@bongos/core 1.19.297 → 1.19.298

package/.bongos-core.json

@@ -2,22 +2,22 @@
   "artifact": "bongos-core",
   "manifest_schema": 1,
   "generator": "scripts/gds/package-core.js",
-  "core_version": "1.19.297",
-  "core_contract": "1.19.297",
-  "source_commit": "1f1b380614ecad230b7399a63883dd4aa65a5c51",
+  "core_version": "1.19.298",
+  "core_contract": "1.19.298",
+  "source_commit": "89c91526e13db0ef8a1fbc4091e6691df74f71fc",
   "source_ref": "HEAD",
-  "built_at": "2026-08-22T19:02:34.784Z",
+  "built_at": "2026-08-22T20:51:27.946Z",
   "redaction": {
     "model": "docs-redacted+functional-verbatim",
-    "docs_redacted": 321,
+    "docs_redacted": 322,
     "agent_docs_stubbed": 22,
-    "functional_verbatim": 1400,
+    "functional_verbatim": 1401,
     "rules": 3,
     "gate_literals": 3,
     "gate": "passed"
   },
-  "file_count": 1743,
-  "tree_sha256": "39da631b7c0c17d3b63eb793e9e7b624bf55dbe877a2bdd2a568608076258bf7",
+  "file_count": 1745,
+  "tree_sha256": "885d55252052de946b48981a842f0b6230d156fbb900f77f02c2e1daf0e0d511",
   "files": [
     {
       "path": ".claude/skills/blocker-review/SKILL.md",
@@ -1404,10 +1404,15 @@
       "mode": "0000644",
       "sha256": "d68cae6169d7ef251fdf6c721e63a124bd3bf46979ffa51459db435426d24f8b"
     },
+    {
+      "path": "docs/adr/0185-spark-handoff-credit-split.md",
+      "mode": "0000644",
+      "sha256": "51931fe5ae89b14b6c8955e6d6cd43d88a7a6ed05f8c862cdfe56a14302cc990"
+    },
     {
       "path": "docs/adr/README.md",
       "mode": "0000644",
-      "sha256": "0eafe881d241706331548cf8212c5e84f2f42167c2ac5688427820fa394d77ef"
+      "sha256": "96f12718ea595a8fff3d3aeafc27013b4ef251724e80d077607addc167533639"
     },
     {
       "path": "docs/api-reference.md",
@@ -1417,7 +1422,7 @@
     {
       "path": "docs/api/openapi.json",
       "mode": "0000644",
-      "sha256": "ef7e4fbdb912b077c49b15e7ba0dd6333196fe0d82d4462a83c507669fd82767"
+      "sha256": "f77f37d52d726cf7df447b7988416e5eca802cc2da0398ac1e6e1df212ba664e"
     },
     {
       "path": "docs/architecture.md",
@@ -2982,7 +2987,7 @@
     {
       "path": "modules/economy/credits.js",
       "mode": "0000644",
-      "sha256": "71248889315a29d2a1714ad55ffc685987d862b74e877a29ac2de010bea140f3"
+      "sha256": "7c42fc848a1b7139d7ffa59cc3d81d89db84329b7beae9d5b8c5bc0afefc6f41"
     },
     {
       "path": "modules/economy/migrations/economy_001_fix_gds_shipper_description.sql",
@@ -3747,7 +3752,7 @@
     {
       "path": "modules/ideas/routes/inbox.js",
       "mode": "0000644",
-      "sha256": "eafc7ff6f4d9567813cefe2b47333caa4ab79b77ab979e77eb65ac88102a78f1"
+      "sha256": "44e918d0fe82a22a986f66b33e1165c1f30d3e67b04cde9019a6c293d42f1f72"
     },
     {
       "path": "modules/ideas/routing.js",
@@ -4542,12 +4547,12 @@
     {
       "path": "package-lock.json",
       "mode": "0000644",
-      "sha256": "9fea7a7292ec0de1ea5fea27ec984796c150ed75f0e94e30eca8837f55cbcee6"
+      "sha256": "56a2a9e3416c259a9ee31664dae5bb5509baa1410c40e6e6b0fceca4b3bff209"
     },
     {
       "path": "package.json",
       "mode": "0000644",
-      "sha256": "8b60b6155a3fd2c2d0110df0404319a6a5da35eeed3ee8d60f61ae009672ed35"
+      "sha256": "b58f5b7eddb94b3ec917dfe1694957f1da4f7154c4ad655b4aed06bafaf033ac"
     },
     {
       "path": "public-docs/index.html",
@@ -6202,7 +6207,7 @@
     {
       "path": "src/module-api.js",
       "mode": "0000644",
-      "sha256": "2bfcc90c50b5fd0945b97179e4445602f145896dd1821066cabcd411a8d7a9d9"
+      "sha256": "3a94110af825d5235724b6d1552ae99b13f90f74ff9b8e82e4ada09885c8b3fd"
     },
     {
       "path": "src/module-loader/catalog.js",
@@ -7489,10 +7494,15 @@
       "mode": "0000644",
       "sha256": "7e2024b3f1fa79a6bdec55b134be6337d4867df0a77fedb205f32b783a3d6193"
     },
+    {
+      "path": "tests/idea_credit_split.mjs",
+      "mode": "0000644",
+      "sha256": "fd96eb0dd472810854d9e0a7ee29725764cf0c3f4ad502c57d6d4a324da25ef5"
+    },
     {
       "path": "tests/idea_develop_spark.mjs",
       "mode": "0000644",
-      "sha256": "03d2f692eaa02e85a5f53e89527d4ea1a20c032d4801e2a7acd421eda12ce76c"
+      "sha256": "a498e2dfc87dbb5050d414ff04ebf4178900edb771be384fe91247e452a37a02"
     },
     {
       "path": "tests/idea_full_capture.mjs",
@@ -7502,7 +7512,7 @@
     {
       "path": "tests/idea_full_pass_credit.mjs",
       "mode": "0000644",
-      "sha256": "1ae98ae22202e6a6dbf42a48e0133654eeda32eec36b697c59f6b9d630936817"
+      "sha256": "63afe2afd59ff64e290234a0cc8d33a0f77b784d8c10c2d7147fe2ab3c114cd1"
     },
     {
       "path": "tests/idea_grades.mjs",

