@bongos/core 1.19.295 → 1.19.296

package/.bongos-core.json

@@ -2,22 +2,22 @@
   "artifact": "bongos-core",
   "manifest_schema": 1,
   "generator": "scripts/gds/package-core.js",
-  "core_version": "1.19.295",
-  "core_contract": "1.19.295",
-  "source_commit": "a9c6feaf0d724e69e2c74fae890f66887a1f6052",
+  "core_version": "1.19.296",
+  "core_contract": "1.19.296",
+  "source_commit": "a0c264baf117184273d9a83f7c158844920f1d48",
   "source_ref": "HEAD",
-  "built_at": "2026-08-22T18:22:26.661Z",
+  "built_at": "2026-08-22T18:35:34.578Z",
   "redaction": {
     "model": "docs-redacted+functional-verbatim",
     "docs_redacted": 321,
     "agent_docs_stubbed": 22,
-    "functional_verbatim": 1397,
+    "functional_verbatim": 1398,
     "rules": 3,
     "gate_literals": 3,
     "gate": "passed"
   },
-  "file_count": 1740,
-  "tree_sha256": "0d0f553d620644b95da343b98d6a1bb50e5e934ea015e43de5f7630c1d505842",
+  "file_count": 1741,
+  "tree_sha256": "a34c536a2753b233ccd552b62e7fcfbe3768304013f4130c641a9bb51d7e51d5",
   "files": [
     {
       "path": ".claude/skills/blocker-review/SKILL.md",
@@ -347,12 +347,12 @@
     {
       "path": "clients/bongos-client/README.md",
       "mode": "0000644",
-      "sha256": "c5008815c70e20b7bbc49668082bd6886f1ac406d948a4d27f5f9fd4ff70188e"
+      "sha256": "cc15a1c79d2dd761b8b50190f72d69b2ccec0a56bdd812a82913213a4b811da6"
     },
     {
       "path": "clients/bongos-client/bongos-client.global.js",
       "mode": "0000644",
-      "sha256": "91cc8b99c22e82ef7bbcb93f4b1596e88d772bc50f1baafdd373c8fe0e9c8ce5"
+      "sha256": "b2add6cdda6bf67a34a33864f5c6c0a1bdaf7f3ac21314800d222b5f4be55eb5"
     },
     {
       "path": "clients/bongos-client/examples/hello-world.mjs",
@@ -362,17 +362,17 @@
     {
       "path": "clients/bongos-client/index.cjs",
       "mode": "0000644",
-      "sha256": "a7cd2351a67f71cf889601718f792b299bbbf663c62d0fbdb43babc83a83b8ba"
+      "sha256": "b6f803fa3594804e6781eab762eb91241c9146c1e3aa09a8883dd8015a55dc3b"
     },
     {
       "path": "clients/bongos-client/index.d.ts",
       "mode": "0000644",
-      "sha256": "57dc78f1c14c72595b1efe6b269161732be2e84caa7823ebd82f045e26e4d76f"
+      "sha256": "ee350739d64eb2ddce22fa0378ece2eebc363eae96c7755f087363b87e9581fe"
     },
     {
       "path": "clients/bongos-client/index.mjs",
       "mode": "0000644",
-      "sha256": "a077e8810feaa0efbfe25234b4153db206089deaed9071b45c2ae2f42f06fdaa"
+      "sha256": "9f4db5e5579a3e401a9d56ee473436b8c6cd00e82f209de784c321131f6e420d"
     },
     {
       "path": "clients/bongos-client/package.json",
@@ -1412,12 +1412,12 @@
     {
       "path": "docs/api-reference.md",
       "mode": "0000644",
-      "sha256": "d501dff7e10bbb0cee28717f652c26fca962f8f756a98b3be6ff7f361a92d967"
+      "sha256": "f7102579bfe64bb798e9ebc826849857218da439113c6f7b049cfc9a580f863f"
     },
     {
       "path": "docs/api/openapi.json",
       "mode": "0000644",
-      "sha256": "ebef1d04e8bc3e299c24a6113b2bc0ec43a92a0e93ff60fc801087bbdbb08fab"
+      "sha256": "a3d866c17cdb60660fb7603de26faccb0fd0fa345e47c26d9703e2fc1fdbfd40"
     },
     {
       "path": "docs/architecture.md",
@@ -1552,7 +1552,7 @@
     {
       "path": "docs/file-map.md",
       "mode": "0000644",
-      "sha256": "a1c109f23cb4916b89bbc5ba522ebee6413bcb812569a30cbc1e0a7a00f8e9bc"
+      "sha256": "9a2f67ab5989d068060bfe336d17ae88a33484fa8cbb5a92f23534b1c6de6289"
     },
     {
       "path": "docs/handoff-template.md",
@@ -2807,7 +2807,7 @@
     {
       "path": "modules/dev-box/app/src/vendor/bongos-client.cjs",
       "mode": "0000644",
-      "sha256": "a7cd2351a67f71cf889601718f792b299bbbf663c62d0fbdb43babc83a83b8ba"
+      "sha256": "b6f803fa3594804e6781eab762eb91241c9146c1e3aa09a8883dd8015a55dc3b"
     },
     {
       "path": "modules/dev-box/app/test/unit.mjs",
@@ -3707,7 +3707,7 @@
     {
       "path": "modules/ideas/inbox.js",
       "mode": "0000644",
-      "sha256": "19af72245517260ac6ee670c93fa3cda99a678da25a7fa6a5d6ec565995201ce"
+      "sha256": "33a25e6bd24ee0952c03e2aeab3e1edb68f8cf84989ee04206c9efdb7d202fa7"
     },
     {
       "path": "modules/ideas/migrations/ideas_001_grades.sql",
@@ -3742,7 +3742,7 @@
     {
       "path": "modules/ideas/routes/inbox.js",
       "mode": "0000644",
-      "sha256": "8b832303a87a6caf9fd4f7779967576bb615bcb893640171beeef175c8783174"
+      "sha256": "7de2735020ddd526ded8ca252fbfba157ee5eb174895660d37ac713b9d0d6fd2"
     },
     {
       "path": "modules/ideas/routing.js",
@@ -4537,12 +4537,12 @@
     {
       "path": "package-lock.json",
       "mode": "0000644",
-      "sha256": "930aad90fce5c0ac0d66ec5e44c4948f3b704a790037b9b4856fe4a022e9a08f"
+      "sha256": "b937444a6338c17ae2692d47f126d612f87c2429783a3d9a95e4c5d6076f3f5b"
     },
     {
       "path": "package.json",
       "mode": "0000644",
-      "sha256": "cbd88d46d805881d4eb8cb4f35b34b77bb1d0b22be90682bc8cd47699b445a58"
+      "sha256": "ce72a3e5a70ae07f431f223dccf12d2c896474bcb1f0d62724aea22206b23dde"
     },
     {
       "path": "public-docs/index.html",
@@ -5782,7 +5782,7 @@
     {
       "path": "scripts/gds/spark.js",
       "mode": "0000755",
-      "sha256": "27a98a84ad1682bc9d17286c675fb75d14e2ff529d7ce43f848f54a631ee99bc"
+      "sha256": "61ad614ec3fb8cbfc98d815629fd3ccafd179a8f2c058539103c9bf4e23e9504"
     },
     {
       "path": "scripts/gds/start.js",
@@ -6197,7 +6197,7 @@
     {
       "path": "src/module-api.js",
       "mode": "0000644",
-      "sha256": "e7b52e29073dcbe62ed6c069753c22f9c7cf3a69cf8987bc2f91a7b4b9571d99"
+      "sha256": "e5f489e0d2b9cc6d9c73cc853132a8a7a7e3fbcd8ea2325284d58143d4020a05"
     },
     {
       "path": "src/module-loader/catalog.js",
@@ -7519,6 +7519,11 @@
       "mode": "0000644",
       "sha256": "fb5af0aa1b34116114a1c734c548cafaa52eefda57bd145c0008995bc69addee"
     },
+    {
+      "path": "tests/idea_spark_queue.mjs",
+      "mode": "0000644",
+      "sha256": "6bea289f0473d07e21acd0b45b50511f061d8d1f0d09b7437a909081ea83344a"
+    },
     {
       "path": "tests/idea_task_lineage.mjs",
       "mode": "0000644",

