@bongos/core 1.19.296 → 1.19.297

package/.bongos-core.json

@@ -2,22 +2,22 @@
   "artifact": "bongos-core",
   "manifest_schema": 1,
   "generator": "scripts/gds/package-core.js",
-  "core_version": "1.19.296",
-  "core_contract": "1.19.296",
-  "source_commit": "a0c264baf117184273d9a83f7c158844920f1d48",
+  "core_version": "1.19.297",
+  "core_contract": "1.19.297",
+  "source_commit": "1f1b380614ecad230b7399a63883dd4aa65a5c51",
   "source_ref": "HEAD",
-  "built_at": "2026-08-22T18:35:34.578Z",
+  "built_at": "2026-08-22T19:02:34.784Z",
   "redaction": {
     "model": "docs-redacted+functional-verbatim",
     "docs_redacted": 321,
     "agent_docs_stubbed": 22,
-    "functional_verbatim": 1398,
+    "functional_verbatim": 1400,
     "rules": 3,
     "gate_literals": 3,
     "gate": "passed"
   },
-  "file_count": 1741,
-  "tree_sha256": "a34c536a2753b233ccd552b62e7fcfbe3768304013f4130c641a9bb51d7e51d5",
+  "file_count": 1743,
+  "tree_sha256": "39da631b7c0c17d3b63eb793e9e7b624bf55dbe877a2bdd2a568608076258bf7",
   "files": [
     {
       "path": ".claude/skills/blocker-review/SKILL.md",
@@ -347,12 +347,12 @@
     {
       "path": "clients/bongos-client/README.md",
       "mode": "0000644",
-      "sha256": "cc15a1c79d2dd761b8b50190f72d69b2ccec0a56bdd812a82913213a4b811da6"
+      "sha256": "6e44e5da05194cc5aae1784d591d5f560dc36527939eda359de794e3d29fdb37"
     },
     {
       "path": "clients/bongos-client/bongos-client.global.js",
       "mode": "0000644",
-      "sha256": "b2add6cdda6bf67a34a33864f5c6c0a1bdaf7f3ac21314800d222b5f4be55eb5"
+      "sha256": "b05f34f719999b987f9ea6dcecec7bed016a0486ffb43a2ba95fcabbbe7457db"
     },
     {
       "path": "clients/bongos-client/examples/hello-world.mjs",
@@ -362,17 +362,17 @@
     {
       "path": "clients/bongos-client/index.cjs",
       "mode": "0000644",
-      "sha256": "b6f803fa3594804e6781eab762eb91241c9146c1e3aa09a8883dd8015a55dc3b"
+      "sha256": "5fbf0ea8c5b9eba86cc1d471407d8f4bb1df23af72d4fe7a618576bf67233a14"
     },
     {
       "path": "clients/bongos-client/index.d.ts",
       "mode": "0000644",
-      "sha256": "ee350739d64eb2ddce22fa0378ece2eebc363eae96c7755f087363b87e9581fe"
+      "sha256": "db6c391a39f2caea99486c5f03993b0cc52e3506835d750a28a4a0b2108bb441"
     },
     {
       "path": "clients/bongos-client/index.mjs",
       "mode": "0000644",
-      "sha256": "9f4db5e5579a3e401a9d56ee473436b8c6cd00e82f209de784c321131f6e420d"
+      "sha256": "5ef5dcc11f3713394c6a6225c4206ef8955b27b17c95a47fd51ca43b7965729f"
     },
     {
       "path": "clients/bongos-client/package.json",
@@ -1412,12 +1412,12 @@
     {
       "path": "docs/api-reference.md",
       "mode": "0000644",
-      "sha256": "f7102579bfe64bb798e9ebc826849857218da439113c6f7b049cfc9a580f863f"
+      "sha256": "0c2b5d0fd5e05cbe3b3c06ab10baf7e6af0414d85599519e3ef2eb289008b672"
     },
     {
       "path": "docs/api/openapi.json",
       "mode": "0000644",
-      "sha256": "a3d866c17cdb60660fb7603de26faccb0fd0fa345e47c26d9703e2fc1fdbfd40"
+      "sha256": "ef7e4fbdb912b077c49b15e7ba0dd6333196fe0d82d4462a83c507669fd82767"
     },
     {
       "path": "docs/architecture.md",
@@ -1552,7 +1552,7 @@
     {
       "path": "docs/file-map.md",
       "mode": "0000644",
-      "sha256": "9a2f67ab5989d068060bfe336d17ae88a33484fa8cbb5a92f23534b1c6de6289"
+      "sha256": "b017e7a4425f92cc5cbec8d0a5fc192e3225794fb97955acb3689b12dc0de667"
     },
     {
       "path": "docs/handoff-template.md",
@@ -2807,7 +2807,7 @@
     {
