@bongos/core 1.19.296 → 1.19.298

package/modules/economy/credits.js

@@ -334,6 +334,102 @@ async function maybeAwardIdeaPromotionBonus(client, taskId, shipperBuilderId, mu
   };
 }
 
+// -------------------------------------------------------------------------
+// The spark-handoff split (task 1002923 / BV1.R147, goal 1000062; ADR 0185)
+//
+// When one builder develops ANOTHER builder's Big Idea Spark into a Full Idea
+// (R146), two people made the idea: the one who had the thought and said "I do
+// not have the full picture", and the one who wrote out the five fields. Both
+// existing ideator streams paid `captured_by` alone, so the developer earned
+// nothing and the R145 queue had no reason to ever be picked up.
+//
+// OWNER DECISION (2026-08-22): 70% to the DEVELOPER, 30% to the spark author,
+// on BOTH existing streams. The developer takes the larger share because
+// developing someone else's spark is the scarce act the queue depends on — at
+// 50/50 it pays strictly worse than authoring your own Full Idea, so nobody
+// picks anything up. The author is not left thin: they keep 30% here AND the
+// full trailing stream-1 share on every task shipped under the idea forever.
+//
+// A POLICY CONSTANT IN THIS FILE, not a table — the ADR 0172 §Consequences rule
+// ("thresholds/factors are policy constants in credits.js", the ADR 0023
+// precedent): it deserves a review and a commit, not a runtime edit.
+const IDEA_DEVELOPER_SHARE = 0.70;
+
+// splitIdeaCredit — divide one payout between the two parties.
+//
+// THREE PROPERTIES THIS MUST HAVE, each of which is a real bug if missed:
+//
+//  1. THE TOTAL IS CONSERVED. The developer's share is rounded and the author
+//     gets THE REMAINDER — never both rounded independently, which would pay
+//     6 credits out of a 5-credit payout (round(3.5) + round(1.5) = 4 + 2).
+//  2. SELF-DEVELOPMENT COLLAPSES TO ONE PAYEE. R146 deliberately allows an
+//     author to develop their own spark. Emitting two rows for the same builder
+//     would not double-pay — it would UNDER-pay, because the idempotency
+//     predicate is (builder_id, reason) and the second insert is silently
+//     refused, so the builder would receive only one of their two shares.
+//  3. ZERO-VALUE ROWS ARE DROPPED. A 1-credit payout splits to 1/0; booking a
+//     0-credit ledger row is noise that reads like a payment.
+//
+// Pure — no DB, no config. Returns [{ builderId, delta, role }], biggest first.
+function splitIdeaCredit(delta, { authorId, developedBy } = {}) {
+  const total = Math.round(Number(delta) || 0);
+  if (total <= 0 || authorId == null) return [];
+  // IDS PASS THROUGH UNCONVERTED. builder_id is a bigint, which pg hands back as
+  // a STRING; Number()-ing it would risk precision on a large id and would also
+  // change the value type the pre-R147 code fed straight into the INSERT. Only
+  // the COMPARISON below normalises, via String() — a number/string mismatch
+  // between captured_by and developed_by must not become a phantom second payee.
+  if (developedBy == null) {
+    return [{ builderId: authorId, delta: total, role: 'author' }];
+  }
+  if (String(developedBy) === String(authorId)) {
+    return [{ builderId: authorId, delta: total, role: 'author_developer' }];
+  }
+  const developerCut = Math.round(total * IDEA_DEVELOPER_SHARE);
+  const authorCut = total - developerCut;      // the remainder — conserves the total
+  const out = [];
+  if (developerCut > 0) out.push({ builderId: developedBy, delta: developerCut, role: 'developer' });
+  if (authorCut > 0) out.push({ builderId: authorId, delta: authorCut, role: 'spark_author' });
+  return out;
+}
+
+// Who are the two parties for this idea? Read from the DB rather than trusted
+// from the caller, deliberately: R146's develop route could not safely pay
+// anything precisely because the recipient was ambiguous at the call site. With
+// the payees derived HERE, a caller cannot direct a payment at the wrong builder,
+// and there is exactly one place that decides who earns from an idea.
+async function ideaCreditParties(client, ideaId) {
+  const { rows } = await client.query(
+    `SELECT i.captured_by, g.developed_by
+       FROM idea_inbox i
+       LEFT JOIN ideas_grades g ON g.idea_id = i.id
+      WHERE i.id = $1`,
+    [ideaId]
+  );
+  if (rows.length === 0) return null;
+  return { authorId: rows[0].captured_by, developedBy: rows[0].developed_by };
+}
+
+// Book one split across the ledger, idempotently per (builder, reason). Returns
+// { credited, payees } where credited is the sum of what was NEWLY booked — so a
+// re-run that finds both rows present reports 0, and a partially-booked split