package/docs/adr/0185-spark-handoff-credit-split.md

@@ -0,0 +1,129 @@
+# 0185 — The spark-handoff credit split: 70% developer, 30% spark author
+
+- **Status:** Accepted
+- **Date:** 2026-08-22
+- **Tasks:** [#1002923](https://cloudbongos.com/builders#/task/1002923) (BV1.R147, goal 1000062 — three grades of idea). Completes the spark chain: [#1002920](https://cloudbongos.com/builders#/task/1002920) (the mark), [#1002921](https://cloudbongos.com/builders#/task/1002921) (the queue), [#1002922](https://cloudbongos.com/builders#/task/1002922) (the pickup)
+- **Extends:** [ADR 0172](<redacted>.md) — the ideator credit lane. That ADR built the streams and paid `captured_by`; this one decides what happens when `captured_by` is not the only person who made the idea.
+- **Related:** ADR 0023 (the original idea-promotion slice), 0146 (reward-mode machinery), 0054 (cost-plus)
+
+## Context
+
+ADR 0172 shipped the ideator credit lane: stream 1 pays 5 credits (scaled by idea
+grade) for every task shipped under an idea, stream 2 pays 5 credits once when a
+Full Idea clears the completeness bar. Both paid `idea_inbox.captured_by` — the
+person who filed the idea — because at the time that was the only person an idea
+had.
+
+Goal 1000062 then built the **spark handoff**. An author marks a quick idea as a
+Big Idea Spark ("I have the spark but not the full picture, someone develop
+this" — R144); that mark is the consent that makes cross-builder development
+fair. The spark becomes browsable (R145), and another builder develops it into a
+Full Idea in place, preserving the original author while being recorded as its
+developer (R146, `ideas_grades.developed_by`).
+
+That created a person the credit model had no answer for. Two builders now make
+one Full Idea: one had the thought, one wrote the five fields. Both streams still
+paid only the author.
+
+**R146 therefore deliberately shipped paying nothing at all.** Not an oversight —
+a refusal to guess. `awardIdeaFullPassCredit`'s idempotency predicate is
+`(builder_id, reason)`, so a payment to the *developer* would **not** have blocked
+a later payment to the *author*: the same idea would have paid twice. Choosing a
+recipient at that call site was not merely premature, it was unsafe. The develop
+route left the money alone and named this task as the owner of the decision.
+
+The result was a real gap in the meantime: a developed Full Idea that cleared the
+bar received stream 2 **never** — the only path that could pay it was the author
+resubmitting their own idea.
+
+## Decision
+
+### 1. 70% to the developer, 30% to the spark author — on both existing streams
+
+The owner's call, 2026-08-22. The developer takes the larger share, and the
+reasoning is behavioural rather than sentimental: **developing someone else's
+spark is the scarce act the queue depends on.** At an even split, developing a
+spark pays half what authoring your own Full Idea pays for the same writing work,
+so the rational move is always to write your own and the R145 queue stays a list
+nobody reads. The majority share is what makes the pickup surface function.
+
+The author is not left thin. They keep 30% of every split **and** their share of
+stream 1 on every task shipped under the idea, for as long as the idea keeps
+producing work. The thought keeps earning; it simply stops being the only
+contribution the ledger recognises.
+
+One ratio, applied to **both** streams — the immediate pass credit and the
+trailing per-task credit — so there is a single rule to explain rather than a
+table of cases. Stream 3 (the board-room payout, [#1002999](https://cloudbongos.com/builders#/task/1002999),
+not yet built) inherits the same helper when it lands.
+
+### 2. A policy constant in `credits.js`, not a table
+
+`IDEA_DEVELOPER_SHARE = 0.70` sits beside the pass bar and the quick factor, per
+ADR 0172's own consequence ("thresholds/factors are policy constants in
+`credits.js`", following the ADR 0023 precedent). A share of someone's earnings
+deserves a review and a commit, not a runtime edit. It is one constant, so a
+project that wants a different balance changes one line — which is the recorded
+owner philosophy for this goal: a simple base, designed to be altered.
+
+### 3. The economy module decides who is paid — the caller no longer can
+
+`awardIdeaFullPassCredit` now reads `captured_by` and `developed_by` from the
+database itself (`ideaCreditParties`) instead of trusting the `authorId` its
+caller passes; the argument survives only as a fallback for an idea the lookup
+cannot see. `awardIdeaTaskShipCredit` already read the idea row and simply selects
+`developed_by` alongside.
+
+This is the structural half of the decision, and it is what makes R146's caution
+unnecessary going forward. The reason the develop route could not safely pay was
+that *the recipient was chosen at the call site*. With the payees derived in one
+place, no caller can direct money at the wrong builder, and the develop route now
+books the split like any other path — **it hands over an idea and a score, never
+a recipient.**
+
+### 4. Three arithmetic properties, each a real bug if missed
+
+`splitIdeaCredit` is pure and carries them:
+
+- **The total is conserved.** The developer's share is rounded and the author gets
+  *the remainder*. Rounding both independently pays 6 credits out of a 5-credit
+  payout (`round(3.5) + round(1.5) = 4 + 2`).
+- **A self-developed idea collapses to one payee.** R146 deliberately permits an
+  author to develop their own spark. Emitting two rows for one builder would not
+  double-pay — it would **under**-pay, because the idempotency predicate is
+  `(builder_id, reason)` and the second insert is silently refused, so the builder
+  would receive one of their two shares. The comparison normalises with `String()`
+  because `bigint` columns arrive as strings: a type mismatch must not become a
+  phantom second payee.
+- **Zero-value rows are dropped.** A 1-credit payout splits to 1/0; a 0-credit
+  ledger row reads like a payment that was not made.
+
+Ids otherwise pass through **unconverted**. `builder_id` is a `bigint`, so
+`Number()`-ing it risks precision on a large id and would change the value type
+the pre-R147 code fed straight into the `INSERT`.
+
+### 5. `builder_id` in the idempotency predicate is now load-bearing
+
+It entered as an index optimisation — narrowing the `NOT EXISTS` to one builder's
+rows via `idx_credit_log_builder` instead of scanning a growing `credit_log` (the
+R143/IC2 grader finding). Under a split it is also **correctness**: two payees are
+booked under one `reason`, so a reason-only predicate would refuse the second.
+A partially-booked split therefore completes on the next call, and `credited`
+reports only what was newly booked.
+
+## Consequences
+
+- **The spark queue has a reason to be picked up.** The chain R144 → R145 → R146
+  now ends in a payment rather than in attribution alone.
+- **A developed Full Idea gets stream 2 at develop time**, closing the gap R146
+  left. It is fail-open: the development has already committed, and a credit-lane
+  hiccup must never roll back somebody's work.
+- **One place decides who earns from an idea.** Future callers inherit the split
+  for free and cannot get the recipient wrong.
+- **Not decided here:** stream 3's split (it ships with the Board Room, task
+  1002999) and whether `origin='develop'` in `ideas_task_lineage` belongs to
+  whoever promotes a *developed* idea into a task. ADR 0172 §5 says the lineage
+  row is "set at promotion and at develop (R146)", but R146 creates no task —
+  developing a spark produces a Full Idea, not work — so that origin is still
+  unwired, deliberately, rather than invented. It changes who stream 1 pays, so it
+  deserves its own decision.