package/clients/bongos-client/README.md

@@ -5,7 +5,7 @@ A **generated**, zero-dependency typed client for the Bongos API — produced fr
 by hand; it regenerates when the spec changes, so it can never drift from the routes.
 
 - API version: **v1** (served at `/api/bongos/v1`)
-- 296 operations across 47 resource groups
+- 297 operations across 47 resource groups
 
 ## Install
 

package/clients/bongos-client/bongos-client.global.js

@@ -415,6 +415,8 @@ function createClient(opts = {}) {
       postInboxIdSpark: (args) => request("POST", "/inbox/{id}/spark", { hasBody: true }, args),
       // GET /inbox/awaiting-nod — rank: metic+archon — GET /inbox/awaiting-nod
       getInboxAwaitingNod: (args) => request("GET", "/inbox/awaiting-nod", { hasBody: false }, args),
+      // GET /inbox/sparks — rank: any-builder — GET /inbox/sparks
+      getInboxSparks: (args) => request("GET", "/inbox/sparks", { hasBody: false }, args),
     },
     "instance": {
       // GET /instance — rank: public — GET /instance

package/clients/bongos-client/index.cjs

@@ -414,6 +414,8 @@ function createClient(opts = {}) {
       postInboxIdSpark: (args) => request("POST", "/inbox/{id}/spark", { hasBody: true }, args),
       // GET /inbox/awaiting-nod — rank: metic+archon — GET /inbox/awaiting-nod
       getInboxAwaitingNod: (args) => request("GET", "/inbox/awaiting-nod", { hasBody: false }, args),
+      // GET /inbox/sparks — rank: any-builder — GET /inbox/sparks
+      getInboxSparks: (args) => request("GET", "/inbox/sparks", { hasBody: false }, args),
     },
     "instance": {
       // GET /instance — rank: public — GET /instance

package/clients/bongos-client/index.d.ts

@@ -50,6 +50,7 @@ export interface GetHealthzResponse { ok: boolean; auth_configured: unknown }
 export interface GetInboxAwaitingNodResponse { awaiting: unknown; count: unknown }
 export interface GetInboxIdResponse { idea: unknown }
 export interface GetInboxResponse { ideas: unknown; open_count: unknown }
+export interface GetInboxSparksResponse { sparks: unknown; count: unknown }
 export interface GetLeaderboardResponse { leaderboard: unknown; page: unknown }
 export interface GetLearningsResponse { learnings: unknown }
 export interface GetMeAchievementsResponse { unlocked: unknown }
@@ -677,6 +678,8 @@ export interface BongosClient {
     postInboxIdSpark(args?: RequestArgs): Promise<PostInboxIdSparkResponse>;
     /** GET /inbox/awaiting-nod — rank: metic+archon */
     getInboxAwaitingNod(args?: RequestArgs): Promise<GetInboxAwaitingNodResponse>;
+    /** GET /inbox/sparks — rank: any-builder */
+    getInboxSparks(args?: RequestArgs): Promise<GetInboxSparksResponse>;
   };
   "instance": {
     /** GET /instance — rank: public */