+// (one payee inserted, then a crash) completes on the next call.
+async function bookIdeaSplit(client, { payees, reason, taskId = null, describe }) {
+  let credited = 0;
+  const booked = [];
+  for (const p of payees) {
+    const { rowCount } = await client.query(
+      `INSERT INTO credit_log (builder_id, task_id, delta, reason, description)
+       SELECT $1, $2, $3, $4, $5
+        WHERE NOT EXISTS (SELECT 1 FROM credit_log WHERE builder_id = $1 AND reason = $4)`,
+      [p.builderId, taskId, p.delta, reason, describe(p)]
+    );
+    if (rowCount > 0) credited += p.delta;
+    booked.push({ ...p, booked: rowCount > 0 });
+  }
+  return { credited, payees: booked };
+}
+
 // Stream 2 (ADR 0172 / IC2): a Full Idea with a passing completeness score pays
 // its author IDEA_FULL_PASS_CREDIT, ONCE. Transaction-participant like the rest
 // of the reward port — the caller passes its `client` (a pool works too, since
@@ -362,29 +458,46 @@ async function awardIdeaFullPassCredit(client, { ideaId, authorId, completenessS
   if (completenessScore == null || !Number.isFinite(Number(completenessScore)) || Number(completenessScore) < IDEA_FULL_PASS_BAR) {
     return { credited: 0, reason: 'below_bar' };
   }
-  if (authorId == null || ideaId == null) {
+  if (ideaId == null) {
     return { credited: 0, reason: 'missing_author_or_idea' };
   }
+  // R147: the PARTIES come from the DB, not the call site. `authorId` is kept as
+  // a fallback only for a caller holding an idea the lookup cannot see (and for
+  // the pre-R147 call shape); when the row is there, it wins.
+  const parties = await ideaCreditParties(client, ideaId);
+  const resolvedAuthor = (parties && parties.authorId != null) ? parties.authorId : authorId;
+  if (resolvedAuthor == null) {
+    return { credited: 0, reason: 'missing_author_or_idea' };
+  }
+  const payees = splitIdeaCredit(IDEA_FULL_PASS_CREDIT, {
+    authorId: resolvedAuthor,
+    developedBy: parties ? parties.developedBy : null,
+  });
+  if (payees.length === 0) {
+    return { credited: 0, reason: 'zero_after_scaling' };
+  }
+  // Idempotency predicate is `builder_id = payee AND reason = <per-idea key>`.
+  // The `builder_id` term was originally an index optimisation (hitting
+  // `idx_credit_log_builder` instead of scanning a growing credit_log — the
+  // R143/IC2 grader finding), and R147 makes it load-bearing for CORRECTNESS
+  // too: a split books one row per payee under the SAME reason, so the predicate
+  // has to be per-builder or the second payee would be refused. That is also
+  // exactly why splitIdeaCredit collapses a self-developed idea to a single
+  // payee — two rows for one builder would be silently under-paid, not
+  // double-paid. credit_log is a CORE table, so a module migration cannot add an
+  // index on `reason` anyway (the additive-namespace rule).
   const reason = `idea.credit.full_pass:${ideaId}`;
-  const description = `Full Idea #${ideaId} passed (completeness ${Math.round(Number(completenessScore))}/100) → ${IDEA_FULL_PASS_CREDIT}c to its author (ideator lane, ADR 0172)`;
-  // Idempotency predicate is `builder_id = author AND reason = <per-idea key>`.
-  // The `builder_id` term is NOT for correctness — the reason string is already
-  // globally unique per idea — it exists to hit the existing
-  // `idx_credit_log_builder (builder_id, recorded_at)` index: the NOT EXISTS
-  // narrows to the author's handful of credit rows (index scan) instead of a
-  // sequential scan of a credit_log that grows with total platform activity.
-  // credit_log is a CORE table, so a module migration cannot add an index on
-  // `reason` (the additive-namespace rule) — reusing the builder index is the
-  // in-scope fix. (R143/IC2 grader finding.)
-  const { rowCount } = await client.query(
-    `INSERT INTO credit_log (builder_id, task_id, delta, reason, description)
-     SELECT $1, NULL, $2, $3, $4
-      WHERE NOT EXISTS (SELECT 1 FROM credit_log WHERE builder_id = $1 AND reason = $3)`,
-    [authorId, IDEA_FULL_PASS_CREDIT, reason, description]
-  );
-  return rowCount > 0
-    ? { credited: IDEA_FULL_PASS_CREDIT, reason: 'paid' }
-    : { credited: 0, reason: 'already_paid' };
+  const pct = Math.round(Number(completenessScore));
+  const { credited, payees: booked } = await bookIdeaSplit(client, {
+    payees,
+    reason,
+    describe: (p) => `Full Idea #${ideaId} passed (completeness ${pct}/100) → ${p.delta}c to its ${p.role.replace(/_/g, ' ')} (ideator lane, ADR 0172${p.role === 'developer' || p.role === 'spark_author' ? '; split ADR 0185' : ''})`,
+  });
+  return {
+    credited,
+    reason: credited > 0 ? 'paid' : 'already_paid',
+    payees: booked,
+  };
 }
 