package/docs/adr/README.md

@@ -258,5 +258,6 @@ This keeps the decision history honest and traceable.
 | 0182 | [**Project visibility is TWO axes: a derived publish gate and a stored join door** ([task 1002320](https://cloudbongos.com/builders#/task/1002320), goal 1000046). Goal 1000046 seeded 31 tasks each citing "per R01" — this ADR — so nothing in the goal could start until it landed: it gated **29 open tasks**, the largest single chokepoint in the repo, while itself parked at `backlog` with no dependencies. The spec its planning task cites was never written, so this is the design of record. The goal's criterion says **four** states (Public/Private/Stealth/Unlisted) and R04 says **three** stored plus a derived dark-matter; both are right and conflating them is the trap. There are two INDEPENDENT axes: **publishability** (DERIVED from the identity gate — name + description, per the owner interview) decides whether a project is on the map at all, and **the join door** (STORED `visibility ∈ public|private|stealth`, owner-set) decides how it renders and who gets in. Four user-facing states = 3 × publishable + one derived state that collapses all three. The column name `visibility` is a mild lie kept for consistency with `goals.visibility` (ADR 0112) — it does NOT decide visibility, publishability does — and the ADR is the mitigation. All three stored states are VISIBLE; only the derived state is invisible, which is what makes the 3+1 split honest rather than a workaround. `private` inherits ADR 0112's exact meaning (visible-but-closed); `stealth` exposes EXISTENCE but not IDENTITY, and its redaction is **server-side in the feed** — the naive client-side version leaks to anyone opening the network tab, and the orbs page is a static site OUTSIDE this repo (R09) so it could never be enforced there. Three mechanisms touch "does this appear" and are separated: `status` (operational), `visibility` (owner), `featured` (Archon editorial) — on the map iff `status='active' AND publishable`, with `featured` only ranking among those. That is a real behaviour change: today's predicate is `featured=true AND status='active'`, so **featuring is currently load-bearing for visibility at all** and the goal's owner-control premise silently does not work without it. Visibility is owned by the INSTANCE and the hub row is a CACHE (ADR 0141 §3 + the admin-console spike's D1) — so `owner_github_id` being "advisory, not an authority" is CORRECT rather than a gap, R05 moves to an instance surface, and R08's absent-report default is fail-closed (unreported ⇒ dark matter, off the map rather than exposed by omission). Per-state join rules compose with the separate `open|closed` join policy ([task 1002817](https://cloudbongos.com/builders#/task/1002817)) by one rule: **visibility sets the ceiling, join policy may only narrow** — otherwise the two settings are a coin-flip decided by evaluation order. Finally, `stealth` COLLIDES with the existing instance-wide pre-launch password gate (`STEALTH_PASSWORD`, `src/bongos/stealth-gate.js`), which means nearly the opposite (a whole instance made unreadable vs a project publicly on the map, anonymously); per ADR 0174 the product meaning keeps the word and the infra rename is filed separately rather than decided by an ADR about visibility. Rejected: a stored 4-valued enum (makes `unlisted` compete with `private`, and lets publishable+unlisted disagree), a separate `published` boolean (can drift from the identity it summarises; derived cannot), and keeping `featured` as the visibility gate (an owner who sets public and appears nowhere has not been given control).](<redacted>.md) | platform-identity / project visibility |
 | 0183 | [**A done-when criterion closes itself; the review queue becomes a place to look** ([task 1002069](https://cloudbongos.com/builders#/task/1002069), goal 1000072, owner request 2026-07-05). ADR 0086 §6 made `satisfied` reachable exactly one way — a Metic+ calling `POST /done-when/:id/satisfy` — even though the signal it gated on is unambiguous (**every** gating task shipped) and a human confirming it adds no information. When nobody runs `/goal-review` the result is not a careful pause but a **lying board**: this session measured goal 1000072 at `6/9 shipped, 0/5 criteria`. Now one helper, `doneWhen.autoSatisfyShippedCriteria(exec, {taskId})`, runs from **two** places for two different reasons — inside `shipTask`'s txn (scoped, **immediate**, on the txn client so a rolled-back ship cannot leave a goal achieved) and unscoped on every `publish-reconciler` tick (**backlog drain** for criteria whose tasks shipped before this existed, since nothing will ship against them again, plus **self-heal**). Idempotent by construction — it reads only `satisfied=false` rows — which is what makes an every-tick sweep safe. **The load-bearing subtlety is the delivery guard.** Auto-close needs BOTH "nothing still pending" AND **≥ 1 task actually `shipped`**; the second is not redundant, because since [task 1002651](https://cloudbongos.com/builders#/task/1002651) made `abandoned` terminal-not-pending, a criterion whose tasks were **all cut** satisfies the first clause *vacuously* and would auto-close on ZERO delivered work, cascading its goal to `achieved` (measured: `buildCriterionProgress` returns `pending_review:true` for exactly that shape). Yet `pending_review` **keeps** that wider meaning on purpose — it asks "should a human LOOK at this", and 1002651 chose that an all-abandoned criterion surfaces so someone decides whether it still means anything. So: everything that auto-closes was flagged; not everything flagged auto-closes. An earlier draft "aligned" the two predicates and broke that intent — `tests/criterion_progress.mjs` caught it; **do not re-align them**, the gap is the design. `/goal-review` is kept, demoted from gate to viewing surface; manual `POST /satisfy` stays for what automation cannot judge (a criterion with no linked tasks never auto-closes). Honest limits recorded: auto-satisfy cannot help a criterion nothing is LINKED to, and the in-txn close logs before commit (accepted — threading the summary out through `withTx` would cost ~5 lines in the over-threshold `db.js` under shrink-only ratchet policy). Rejected: sweep-only (up to 5 min to see your own goal close), hook-only (never drains the backlog), a stored `pending_review` column (second source of truth), deleting `/goal-review`.](<redacted>.md) | lifecycle / goal tier |
 | 0184 | [**A ship must account for itself: `shipTask` requires a land proof or a declared no-artifact** ([task 1002483](https://cloudbongos.com/builders#/task/1002483), goal 1000024). `db.shipTask` is the confirmed→shipped flip and, since [ADR 0120](<redacted>.md), where the CREDIT is booked — yet its only precondition was `WHERE status = 'confirmed'`, nothing about whether code reached main. The two AUTOMATED paths each proved the land first; the MANUAL route passed nothing, so a task confirmed with no pushed code could be shipped by its claim holder **or by any Metic+ sweeping `/merge-mode`**, booking its `task.shipped` credit. It stayed untracked for two months because its tracking task was closed in June asserting task 1001547 had delivered the gate — it had not, blocker 1000047's own final update says so, and the code agreed with the blocker rather than the closure note: **a hole hidden by a record nobody checked**, which is the same failure the gate is about. Decision: the gate lives at the WRITE, not the route (a route gate leaves the invariant unenforced at the layer that moves the ledger, so the next caller reopens it silently), and `shipTask` is FAIL-CLOSED on a required `landAssurance`. TWO kinds, and the second is why this does not make things worse: `proof` (this task's commit is on main) and **`no_artifact`** — a deliberate DB-only ship, an explicitly supported shape (CLAUDE.md "Direct DB writes are work too") that [task 1002478](https://cloudbongos.com/builders#/task/1002478) documents as a dead end below Archon. A naive proof-only gate would have made 1002478 strictly worse; naming no-artifact as a KIND turns it from an absence the gate must be talked out of into a recorded answer. Both carry a reason, audited post-commit and best-effort (an audit miss must never roll back a landed ship). `ship.js` now declares its own `--db-only`/`--allow-empty` lands, without which this fix would have regressed the very flow CLAUDE.md calls supported. Rejected: (b) gate only the route — leaves the write unguarded; (c) record the residual as tolerable — defensible on blast radius and genuinely close, but it would have been the FOURTH record asserting this was handled with nothing checkable behind it. Does NOT gate confirm: a codeless confirm is still accepted, it simply cannot reach `shipped` or pay.](<redacted>.md) | lifecycle / integrity |
+| 0185 | [**The spark-handoff credit split: 70% developer, 30% spark author** ([task 1002923](https://cloudbongos.com/builders#/task/1002923), BV1.R147, goal 1000062 — completing the chain [task 1002920](https://cloudbongos.com/builders#/task/1002920) mark → [task 1002921](https://cloudbongos.com/builders#/task/1002921) queue → [task 1002922](https://cloudbongos.com/builders#/task/1002922) pickup). [ADR 0172](<redacted>.md) built the ideator streams and paid `captured_by`, the only person an idea then had. The spark handoff created a second: R146 develops a spark IN PLACE, preserving the author while recording a `developed_by`. **R146 therefore shipped paying NOTHING on purpose** — not an oversight but a refusal to guess, because `awardIdeaFullPassCredit`'s idempotency predicate is `(builder_id, reason)`, so paying the DEVELOPER would not have blocked a later payment to the AUTHOR and one idea would have paid twice; the cost of that caution was that a developed Full Idea received stream 2 **never** unless its author resubmitted. Owner decision (2026-08-22): **70/30 favouring the developer**, on BOTH existing streams, one ratio so there is one rule to explain. The reasoning is behavioural, not sentimental — developing someone else's spark is the scarce act the queue depends on, and at an even split it pays HALF what authoring your own Full Idea pays for the same writing work, so the rational move is always to write your own and the R145 queue stays a list nobody reads. The author keeps 30% plus their share of stream 1 on every task shipped under the idea, forever. `IDEA_DEVELOPER_SHARE = 0.70` is a **policy constant in `credits.js`** beside the pass bar and quick factor (ADR 0172's own consequence, the ADR 0023 precedent): a share of someone's earnings deserves a review and a commit, not a runtime edit. **The structural half is what retires R146's caution:** the economy module now derives the payees itself (`ideaCreditParties` reads `captured_by` + `developed_by`), so the caller can no longer choose a recipient — the develop route hands over an idea and a score, never a payee, and books the split like any other path (fail-open; the development has already committed). Three arithmetic properties, each a real bug if missed: the total is **conserved** (developer rounded, author gets the REMAINDER — rounding both pays 6 out of a 5-credit payout); a **self-developed** idea collapses to ONE payee, because two rows for one builder would silently UNDER-pay under the per-builder idempotency predicate, not double-pay (the comparison normalises via `String()` since `bigint` arrives as a string, so a type mismatch cannot become a phantom payee); and **zero-value rows are dropped**. Ids otherwise pass through unconverted — `Number()`-ing a `bigint` risks precision. `builder_id` in the idempotency predicate, which entered as an index optimisation (the R143/IC2 grader finding), is now **load-bearing for correctness**: two payees share one `reason`, so a reason-only predicate would refuse the second, and a partially-booked split completes on the next call. **Not decided here:** stream 3's split (ships with the Board Room, task 1002999), and whether `origin='develop'` in `ideas_task_lineage` belongs to whoever promotes a DEVELOPED idea into a task — ADR 0172 §5 says the row is "set at promotion and at develop (R146)", but R146 creates no task, so that origin stays deliberately unwired rather than invented; it changes who stream 1 pays.](<redacted>.md) | economy / ideator lane |
 
 > ⚠️ **Numbering collision (known):** two ADRs share `0008`. The numbers were assigned in parallel sessions before the lock could be enforced. The files are kept under their existing filenames to preserve git history, but the table disambiguates them as `0008-a` / `0008-b`. New ADRs should resume at `0040` to avoid further collisions. (`0024` is also a real on-disk duplicate: the cloneable-repo/local-first-memory ADR and the multi-agent-system-architecture ADR were both numbered `0024` in parallel; both keep their filenames, disambiguated as `0024-a` / `0024-b` like `0008`. Likewise `0025` ended up with two on-disk files — the offsite-backup ADR and the structured-criterion↔task-link ADR — both kept under their existing filenames and disambiguated as `0025-a` / `0025-b`; separately, the BFG ADR had also claimed `0025` on 2026-05-30 and yielded to `0026`. A third happened 2026-06-06: `0036` was claimed in parallel by the builders-subdomain ADR ([#726](https://example.com/builders#/task/726)) and this Discord-channels ADR ([#727](https://example.com/builders#/task/727)); the Discord-channels ADR yielded to `0037`. A fourth landed 2026-06-10: `0044` was claimed in parallel by the palette-replacement ADR and the per-box game-preview ADR ([#897](https://example.com/builders#/task/897)); both keep their filenames, disambiguated as `0044-a` / `0044-b` like `0008`. A fifth was caught pre-land 2026-06-13: `0050` was claimed in parallel by the device-flow-admission ADR ([#1000](https://example.com/builders#/task/1000)) and the sandbox-for-everyone ADR ([#1001](https://example.com/builders#/task/1001)); the latter yielded to `0052` before merging, so there is no `0050` duplicate. A sixth was caught pre-land 2026-06-21: the tool-agnostic-design-layer ADR ([#1375](https://example.com/builders#/task/1375)) first collided at `0079` with the value-gated-autonomous-engagement ADR, then at `0080` with the llm-cache-api-transport ADR (both part of the 0075–0080 LLM-cost-reduction series, landed on `main` in parallel); it yielded to `0081` before merging, so there is no `0079`/`0080` design-layer duplicate. A seventh landed 2026-06-23: `0084` was claimed in parallel by the auto-derived-per-task-rank-floor ADR and the remove-default-spend-cap ADR (task 1499); the rank-floor ADR landed on `main` first, so the spend-cap ADR yielded to `0085`, leaving no `0084` duplicate. An eighth landed 2026-06-27: `0095` was claimed in parallel by the borrowed-memory-and-retrieval-concepts ADR (PR #459, landed first) and the cross-agent-context-management ADR ([#1651](https://example.com/builders#/task/1651), PR #460); both keep their filenames, disambiguated as `0095-a` / `0095-b` like `0008`. These two are companions — `0095-a` adopts the memory/retrieval concepts and explicitly defers the grep-vs-semantic question to `0095-b`.)