package/clients/bongos-client/index.mjs

@@ -411,6 +411,8 @@ export function createClient(opts = {}) {
       postInboxIdSpark: (args) => request("POST", "/inbox/{id}/spark", { hasBody: true }, args),
       // GET /inbox/awaiting-nod — rank: metic+archon — GET /inbox/awaiting-nod
       getInboxAwaitingNod: (args) => request("GET", "/inbox/awaiting-nod", { hasBody: false }, args),
+      // GET /inbox/sparks — rank: any-builder — GET /inbox/sparks
+      getInboxSparks: (args) => request("GET", "/inbox/sparks", { hasBody: false }, args),
     },
     "instance": {
       // GET /instance — rank: public — GET /instance

package/docs/api/openapi.json

@@ -6307,6 +6307,44 @@
         ]
       }
     },
+    "/inbox/sparks": {
+      "get": {
+        "operationId": "get_inbox_sparks",
+        "tags": [
+          "inbox"
+        ],
+        "summary": "GET /inbox/sparks",
+        "description": "GET /inbox/sparks — THE SPARK QUEUE (task 1002921 / BV1.R145, goal 1000062). Big Idea Sparks awaiting development: the ideator craft's pickup surface, and the first place one craft sources work from another craft's output. READABLE BY ANY BUILDER, by design and by the done-when. A pickup surface that only trusted builders could read would defeat its own purpose — the whole point is that someone OTHER than the author comes along and develops the thought. The author's consent is already recorded (the R144 mark is what put the row here), so no further gate belongs on the read. Contrast /inbox/awaiting-nod directly above, which IS gated: that queue exists to be ACTED on by a triager, this one to be BROWSED by anyone. DECLARED BEFORE `GET /inbox/:id` DELIBERATELY — and this ordering is load-bearing, not stylistic. Express matches in declaration order, so with the routes the other way round `/inbox/sparks` binds `:id = 'sparks'` and parseId turns the whole queue into a 400 bad_id. Same reason /inbox/awaiting-nod sits above it. tests/idea_spark_queue.mjs pins the relative order so a future insertion cannot quietly re-shadow it. rank: any-builder — a pickup surface is public to builders (the R144 mark is the consent). Deliberately NOT pinned in route-rank-check: a read with no gate to protect has no downgrade to catch, and pinning it would only assert that a read stays open.\n\n**Rank:** `any-builder` — Any authenticated builder (row-level ownership enforced in-handler).",
+        "x-rank": "any-builder",
+        "x-source": "modules/ideas/routes/inbox.js",
+        "responses": {
+          "200": {
+            "description": "Success.",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/GetInboxSparksResponse"
+                }
+              }
+            }
+          },
+          "400": {
+            "$ref": "#/components/responses/BadRequest"
+          },
+          "401": {
+            "$ref": "#/components/responses/Unauthorized"
+          },
+          "403": {
+            "$ref": "#/components/responses/Forbidden"
+          }
+        },
+        "security": [
+          {
+            "builderSession": []
+          }
+        ]
+      }
+    },
     "/inbox/{id}": {
       "get": {
         "operationId": "get_inbox_id",
@@ -14028,6 +14066,17 @@
           "open_count"
         ]
       },
+      "GetInboxSparksResponse": {
+        "type": "object",
+        "properties": {
+          "sparks": {},
+          "count": {}
+        },
+        "required": [
+          "sparks",
+          "count"
+        ]
+      },
       "GetLeaderboardResponse": {
         "type": "object",
         "properties": {
@@ -18707,9 +18756,9 @@
       "description": "A required dependency/feature is not configured or is temporarily down."
     }
   },
-  "x-endpoint-count": 296,
-  "x-schema-count": 329,
+  "x-endpoint-count": 297,
+  "x-schema-count": 330,
   "x-undocumented-bodies": 8,
-  "x-response-schemas": 220,
+  "x-response-schemas": 221,
   "x-generated-by": "scripts/gds/gen-api-docs.js"
 }

package/docs/api-reference.md

@@ -2,7 +2,7 @@
 
 # Bongos API reference
 
-> **Generated from the live route files** — the route file is authoritative. 296 endpoints across 47 route files.
+> **Generated from the live route files** — the route file is authoritative. 297 endpoints across 47 route files.
 > Machine-readable spec: [`docs/api/openapi.json`](api/openapi.json) (OpenAPI 3.1). Rendered docs site: **`/docs`** (e.g. `cloudbongos.com/docs`).
 