 // Stream 1 (ADR 0172 / goal 1000067 IC4): as each task descended from an idea
@@ -420,7 +533,8 @@ async function awardIdeaTaskShipCredit(client, { taskId, config = rewardConfig()
     `SELECT l.idea_id,
             i.captured_by,
             COALESCE(g.grade, 'quick')        AS grade,
-            g.completeness_score              AS completeness
+            g.completeness_score              AS completeness,
+            g.developed_by                    AS developed_by
        FROM ideas_task_lineage l
        JOIN idea_inbox i        ON i.id = l.idea_id
        LEFT JOIN ideas_grades g ON g.idea_id = l.idea_id
@@ -430,7 +544,7 @@ async function awardIdeaTaskShipCredit(client, { taskId, config = rewardConfig()
   if (rows.length === 0 || rows[0].captured_by == null) {
     return { credited: 0, reason: 'no_source_idea', ideaId: null, authorId: null };
   }
-  const { idea_id: ideaId, captured_by: authorId, grade, completeness } = rows[0];
+  const { idea_id: ideaId, captured_by: authorId, grade, completeness, developed_by: developedBy } = rows[0];
   // Grade factor: a Full Idea earns in proportion to its completeness; a Quick
   // or Spark idea (no completeness score) earns the flat quick factor. A full
   // idea with no score yet also falls back to the quick factor rather than 0 —
@@ -442,16 +556,24 @@ async function awardIdeaTaskShipCredit(client, { taskId, config = rewardConfig()
   if (delta <= 0) {
     return { credited: 0, reason: 'zero_after_scaling', ideaId: Number(ideaId), authorId: Number(authorId) };
   }
+  // R147 (ADR 0185): if someone else developed this spark, the per-task stream is
+  // split with them too — the same 70/30 rule as stream 2, so there is one rule
+  // to explain rather than two. A developer who shaped the idea shares in what
+  // the idea goes on to deliver.
+  const payees = splitIdeaCredit(delta, { authorId, developedBy });
+  if (payees.length === 0) {
+    return { credited: 0, reason: 'zero_after_scaling', ideaId: Number(ideaId), authorId: Number(authorId) };
+  }
   const reason = `idea.credit.task_ship:${ideaId}:${taskId}`;
-  const description = `Task #${taskId} shipped under idea #${ideaId} (${grade}${completeness != null ? ` ${Math.round(Number(completeness))}%` : ''}) → ${delta}c to its author (ideator lane stream 1, ADR 0172)`;
-  const { rowCount } = await client.query(
-    `INSERT INTO credit_log (builder_id, task_id, delta, reason, description)
-     SELECT $1, $2, $3, $4, $5
-      WHERE NOT EXISTS (SELECT 1 FROM credit_log WHERE builder_id = $1 AND reason = $4)`,
-    [authorId, taskId, delta, reason, description]
-  );
-  return rowCount > 0
-    ? { credited: delta, reason: 'paid', ideaId: Number(ideaId), authorId: Number(authorId) }
+  const gradeLabel = `${grade}${completeness != null ? ` ${Math.round(Number(completeness))}%` : ''}`;
+  const { credited, payees: booked } = await bookIdeaSplit(client, {
+    payees,
+    reason,
+    taskId,
+    describe: (p) => `Task #${taskId} shipped under idea #${ideaId} (${gradeLabel}) → ${p.delta}c to its ${p.role.replace(/_/g, ' ')} (ideator lane stream 1, ADR 0172${p.role === 'developer' || p.role === 'spark_author' ? '; split ADR 0185' : ''})`,
+  });
+  return credited > 0
+    ? { credited, reason: 'paid', ideaId: Number(ideaId), authorId: Number(authorId), payees: booked }
     : { credited: 0, reason: 'already_paid', ideaId: Number(ideaId), authorId: Number(authorId) };
 }
 