package/docs/api/openapi.json

@@ -6531,7 +6531,7 @@
           "inbox"
         ],
         "summary": "POST /inbox/:id/develop",
-        "description": "POST /inbox/:id/develop — DEVELOP A SPARK INTO A FULL IDEA (task 1002922 / BV1.R146, goal 1000062). The pickup half of the handoff R144 and R145 set up: the author consented by marking the spark, the queue made it findable, and now another builder fills in the five template fields and the thought becomes a Full Idea. OPEN TO ANY BUILDER, INCLUDING THE AUTHOR. Cross-builder development is the entire point, so there is no author check here — the mirror image of R144, where the gate was the whole feature. The consent was already given and is already recorded (this row is a spark BECAUSE its author said so), and re-asking for it would make the queue unpickable. Self-development is likewise legal: an author may mark a thought and come back to it themselves. ONLY A SPARK CAN BE DEVELOPED, and \"only once\" is enforced by the DATABASE, not by this handler. developSpark's UPDATE carries `AND grade = 'spark'`, so two builders picking the same spark off the queue at the same instant cannot both succeed — the second matches zero rows. The pre-read below exists ONLY to tell a 404 apart from a 409 and to give a useful message; it is not the guard, and it deliberately does not try to be. WHAT THIS ROUTE DELIBERATELY DOES NOT DO: pay the stream-2 \"Full Idea passed\" credit. Capture and resubmit both fire it, but on those paths the recipient is unambiguously the author. Here there are two people, and choosing between them is R147's job (task 1002923 — \"karma for a ratified Full Idea, scaled by completeness and SPLIT WITH THE SPARK AUTHOR\"). Firing it here would not just pre-empt that decision, it would corrupt it: awardIdeaFullPassCredit's idempotency predicate is (builder_id, `idea.credit.full_pass:<id>`), so a payment to the DEVELOPER does not block a later payment to the AUTHOR — one idea would pay twice. The credit is idempotent per idea+builder, so R147 can still pay it at the right time, to the right people, in the right shares. The board window IS opened, because it is recipient-agnostic (it takes an idea and a score, not a builder) and without it a developed Full Idea could never reach ratification — the handoff would dead-end one step from done. Fail-open like every other caller of that port. rank: any-builder — development is the pickup, and the author's mark is the consent. Deliberately NOT pinned in route-rank-check: there is no gate here to protect, and pinning it would only assert that an open route stays open.\n\n**Rank:** `any-builder` — Any authenticated builder (row-level ownership enforced in-handler).",
+        "description": "POST /inbox/:id/develop — DEVELOP A SPARK INTO A FULL IDEA (task 1002922 / BV1.R146, goal 1000062). The pickup half of the handoff R144 and R145 set up: the author consented by marking the spark, the queue made it findable, and now another builder fills in the five template fields and the thought becomes a Full Idea. OPEN TO ANY BUILDER, INCLUDING THE AUTHOR. Cross-builder development is the entire point, so there is no author check here — the mirror image of R144, where the gate was the whole feature. The consent was already given and is already recorded (this row is a spark BECAUSE its author said so), and re-asking for it would make the queue unpickable. Self-development is likewise legal: an author may mark a thought and come back to it themselves. ONLY A SPARK CAN BE DEVELOPED, and \"only once\" is enforced by the DATABASE, not by this handler. developSpark's UPDATE carries `AND grade = 'spark'`, so two builders picking the same spark off the queue at the same instant cannot both succeed — the second matches zero rows. The pre-read below exists ONLY to tell a 404 apart from a 409 and to give a useful message; it is not the guard, and it deliberately does not try to be. THE STREAM-2 CREDIT IS PAID HERE, SPLIT (task 1002923 / R147, ADR 0185). R146 shipped this route paying nothing on purpose: with two people involved, the recipient was ambiguous, and awardIdeaFullPassCredit's idempotency predicate is (builder_id, reason) — so guessing the developer would NOT have blocked a later payment to the author, and one idea would have paid twice. R147 resolved that by moving the payee decision INTO the economy module: it reads captured_by + developed_by itself and books 70% to the developer, 30% to the spark author (one payee at 100% when they are the same person). This route can therefore call it safely — it no longer chooses who earns. The board window IS opened, because it is recipient-agnostic (it takes an idea and a score, not a builder) and without it a developed Full Idea could never reach ratification — the handoff would dead-end one step from done. Fail-open like every other caller of that port. rank: any-builder — development is the pickup, and the author's mark is the consent. Deliberately NOT pinned in route-rank-check: there is no gate here to protect, and pinning it would only assert that an open route stays open.\n\n**Rank:** `any-builder` — Any authenticated builder (row-level ownership enforced in-handler).",
         "x-rank": "any-builder",
         "x-source": "modules/ideas/routes/inbox.js",
         "parameters": [

package/modules/economy/credits.js

@@ -334,6 +334,102 @@ async function maybeAwardIdeaPromotionBonus(client, taskId, shipperBuilderId, mu
   };
 }
 
+// -------------------------------------------------------------------------
+// The spark-handoff split (task 1002923 / BV1.R147, goal 1000062; ADR 0185)
+//
+// When one builder develops ANOTHER builder's Big Idea Spark into a Full Idea
+// (R146), two people made the idea: the one who had the thought and said "I do
+// not have the full picture", and the one who wrote out the five fields. Both
+// existing ideator streams paid `captured_by` alone, so the developer earned
+// nothing and the R145 queue had no reason to ever be picked up.
+//
+// OWNER DECISION (2026-08-22): 70% to the DEVELOPER, 30% to the spark author,
+// on BOTH existing streams. The developer takes the larger share because
+// developing someone else's spark is the scarce act the queue depends on — at
+// 50/50 it pays strictly worse than authoring your own Full Idea, so nobody
+// picks anything up. The author is not left thin: they keep 30% here AND the
+// full trailing stream-1 share on every task shipped under the idea forever.
+//
+// A POLICY CONSTANT IN THIS FILE, not a table — the ADR 0172 §Consequences rule
+// ("thresholds/factors are policy constants in credits.js", the ADR 0023
+// precedent): it deserves a review and a commit, not a runtime edit.
+const IDEA_DEVELOPER_SHARE = 0.70;
+
+// splitIdeaCredit — divide one payout between the two parties.
+//
+// THREE PROPERTIES THIS MUST HAVE, each of which is a real bug if missed:
+//
+//  1. THE TOTAL IS CONSERVED. The developer's share is rounded and the author
+//     gets THE REMAINDER — never both rounded independently, which would pay
+//     6 credits out of a 5-credit payout (round(3.5) + round(1.5) = 4 + 2).
+//  2. SELF-DEVELOPMENT COLLAPSES TO ONE PAYEE. R146 deliberately allows an
+//     author to develop their own spark. Emitting two rows for the same builder
+//     would not double-pay — it would UNDER-pay, because the idempotency
+//     predicate is (builder_id, reason) and the second insert is silently
+//     refused, so the builder would receive only one of their two shares.
+//  3. ZERO-VALUE ROWS ARE DROPPED. A 1-credit payout splits to 1/0; booking a
+//     0-credit ledger row is noise that reads like a payment.
+//
+// Pure — no DB, no config. Returns [{ builderId, delta, role }], biggest first.
+function splitIdeaCredit(delta, { authorId, developedBy } = {}) {
+  const total = Math.round(Number(delta) || 0);
+  if (total <= 0 || authorId == null) return [];
+  // IDS PASS THROUGH UNCONVERTED. builder_id is a bigint, which pg hands back as
+  // a STRING; Number()-ing it would risk precision on a large id and would also
+  // change the value type the pre-R147 code fed straight into the INSERT. Only
+  // the COMPARISON below normalises, via String() — a number/string mismatch
+  // between captured_by and developed_by must not become a phantom second payee.
+  if (developedBy == null) {
+    return [{ builderId: authorId, delta: total, role: 'author' }];
+  }
+  if (String(developedBy) === String(authorId)) {
+    return [{ builderId: authorId, delta: total, role: 'author_developer' }];
+  }
+  const developerCut = Math.round(total * IDEA_DEVELOPER_SHARE);
+  const authorCut = total - developerCut;      // the remainder — conserves the total
+  const out = [];
+  if (developerCut > 0) out.push({ builderId: developedBy, delta: developerCut, role: 'developer' });
+  if (authorCut > 0) out.push({ builderId: authorId, delta: authorCut, role: 'spark_author' });
+  return out;
+}
+
+// Who are the two parties for this idea? Read from the DB rather than trusted
+// from the caller, deliberately: R146's develop route could not safely pay
+// anything precisely because the recipient was ambiguous at the call site. With
+// the payees derived HERE, a caller cannot direct a payment at the wrong builder,
+// and there is exactly one place that decides who earns from an idea.
+async function ideaCreditParties(client, ideaId) {
+  const { rows } = await client.query(
+    `SELECT i.captured_by, g.developed_by
+       FROM idea_inbox i
+       LEFT JOIN ideas_grades g ON g.idea_id = i.id
+      WHERE i.id = $1`,
+    [ideaId]
+  );
+  if (rows.length === 0) return null;
+  return { authorId: rows[0].captured_by, developedBy: rows[0].developed_by };
+}
+
+// Book one split across the ledger, idempotently per (builder, reason). Returns
+// { credited, payees } where credited is the sum of what was NEWLY booked — so a
+// re-run that finds both rows present reports 0, and a partially-booked split
+// (one payee inserted, then a crash) completes on the next call.
+async function bookIdeaSplit(client, { payees, reason, taskId = null, describe }) {
+  let credited = 0;
+  const booked = [];
+  for (const p of payees) {
+    const { rowCount } = await client.query(
+      `INSERT INTO credit_log (builder_id, task_id, delta, reason, description)
+       SELECT $1, $2, $3, $4, $5
+        WHERE NOT EXISTS (SELECT 1 FROM credit_log WHERE builder_id = $1 AND reason = $4)`,
+      [p.builderId, taskId, p.delta, reason, describe(p)]
+    );
+    if (rowCount > 0) credited += p.delta;
+    booked.push({ ...p, booked: rowCount > 0 });
+  }
+  return { credited, payees: booked };
+}
+
 // Stream 2 (ADR 0172 / IC2): a Full Idea with a passing completeness score pays
 // its author IDEA_FULL_PASS_CREDIT, ONCE. Transaction-participant like the rest
 // of the reward port — the caller passes its `client` (a pool works too, since
@@ -362,29 +458,46 @@ async function awardIdeaFullPassCredit(client, { ideaId, authorId, completenessS
   if (completenessScore == null || !Number.isFinite(Number(completenessScore)) || Number(completenessScore) < IDEA_FULL_PASS_BAR) {
     return { credited: 0, reason: 'below_bar' };
   }
-  if (authorId == null || ideaId == null) {
+  if (ideaId == null) {
     return { credited: 0, reason: 'missing_author_or_idea' };
   }
+  // R147: the PARTIES come from the DB, not the call site. `authorId` is kept as
+  // a fallback only for a caller holding an idea the lookup cannot see (and for
+  // the pre-R147 call shape); when the row is there, it wins.
+  const parties = await ideaCreditParties(client, ideaId);
+  const resolvedAuthor = (parties && parties.authorId != null) ? parties.authorId : authorId;
+  if (resolvedAuthor == null) {
+    return { credited: 0, reason: 'missing_author_or_idea' };
+  }
+  const payees = splitIdeaCredit(IDEA_FULL_PASS_CREDIT, {
+    authorId: resolvedAuthor,
+    developedBy: parties ? parties.developedBy : null,
+  });
+  if (payees.length === 0) {
+    return { credited: 0, reason: 'zero_after_scaling' };
+  }
+  // Idempotency predicate is `builder_id = payee AND reason = <per-idea key>`.
+  // The `builder_id` term was originally an index optimisation (hitting
+  // `idx_credit_log_builder` instead of scanning a growing credit_log — the
+  // R143/IC2 grader finding), and R147 makes it load-bearing for CORRECTNESS
+  // too: a split books one row per payee under the SAME reason, so the predicate
+  // has to be per-builder or the second payee would be refused. That is also
+  // exactly why splitIdeaCredit collapses a self-developed idea to a single
+  // payee — two rows for one builder would be silently under-paid, not
+  // double-paid. credit_log is a CORE table, so a module migration cannot add an
+  // index on `reason` anyway (the additive-namespace rule).
   const reason = `idea.credit.full_pass:${ideaId}`;
-  const description = `Full Idea #${ideaId} passed (completeness ${Math.round(Number(completenessScore))}/100) → ${IDEA_FULL_PASS_CREDIT}c to its author (ideator lane, ADR 0172)`;
-  // Idempotency predicate is `builder_id = author AND reason = <per-idea key>`.
-  // The `builder_id` term is NOT for correctness — the reason string is already
-  // globally unique per idea — it exists to hit the existing
-  // `idx_credit_log_builder (builder_id, recorded_at)` index: the NOT EXISTS
-  // narrows to the author's handful of credit rows (index scan) instead of a
-  // sequential scan of a credit_log that grows with total platform activity.
-  // credit_log is a CORE table, so a module migration cannot add an index on
-  // `reason` (the additive-namespace rule) — reusing the builder index is the
-  // in-scope fix. (R143/IC2 grader finding.)
-  const { rowCount } = await client.query(
-    `INSERT INTO credit_log (builder_id, task_id, delta, reason, description)
-     SELECT $1, NULL, $2, $3, $4
-      WHERE NOT EXISTS (SELECT 1 FROM credit_log WHERE builder_id = $1 AND reason = $3)`,
-    [authorId, IDEA_FULL_PASS_CREDIT, reason, description]
-  );
-  return rowCount > 0
-    ? { credited: IDEA_FULL_PASS_CREDIT, reason: 'paid' }
-    : { credited: 0, reason: 'already_paid' };
+  const pct = Math.round(Number(completenessScore));
+  const { credited, payees: booked } = await bookIdeaSplit(client, {
+    payees,
+    reason,
+    describe: (p) => `Full Idea #${ideaId} passed (completeness ${pct}/100) → ${p.delta}c to its ${p.role.replace(/_/g, ' ')} (ideator lane, ADR 0172${p.role === 'developer' || p.role === 'spark_author' ? '; split ADR 0185' : ''})`,
+  });
+  return {
+    credited,
+    reason: credited > 0 ? 'paid' : 'already_paid',
+    payees: booked,
+  };
 }
 