       "path": "modules/dev-box/app/src/vendor/bongos-client.cjs",
       "mode": "0000644",
-      "sha256": "b6f803fa3594804e6781eab762eb91241c9146c1e3aa09a8883dd8015a55dc3b"
+      "sha256": "5fbf0ea8c5b9eba86cc1d471407d8f4bb1df23af72d4fe7a618576bf67233a14"
     },
     {
       "path": "modules/dev-box/app/test/unit.mjs",
@@ -3707,7 +3707,7 @@
     {
       "path": "modules/ideas/inbox.js",
       "mode": "0000644",
-      "sha256": "33a25e6bd24ee0952c03e2aeab3e1edb68f8cf84989ee04206c9efdb7d202fa7"
+      "sha256": "ceaa172a8e0338dd9202dae6abea8a5278594937bd980ddaf9ac2b2017b555a4"
     },
     {
       "path": "modules/ideas/migrations/ideas_001_grades.sql",
@@ -3729,6 +3729,11 @@
       "mode": "0000644",
       "sha256": "eb1393f0ee8dccc57efcfe0acd0fdac7857389b74e0cb734042bb4293768b8e8"
     },
+    {
+      "path": "modules/ideas/migrations/ideas_005_grade_developed_by.sql",
+      "mode": "0000644",
+      "sha256": "3c7a48505c922bd0742888bc9c0598d776a4de0cc3d2745bd08d6452e07f34b9"
+    },
     {
       "path": "modules/ideas/module.json",
       "mode": "0000644",
@@ -3742,7 +3747,7 @@
     {
       "path": "modules/ideas/routes/inbox.js",
       "mode": "0000644",
-      "sha256": "7de2735020ddd526ded8ca252fbfba157ee5eb174895660d37ac713b9d0d6fd2"
+      "sha256": "eafc7ff6f4d9567813cefe2b47333caa4ab79b77ab979e77eb65ac88102a78f1"
     },
     {
       "path": "modules/ideas/routing.js",
@@ -4537,12 +4542,12 @@
     {
       "path": "package-lock.json",
       "mode": "0000644",
-      "sha256": "b937444a6338c17ae2692d47f126d612f87c2429783a3d9a95e4c5d6076f3f5b"
+      "sha256": "9fea7a7292ec0de1ea5fea27ec984796c150ed75f0e94e30eca8837f55cbcee6"
     },
     {
       "path": "package.json",
       "mode": "0000644",
-      "sha256": "ce72a3e5a70ae07f431f223dccf12d2c896474bcb1f0d62724aea22206b23dde"
+      "sha256": "8b60b6155a3fd2c2d0110df0404319a6a5da35eeed3ee8d60f61ae009672ed35"
     },
     {
       "path": "public-docs/index.html",
@@ -5782,7 +5787,7 @@
     {
       "path": "scripts/gds/spark.js",
       "mode": "0000755",
-      "sha256": "61ad614ec3fb8cbfc98d815629fd3ccafd179a8f2c058539103c9bf4e23e9504"
+      "sha256": "dfd5aa72caa26eb2c8cf3063e1b4f51e1f4bcd7fddcdd93d243279c130850628"
     },
     {
       "path": "scripts/gds/start.js",
@@ -6197,7 +6202,7 @@
     {
       "path": "src/module-api.js",
       "mode": "0000644",
-      "sha256": "e5f489e0d2b9cc6d9c73cc853132a8a7a7e3fbcd8ea2325284d58143d4020a05"
+      "sha256": "2bfcc90c50b5fd0945b97179e4445602f145896dd1821066cabcd411a8d7a9d9"
     },
     {
       "path": "src/module-loader/catalog.js",
@@ -7484,6 +7489,11 @@
       "mode": "0000644",
       "sha256": "7e2024b3f1fa79a6bdec55b134be6337d4867df0a77fedb205f32b783a3d6193"
     },
+    {
+      "path": "tests/idea_develop_spark.mjs",
+      "mode": "0000644",
+      "sha256": "03d2f692eaa02e85a5f53e89527d4ea1a20c032d4801e2a7acd421eda12ce76c"
+    },
     {
       "path": "tests/idea_full_capture.mjs",
       "mode": "0000644",
@@ -7522,7 +7532,7 @@
     {
       "path": "tests/idea_spark_queue.mjs",
       "mode": "0000644",
-      "sha256": "6bea289f0473d07e21acd0b45b50511f061d8d1f0d09b7437a909081ea83344a"
+      "sha256": "43f801610e37062c54e631904aecaa10aa2486139aba3aa9eeb820d84fd32368"
     },
     {
       "path": "tests/idea_task_lineage.mjs",

package/clients/bongos-client/README.md

@@ -5,7 +5,7 @@ A **generated**, zero-dependency typed client for the Bongos API — produced fr
 by hand; it regenerates when the spec changes, so it can never drift from the routes.
 