@@ -667,6 +789,9 @@ module.exports = {
   maybeAwardIdeaPromotionBonus,
   awardIdeaFullPassCredit,
   awardIdeaTaskShipCredit,
+  // the spark-handoff split (task 1002923 / BV1.R147, ADR 0185)
+  splitIdeaCredit,
+  IDEA_DEVELOPER_SHARE,
   IDEA_FULL_PASS_CREDIT,
   IDEA_FULL_PASS_BAR,
   IDEA_TASK_SHIP_BASE,

package/modules/ideas/inbox.js

@@ -100,15 +100,22 @@ const FIELD_VALUES_MAX = 32768;
 // The grade half of an idea read: the COALESCE above, plus the template-shaped
 // store and the score. `g.*` columns are NULL for an ungraded idea, which is
 // exactly right — it has no template and no score, it just has a default grade.
+// developed_by/developed_at (ideas_005, task 1002922 / BV1.R146) ride along on
+// EVERY idea read rather than needing a second query: "who developed this" is
+// part of an idea's identity once it has been developed, and the R145 queue, the
+// hall detail view (R153) and the R147 credit split all want it. NULL for the
+// overwhelming majority of rows — a quick idea and a self-authored Full Idea were
+// never developed by anyone — which is the honest answer, not a missing one.
 const GRADE_COLS_Q = `COALESCE(g.grade, '${DEFAULT_GRADE}') AS grade,
-            g.template_key, g.field_values, g.completeness_score`;
+            g.template_key, g.field_values, g.completeness_score,
+            g.developed_by, g.developed_at`;
 const IDEA_JOIN_GRADE = `LEFT JOIN ideas_grades g ON g.idea_id = i.id`;
 
 // The same projection for a row that provably has no grade row yet (a just-
 // INSERTed idea), so INSERT…RETURNING does not need a second round trip to
 // return the same shape every other read returns.
 function ungradedProjection() {
-  return { grade: DEFAULT_GRADE, template_key: null, field_values: null, completeness_score: null };
+  return { grade: DEFAULT_GRADE, template_key: null, field_values: null, completeness_score: null, developed_by: null, developed_at: null };
 }
 
 // -------------------------------------------------------------------------
@@ -951,6 +958,81 @@ async function setIdeaCompleteness(ideaId, completenessScore) {
   return rows[0] ?? null;
 }
 