 // Stream 1 (ADR 0172 / goal 1000067 IC4): as each task descended from an idea
@@ -420,7 +533,8 @@ async function awardIdeaTaskShipCredit(client, { taskId, config = rewardConfig()
     `SELECT l.idea_id,
             i.captured_by,
             COALESCE(g.grade, 'quick')        AS grade,
-            g.completeness_score              AS completeness
+            g.completeness_score              AS completeness,
+            g.developed_by                    AS developed_by
        FROM ideas_task_lineage l
        JOIN idea_inbox i        ON i.id = l.idea_id
        LEFT JOIN ideas_grades g ON g.idea_id = l.idea_id
@@ -430,7 +544,7 @@ async function awardIdeaTaskShipCredit(client, { taskId, config = rewardConfig()
   if (rows.length === 0 || rows[0].captured_by == null) {
     return { credited: 0, reason: 'no_source_idea', ideaId: null, authorId: null };
   }
-  const { idea_id: ideaId, captured_by: authorId, grade, completeness } = rows[0];
+  const { idea_id: ideaId, captured_by: authorId, grade, completeness, developed_by: developedBy } = rows[0];
   // Grade factor: a Full Idea earns in proportion to its completeness; a Quick
   // or Spark idea (no completeness score) earns the flat quick factor. A full
   // idea with no score yet also falls back to the quick factor rather than 0 —
@@ -442,16 +556,24 @@ async function awardIdeaTaskShipCredit(client, { taskId, config = rewardConfig()
   if (delta <= 0) {
     return { credited: 0, reason: 'zero_after_scaling', ideaId: Number(ideaId), authorId: Number(authorId) };
   }
+  // R147 (ADR 0185): if someone else developed this spark, the per-task stream is
+  // split with them too — the same 70/30 rule as stream 2, so there is one rule
+  // to explain rather than two. A developer who shaped the idea shares in what
+  // the idea goes on to deliver.
+  const payees = splitIdeaCredit(delta, { authorId, developedBy });
+  if (payees.length === 0) {
+    return { credited: 0, reason: 'zero_after_scaling', ideaId: Number(ideaId), authorId: Number(authorId) };
+  }
   const reason = `idea.credit.task_ship:${ideaId}:${taskId}`;
-  const description = `Task #${taskId} shipped under idea #${ideaId} (${grade}${completeness != null ? ` ${Math.round(Number(completeness))}%` : ''}) → ${delta}c to its author (ideator lane stream 1, ADR 0172)`;
-  const { rowCount } = await client.query(
-    `INSERT INTO credit_log (builder_id, task_id, delta, reason, description)
-     SELECT $1, $2, $3, $4, $5
-      WHERE NOT EXISTS (SELECT 1 FROM credit_log WHERE builder_id = $1 AND reason = $4)`,
-    [authorId, taskId, delta, reason, description]
-  );
-  return rowCount > 0
-    ? { credited: delta, reason: 'paid', ideaId: Number(ideaId), authorId: Number(authorId) }
+  const gradeLabel = `${grade}${completeness != null ? ` ${Math.round(Number(completeness))}%` : ''}`;
+  const { credited, payees: booked } = await bookIdeaSplit(client, {
+    payees,
+    reason,
+    taskId,
+    describe: (p) => `Task #${taskId} shipped under idea #${ideaId} (${gradeLabel}) → ${p.delta}c to its ${p.role.replace(/_/g, ' ')} (ideator lane stream 1, ADR 0172${p.role === 'developer' || p.role === 'spark_author' ? '; split ADR 0185' : ''})`,
+  });
+  return credited > 0
+    ? { credited, reason: 'paid', ideaId: Number(ideaId), authorId: Number(authorId), payees: booked }
     : { credited: 0, reason: 'already_paid', ideaId: Number(ideaId), authorId: Number(authorId) };
 }
 