 - API version: **v1** (served at `/api/bongos/v1`)
-- 297 operations across 47 resource groups
+- 298 operations across 47 resource groups
 
 ## Install
 

package/clients/bongos-client/bongos-client.global.js

@@ -405,6 +405,8 @@ function createClient(opts = {}) {
       patchInboxId: (args) => request("PATCH", "/inbox/{id}", { hasBody: true }, args),
       // PATCH /inbox/{id}/body — rank: any-builder — PATCH /inbox/:id/body
       patchInboxIdBody: (args) => request("PATCH", "/inbox/{id}/body", { hasBody: true }, args),
+      // POST /inbox/{id}/develop — rank: any-builder — POST /inbox/:id/develop
+      postInboxIdDevelop: (args) => request("POST", "/inbox/{id}/develop", { hasBody: true }, args),
       // POST /inbox/{id}/ratify — rank: metic+archon — POST /inbox/:id/ratify
       postInboxIdRatify: (args) => request("POST", "/inbox/{id}/ratify", { hasBody: true }, args),
       // POST /inbox/{id}/resubmit — rank: any-builder — POST /inbox/:id/resubmit

package/clients/bongos-client/index.cjs

@@ -404,6 +404,8 @@ function createClient(opts = {}) {
       patchInboxId: (args) => request("PATCH", "/inbox/{id}", { hasBody: true }, args),
       // PATCH /inbox/{id}/body — rank: any-builder — PATCH /inbox/:id/body
       patchInboxIdBody: (args) => request("PATCH", "/inbox/{id}/body", { hasBody: true }, args),
+      // POST /inbox/{id}/develop — rank: any-builder — POST /inbox/:id/develop
+      postInboxIdDevelop: (args) => request("POST", "/inbox/{id}/develop", { hasBody: true }, args),
       // POST /inbox/{id}/ratify — rank: metic+archon — POST /inbox/:id/ratify
       postInboxIdRatify: (args) => request("POST", "/inbox/{id}/ratify", { hasBody: true }, args),
       // POST /inbox/{id}/resubmit — rank: any-builder — POST /inbox/:id/resubmit

package/clients/bongos-client/index.d.ts

@@ -246,6 +246,7 @@ export interface PostGovernmentBoardItemsResponse { ok: boolean; amendment: unkn
 export interface PostGovernmentRanksRankKeyResetResponse { ok: boolean; rank_key: unknown; seeded_rank: unknown; permission_count: unknown }
 export interface PostGovernmentRanksRequest { rank_key: string; label: string; description?: string }
 export interface PostGovernmentRanksResponse { rank: unknown }
+export interface PostInboxIdDevelopRequest { field_values: Record<string, unknown>; template_key?: string }
 export interface PostInboxIdRatifyRequest { notes_md?: string }
 export interface PostInboxIdResubmitRequest { field_values: Record<string, unknown>; template_key?: string }
 export interface PostInboxIdSparkResponse { idea: unknown; sparked: boolean; unchanged: boolean }
@@ -668,6 +669,8 @@ export interface BongosClient {
     patchInboxId(args?: RequestArgs & { body?: PatchInboxIdRequest }): Promise<PatchInboxIdResponse>;
     /** PATCH /inbox/{id}/body — rank: any-builder */
     patchInboxIdBody(args: RequestArgs & { body: PatchInboxIdBodyRequest }): Promise<PatchInboxIdBodyResponse>;
+    /** POST /inbox/{id}/develop — rank: any-builder */
+    postInboxIdDevelop(args: RequestArgs & { body: PostInboxIdDevelopRequest }): Promise<ApiResponse>;
     /** POST /inbox/{id}/ratify — rank: metic+archon */
     postInboxIdRatify(args?: RequestArgs & { body?: PostInboxIdRatifyRequest }): Promise<ApiResponse>;
     /** POST /inbox/{id}/resubmit — rank: any-builder */