+// -------------------------------------------------------------------------
+// developSpark — turn a Big Idea Spark into a Full Idea IN PLACE
+// (task 1002922 / BV1.R146, goal 1000062)
+//
+// The pickup half of the spark handoff: R144 recorded the author's consent, R145
+// made the spark findable, and this is another builder filling in the five
+// template fields.
+//
+// IN PLACE, ON THE SAME ROW, AND THAT IS A DONE-WHEN. idea_inbox.id,
+// captured_by and captured_at are NOT touched — only the grade row moves. A new
+// row for the developed version would break the hall's /#/idea/N deep link,
+// ideas_task_lineage.idea_id, and the per-idea credit_log reason key. The
+// author's claim on their own thought is precisely what must survive being
+// developed by someone else; it is what the R147 split pays against.
+//
+// ONE GUARDED UPDATE, WHICH IS WHERE "ONLY ONCE" ACTUALLY LIVES. The predicate
+// carries `AND grade = 'spark'`, so the database decides whether this row was
+// still developable. A read-then-write ("is it a spark? ok, develop it") looks
+// identical in a test and loses a race in production: two builders picking the
+// same spark off the R145 queue at the same moment would both pass the check and
+// the second would overwrite the first's work AND their attribution. Here the
+// second UPDATE matches zero rows and the route turns that into a 409. Zero rows
+// is therefore NOT an error condition to log — it is the answer.
+//
+// It is also why this is not expressed as setIdeaGrade + a second write:
+// two statements cannot carry one guard, and a Full Idea with no recorded
+// developer is the exact state the done-when forbids.
+//
+// THE STATUS HALF OF THE GUARD, AND WHY IT IS NOT REDUNDANT WITH THE ROUTE'S
+// PRE-CHECK. Triage (`updateIdea`) writes idea_inbox.status and NEVER touches
+// ideas_grades — so a spark that a Metic+ triager discards, merges or promotes
+// keeps grade='spark' forever. Grade alone therefore does NOT mean "still
+// developable", and a develop that trusted it would resurrect content the triage
+// flow already decided was dead, opening a fresh board ratification window for
+// it. The R145 queue already filters on status and the R144 mark already requires
+// it; this closes the same hole on the write. In the PREDICATE rather than only
+// in the handler because a triager discarding an idea mid-request is the same
+// class of race as two developers colliding — and the fix for a race is never a
+// check that ran earlier.
+//
+// NOTE ON setIdeaGrade's whole-row contract: developed_by/developed_at are
+// deliberately OUTSIDE it. That contract exists so a grade change cannot inherit
+// stale field_values; but a developer is a historical FACT about who did the
+// work, not current content, and setIdeaGrade's ON CONFLICT SET list omits both
+// columns — so a later re-score or an author's R13 resubmission preserves the
+// developer's attribution instead of silently erasing it.
+async function developSpark(ideaId, { developedBy, templateKey = DEFAULT_TEMPLATE_KEY, fieldValues = {}, completenessScore = null } = {}) {
+  // Reuse the R140 payload validator so a bad template key or an oversize
+  // field_values map is a structured throw here rather than a constraint
+  // violation surfacing as a 500 (the assertGradePayload contract).
+  assertGradePayload({ grade: 'full', templateKey, fieldValues, completenessScore });
+  if (developedBy == null) throw { code: 'MISSING_DEVELOPER' };
+  const { rows } = await pool.query(
+    `UPDATE ideas_grades
+        SET grade              = 'full',
+            template_key       = $2,
+            field_values       = $3::jsonb,
+            completeness_score = $4,
+            developed_by       = $5,
+            developed_at       = now()
+      WHERE idea_id = $1
+        AND grade = 'spark'
+        AND EXISTS (
+          SELECT 1 FROM idea_inbox i WHERE i.id = $1 AND i.status = 'open'
+        )
+      RETURNING idea_id, grade, template_key, field_values, completeness_score,
+                developed_by, developed_at, created_at, updated_at`,
+    [ideaId, templateKey, JSON.stringify(fieldValues), completenessScore, developedBy]
+  );
+  // null = "this row was not a developable spark when we looked". THREE ways to
+  // get here, and the caller re-reads to say which: it was never a spark,
+  // somebody else developed it first, or a triager closed the idea underneath us.
+  return rows[0] ?? null;
+}
+
 // The grade row on its own. null = no row, which reads as grade='quick'
 // everywhere the idea itself is read (see DEFAULT_GRADE).
 async function getIdeaGrade(ideaId) {
@@ -1186,6 +1268,8 @@ module.exports = {
   updateIdeaBody,
   setIdeaGrade,
   setIdeaCompleteness,
+  // develop a spark into a Full Idea, in place (task 1002922, BV1.R146)
+  developSpark,
   // idea → task lineage (task 1002997 / BV1.R173) — the one-idea-many-tasks
   // link stream 1 (IC4) pays against
   linkIdeaTask,