@@ -667,6 +789,9 @@ module.exports = {
   maybeAwardIdeaPromotionBonus,
   awardIdeaFullPassCredit,
   awardIdeaTaskShipCredit,
+  // the spark-handoff split (task 1002923 / BV1.R147, ADR 0185)
+  splitIdeaCredit,
+  IDEA_DEVELOPER_SHARE,
   IDEA_FULL_PASS_CREDIT,
   IDEA_FULL_PASS_BAR,
   IDEA_TASK_SHIP_BASE,

package/modules/ideas/routes/inbox.js

@@ -614,16 +614,15 @@ module.exports = function buildInboxRouter() {
   // to tell a 404 apart from a 409 and to give a useful message; it is not the
   // guard, and it deliberately does not try to be.
   //
-  // WHAT THIS ROUTE DELIBERATELY DOES NOT DO: pay the stream-2 "Full Idea passed"
-  // credit. Capture and resubmit both fire it, but on those paths the recipient
-  // is unambiguously the author. Here there are two people, and choosing between
-  // them is R147's job (task 1002923 — "karma for a ratified Full Idea, scaled by
-  // completeness and SPLIT WITH THE SPARK AUTHOR"). Firing it here would not just
-  // pre-empt that decision, it would corrupt it: awardIdeaFullPassCredit's
-  // idempotency predicate is (builder_id, `idea.credit.full_pass:<id>`), so a
-  // payment to the DEVELOPER does not block a later payment to the AUTHOR — one
-  // idea would pay twice. The credit is idempotent per idea+builder, so R147 can
-  // still pay it at the right time, to the right people, in the right shares.
+  // THE STREAM-2 CREDIT IS PAID HERE, SPLIT (task 1002923 / R147, ADR 0185).
+  // R146 shipped this route paying nothing on purpose: with two people involved,
+  // the recipient was ambiguous, and awardIdeaFullPassCredit's idempotency
+  // predicate is (builder_id, reason) — so guessing the developer would NOT have
+  // blocked a later payment to the author, and one idea would have paid twice.
+  // R147 resolved that by moving the payee decision INTO the economy module: it
+  // reads captured_by + developed_by itself and books 70% to the developer, 30%
+  // to the spark author (one payee at 100% when they are the same person). This
+  // route can therefore call it safely — it no longer chooses who earns.
   //
   // The board window IS opened, because it is recipient-agnostic (it takes an
   // idea and a score, not a builder) and without it a developed Full Idea could
@@ -716,6 +715,28 @@ module.exports = function buildInboxRouter() {
       developed_at: row.developed_at,
     };
 
+    // Fail-open, exactly like the capture and resubmit paths: the development has
+    // already committed, and a credit-lane hiccup must never roll back somebody's
+    // work. The split (and who is in it) is decided inside the economy module.
+    try {
+      const reward = api.resolveOptional && api.resolveOptional('reward');
+      if (reward && reward.awardIdeaFullPassCredit) {
+        const r = await reward.awardIdeaFullPassCredit(api.pool, {
+          ideaId: id,
+          authorId: idea.captured_by,
+          completenessScore: row.completeness_score,
+        });
+        if (r && r.credited > 0) {
+          out.ideator_credit = r.credited;
+          // The per-payee breakdown, so a developer can see their share and the
+          // author theirs without reading the ledger.
+          if (r.payees) out.ideator_credit_split = r.payees;
+        }
+      }
+    } catch (creditErr) {
+      api.logger('ideas').error(`develop: pass-credit failed (development intact, credit skipped): ${creditErr && creditErr.message}`);
+    }
+
     let board_window;
     try {
       const government = api.resolveOptional && api.resolveOptional('government');

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.297",
+  "version": "1.19.298",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.19.297",
+      "version": "1.19.298",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.297",
+  "version": "1.19.298",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/src/module-api.js

@@ -1021,8 +1021,10 @@ const { validateOrRespond, LIMITS, parseId, asyncHandler, corsPublicGet, parsePa
 //         landed since 1.19.295 with no explicit bump. run 32591155887. (task 1002620)
 //   1.19.297 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
 //         landed since 1.19.296 with no explicit bump. run 32592502621. (task 1002620)
+//   1.19.298 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+//         landed since 1.19.297 with no explicit bump. run 32597859474. (task 1002620)
 // ---------------------------------------------------------------------------
-const CORE_VERSION = '1.19.297'; // CI auto-patch carrier (ADR 0161); see changelog above
+const CORE_VERSION = '1.19.298'; // CI auto-patch carrier (ADR 0161); see changelog above
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('dev-box'); log.info('mounted');