package/clients/bongos-client/index.mjs

@@ -401,6 +401,8 @@ export function createClient(opts = {}) {
       patchInboxId: (args) => request("PATCH", "/inbox/{id}", { hasBody: true }, args),
       // PATCH /inbox/{id}/body — rank: any-builder — PATCH /inbox/:id/body
       patchInboxIdBody: (args) => request("PATCH", "/inbox/{id}/body", { hasBody: true }, args),
+      // POST /inbox/{id}/develop — rank: any-builder — POST /inbox/:id/develop
+      postInboxIdDevelop: (args) => request("POST", "/inbox/{id}/develop", { hasBody: true }, args),
       // POST /inbox/{id}/ratify — rank: metic+archon — POST /inbox/:id/ratify
       postInboxIdRatify: (args) => request("POST", "/inbox/{id}/ratify", { hasBody: true }, args),
       // POST /inbox/{id}/resubmit — rank: any-builder — POST /inbox/:id/resubmit

package/docs/api/openapi.json

@@ -6524,6 +6524,62 @@
         ]
       }
     },
+    "/inbox/{id}/develop": {
+      "post": {
+        "operationId": "post_inbox_id_develop",
+        "tags": [
+          "inbox"
+        ],
+        "summary": "POST /inbox/:id/develop",
+        "description": "POST /inbox/:id/develop — DEVELOP A SPARK INTO A FULL IDEA (task 1002922 / BV1.R146, goal 1000062). The pickup half of the handoff R144 and R145 set up: the author consented by marking the spark, the queue made it findable, and now another builder fills in the five template fields and the thought becomes a Full Idea. OPEN TO ANY BUILDER, INCLUDING THE AUTHOR. Cross-builder development is the entire point, so there is no author check here — the mirror image of R144, where the gate was the whole feature. The consent was already given and is already recorded (this row is a spark BECAUSE its author said so), and re-asking for it would make the queue unpickable. Self-development is likewise legal: an author may mark a thought and come back to it themselves. ONLY A SPARK CAN BE DEVELOPED, and \"only once\" is enforced by the DATABASE, not by this handler. developSpark's UPDATE carries `AND grade = 'spark'`, so two builders picking the same spark off the queue at the same instant cannot both succeed — the second matches zero rows. The pre-read below exists ONLY to tell a 404 apart from a 409 and to give a useful message; it is not the guard, and it deliberately does not try to be. WHAT THIS ROUTE DELIBERATELY DOES NOT DO: pay the stream-2 \"Full Idea passed\" credit. Capture and resubmit both fire it, but on those paths the recipient is unambiguously the author. Here there are two people, and choosing between them is R147's job (task 1002923 — \"karma for a ratified Full Idea, scaled by completeness and SPLIT WITH THE SPARK AUTHOR\"). Firing it here would not just pre-empt that decision, it would corrupt it: awardIdeaFullPassCredit's idempotency predicate is (builder_id, `idea.credit.full_pass:<id>`), so a payment to the DEVELOPER does not block a later payment to the AUTHOR — one idea would pay twice. The credit is idempotent per idea+builder, so R147 can still pay it at the right time, to the right people, in the right shares. The board window IS opened, because it is recipient-agnostic (it takes an idea and a score, not a builder) and without it a developed Full Idea could never reach ratification — the handoff would dead-end one step from done. Fail-open like every other caller of that port. rank: any-builder — development is the pickup, and the author's mark is the consent. Deliberately NOT pinned in route-rank-check: there is no gate here to protect, and pinning it would only assert that an open route stays open.\n\n**Rank:** `any-builder` — Any authenticated builder (row-level ownership enforced in-handler).",
+        "x-rank": "any-builder",
+        "x-source": "modules/ideas/routes/inbox.js",
+        "parameters": [
+          {
+            "name": "id",
+            "in": "path",
+            "required": true,
+            "schema": {
+              "type": "string"
+            },
+            "description": "Path parameter `id`."
+          }
+        ],
+        "requestBody": {
+          "required": true,
+          "content": {
+            "application/json": {
+              "schema": {
+                "$ref": "#/components/schemas/PostInboxIdDevelopRequest"
+              }
+            }
+          },
+          "x-validated": true
+        },
+        "responses": {
+          "200": {
+            "description": "Success."
+          },
+          "400": {
+            "$ref": "#/components/responses/ValidationFailed"
+          },
+          "401": {
+            "$ref": "#/components/responses/Unauthorized"
+          },
+          "403": {
+            "$ref": "#/components/responses/Forbidden"
+          },
+          "404": {
+            "$ref": "#/components/responses/NotFound"
+          }
+        },
+        "security": [
+          {
+            "builderSession": []
+          }
+        ]
+      }
+    },
     "/inbox/{id}/ratify": {
       "post": {
         "operationId": "post_inbox_id_ratify",
@@ -16997,6 +17053,22 @@
           "rank"
         ]
       },
+      "PostInboxIdDevelopRequest": {
+        "type": "object",
+        "properties": {
+          "field_values": {
+            "type": "object"
+          },
+          "template_key": {
+            "type": "string",
+            "maxLength": 64
+          }
+        },
+        "required": [
+          "field_values"
+        ],
+        "additionalProperties": false
+      },
       "PostInboxIdRatifyRequest": {
         "type": "object",
         "properties": {
@@ -18756,8 +18828,8 @@
       "description": "A required dependency/feature is not configured or is temporarily down."
     }
   },
-  "x-endpoint-count": 297,
-  "x-schema-count": 330,
+  "x-endpoint-count": 298,
+  "x-schema-count": 331,
   "x-undocumented-bodies": 8,
   "x-response-schemas": 221,
   "x-generated-by": "scripts/gds/gen-api-docs.js"