 Base path: `/api/bongos`. Ranks (enforced server-side, [ADR 0016](adr/<redacted>.md)): `public` < `any-builder` < `metic+archon` < `archon`.
@@ -258,7 +258,7 @@ Base path: `/api/bongos`. Ranks (enforced server-side, [ADR 0016](adr/<redacted>
 |---|---|---|---|---|
 | GET | `/api/bongos/healthz` | `public` | — | liveness probe; status.example.com hits this anonymously. |
 
-## `inbox` (10)
+## `inbox` (11)
 
 | Method | Path | Rank | Body | Description |
 |---|---|---|---|---|
@@ -272,6 +272,7 @@ Base path: `/api/bongos`. Ranks (enforced server-side, [ADR 0016](adr/<redacted>
 | POST | `/api/bongos/inbox/:id/spark` | `any-builder` | — | Mark a Quick Idea as a Big Idea Spark — "I have the spark but not the full picture, someone develop this". |
 | DELETE | `/api/bongos/inbox/:id/spark` | `any-builder` | — | Withdraw the Big Idea Spark mark — the reversibility half of R144. |
 | GET | `/api/bongos/inbox/awaiting-nod` | `metic+archon` | — | GET /inbox/awaiting-nod — the NOD QUEUE (task 1003066, BV1.R05). |
+| GET | `/api/bongos/inbox/sparks` | `any-builder` | — | GET /inbox/sparks — THE SPARK QUEUE (task 1002921 / BV1.R145, goal 1000062). |
 
 ## `instance` (1)
 

package/docs/file-map.md

@@ -175,7 +175,7 @@
 │       ├── smoke-box.sh         ← (#598) hermetic box-lifecycle smoke (no DB/DO/network): runs tests/boxes.mjs + tests/cf_tunnel.mjs (#771 named tunnel) + route-rank + module-load
 │       ├── recall.js            ← `/recall` CLI: two-call progressive-disclosure search (summary → `--expand <id>`) over Bongos retrieval layer (ADR 0060); `node scripts/gds/recall.js <query>`
 │       ├── capture.js           ← file an idea_inbox row from the CLI (the ideas.capture kernel port); backs the "capture a tangent" flow across skills
-│       ├── spark.js            ← (task 1002920 / R144) mark one of your OWN quick ideas as a Big Idea Spark — "someone develop this"; `--undo` withdraws it. Author-only server-side (the mark is the consent); its own command because sparking acts on an EXISTING idea, which is why capture.js refuses grade='spark'
+│       ├── spark.js            ← (tasks 1002920 / R144 + 1002921 / R145) mark one of your OWN quick ideas as a Big Idea Spark — "someone develop this"; `--undo` withdraws it; `--list` is the SPARK QUEUE (what awaits development, readable by any builder). Author-only server-side for the mark (it is the consent); its own command because sparking acts on an EXISTING idea, which is why capture.js refuses grade='spark'
 │       ├── worktree.js          ← (task 1002809) junction-safe worktree add/remove/list — outside-repo worktrees get a node_modules junction via node (no shell quoting), removed BEFORE `git worktree remove`
 │       ├── learning-capture.js  ← file a `learnings` row (DB-backed short-form rule capture, replacing hand-edited recipe files for a single gotcha)
 │       ├── docs-entropy.js      ← ([#…] docs-entropy) markdown-corpus linter: broken internal links + cross-file duplicate-prose detector across every tracked `.md`; `--verbose` / `--file-ideas`

package/modules/dev-box/app/src/vendor/bongos-client.cjs

@@ -414,6 +414,8 @@ function createClient(opts = {}) {
       postInboxIdSpark: (args) => request("POST", "/inbox/{id}/spark", { hasBody: true }, args),
       // GET /inbox/awaiting-nod — rank: metic+archon — GET /inbox/awaiting-nod
       getInboxAwaitingNod: (args) => request("GET", "/inbox/awaiting-nod", { hasBody: false }, args),
+      // GET /inbox/sparks — rank: any-builder — GET /inbox/sparks
+      getInboxSparks: (args) => request("GET", "/inbox/sparks", { hasBody: false }, args),
     },
     "instance": {
       // GET /instance — rank: public — GET /instance

package/modules/ideas/inbox.js

@@ -782,6 +782,91 @@ async function countRoutedAwaitingNod(deps = {}) {
   return rows[0] ? rows[0].n : 0;
 }
 