package/tests/idea_credit_split.mjs

@@ -0,0 +1,224 @@
+// tests/idea_credit_split.mjs
+//
+// task 1002923 (BV1.R147, goal 1000062; ADR 0185) — the spark-handoff credit
+// split: 70% developer / 30% spark author, on both ideator streams.
+//
+// The three properties that are REAL BUGS if missed, asserted first:
+//   1. the total is CONSERVED under rounding (round(3.5)+round(1.5) = 6 from a
+//      5-credit payout is the naive mistake);
+//   2. a SELF-DEVELOPED idea collapses to ONE payee — two rows for one builder
+//      would be silently UNDER-paid, because the idempotency predicate is
+//      (builder_id, reason) and the second insert is refused;
+//   3. zero-value rows are DROPPED, not booked as 0-credit ledger noise.
+//
+// Then the two streams end-to-end against a stub client, and the develop route
+// actually paying (the gap R146 deliberately left open).
+//
+// Run:  node tests/idea_credit_split.mjs
+
+import { strict as assert } from 'node:assert';
+import { createRequire } from 'node:module';
+
+const require = createRequire(import.meta.url);
+const credits = require('../modules/economy/credits.js');
+const { splitIdeaCredit, IDEA_DEVELOPER_SHARE, IDEA_FULL_PASS_CREDIT, IDEA_TASK_SHIP_BASE } = credits;
+
+let passed = 0;
+let failed = 0;
+async function test(name, fn) {
+  try { await fn(); passed++; console.log(`  ok  ${name}`); }
+  catch (err) { failed++; console.error(`  FAIL ${name}\n    ${err.message}`); }
+}
+
+const sum = (ps) => ps.reduce((n, p) => n + p.delta, 0);
+
+// --- property 1: the total is conserved ---------------------------------
+
+await test('the split CONSERVES the total at every payout size', () => {
+  for (let total = 1; total <= 120; total += 1) {
+    const ps = splitIdeaCredit(total, { authorId: 9, developedBy: 42 });
+    assert.equal(sum(ps), total, `total ${total} must not gain or lose a credit`);
+  }
+});
+
+await test('a 5-credit payout splits 4/1, not 4/2 — the rounding trap', () => {
+  const ps = splitIdeaCredit(5, { authorId: 9, developedBy: 42 });
+  assert.equal(sum(ps), 5);
+  const dev = ps.find((p) => p.role === 'developer');
+  const author = ps.find((p) => p.role === 'spark_author');
+  assert.equal(dev.delta, 4, 'round(5 * 0.70) = 4');
+  assert.equal(author.delta, 1, 'the author gets the REMAINDER, not round(1.5)=2');
+});
+
+await test('the developer gets the larger share, and it tracks the constant', () => {
+  assert.equal(IDEA_DEVELOPER_SHARE, 0.70, 'the owner decision, 2026-08-22');
+  const ps = splitIdeaCredit(100, { authorId: 9, developedBy: 42 });
+  assert.equal(ps.find((p) => p.role === 'developer').delta, 70);
+  assert.equal(ps.find((p) => p.role === 'spark_author').delta, 30);
+});
+
+// --- property 2: self-development collapses -----------------------------
+
+await test('a SELF-developed idea is ONE payee at the full amount', () => {
+  const ps = splitIdeaCredit(5, { authorId: 9, developedBy: 9 });
+  assert.equal(ps.length, 1, 'two rows for one builder would be silently under-paid');
+  assert.equal(ps[0].delta, 5);
+  assert.equal(ps[0].builderId, 9);
+  assert.equal(ps[0].role, 'author_developer');
+});
+
+await test('string/number id mismatch still counts as the same person', () => {
+  // captured_by and developed_by come back from pg as strings on a bigint column.
+  const ps = splitIdeaCredit(5, { authorId: '9', developedBy: 9 });
+  assert.equal(ps.length, 1, 'a type difference must not become a phantom second payee');
+});
+
+await test('an UNDEVELOPED idea pays its author everything', () => {
+  const ps = splitIdeaCredit(5, { authorId: 9, developedBy: null });
+  assert.deepEqual(ps, [{ builderId: 9, delta: 5, role: 'author' }]);
+});
+
+// --- property 3: no zero rows -------------------------------------------
+
+await test('a 1-credit payout pays the developer 1 and books NOTHING for the author', () => {
+  const ps = splitIdeaCredit(1, { authorId: 9, developedBy: 42 });
+  assert.equal(sum(ps), 1);
+  assert.equal(ps.length, 1, 'a 0-credit ledger row reads like a payment that was not made');
+  assert.equal(ps[0].role, 'developer');
+});
+
+await test('a zero or negative payout pays nobody', () => {
+  assert.deepEqual(splitIdeaCredit(0, { authorId: 9, developedBy: 42 }), []);
+  assert.deepEqual(splitIdeaCredit(-5, { authorId: 9, developedBy: 42 }), []);
+});
+
+await test('no author means no payment at all', () => {
+  assert.deepEqual(splitIdeaCredit(5, { authorId: null, developedBy: 42 }), []);
+});
+
+// --- stream 2, end to end ----------------------------------------------
+
+// A stub client that records every INSERT and answers the parties lookup.
+function stubClient({ authorId, developedBy, alreadyPaid = [] }) {
+  const inserts = [];
+  return {
+    inserts,
+    query: async (sql, params = []) => {
+      if (/FROM idea_inbox i/i.test(sql) && /developed_by/i.test(sql)) {
+        return { rows: [{ captured_by: authorId, developed_by: developedBy }] };
+      }
+      if (/FROM ideas_task_lineage/i.test(sql)) {
+        return { rows: [{ idea_id: '77', captured_by: authorId, grade: 'full', completeness: 100, developed_by: developedBy }] };
+      }
+      if (/INSERT INTO credit_log/i.test(sql)) {
+        const [builderId, , delta, reason] = params;
+        if (alreadyPaid.some((a) => String(a.builderId) === String(builderId) && a.reason === reason)) {
+          return { rowCount: 0 };
+        }
+        inserts.push({ builderId, delta, reason, description: params[4] });
+        return { rowCount: 1 };
+      }
+      return { rows: [], rowCount: 0 };
+    },
+  };
+}
+
+const ON = { ideatorCredit: true };
+
+await test('stream 2: a developed Full Idea pays BOTH parties under one reason key', async () => {
+  const c = stubClient({ authorId: '9', developedBy: '42' });
+  const r = await credits.awardIdeaFullPassCredit(c, { ideaId: 77, authorId: '9', completenessScore: 100, config: ON });
+  assert.equal(r.credited, IDEA_FULL_PASS_CREDIT, 'the whole payout is booked, split across two rows');
+  assert.equal(c.inserts.length, 2);
+  // One reason key for both — which is exactly why the idempotency predicate
+  // must include builder_id, or the second payee would be refused.
+  assert.equal(new Set(c.inserts.map((i) => i.reason)).size, 1);
+  assert.equal(c.inserts.find((i) => i.builderId === '42').delta, 4);
+  assert.equal(c.inserts.find((i) => i.builderId === '9').delta, 1);
+  assert.match(c.inserts.find((i) => i.builderId === '42').description, /developer/);
+  assert.match(c.inserts.find((i) => i.builderId === '9').description, /spark author/);
+});
+
+await test('stream 2: the PARTIES come from the DB, not from the caller', async () => {
+  // A caller naming the wrong author cannot redirect the money — the whole
+  // reason R146 could not safely pay.
+  const c = stubClient({ authorId: '9', developedBy: '42' });
+  await credits.awardIdeaFullPassCredit(c, { ideaId: 77, authorId: '999', completenessScore: 100, config: ON });
+  assert.ok(!c.inserts.some((i) => i.builderId === '999'), 'the caller-supplied author is ignored when the row is readable');
+  assert.deepEqual(c.inserts.map((i) => i.builderId).sort(), ['42', '9']);
+});
+
+await test('stream 2: an undeveloped Full Idea still pays its author the full 5', async () => {
+  const c = stubClient({ authorId: '9', developedBy: null });
+  const r = await credits.awardIdeaFullPassCredit(c, { ideaId: 77, authorId: '9', completenessScore: 100, config: ON });
+  assert.equal(r.credited, IDEA_FULL_PASS_CREDIT);
+  assert.equal(c.inserts.length, 1);
+  assert.equal(c.inserts[0].builderId, '9');
+  assert.equal(c.inserts[0].delta, IDEA_FULL_PASS_CREDIT);
+});
+
+await test('stream 2: a PARTIALLY booked split completes on a re-run, never double-pays', async () => {
+  const reason = 'idea.credit.full_pass:77';
+  // The developer's row landed; the author's did not (a crash between inserts).
+  const c = stubClient({ authorId: '9', developedBy: '42', alreadyPaid: [{ builderId: '42', reason }] });
+  const r = await credits.awardIdeaFullPassCredit(c, { ideaId: 77, authorId: '9', completenessScore: 100, config: ON });
+  assert.equal(c.inserts.length, 1, 'only the missing row is written');
+  assert.equal(c.inserts[0].builderId, '9');
+  assert.equal(r.credited, 1, 'credited reports only what was NEWLY booked');
+});
+
+await test('stream 2: a fully booked split reports already_paid and writes nothing', async () => {
+  const reason = 'idea.credit.full_pass:77';
+  const c = stubClient({ authorId: '9', developedBy: '42', alreadyPaid: [{ builderId: '42', reason }, { builderId: '9', reason }] });
+  const r = await credits.awardIdeaFullPassCredit(c, { ideaId: 77, authorId: '9', completenessScore: 100, config: ON });
+  assert.equal(c.inserts.length, 0);
+  assert.equal(r.credited, 0);
+  assert.equal(r.reason, 'already_paid');
+});
+
+await test('stream 2: below the bar nobody is paid, developed or not', async () => {
+  const c = stubClient({ authorId: '9', developedBy: '42' });
+  const r = await credits.awardIdeaFullPassCredit(c, { ideaId: 77, authorId: '9', completenessScore: 10, config: ON });
+  assert.equal(r.credited, 0);
+  assert.equal(r.reason, 'below_bar');
+  assert.equal(c.inserts.length, 0);
+});
+
+await test('stream 2: the lane can still be switched off entirely', async () => {
+  const c = stubClient({ authorId: '9', developedBy: '42' });
+  const r = await credits.awardIdeaFullPassCredit(c, { ideaId: 77, authorId: '9', completenessScore: 100, config: { ideatorCredit: false } });
+  assert.equal(r.reason, 'ideator_lane_off');
+  assert.equal(c.inserts.length, 0);
+});
+
+// --- stream 1, end to end ----------------------------------------------
+
+await test('stream 1: a task shipped under a DEVELOPED idea splits the same way', async () => {
+  const c = stubClient({ authorId: '9', developedBy: '42' });
+  const r = await credits.awardIdeaTaskShipCredit(c, { taskId: 100, config: ON });
+  assert.equal(r.credited, IDEA_TASK_SHIP_BASE, 'a 100% full idea pays the full base, split');
+  assert.equal(c.inserts.length, 2);
+  assert.equal(sum(c.inserts.map((i) => ({ delta: i.delta }))), IDEA_TASK_SHIP_BASE);
+  assert.equal(c.inserts.find((i) => i.builderId === '42').delta, 4);
+  assert.equal(c.inserts.find((i) => i.builderId === '9').delta, 1);
+  // Same rule, so the same wording — one rule to explain, not two.
+  assert.match(c.inserts.find((i) => i.builderId === '42').description, /stream 1/);
+  assert.match(c.inserts.find((i) => i.builderId === '42').description, /developer/);
+});
+
+await test('stream 1: an undeveloped idea is unchanged — the author gets it all', async () => {
+  const c = stubClient({ authorId: '9', developedBy: null });
+  const r = await credits.awardIdeaTaskShipCredit(c, { taskId: 100, config: ON });
+  assert.equal(r.credited, IDEA_TASK_SHIP_BASE);
+  assert.equal(c.inserts.length, 1);
+  assert.equal(c.inserts[0].builderId, '9');
+});
+
+await test('stream 1: the per-(idea,task) reason key still scopes idempotency', async () => {
+  const c = stubClient({ authorId: '9', developedBy: '42' });
+  await credits.awardIdeaTaskShipCredit(c, { taskId: 100, config: ON });
+  for (const i of c.inserts) assert.equal(i.reason, 'idea.credit.task_ship:77:100');
+});
+
+console.log(`\nidea_credit_split: ${passed} passed, ${failed} failed`);
+if (failed > 0) process.exit(1);

package/tests/idea_develop_spark.mjs

@@ -93,9 +93,11 @@ const basePoolQuery = async (sql, params = []) => {
 async function test(name, fn) {
   queries = [];
   portsResolved = [];
-  // Restored every test: one case below swaps in a two-phase stub to simulate a
-  // triager closing the idea mid-request, and it must not leak into the next.
+  // Restored every test: cases below swap in a two-phase pool stub (a triager
+  // closing the idea mid-request) and reward/government port stubs, and none of
+  // them may leak into the next test.
   api.pool.query = basePoolQuery;
+  api.resolveOptional = (name) => { portsResolved.push(name); return undefined; };
   // The author is builder 9; the developer in call() defaults to 42.
   idea = {
     id: '77', title: 'a spark', body_md: 'the thought', status: 'open',
@@ -293,16 +295,51 @@ await test('a missing idea is a 404, not a 500', async () => {
 
 // --- the money boundary: R147 owns the split ---------------------------
 
-await test('the stream-2 pass credit is NOT paid here — R147 owns the split', async () => {
+// R146 shipped this route paying NOTHING on purpose: with two people involved the
+// recipient was ambiguous, and awardIdeaFullPassCredit's idempotency predicate is
+// (builder_id, reason) — so guessing the developer would not have blocked a later
+// payment to the author, and one idea would have paid twice. R147 (ADR 0185)
+// resolved that by moving the payee decision INTO the economy module, so this
+// route can now call it safely: it no longer chooses who earns.
+await test('the stream-2 pass credit IS paid here now, and the route does not pick the payee', async () => {
+  let seen = null;
+  api.resolveOptional = (name) => {
+    portsResolved.push(name);
+    if (name === 'reward') {
+      return {
+        awardIdeaFullPassCredit: async (_client, args) => {
+          seen = args;
+          return { credited: 5, reason: 'paid', payees: [
+            { builderId: '42', delta: 4, role: 'developer', booked: true },
+            { builderId: '9', delta: 1, role: 'spark_author', booked: true },
+          ] };
+        },
+      };
+    }
+    return undefined;
+  };
   const r = await call();
   assert.equal(r.status, 200);
-  // Stronger than "no INSERT INTO credit_log": the handler never even asks for
-  // the reward port. awardIdeaFullPassCredit is idempotent per (builder, idea),
-  // so paying the DEVELOPER here would NOT block a later payment to the AUTHOR —
-  // the same idea would pay twice.
-  assert.ok(!portsResolved.includes('reward'), 'the reward port is never resolved on the develop path');
-  assert.ok(!queries.some((q) => /credit_log/i.test(q.sql)), 'no credit is booked');
-  assert.equal(r.payload.ideator_credit, undefined);
+  assert.ok(portsResolved.includes('reward'), 'the reward port is consulted');
+  assert.equal(r.payload.idea.ideator_credit, 5, 'the total is surfaced');
+  assert.equal(r.payload.idea.ideator_credit_split.length, 2, 'and the per-payee breakdown');
+  // The route hands over the idea and the score — never a chosen recipient beyond
+  // the author fallback the economy module overrides from the DB.
+  assert.equal(seen.ideaId, 77);
+  assert.equal(seen.completenessScore, 100);
+  assert.ok(!('developedBy' in seen), 'the route does not tell economy who developed it');
+});
+
+await test('a credit failure does not roll back the development (fail-open)', async () => {
+  api.resolveOptional = (name) => {
+    portsResolved.push(name);
+    if (name === 'reward') return { awardIdeaFullPassCredit: async () => { throw new Error('synthetic credit outage'); } };
+    return undefined;
+  };
+  const r = await call();
+  assert.equal(r.status, 200, 'the development landed');
+  assert.equal(r.payload.developed, true);
+  assert.equal(r.payload.idea.ideator_credit, undefined);
 });
 
 await test('but the board window IS opened — otherwise the handoff dead-ends', async () => {

package/tests/idea_full_pass_credit.mjs

@@ -28,23 +28,35 @@ async function test(name, fn) {
   catch (err) { failed++; console.error(`  FAIL ${name}\n    ${err.message}`); }
 }
 