package/docs/api-reference.md

@@ -2,7 +2,7 @@
 
 # Bongos API reference
 
-> **Generated from the live route files** — the route file is authoritative. 297 endpoints across 47 route files.
+> **Generated from the live route files** — the route file is authoritative. 298 endpoints across 47 route files.
 > Machine-readable spec: [`docs/api/openapi.json`](api/openapi.json) (OpenAPI 3.1). Rendered docs site: **`/docs`** (e.g. `cloudbongos.com/docs`).
 
 Base path: `/api/bongos`. Ranks (enforced server-side, [ADR 0016](adr/<redacted>.md)): `public` < `any-builder` < `metic+archon` < `archon`.
@@ -258,7 +258,7 @@ Base path: `/api/bongos`. Ranks (enforced server-side, [ADR 0016](adr/<redacted>
 |---|---|---|---|---|
 | GET | `/api/bongos/healthz` | `public` | — | liveness probe; status.example.com hits this anonymously. |
 
-## `inbox` (11)
+## `inbox` (12)
 
 | Method | Path | Rank | Body | Description |
 |---|---|---|---|---|
@@ -267,6 +267,7 @@ Base path: `/api/bongos`. Ranks (enforced server-side, [ADR 0016](adr/<redacted>
 | GET | `/api/bongos/inbox/:id` | `any-builder` | — | single idea read for the "#NNN" deep-link resolver (task 1047). |
 | PATCH | `/api/bongos/inbox/:id` | `metic+archon` | `status`, `kind`, `promoted_to_task_id`, `reviewed_at`, `merged_into_idea_id`, `triage_note` |  |
 | PATCH | `/api/bongos/inbox/:id/body` | `any-builder` | `body_md` | Metic+ (task 360 / ADR 0018): idea triage (promote/discard/merge) shapes the backlog. |
+| POST | `/api/bongos/inbox/:id/develop` | `any-builder` | `field_values`, `template_key` | POST /inbox/:id/develop — DEVELOP A SPARK INTO A FULL IDEA (task 1002922 / BV1.R146, goal 1000062). |
 | POST | `/api/bongos/inbox/:id/ratify` | `metic+archon` | `notes_md` | V3.R31 (task 252) — Archon ratifies a criterion-proposal idea, atomically: - INSERT done_when_criteria row on the target version - UPDATE… |
 | POST | `/api/bongos/inbox/:id/resubmit` | `any-builder` | `field_values`, `template_key` | RESUBMIT a Full Idea after a rejection (R13 of goal 1000069, criterion C2: an idea never dies and never stalls). |
 | POST | `/api/bongos/inbox/:id/spark` | `any-builder` | — | Mark a Quick Idea as a Big Idea Spark — "I have the spark but not the full picture, someone develop this". |