+// -------------------------------------------------------------------------
+// The spark queue (task 1002921 / BV1.R145, goal 1000062)
+//
+// "What Big Idea Sparks are awaiting development?" — the ideator craft's pickup
+// surface, and the first place in this codebase where one craft sources work
+// from another craft's output.
+//
+// THE PREDICATE IS grade='spark' AND status='open', AND THAT IS THE WHOLE
+// QUEUE. There is deliberately no `developed` flag and no separate queue table:
+// R146 develops a spark into a Full Idea IN PLACE on the same idea_inbox row
+// (same id, same captured_by), which flips its grade spark→full — so a developed
+// spark leaves this queue as a CONSEQUENCE of being developed, not because
+// anything remembered to remove it. A second source of truth for "still
+// waiting" is a thing that can disagree with the grade; this cannot.
+//
+// AN INNER JOIN, WHICH INVERTS THIS MODULE'S USUAL RULE ON PURPOSE. Every other
+// idea read LEFT JOINs ideas_grades and COALESCEs to 'quick', because an
+// un-graded idea must still appear. Here the opposite is correct and safe:
+// grade='spark' can never be implicit — absence of a row means quick — so a
+// spark ALWAYS has a real row, and starting from ideas_grades lets
+// ideas_grades_grade_score_idx (ideas_001, written for this very read) drive the
+// scan instead of filtering a full idea_inbox pass afterwards.
+//
+// ORDERING — "newest-or-best first", and only the newest half is real. A spark
+// carries no completeness score by construction (it has no template fields to
+// score), so there is no "best" signal to sort by: upvotes live on builders as
+// karma, not per-idea, and inventing a quality metric for an undeveloped thought
+// is exactly the guess this queue should not be making. captured_at DESC, id
+// DESC as a stable tiebreak for same-timestamp rows. When a real per-idea
+// signal exists, this ORDER BY is the one line that changes.
+//
+// The skill-friction visibility gate (V3.R70) is applied here too, on the same
+// title-prefix rule listOpenIdeas uses. A routine-filed friction row is unlikely
+// to ever be sparked (marking requires an author), but the two idea listings
+// agreeing by construction beats them agreeing by accident.
+function sparkQueueWhere(viewerRank, params) {
+  const where = [`g.grade = 'spark'`, `i.status = 'open'`];
+  if (!rankCanSeeSkillFriction(viewerRank)) {
+    params.push(`${SKILL_FRICTION_TAG}%`);
+    where.push(`i.title NOT LIKE $${params.length}`);
+  }
+  return where;
+}
+
+async function listSparkQueue({ limit = 50, viewerRank = null } = {}, deps = {}) {
+  const activePool = (deps.pool && process.env.NODE_ENV === 'test') ? deps.pool : pool;
+  const params = [];
+  const where = sparkQueueWhere(viewerRank, params);
+  params.push(limit);
+  const { rows } = await activePool.query(
+    // `b.github_login` because attribution is the POINT of this surface: an
+    // ideator picking work up should see whose thought they are developing, and
+    // R146 has to preserve that name. LEFT JOIN — a builder row can be missing.
+    `SELECT ${IDEA_COLS_Q}, ${GRADE_COLS_Q},
+            b.github_login AS filed_by_login
+       FROM ideas_grades g
+       JOIN idea_inbox i ON i.id = g.idea_id
+       LEFT JOIN builders b ON b.id = i.captured_by
+      WHERE ${where.join(' AND ')}
+      ORDER BY i.captured_at DESC, i.id DESC
+      LIMIT $${params.length}`,
+    params
+  );
+  return rows;
+}
+
+// The count behind the queue's pill — the SAME predicate as the list (the
+// countRoutedAwaitingNod / countOpenIdeas precedent), so the number a viewer is
+// shown can never disagree with the rows they can actually see. It deliberately
+// takes viewerRank too: a count that ignored the visibility gate would tell a
+// Xenos there are sparks they cannot find.
+async function countSparkQueue({ viewerRank = null } = {}, deps = {}) {
+  const activePool = (deps.pool && process.env.NODE_ENV === 'test') ? deps.pool : pool;
+  const params = [];
+  const where = sparkQueueWhere(viewerRank, params);
+  const { rows } = await activePool.query(
+    `SELECT COUNT(*)::int AS n
+       FROM ideas_grades g
+       JOIN idea_inbox i ON i.id = g.idea_id
+      WHERE ${where.join(' AND ')}`,
+    params
+  );
+  return rows[0] ? rows[0].n : 0;
+}
+
 // -------------------------------------------------------------------------
 // Grade writes (task 1002916 / BV1.R140)
 //
@@ -1109,6 +1194,9 @@ module.exports = {
   // the nod queue (task 1003066, BV1.R05)
   listRoutedAwaitingNod,
   countRoutedAwaitingNod,
+  // the spark queue (task 1002921, BV1.R145) — sparks awaiting development
+  listSparkQueue,
+  countSparkQueue,
   // criterion-proposal ratification (V3.R31 / #252)
   ratifyCriterionProposal,
   parseProposalBody,

package/modules/ideas/routes/inbox.js

@@ -312,6 +312,43 @@ module.exports = function buildInboxRouter() {
     }
   });
 
+
+  // GET /inbox/sparks — THE SPARK QUEUE (task 1002921 / BV1.R145, goal 1000062).
+  //
+  // Big Idea Sparks awaiting development: the ideator craft's pickup surface,
+  // and the first place one craft sources work from another craft's output.
+  //
+  // READABLE BY ANY BUILDER, by design and by the done-when. A pickup surface
+  // that only trusted builders could read would defeat its own purpose — the
+  // whole point is that someone OTHER than the author comes along and develops
+  // the thought. The author's consent is already recorded (the R144 mark is what
+  // put the row here), so no further gate belongs on the read. Contrast
+  // /inbox/awaiting-nod directly above, which IS gated: that queue exists to be
+  // ACTED on by a triager, this one to be BROWSED by anyone.
+  //
+  // DECLARED BEFORE `GET /inbox/:id` DELIBERATELY — and this ordering is
+  // load-bearing, not stylistic. Express matches in declaration order, so with
+  // the routes the other way round `/inbox/sparks` binds `:id = 'sparks'` and
+  // parseId turns the whole queue into a 400 bad_id. Same reason
+  // /inbox/awaiting-nod sits above it. tests/idea_spark_queue.mjs pins the
+  // relative order so a future insertion cannot quietly re-shadow it.
+  //
+  // rank: any-builder — a pickup surface is public to builders (the R144 mark is
+  // the consent). Deliberately NOT pinned in route-rank-check: a read with no
+  // gate to protect has no downgrade to catch, and pinning it would only assert
+  // that a read stays open.
+  router.get('/inbox/sparks', api.requireBuilder, api.asyncHandler('GET /inbox/sparks', async (req, res) => {
+    const limitRaw = Number(req.query.limit);
+    const limit = Number.isInteger(limitRaw) && limitRaw > 0 && limitRaw <= 100 ? limitRaw : 50;
+    // Both halves take the viewer's rank so the pill can never claim sparks the
+    // list will not show (the countRoutedAwaitingNod precedent).
+    const viewerRank = req.builder && req.builder.rank;
+    const [sparks, count] = await Promise.all([
+      inbox.listSparkQueue({ limit, viewerRank }),
+      inbox.countSparkQueue({ viewerRank }),
+    ]);
+    return res.json({ sparks, count });
+  }, { errorCode: 'spark_queue_failed' }));
   // rank: any-builder — single idea read for the "#NNN" deep-link resolver
   // (#1047). Mirrors GET /blockers/:id. The hall resolves /#/idea/N by id, but
   // the /inbox LIST returns only the open-first-50, so a closed/older idea ref