-// A stub client whose credit_log "table" is an in-memory set of reasons, so the
-// INSERT ... WHERE NOT EXISTS (SELECT 1 ... WHERE reason=$3) behaves exactly like
-// Postgres: the second insert of the same reason is a no-op (rowCount 0).
-function stubClient() {
+// A stub client whose credit_log "table" is an in-memory set of (builder, reason)
+// pairs, so the INSERT ... WHERE NOT EXISTS behaves exactly like Postgres: a
+// second insert for the same pair is a no-op (rowCount 0).
+//
+// R147 (task 1002923) reshaped the write: the function now first LOOKS UP the
+// idea's parties (captured_by + developed_by) so it — not its caller — decides
+// who earns, and the INSERT carries task_id as a parameter, moving `reason` from
+// $3 to $4. `developedBy` here defaults to null, i.e. an idea nobody developed,
+// which is the case every test below was written for; the split itself is
+// covered in tests/idea_credit_split.mjs.
+function stubClient({ authorId = null, developedBy = null } = {}) {
   const rows = [];
   return {
     rows,
     async query(sql, params) {
-      // our fn issues exactly one INSERT ... SELECT ... WHERE NOT EXISTS, whose
-      // subquery filters on builder_id AND reason (the index-friendly predicate).
-      // Mirror both terms so the stub matches the real query.
+      // The R147 parties lookup — who authored this idea, and who developed it.
+      if (/FROM idea_inbox i/i.test(sql) && /developed_by/i.test(sql)) {
+        return { rows: authorId == null ? [] : [{ captured_by: authorId, developed_by: developedBy }] };
+      }
+      // The idempotency subquery must still scope by builder_id AND reason. That
+      // was an index concern before (idx_credit_log_builder); under R147 it is
+      // also load-bearing for correctness, because a split books two rows under
+      // ONE reason and a reason-only predicate would refuse the second payee.
       const builderId = params[0];
-      const reason = params[2];
-      assert.match(sql, /builder_id = \$1 AND reason = \$3/, 'idempotency check must scope by builder_id to hit the index');
+      const reason = params[3];
+      assert.match(sql, /builder_id = \$1 AND reason = \$4/, 'idempotency check must scope by builder_id AND reason');
       const exists = rows.some((r) => r.builder_id === builderId && r.reason === reason);
       if (exists) return { rowCount: 0, rows: [] };
-      rows.push({ builder_id: builderId, delta: params[1], reason, description: params[3] });
+      rows.push({ builder_id: builderId, delta: params[2], reason, description: params[4] });
       return { rowCount: 1, rows: [] };
     },
   };
@@ -54,7 +66,7 @@ const PASS = 72;   // clears the 60 bar
 const THIN = 40;   // below the bar
 
 await test('a passing Full Idea books exactly 5 credits to its author', async () => {
-  const c = stubClient();
+  const c = stubClient({ authorId: 3 });
   const r = await credits.awardIdeaFullPassCredit(c, { ideaId: 9, authorId: 3, completenessScore: PASS, config: { ideatorCredit: true } });
   assert.equal(r.credited, credits.IDEA_FULL_PASS_CREDIT);
   assert.equal(r.reason, 'paid');
@@ -65,7 +77,7 @@ await test('a passing Full Idea books exactly 5 credits to its author', async ()
 });
 
 await test('re-running pays nothing — idempotent per idea', async () => {
-  const c = stubClient();
+  const c = stubClient({ authorId: 3 });
   const opts = { ideaId: 9, authorId: 3, completenessScore: PASS, config: { ideatorCredit: true } };
   const first = await credits.awardIdeaFullPassCredit(c, opts);
   const second = await credits.awardIdeaFullPassCredit(c, opts);
@@ -78,7 +90,7 @@ await test('re-running pays nothing — idempotent per idea', async () => {
 });
 
 await test('a below-bar or null score books 0 — scoring gates the pay, not capture', async () => {
-  const c = stubClient();
+  const c = stubClient({ authorId: 3 });
   assert.equal((await credits.awardIdeaFullPassCredit(c, { ideaId: 1, authorId: 3, completenessScore: THIN, config: { ideatorCredit: true } })).reason, 'below_bar');
   assert.equal((await credits.awardIdeaFullPassCredit(c, { ideaId: 2, authorId: 3, completenessScore: null, config: { ideatorCredit: true } })).reason, 'below_bar');
   assert.equal((await credits.awardIdeaFullPassCredit(c, { ideaId: 3, authorId: 3, completenessScore: undefined, config: { ideatorCredit: true } })).reason, 'below_bar');
@@ -90,13 +102,13 @@ await test('COST-PLUS-ONLY does NOT suppress it: the ideator lane pays regardles
   const policy = credits.rewardPolicy({ mode: 'cost-plus-only' });
   assert.equal(policy.perTaskCredit, false);
   assert.equal(policy.ideatorCredit, true);
-  const c = stubClient();
+  const c = stubClient({ authorId: 3 });
   const r = await credits.awardIdeaFullPassCredit(c, { ideaId: 5, authorId: 3, completenessScore: PASS, config: policy });
   assert.equal(r.credited, 5, 'paid despite cost-plus-only — this is the whole point of ADR 0172');
 });
 
 await test('an instance that opts the ideator lane out pays nothing', async () => {
-  const c = stubClient();
+  const c = stubClient({ authorId: 3 });
   const r = await credits.awardIdeaFullPassCredit(c, { ideaId: 6, authorId: 3, completenessScore: PASS, config: { ideatorCredit: false } });
   assert.equal(r.credited, 0);
   assert.equal(r.reason, 'ideator_lane_off');
@@ -104,9 +116,29 @@ await test('an instance that opts the ideator lane out pays nothing', async () =
 });
 
 await test('a missing author or idea is a safe 0, never a throw', async () => {
-  const c = stubClient();
-  assert.equal((await credits.awardIdeaFullPassCredit(c, { ideaId: 6, authorId: null, completenessScore: PASS, config: { ideatorCredit: true } })).reason, 'missing_author_or_idea');
-  assert.equal((await credits.awardIdeaFullPassCredit(c, { ideaId: null, authorId: 3, completenessScore: PASS, config: { ideatorCredit: true } })).reason, 'missing_author_or_idea');
+  // No ideaId at all: refused before the parties lookup even runs.
+  const noIdea = stubClient({ authorId: 3 });
+  assert.equal((await credits.awardIdeaFullPassCredit(noIdea, { ideaId: null, authorId: 3, completenessScore: PASS, config: { ideatorCredit: true } })).reason, 'missing_author_or_idea');
+  // An idea the lookup cannot see AND no caller-supplied author → still a safe 0.
+  const unknown = stubClient();   // lookup returns no row
+  assert.equal((await credits.awardIdeaFullPassCredit(unknown, { ideaId: 6, authorId: null, completenessScore: PASS, config: { ideatorCredit: true } })).reason, 'missing_author_or_idea');
+  assert.equal(unknown.rows.length, 0);
+});
+
+await test('R147: the DB is authoritative for the author; the argument is only a fallback', async () => {
+  // The caller passing null no longer matters when the row is readable — the
+  // whole point of moving the payee decision into this module.
+  const known = stubClient({ authorId: 3 });
+  const r = await credits.awardIdeaFullPassCredit(known, { ideaId: 6, authorId: null, completenessScore: PASS, config: { ideatorCredit: true } });
+  assert.equal(r.credited, credits.IDEA_FULL_PASS_CREDIT);
+  assert.equal(known.rows[0].builder_id, 3, 'paid the author the DB names');
+
+  // ...and when the lookup finds nothing, the passed author is still honoured,
+  // so a caller holding an idea this module cannot see is not silently unpaid.
+  const invisible = stubClient();
+  const f = await credits.awardIdeaFullPassCredit(invisible, { ideaId: 6, authorId: 7, completenessScore: PASS, config: { ideatorCredit: true } });
+  assert.equal(f.credited, credits.IDEA_FULL_PASS_CREDIT);
+  assert.equal(invisible.rows[0].builder_id, 7);
 });
 
 console.log(`\nidea_full_pass_credit: ${passed} passed, ${failed} failed`);