package/docs/file-map.md

@@ -175,7 +175,7 @@
 │       ├── smoke-box.sh         ← (#598) hermetic box-lifecycle smoke (no DB/DO/network): runs tests/boxes.mjs + tests/cf_tunnel.mjs (#771 named tunnel) + route-rank + module-load
 │       ├── recall.js            ← `/recall` CLI: two-call progressive-disclosure search (summary → `--expand <id>`) over Bongos retrieval layer (ADR 0060); `node scripts/gds/recall.js <query>`
 │       ├── capture.js           ← file an idea_inbox row from the CLI (the ideas.capture kernel port); backs the "capture a tangent" flow across skills
-│       ├── spark.js            ← (tasks 1002920 / R144 + 1002921 / R145) mark one of your OWN quick ideas as a Big Idea Spark — "someone develop this"; `--undo` withdraws it; `--list` is the SPARK QUEUE (what awaits development, readable by any builder). Author-only server-side for the mark (it is the consent); its own command because sparking acts on an EXISTING idea, which is why capture.js refuses grade='spark'
+│       ├── spark.js            ← (tasks 1002920 / R144 + 1002921 / R145 + 1002922 / R146) the whole spark handoff from the terminal: mark one of your OWN quick ideas as a Big Idea Spark (`--undo` withdraws it), `--list` is the SPARK QUEUE, `--template` prints the five Full Idea fields, `--develop <id> --fields-file <json>` is the PICKUP (any builder; author + developer both recorded). Author-only server-side for the mark (it is the consent); its own command because sparking acts on an EXISTING idea, which is why capture.js refuses grade='spark'
 │       ├── worktree.js          ← (task 1002809) junction-safe worktree add/remove/list — outside-repo worktrees get a node_modules junction via node (no shell quoting), removed BEFORE `git worktree remove`
 │       ├── learning-capture.js  ← file a `learnings` row (DB-backed short-form rule capture, replacing hand-edited recipe files for a single gotcha)
 │       ├── docs-entropy.js      ← ([#…] docs-entropy) markdown-corpus linter: broken internal links + cross-file duplicate-prose detector across every tracked `.md`; `--verbose` / `--file-ideas`

package/modules/dev-box/app/src/vendor/bongos-client.cjs

@@ -404,6 +404,8 @@ function createClient(opts = {}) {
       patchInboxId: (args) => request("PATCH", "/inbox/{id}", { hasBody: true }, args),
       // PATCH /inbox/{id}/body — rank: any-builder — PATCH /inbox/:id/body
       patchInboxIdBody: (args) => request("PATCH", "/inbox/{id}/body", { hasBody: true }, args),
+      // POST /inbox/{id}/develop — rank: any-builder — POST /inbox/:id/develop
+      postInboxIdDevelop: (args) => request("POST", "/inbox/{id}/develop", { hasBody: true }, args),
       // POST /inbox/{id}/ratify — rank: metic+archon — POST /inbox/:id/ratify
       postInboxIdRatify: (args) => request("POST", "/inbox/{id}/ratify", { hasBody: true }, args),
       // POST /inbox/{id}/resubmit — rank: any-builder — POST /inbox/:id/resubmit

package/modules/ideas/inbox.js

@@ -100,15 +100,22 @@ const FIELD_VALUES_MAX = 32768;
 // The grade half of an idea read: the COALESCE above, plus the template-shaped
 // store and the score. `g.*` columns are NULL for an ungraded idea, which is
 // exactly right — it has no template and no score, it just has a default grade.
+// developed_by/developed_at (ideas_005, task 1002922 / BV1.R146) ride along on
+// EVERY idea read rather than needing a second query: "who developed this" is
+// part of an idea's identity once it has been developed, and the R145 queue, the
+// hall detail view (R153) and the R147 credit split all want it. NULL for the
+// overwhelming majority of rows — a quick idea and a self-authored Full Idea were
+// never developed by anyone — which is the honest answer, not a missing one.
 const GRADE_COLS_Q = `COALESCE(g.grade, '${DEFAULT_GRADE}') AS grade,
-            g.template_key, g.field_values, g.completeness_score`;
+            g.template_key, g.field_values, g.completeness_score,
+            g.developed_by, g.developed_at`;
 const IDEA_JOIN_GRADE = `LEFT JOIN ideas_grades g ON g.idea_id = i.id`;
 
 // The same projection for a row that provably has no grade row yet (a just-
 // INSERTed idea), so INSERT…RETURNING does not need a second round trip to
 // return the same shape every other read returns.
 function ungradedProjection() {
-  return { grade: DEFAULT_GRADE, template_key: null, field_values: null, completeness_score: null };
+  return { grade: DEFAULT_GRADE, template_key: null, field_values: null, completeness_score: null, developed_by: null, developed_at: null };
 }
 
 // -------------------------------------------------------------------------
@@ -951,6 +958,81 @@ async function setIdeaCompleteness(ideaId, completenessScore) {
   return rows[0] ?? null;
 }
 