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.295",
+  "version": "1.19.296",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.19.295",
+      "version": "1.19.296",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.295",
+  "version": "1.19.296",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/scripts/gds/spark.js

@@ -13,7 +13,15 @@
 // grade='spark' for the same reason). The builders-hall control is R154; this is
 // the terminal path, and the two hit the same route.
 //
+// --list is the other side of the same idea: the SPARK QUEUE (task 1002921 /
+// BV1.R145) — what other builders have marked as needing development. It lives
+// here rather than in its own script because "mark it" and "see what is marked"
+// are one mental model, and a queue nobody can read is not a pickup surface. The
+// queue is readable by ANY builder: the author's mark is already the consent.
+//
 // Usage:
+//   node scripts/gds/spark.js --list           # the spark queue: what awaits development
+//   node scripts/gds/spark.js --list --limit 10
 //   node scripts/gds/spark.js 123              # mark idea 123 as a spark
 //   node scripts/gds/spark.js 123 --undo       # withdraw the mark (back to quick)
 //
@@ -22,7 +30,7 @@
 //   1  api / network error, or the server refused (not yours / not a quick idea)
 //   2  bad invocation
 
-const { cliClient, requireSession, hasFlag } = require('./cli-lib');
+const { cliClient, requireSession, hasFlag, arg, hallBase } = require('./cli-lib');
 
 // The server's refusals, in the ideator's own words. Anything unmapped falls
 // through to the raw envelope — a new server-side rule should be visible, not
@@ -56,15 +64,58 @@ function explain(status, data) {
   return `spark failed (${status}): ${rendered}`;
 }
 
+// Render the queue. Kept separate from the fetch so it is testable without a
+// session, and so the empty case reads as an answer ("nothing is waiting")
+// rather than as a blank screen that looks like a failure.
+function renderQueue({ sparks, count }) {
+  const lines = [];
+  if (!sparks || sparks.length === 0) {
+    lines.push('No sparks are awaiting development.');
+    lines.push('A spark is a quick idea whose AUTHOR marked it as needing development —');
+    lines.push('mark one of your own with: node scripts/gds/spark.js <idea-id>');
+    return lines.join('\n');
+  }
+  const shown = sparks.length;
+  const total = Number.isInteger(count) ? count : shown;
+  lines.push(`${total} spark${total === 1 ? '' : 's'} awaiting development${shown < total ? ` (showing ${shown})` : ''}:`);
+  lines.push('');
+  for (const s of sparks) {
+    // The hall link, never a bare "#NNN" — that autolinks to a GitHub issue and
+    // 404s, since our idea ids are not GitHub's (the CLAUDE.md refs rule).
+    lines.push(`  ${hallBase()}/#/idea/${s.id}`);
+    lines.push(`    ${s.title}`);
+    const who = s.filed_by_login ? `@${s.filed_by_login}` : 'an unnamed builder';
+    lines.push(`    had by ${who}${s.captured_at ? ` · ${String(s.captured_at).slice(0, 10)}` : ''}`);
+    lines.push('');
+  }
+  lines.push('Develop one into a Full Idea and the author keeps the attribution.');
+  return lines.join('\n');
+}
+
+async function listQueue() {
+  const api = await cliClient();
+  const limitRaw = arg('--limit');
+  const limit = limitRaw != null && /^[0-9]+$/.test(limitRaw) ? Number(limitRaw) : null;
+  const r = await api.inbox.getInboxSparks(limit ? { query: { limit } } : {});
+  if (!r.ok) {
+    console.error(explain(r.status, r.data));
+    process.exit(1);
+  }
+  console.log(renderQueue(r.data || {}));
+}
+
 async function main() {
   await requireSession();
 
+  if (hasFlag('--list')) return listQueue();
+
   const positional = process.argv.slice(2).filter((a) => !a.startsWith('-'));
   const id = Number(positional[0]);
   const undo = hasFlag('--undo');
 
   if (!Number.isInteger(id) || id <= 0) {
     console.error('usage: node scripts/gds/spark.js <idea-id> [--undo]');
+    console.error('       node scripts/gds/spark.js --list [--limit N]');
     process.exit(2);
   }
 
@@ -90,10 +141,11 @@ async function main() {
   }
 }
 
-// Only explain() is exported — tests/idea_spark_mark.mjs pins its message layer
-// against the real envelope. REFUSALS stays private: it is the message table,
-// reachable through explain(), and a second export would be dead surface.
-module.exports = { explain };
+// explain() and renderQueue() are exported because both are pinned by tests —
+// explain against the real envelope shape, renderQueue for the empty case and the
+// hall-link form. REFUSALS stays private: it is the message table, reachable
+// through explain(), and a third export would be dead surface.
+module.exports = { explain, renderQueue };
 
 if (require.main === module) {
   main().catch((err) => {

package/src/module-api.js

@@ -1017,8 +1017,10 @@ const { validateOrRespond, LIMITS, parseId, asyncHandler, corsPublicGet, parsePa
 //         landed since 1.19.293 with no explicit bump. run 32588977219. (task 1002620)
 //   1.19.295 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
 //         landed since 1.19.294 with no explicit bump. run 32590508145. (task 1002620)
+//   1.19.296 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+//         landed since 1.19.295 with no explicit bump. run 32591155887. (task 1002620)
 // ---------------------------------------------------------------------------
-const CORE_VERSION = '1.19.295'; // CI auto-patch carrier (ADR 0161); see changelog above
+const CORE_VERSION = '1.19.296'; // CI auto-patch carrier (ADR 0161); see changelog above
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('dev-box'); log.info('mounted');