package/modules/ideas/migrations/ideas_005_grade_developed_by.sql

@@ -0,0 +1,85 @@
+-- ideas_005_grade_developed_by.sql — who developed this spark into a Full Idea
+-- (task 1002922, BV1.R146, goal 1000062 "three grades of idea").
+--
+-- WHY. R144 let an author mark a quick idea as a Big Idea Spark ("I have the
+-- spark but not the full picture, someone develop this") and R145 made those
+-- sparks browsable. R146 is the pickup itself: another builder fills in the five
+-- template fields and the spark becomes a Full Idea. The done-when requires the
+-- row to keep its id and its ORIGINAL author while a DISTINCT developer is
+-- recorded — and ideas_grades had nowhere to record the second person. This adds
+-- that place.
+--
+-- WHY IN-PLACE, ON THE SAME ROW. The alternative — a new idea_inbox row for the
+-- developed version — breaks every reference to the original: the hall's
+-- /#/idea/N deep link, ideas_task_lineage.idea_id, the credit_log reason key
+-- `idea.credit.full_pass:<id>`, and any prose that cited it. "References to the
+-- idea never break" is a done-when, so development mutates the grade row and
+-- leaves idea_inbox.id / captured_by / captured_at untouched. That is also why
+-- the developer needs its own column instead of overwriting captured_by: the
+-- author's claim on their own thought is exactly what must survive being
+-- developed by someone else, and it is what the R147 credit split pays against.
+--
+-- WHY developed_at, AND NOT JUST updated_at. ideas_001 put a touch trigger on
+-- this table, so updated_at moves on EVERY later write — a re-score, a
+-- resubmission, a triage-adjacent grade rewrite. An attribution record whose
+-- only timestamp drifts cannot answer "when was this developed", which is the
+-- question the R147 split and any dispute about it will ask. One extra column is
+-- cheaper than an unanswerable question.
+--
+-- SELF-DEVELOPMENT IS LEGAL, SO THERE IS NO developed_by <> captured_by CHECK.
+-- An author may mark their own idea as needing development and then develop it
+-- themselves (they may have had the full picture a week later). Forbidding that
+-- would add a rule the owner never asked for; R147 simply sees a split where
+-- both halves are the same person. The pair-coherence CHECK below is the only
+-- constraint, and it guards a shape this module's own code controls.
+--
+-- Module migrations are ADDITIVE and NAMESPACED: every object here targets the
+-- ideas_-owned ideas_grades table, no down-migration, idempotent (safe to re-run).
+
+BEGIN;
+
+-- ON DELETE SET NULL, matching the builders-FK posture of every other module
+-- table that names a person (agents_001, government_001): losing a builder row
+-- must never cascade away an idea's grade. The attribution degrades to "someone",
+-- which the read path already renders (R145's queue prints "an unnamed builder").
+ALTER TABLE ideas_grades
+  ADD COLUMN IF NOT EXISTS developed_by bigint REFERENCES builders(id) ON DELETE SET NULL;
+
+ALTER TABLE ideas_grades
+  ADD COLUMN IF NOT EXISTS developed_at timestamptz;
+
+-- The two columns are written together by developSpark() and mean nothing apart:
+-- a developer with no timestamp cannot be dated, and a timestamp with no
+-- developer names nobody. Defense in depth against a future partial write.
+ALTER TABLE ideas_grades DROP CONSTRAINT IF EXISTS ideas_grades_developed_pair_chk;
+ALTER TABLE ideas_grades ADD CONSTRAINT ideas_grades_developed_pair_chk
+  CHECK ((developed_by IS NULL) = (developed_at IS NULL));
+
+-- "What has this builder developed?" — the read the R147 credit split walks, and
+-- the one a builder's own profile will want. PARTIAL, because the overwhelming
+-- majority of grade rows have no developer at all (every quick idea, every
+-- self-authored full idea), so indexing them would be paying for empty space.
+CREATE INDEX IF NOT EXISTS ideas_grades_developed_by_idx
+  ON ideas_grades (developed_by)
+  WHERE developed_by IS NOT NULL;
+
+-- SAFETY NET — a migration that cannot prove its own effect must not report
+-- success (the ideas_003 precedent). Read-only, no DDL: if either column is
+-- missing, the ADD silently did nothing and R146's route would fail at runtime
+-- on the one write whose whole job is preserving attribution.
+DO $$
+DECLARE missing text;
+BEGIN
+  SELECT string_agg(c, ', ') INTO missing
+    FROM unnest(ARRAY['developed_by', 'developed_at']) AS c
+   WHERE NOT EXISTS (
+     SELECT 1 FROM information_schema.columns
+      WHERE table_name = 'ideas_grades' AND column_name = c
+   );
+  IF missing IS NOT NULL THEN
+    RAISE EXCEPTION
+      'ideas_005: column(s) % missing from ideas_grades after ADD COLUMN — the migration did not take.', missing;
+  END IF;
+END $$;
+
+COMMIT;

package/modules/ideas/routes/inbox.js

@@ -593,6 +593,181 @@ module.exports = function buildInboxRouter() {
     });
   }, { errorCode: 'idea_unspark_failed' }));
 
