 'spark');
+});
+
+await test('a NON-author is a 403 and nothing is written — the consent is not theirs to give', async () => {
+  const r = await call(postSpark, { builderId: '12' });
+  assert.equal(r.status, 403);
+  assert.equal(r.payload.error, 'not_your_idea');
+  assert.equal(gradeWrites().length, 0);
+});
+
+await test('an idea with NO author cannot be sparked by anyone (no consent to read)', async () => {
+  idea.captured_by = null;
+  const r = await call(postSpark);
+  assert.equal(r.status, 403);
+  assert.equal(r.payload.error, 'not_your_idea');
+  assert.equal(gradeWrites().length, 0);
+});
+
+await test('a non-author cannot WITHDRAW the mark either', async () => {
+  idea.grade = 'spark';
+  const r = await call(deleteSpark, { builderId: '12' });
+  assert.equal(r.status, 403);
+  assert.equal(gradeWrites().length, 0);
+});
+
+// --- reversible ----------------------------------------------------------
+
+await test('the mark is REVERSIBLE: DELETE puts the idea back to quick', async () => {
+  idea.grade = 'spark';
+  const r = await call(deleteSpark);
+  assert.equal(r.status, 200);
+  assert.equal(r.payload.sparked, false);
+  assert.equal(r.payload.unchanged, false);
+  assert.equal(r.payload.idea.grade, 'quick');
+  const w = gradeWrites();
+  assert.equal(w.length, 1);
+  assert.equal(w[0].params[1], 'quick', 'un-sparking writes an EXPLICIT quick row (R140: it reads as quick either way)');
+});
+
+await test('both directions are idempotent and report `unchanged` rather than erroring', async () => {
+  idea.grade = 'spark';
+  const again = await call(postSpark);
+  assert.equal(again.status, 200);
+  assert.equal(again.payload.unchanged, true);
+  assert.equal(gradeWrites().length, 0, 'no write for a no-op');
+
+  queries = [];
+  idea.grade = 'quick';
+  const off = await call(deleteSpark);
+  assert.equal(off.status, 200);
+  assert.equal(off.payload.sparked, false);
+  assert.equal(off.payload.unchanged, true);
+  assert.equal(gradeWrites().length, 0);
+});
+
+// --- distinct from a FULL idea ------------------------------------------
+
+await test('a FULL idea is refused 409 — and its field_values are never touched', async () => {
+  const fields = { purpose: 'x'.repeat(60), big_picture: 'y'.repeat(60) };
+  idea.grade = 'full';
+  idea.field_values = fields;
+  idea.completeness_score = 80;
+  const r = await call(postSpark);
+  assert.equal(r.status, 409);
+  assert.equal(r.payload.error, 'not_a_quick_idea');
+  assert.equal(r.payload.grade, 'full');
+  assert.equal(gradeWrites().length, 0, 'a spark write would have WIPED the five fields');
+  assert.deepEqual(idea.field_values, fields);
+});
+
+await test('un-sparking a FULL idea is refused too — it is not a withdrawn spark', async () => {
+  idea.grade = 'full';
+  const r = await call(deleteSpark);
+  assert.equal(r.status, 409);
+  assert.equal(r.payload.error, 'not_a_quick_idea');
+  assert.equal(gradeWrites().length, 0);
+});
+
+// --- only an OPEN idea awaits development -------------------------------
+
+await test('a promoted idea cannot be newly marked — the spark queue must stay pickable', async () => {
+  idea.status = 'promoted';
+  const r = await call(postSpark);
+  assert.equal(r.status, 409);
+  assert.equal(r.payload.error, 'idea_not_open');
+  assert.equal(r.payload.status, 'promoted');
+  assert.equal(gradeWrites().length, 0);
+});
+
+await test('but a stale mark can always be WITHDRAWN, whatever the status', async () => {
+  idea.status = 'discarded';
+  idea.grade = 'spark';
+  const r = await call(deleteSpark);
+  assert.equal(r.status, 200);
+  assert.equal(r.payload.idea.grade, 'quick');
+  assert.equal(gradeWrites().length, 1, 'housekeeping a dead idea\'s mark is never blocked');
+});
+
+// --- plumbing -----------------------------------------------------------
+
+await test('a missing idea is a 404, not a 500', async () => {
+  idea = null;
+  const r = await call(postSpark);
+  assert.equal(r.status, 404);
+  assert.equal(r.payload.error, 'idea_not_found');
+  assert.equal(gradeWrites().length, 0);
+});
+
+// --- the CLI's message layer, against the REAL envelope -----------------
+//
+// The stub res.fail above spreads its extras onto the payload for terseness (the
+// idea_full_capture.mjs idiom). Production does NOT: ADR 0116's envelope nests
+// them under error.details. So the CLI's explain() is checked against the real
+// builder, not the stub — that mismatch is a silent "grade=undefined" in an
+// ideator's terminal, which no route-level assertion above would catch.
+const { explain } = require('../scripts/gds/spark.js');
+const { envelope } = require('../src/bongos/api-errors.js');
+
+await test('the CLI reads each refusal off the REAL envelope shape', async () => {
+  const full = explain(409, envelope('not_a_quick_idea', undefined, { grade: 'full' }));
+  assert.match(full, /already a Full Idea \(grade=full\)/);
+  assert.doesNotMatch(full, /undefined/);
+
+  const closed = explain(409, envelope('idea_not_open', undefined, { status: 'promoted' }));
+  assert.match(closed, /is promoted, so it is not awaiting development/);
+  assert.doesNotMatch(closed, /undefined/);
+
+  assert.match(explain(403, envelope('not_your_idea')), /not yours to mark/);
+  assert.match(explain(404, envelope('idea_not_found')), /No idea with that id/);
+});
+
+await test('an UNMAPPED server refusal is shown raw, never swallowed', async () => {
+  const out = explain(409, envelope('some_future_rule', undefined, { hint: 'x' }));
+  assert.match(out, /spark failed \(409\)/);
+  assert.match(out, /some_future_rule/, 'a new server-side rule must stay visible');
+});
+
+console.log(`\nidea_spark_mark: ${passed} passed, ${failed} failed`);
+if (failed > 0) process.exit(1);