+// -------------------------------------------------------------------------
+// developSpark — turn a Big Idea Spark into a Full Idea IN PLACE
+// (task 1002922 / BV1.R146, goal 1000062)
+//
+// The pickup half of the spark handoff: R144 recorded the author's consent, R145
+// made the spark findable, and this is another builder filling in the five
+// template fields.
+//
+// IN PLACE, ON THE SAME ROW, AND THAT IS A DONE-WHEN. idea_inbox.id,
+// captured_by and captured_at are NOT touched — only the grade row moves. A new
+// row for the developed version would break the hall's /#/idea/N deep link,
+// ideas_task_lineage.idea_id, and the per-idea credit_log reason key. The
+// author's claim on their own thought is precisely what must survive being
+// developed by someone else; it is what the R147 split pays against.
+//
+// ONE GUARDED UPDATE, WHICH IS WHERE "ONLY ONCE" ACTUALLY LIVES. The predicate
+// carries `AND grade = 'spark'`, so the database decides whether this row was
+// still developable. A read-then-write ("is it a spark? ok, develop it") looks
+// identical in a test and loses a race in production: two builders picking the
+// same spark off the R145 queue at the same moment would both pass the check and
+// the second would overwrite the first's work AND their attribution. Here the
+// second UPDATE matches zero rows and the route turns that into a 409. Zero rows
+// is therefore NOT an error condition to log — it is the answer.
+//
+// It is also why this is not expressed as setIdeaGrade + a second write:
+// two statements cannot carry one guard, and a Full Idea with no recorded
+// developer is the exact state the done-when forbids.
+//
+// THE STATUS HALF OF THE GUARD, AND WHY IT IS NOT REDUNDANT WITH THE ROUTE'S
+// PRE-CHECK. Triage (`updateIdea`) writes idea_inbox.status and NEVER touches
+// ideas_grades — so a spark that a Metic+ triager discards, merges or promotes
+// keeps grade='spark' forever. Grade alone therefore does NOT mean "still
+// developable", and a develop that trusted it would resurrect content the triage
+// flow already decided was dead, opening a fresh board ratification window for
+// it. The R145 queue already filters on status and the R144 mark already requires
+// it; this closes the same hole on the write. In the PREDICATE rather than only
+// in the handler because a triager discarding an idea mid-request is the same
+// class of race as two developers colliding — and the fix for a race is never a
+// check that ran earlier.
+//
+// NOTE ON setIdeaGrade's whole-row contract: developed_by/developed_at are
+// deliberately OUTSIDE it. That contract exists so a grade change cannot inherit
+// stale field_values; but a developer is a historical FACT about who did the
+// work, not current content, and setIdeaGrade's ON CONFLICT SET list omits both
+// columns — so a later re-score or an author's R13 resubmission preserves the
+// developer's attribution instead of silently erasing it.
+async function developSpark(ideaId, { developedBy, templateKey = DEFAULT_TEMPLATE_KEY, fieldValues = {}, completenessScore = null } = {}) {
+  // Reuse the R140 payload validator so a bad template key or an oversize
+  // field_values map is a structured throw here rather than a constraint
+  // violation surfacing as a 500 (the assertGradePayload contract).
+  assertGradePayload({ grade: 'full', templateKey, fieldValues, completenessScore });
+  if (developedBy == null) throw { code: 'MISSING_DEVELOPER' };
+  const { rows } = await pool.query(
+    `UPDATE ideas_grades
+        SET grade              = 'full',
+            template_key       = $2,
+            field_values       = $3::jsonb,
+            completeness_score = $4,
+            developed_by       = $5,
+            developed_at       = now()
+      WHERE idea_id = $1
+        AND grade = 'spark'
+        AND EXISTS (
+          SELECT 1 FROM idea_inbox i WHERE i.id = $1 AND i.status = 'open'
+        )
+      RETURNING idea_id, grade, template_key, field_values, completeness_score,
+                developed_by, developed_at, created_at, updated_at`,
+    [ideaId, templateKey, JSON.stringify(fieldValues), completenessScore, developedBy]
+  );
+  // null = "this row was not a developable spark when we looked". THREE ways to
+  // get here, and the caller re-reads to say which: it was never a spark,
+  // somebody else developed it first, or a triager closed the idea underneath us.
+  return rows[0] ?? null;
+}
+
 // The grade row on its own. null = no row, which reads as grade='quick'
 // everywhere the idea itself is read (see DEFAULT_GRADE).
 async function getIdeaGrade(ideaId) {
@@ -1186,6 +1268,8 @@ module.exports = {
   updateIdeaBody,
   setIdeaGrade,
   setIdeaCompleteness,
+  // develop a spark into a Full Idea, in place (task 1002922, BV1.R146)
+  developSpark,
   // idea → task lineage (task 1002997 / BV1.R173) — the one-idea-many-tasks
   // link stream 1 (IC4) pays against
   linkIdeaTask,