+  // POST /inbox/:id/develop — DEVELOP A SPARK INTO A FULL IDEA
+  // (task 1002922 / BV1.R146, goal 1000062).
+  //
+  // The pickup half of the handoff R144 and R145 set up: the author consented by
+  // marking the spark, the queue made it findable, and now another builder fills
+  // in the five template fields and the thought becomes a Full Idea.
+  //
+  // OPEN TO ANY BUILDER, INCLUDING THE AUTHOR. Cross-builder development is the
+  // entire point, so there is no author check here — the mirror image of R144,
+  // where the gate was the whole feature. The consent was already given and is
+  // already recorded (this row is a spark BECAUSE its author said so), and
+  // re-asking for it would make the queue unpickable. Self-development is
+  // likewise legal: an author may mark a thought and come back to it themselves.
+  //
+  // ONLY A SPARK CAN BE DEVELOPED, and "only once" is enforced by the DATABASE,
+  // not by this handler. developSpark's UPDATE carries `AND grade = 'spark'`, so
+  // two builders picking the same spark off the queue at the same instant cannot
+  // both succeed — the second matches zero rows. The pre-read below exists ONLY
+  // to tell a 404 apart from a 409 and to give a useful message; it is not the
+  // guard, and it deliberately does not try to be.
+  //
+  // THE STREAM-2 CREDIT IS PAID HERE, SPLIT (task 1002923 / R147, ADR 0185).
+  // R146 shipped this route paying nothing on purpose: with two people involved,
+  // the recipient was ambiguous, and awardIdeaFullPassCredit's idempotency
+  // predicate is (builder_id, reason) — so guessing the developer would NOT have
+  // blocked a later payment to the author, and one idea would have paid twice.
+  // R147 resolved that by moving the payee decision INTO the economy module: it
+  // reads captured_by + developed_by itself and books 70% to the developer, 30%
+  // to the spark author (one payee at 100% when they are the same person). This
+  // route can therefore call it safely — it no longer chooses who earns.
+  //
+  // The board window IS opened, because it is recipient-agnostic (it takes an
+  // idea and a score, not a builder) and without it a developed Full Idea could
+  // never reach ratification — the handoff would dead-end one step from done.
+  // Fail-open like every other caller of that port.
+  //
+  // rank: any-builder — development is the pickup, and the author's mark is the
+  // consent. Deliberately NOT pinned in route-rank-check: there is no gate here
+  // to protect, and pinning it would only assert that an open route stays open.
+  router.post('/inbox/:id/develop', api.requireBuilder, api.asyncHandler('POST /inbox/:id/develop', async (req, res) => {
+    const id = parseId(req, res, { code: 'bad_id', positiveInt: true });
+    if (id === null) return;
+    if (validateOrRespond(req, res, {
+      field_values: { required: true, type: 'object' },
+      template_key: { type: 'string', maxLength: 64 },
+    })) return;
+
+    const idea = await inbox.getIdea(id);
+    if (!idea) return res.fail('idea_not_found', 404);
+    if (idea.grade !== 'spark') {
+      return res.fail('not_a_spark', 409, {
+        grade: idea.grade,
+        ...(idea.developed_by ? { developed_by: idea.developed_by } : {}),
+        reason: idea.grade === 'full'
+          ? 'this idea has already been developed into a Full Idea'
+          : 'only a Big Idea Spark can be developed — its author has to mark it first, which is what makes developing it fair',
+      });
+    }
+    // A SPARK IS NOT NECESSARILY STILL DEVELOPABLE. Triage writes
+    // idea_inbox.status and never touches ideas_grades, so an idea a triager
+    // discarded, merged or promoted keeps grade='spark' forever. Developing one
+    // would resurrect content the triage flow already decided was dead — and
+    // worse, open a fresh board ratification window for it. The R144 mark and the
+    // R145 queue both require status='open'; this is the same rule on the write.
+    // (developSpark's predicate carries it too, for the mid-request race.)
+    if (idea.status !== 'open') {
+      return res.fail('idea_not_open', 409, {
+        status: idea.status,
+        reason: 'this idea is no longer open, so it is not awaiting development',
+      });
+    }
+
+    // Same validation the capture and resubmit paths use, against the same
+    // template declaration — a developed Full Idea is a Full Idea, and must not
+    // be held to a looser standard just because someone else wrote it.
+    const templateKey = req.body.template_key ?? idea.template_key ?? undefined;
+    let v;
+    try {
+      v = validateFieldValues(req.body.field_values, templateKey ? { templateKey } : undefined);
+    } catch (validationErr) {
+      api.logger('ideas').error(`POST /inbox/:id/develop validation threw: ${validationErr && validationErr.message}`);
+      return res.fail('invalid_field_values', 400, { errors: [{ field: null, reason: 'unvalidatable' }] });