package/tests/idea_spark_queue.mjs

@@ -0,0 +1,225 @@
+// tests/idea_spark_queue.mjs
+//
+// task 1002921 (BV1.R145, goal 1000062) — the spark queue.
+//
+// The done-when, as assertions: the GET returns OPEN sparks NOT YET DEVELOPED,
+// newest first; a DEVELOPED spark leaves the queue; and the queue is readable by
+// ANY builder (a Xenos included — it is a pickup surface, and the author's R144
+// mark is the consent).
+//
+// It also pins two things that are load-bearing but invisible in a passing app:
+// the DECLARATION ORDER against `GET /inbox/:id` (which would otherwise capture
+// the literal "sparks" and 400 the whole queue), and the fact that the count and
+// the list share one predicate — a pill that disagrees with its rows is the
+// classic version of this bug.
+//
+// DB-free the idea_full_capture.mjs way: pool.query patched on the doorway before
+// the modules load, so the REAL SQL is captured and the REAL handler runs.
+//
+// Run:  node tests/idea_spark_queue.mjs
+
+import { strict as assert } from 'node:assert';
+import { createRequire } from 'node:module';
+
+const require = createRequire(import.meta.url);
+const api = require('../src/module-api.js');
+
+let queries = [];
+let listRows = [];
+let countN = 0;
+
+api.pool.query = async (sql, params = []) => {
+  queries.push({ sql, params });
+  if (/COUNT\(\*\)/i.test(sql)) return { rows: [{ n: countN }] };
+  return { rows: listRows };
+};
+
+const inbox = require('../modules/ideas/inbox.js');
+const routesFactory = require('../modules/ideas/routes/inbox.js');
+const router = routesFactory({});
+
+const mounted = router.stack.filter((l) => l.route)
+  .map((l) => `${Object.keys(l.route.methods)[0].toUpperCase()} ${l.route.path}`);
+
+function handlerFor(pathStr, method) {
+  const layer = router.stack.find((l) => l.route && l.route.path === pathStr && l.route.methods[method]);
+  assert.ok(layer, `route ${method.toUpperCase()} ${pathStr} is not mounted`);
+  const stack = layer.route.stack.map((s) => s.handle);
+  return stack[stack.length - 1];
+}
+const getSparks = handlerFor('/inbox/sparks', 'get');
+
+function call({ query = {}, rank = 'metic' } = {}) {
+  return new Promise((resolve, reject) => {
+    const req = { params: {}, body: {}, query, builder: { id: '9', rank } };
+    const res = {
+      statusCode: 200,
+      status(c) { this.statusCode = c; return this; },
+      json(payload) { resolve({ status: this.statusCode, payload }); },
+      fail(code, status, extra) {
+        const s = typeof status === 'number' ? status : (status && status.status) || 500;
+        resolve({ status: s, payload: { error: code, ...(extra || {}) } });
+      },
+    };
+    Promise.resolve(getSparks(req, res, (err) => reject(err || new Error('next() called')))).catch(reject);
+  });
+}
+
+const listSql = () => queries.find((q) => !/COUNT\(\*\)/i.test(q.sql));
+const countSql = () => queries.find((q) => /COUNT\(\*\)/i.test(q.sql));
+
+let passed = 0;
+let failed = 0;
+async function test(name, fn) {
+  queries = [];
+  listRows = [];
+  countN = 0;
+  try { await fn(); passed++; console.log(`  ok  ${name}`); }
+  catch (err) { failed++; console.error(`  FAIL ${name}\n    ${err.message}`); }
+}
+
+// --- declaration order: the bug that would 400 the whole queue -----------
+
+await test('GET /inbox/sparks is declared BEFORE GET /inbox/:id', () => {
+  const iSparks = mounted.indexOf('GET /inbox/sparks');
+  const iId = mounted.indexOf('GET /inbox/:id');
+  assert.ok(iSparks >= 0, 'the spark queue route is mounted');
+  assert.ok(iId >= 0, 'the by-id read is mounted');
+  assert.ok(
+    iSparks < iId,
+    `declaration order is load-bearing: with :id first, "/inbox/sparks" binds id="sparks" and parseId 400s the queue (sparks@${iSparks}, :id@${iId})`,
+  );
+});
+
+// --- the predicate: open, undeveloped sparks, newest first ---------------
+
+await test('the queue asks for grade=spark AND status=open — nothing else', async () => {
+  const r = await call();
+  assert.equal(r.status, 200);
+  const sql = listSql().sql;
+  assert.match(sql, /g\.grade = 'spark'/, 'only sparks');
+  assert.match(sql, /i\.status = 'open'/, 'only open ideas');
+});
+
+await test('a DEVELOPED spark leaves the queue by GRADE, with no `developed` flag', async () => {
+  await call();
+  const sql = listSql().sql;
+  // R146 develops in place and flips the grade spark→full, so grade='spark' IS
+  // "not yet developed". A second source of truth could disagree with the grade.
+  assert.doesNotMatch(sql, /developed/i, 'no separate developed column/flag');
+  assert.doesNotMatch(sql, /promoted_to_task_id\s*IS\s*NULL/i, 'exit is the grade flip, not a promote link');
+});
+
+await test('newest first, with a stable tiebreak', async () => {
+  await call();
+  assert.match(listSql().sql, /ORDER BY i\.captured_at DESC, i\.id DESC/);
+});
+