package/modules/ideas/migrations/ideas_005_grade_developed_by.sql

@@ -0,0 +1,85 @@
+-- ideas_005_grade_developed_by.sql — who developed this spark into a Full Idea
+-- (task 1002922, BV1.R146, goal 1000062 "three grades of idea").
+--
+-- WHY. R144 let an author mark a quick idea as a Big Idea Spark ("I have the
+-- spark but not the full picture, someone develop this") and R145 made those
+-- sparks browsable. R146 is the pickup itself: another builder fills in the five
+-- template fields and the spark becomes a Full Idea. The done-when requires the
+-- row to keep its id and its ORIGINAL author while a DISTINCT developer is
+-- recorded — and ideas_grades had nowhere to record the second person. This adds
+-- that place.
+--
+-- WHY IN-PLACE, ON THE SAME ROW. The alternative — a new idea_inbox row for the
+-- developed version — breaks every reference to the original: the hall's
+-- /#/idea/N deep link, ideas_task_lineage.idea_id, the credit_log reason key
+-- `idea.credit.full_pass:<id>`, and any prose that cited it. "References to the
+-- idea never break" is a done-when, so development mutates the grade row and
+-- leaves idea_inbox.id / captured_by / captured_at untouched. That is also why
+-- the developer needs its own column instead of overwriting captured_by: the
+-- author's claim on their own thought is exactly what must survive being
+-- developed by someone else, and it is what the R147 credit split pays against.
+--
+-- WHY developed_at, AND NOT JUST updated_at. ideas_001 put a touch trigger on
+-- this table, so updated_at moves on EVERY later write — a re-score, a
+-- resubmission, a triage-adjacent grade rewrite. An attribution record whose
+-- only timestamp drifts cannot answer "when was this developed", which is the
+-- question the R147 split and any dispute about it will ask. One extra column is
+-- cheaper than an unanswerable question.
+--
+-- SELF-DEVELOPMENT IS LEGAL, SO THERE IS NO developed_by <> captured_by CHECK.
+-- An author may mark their own idea as needing development and then develop it
+-- themselves (they may have had the full picture a week later). Forbidding that
+-- would add a rule the owner never asked for; R147 simply sees a split where
+-- both halves are the same person. The pair-coherence CHECK below is the only
+-- constraint, and it guards a shape this module's own code controls.
+--
+-- Module migrations are ADDITIVE and NAMESPACED: every object here targets the
+-- ideas_-owned ideas_grades table, no down-migration, idempotent (safe to re-run).
+
+BEGIN;
+
+-- ON DELETE SET NULL, matching the builders-FK posture of every other module
+-- table that names a person (agents_001, government_001): losing a builder row
+-- must never cascade away an idea's grade. The attribution degrades to "someone",
+-- which the read path already renders (R145's queue prints "an unnamed builder").
+ALTER TABLE ideas_grades
+  ADD COLUMN IF NOT EXISTS developed_by bigint REFERENCES builders(id) ON DELETE SET NULL;
+
+ALTER TABLE ideas_grades
+  ADD COLUMN IF NOT EXISTS developed_at timestamptz;
+
+-- The two columns are written together by developSpark() and mean nothing apart:
+-- a developer with no timestamp cannot be dated, and a timestamp with no
+-- developer names nobody. Defense in depth against a future partial write.
+ALTER TABLE ideas_grades DROP CONSTRAINT IF EXISTS ideas_grades_developed_pair_chk;
+ALTER TABLE ideas_grades ADD CONSTRAINT ideas_grades_developed_pair_chk
+  CHECK ((developed_by IS NULL) = (developed_at IS NULL));
+
+-- "What has this builder developed?" — the read the R147 credit split walks, and
+-- the one a builder's own profile will want. PARTIAL, because the overwhelming
+-- majority of grade rows have no developer at all (every quick idea, every
+-- self-authored full idea), so indexing them would be paying for empty space.
+CREATE INDEX IF NOT EXISTS ideas_grades_developed_by_idx
+  ON ideas_grades (developed_by)
+  WHERE developed_by IS NOT NULL;
+
+-- SAFETY NET — a migration that cannot prove its own effect must not report
+-- success (the ideas_003 precedent). Read-only, no DDL: if either column is
+-- missing, the ADD silently did nothing and R146's route would fail at runtime
+-- on the one write whose whole job is preserving attribution.
+DO $$
+DECLARE missing text;
+BEGIN
+  SELECT string_agg(c, ', ') INTO missing
+    FROM unnest(ARRAY['developed_by', 'developed_at']) AS c
+   WHERE NOT EXISTS (
+     SELECT 1 FROM information_schema.columns
+      WHERE table_name = 'ideas_grades' AND column_name = c
+   );
+  IF missing IS NOT NULL THEN
+    RAISE EXCEPTION
+      'ideas_005: column(s) % missing from ideas_grades after ADD COLUMN — the migration did not take.', missing;
+  END IF;
+END $$;
+
+COMMIT;