+    }
+    if (!v.ok) return res.fail('invalid_field_values', 400, { errors: v.errors, template_key: templateKey ?? null });
+
+    const row = await inbox.developSpark(id, {
+      developedBy: req.builder.id,
+      ...(templateKey ? { templateKey } : {}),
+      fieldValues: req.body.field_values,
+      completenessScore: completenessScore(req.body.field_values, templateKey ? { templateKey } : undefined),
+    });
+    // Zero rows means the guard fired: somebody else developed this spark between
+    // the read above and this write. Their work stands; this caller is told so
+    // rather than silently overwriting it.
+    if (!row) {
+      // The guard fired between the read above and the write. THREE causes now,
+      // and guessing would misinform: another developer got there first, or a
+      // triager closed the idea. One extra read on a rare path buys an honest
+      // answer instead of a plausible one.
+      const now = await inbox.getIdea(id);
+      if (now && now.status !== 'open') {
+        return res.fail('idea_not_open', 409, {
+          status: now.status,
+          reason: 'a triager closed this idea while you were developing it',
+        });
+      }
+      return res.fail('spark_already_developed', 409, {
+        ...(now && now.developed_by ? { developed_by: now.developed_by } : {}),
+        reason: 'another builder developed this spark first — their version stands',
+      });
+    }
+
+    const out = {
+      ...idea,
+      grade: row.grade,
+      template_key: row.template_key,
+      field_values: row.field_values,
+      completeness_score: row.completeness_score,
+      developed_by: row.developed_by,
+      developed_at: row.developed_at,
+    };
+
+    // Fail-open, exactly like the capture and resubmit paths: the development has
+    // already committed, and a credit-lane hiccup must never roll back somebody's
+    // work. The split (and who is in it) is decided inside the economy module.
+    try {
+      const reward = api.resolveOptional && api.resolveOptional('reward');
+      if (reward && reward.awardIdeaFullPassCredit) {
+        const r = await reward.awardIdeaFullPassCredit(api.pool, {
+          ideaId: id,
+          authorId: idea.captured_by,
+          completenessScore: row.completeness_score,
+        });
+        if (r && r.credited > 0) {
+          out.ideator_credit = r.credited;
+          // The per-payee breakdown, so a developer can see their share and the
+          // author theirs without reading the ledger.
+          if (r.payees) out.ideator_credit_split = r.payees;
+        }
+      }
+    } catch (creditErr) {
+      api.logger('ideas').error(`develop: pass-credit failed (development intact, credit skipped): ${creditErr && creditErr.message}`);
+    }
+
+    let board_window;
+    try {
+      const government = api.resolveOptional && api.resolveOptional('government');
+      if (government && government.openBoardWindowForIdea) {
+        const w = await government.openBoardWindowForIdea({ ideaId: id, completenessScore: row.completeness_score });
+        if (w && w.opened && w.item) board_window = { item_id: w.item.id, closes_at: w.item.closes_at };
+        else if (w && w.reason === 'below_bar') {
+          // The same honest feedback the resubmit path gives: which section is
+          // thinnest, computed from what was just written. Derived, never stored.
+          const flag = weakestSectionPayload(req.body.field_values, templateKey ? { templateKey } : undefined);
+          if (flag) out.rejection = flag;
+        }
+      }
+    } catch (boardErr) {
+      // Fail-open, like every other caller of this port: the development landed
+      // and must not be rolled back because the board could not be told.
+      api.logger('ideas').error(`develop: board-window open failed (development intact, window skipped): ${boardErr && boardErr.message}`);
+    }
+
+    return res.json({
+      idea: out,
+      developed: true,
+      // Named explicitly so a caller never has to compare two ids to find out,
+      // and so the R147 split reads its two parties off one response.
+      author_id: idea.captured_by ?? null,
+      developer_id: row.developed_by,
+      self_developed: idea.captured_by != null && String(idea.captured_by) === String(row.developed_by),
+      ...(board_window ? { board_window } : {}),
+    });
+  }, { errorCode: 'idea_develop_failed' }));
+
   // Metic+ (#360 / ADR 0018): idea triage (promote/discard/merge) shapes the
   // backlog. Criterion C2 assigns triage to Metic, so this widened from
   // archon-only to metic+archon when the three-rank model went live. Any

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.296",
+  "version": "1.19.298",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.19.296",
+      "version": "1.19.298",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.296",
+  "version": "1.19.298",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",