+await test('an INNER join from ideas_grades — a spark is never implicit', async () => {
+  await call();
+  const sql = listSql().sql;
+  // Inverted from every other idea read on purpose: absence of a grade row means
+  // 'quick', so a spark ALWAYS has a real row, and starting from ideas_grades
+  // lets ideas_grades_grade_score_idx drive the scan.
+  assert.match(sql, /FROM ideas_grades g/, 'driven by the graded table');
+  assert.match(sql, /JOIN idea_inbox i ON i\.id = g\.idea_id/);
+  assert.doesNotMatch(sql, /LEFT JOIN ideas_grades/, 'not the COALESCE-to-quick read shape');
+});
+
+await test('the author is named — attribution is the point of a pickup surface', async () => {
+  listRows = [{ id: '5', title: 'a spark', captured_by: '3', grade: 'spark', filed_by_login: 'someone' }];
+  const r = await call();
+  assert.match(listSql().sql, /github_login/);
+  assert.equal(r.payload.sparks[0].filed_by_login, 'someone');
+});
+
+// --- the count cannot disagree with the list ----------------------------
+
+await test('count and list share ONE predicate', async () => {
+  countN = 7;
+  const r = await call();
+  assert.equal(r.payload.count, 7);
+  const l = listSql().sql;
+  const c = countSql().sql;
+  for (const clause of [/g\.grade = 'spark'/, /i\.status = 'open'/]) {
+    assert.match(l, clause);
+    assert.match(c, clause, 'the pill must not claim sparks the list will not show');
+  }
+});
+
+// --- readable by ANY builder -------------------------------------------
+
+await test('a XENOS can read the queue — the R144 mark is the consent', async () => {
+  listRows = [{ id: '5', title: 'a spark', grade: 'spark' }];
+  const r = await call({ rank: 'xenos' });
+  assert.equal(r.status, 200, 'no rank gate on a pickup surface');
+  assert.equal(r.payload.sparks.length, 1);
+});
+
+await test('but the skill-friction visibility gate still applies, to BOTH halves', async () => {
+  await call({ rank: 'xenos' });
+  const l = listSql();
+  const c = countSql();
+  assert.match(l.sql, /i\.title NOT LIKE/, 'a Xenos does not see routine-filed friction rows');
+  assert.match(c.sql, /i\.title NOT LIKE/, 'nor are they counted for them');
+  assert.ok(l.params.some((p) => typeof p === 'string' && p.endsWith('%')));
+
+  queries = [];
+  await call({ rank: 'archon' });
+  assert.doesNotMatch(listSql().sql, /i\.title NOT LIKE/, 'a trusted rank sees everything');
+});
+
+// --- limit -------------------------------------------------------------
+
+await test('limit defaults to 50 and is clamped to 1..100', async () => {
+  await call();
+  assert.equal(listSql().params.at(-1), 50, 'default');
+
+  for (const [given, want] of [['10', 10], ['0', 50], ['-5', 50], ['1000', 50], ['abc', 50], ['100', 100]]) {
+    queries = [];
+    await call({ query: { limit: given } });
+    assert.equal(listSql().params.at(-1), want, `limit=${given}`);
+  }
+});
+
+await test('the count query takes no limit — it counts the whole queue', async () => {
+  await call({ query: { limit: '5' } });
+  assert.equal(countSql().params.length, 0, 'a trusted viewer adds no filter param, and the count never takes the limit');
+});
+
+// --- the CLI's rendering of the queue ------------------------------------
+
+const { renderQueue } = require('../scripts/gds/spark.js');
+
+await test('the empty queue reads as an ANSWER, not a blank screen', () => {
+  const out = renderQueue({ sparks: [], count: 0 });
+  assert.match(out, /No sparks are awaiting development/);
+  assert.match(out, /mark one of your own/, 'it says what to do next');
+});
+
+await test('each row links to the HALL, never a bare #NNN', () => {
+  const out = renderQueue({
+    sparks: [{ id: '812', title: 'a thought', filed_by_login: 'someone', captured_at: '2026-08-20T10:11:12Z' }],
+    count: 1,
+  });
+  // A bare "#NNN" autolinks to a GitHub issue and 404s — our ids are not
+  // GitHub's. The hall deep-link resolver form is /builders/#/idea/N.
+  assert.match(out, /\/builders\/#\/idea\/812/);
+  assert.doesNotMatch(out, /(^|[^/])#812\b/, 'no bare ref');
+  assert.match(out, /@someone/, 'the author is named');
+  assert.match(out, /2026-08-20/);
+});
+
+await test('a missing author degrades to prose, not "@undefined"', () => {
+  const out = renderQueue({ sparks: [{ id: '1', title: 't', filed_by_login: null }], count: 1 });
+  assert.match(out, /an unnamed builder/);
+  assert.doesNotMatch(out, /undefined|null/);
+});
+
+await test('the header distinguishes "showing N" from the true total', () => {
+  assert.match(renderQueue({ sparks: [{ id: '1', title: 't' }], count: 5 }), /5 sparks awaiting development \(showing 1\)/);
+  assert.match(renderQueue({ sparks: [{ id: '1', title: 't' }], count: 1 }), /^1 spark awaiting development:/m, 'singular, no "showing"');
+});
+
+console.log(`\nidea_spark_queue: ${passed} passed, ${failed} failed`);
+if (failed > 0) process.exit(1);