@bongos/core 1.19.297 → 1.19.299

package/modules/ideas/routes/inbox.js

@@ -6,8 +6,8 @@ const api = require('../../../src/module-api');
 const inbox = require('../inbox');
 // Full Idea capture (task 1002919 / BV1.R143): the template validator (R141)
 // and the deterministic scorer (R142) — both pure, both walk the declaration.
-const { validateFieldValues } = require('../templates');
-const { completenessScore, weakestSectionPayload } = require('../completeness');
+const { validateFieldValues, templateFor, fieldOrder } = require('../templates');
+const { completenessScore, weakestSectionPayload, scoreFieldValues } = require('../completeness');
 const { validateOrRespond, LIMITS, parseId } = api;
 
 const INBOX_STATUS_VALUES = ['open', 'promoted', 'discarded', 'merged'];
@@ -313,6 +313,94 @@ module.exports = function buildInboxRouter() {
   });
 
 
+
+  // -----------------------------------------------------------------------
+  // The two reads the hall's Full Idea composer is built from
+  // (task 1002928 / BV1.R152, goal 1000062).
+  //
+  // The done-when says the live meter must reflect THE REAL SCORER, "not a
+  // second copy of the rules". A browser cannot require() this module —
+  // completeness.js and templates.js are CJS and templates.js reaches inbox.js
+  // for DEFAULT_TEMPLATE_KEY, which reaches the pool — so the choice is between
+  // re-implementing the arithmetic in page JS and asking the server. These two
+  // routes are that ask, and they are why the composer contains no rules at all:
+  //
+  //   GET  /inbox/template  → what the five fields ARE (so the FORM is rendered
+  //                           from the R141 declaration, not from five <textarea>
+  //                           elements hand-written into the HTML — a hard-coded
+  //                           form is the same "second copy" defect as a
+  //                           hard-coded scorer, one step earlier, and it would
+  //                           silently ignore a per-project template (R156)).
+  //   POST /inbox/score     → what it is WORTH right now (the R142 scorer itself,
+  //                           per-field, in template order).
+  //
+  // BOTH ARE PURE. No DB read, no write, no idea id: they describe and score a
+  // payload the caller already holds. That is what makes a debounced call on
+  // every keystroke reasonable, and why scoring carries no rank beyond sign-in —
+  // it tells you nothing you did not just type.
+  //
+  // DECLARED BEFORE `GET /inbox/:id`, and for GET /inbox/template that ordering
+  // is LOAD-BEARING: Express matches in declaration order, so with `:id` first
+  // the literal "/inbox/template" binds id='template' and parseId 400s it. Same
+  // trap as /inbox/sparks and /inbox/awaiting-nod above.
+  //
+  // rank: any-builder — filing a Full Idea is open to every role by the goal's
+  // own settled decision ("no permission gate on Full Ideas; completeness scoring
+  // and triage do the filtering"), so describing and scoring one must be too.
+  // Deliberately NOT pinned in route-rank-check: neither has a gate to protect.
+  router.get('/inbox/template', api.requireBuilder, api.asyncHandler('GET /inbox/template', async (req, res) => {
+    // templateFor deliberately does NOT default — it returns null for anything
+    // that is not a declared own key, which is what makes it safe against an
+    // attacker-supplied 'constructor'/'__proto__' (the R143 grader's finding). So
+    // the DEFAULT is supplied here, explicitly, from the one place that declares
+    // it. Leaving it undefined 404s the normal page load, which is exactly what
+    // the first run of tests/idea_hall_composer.mjs caught.
+    const key = typeof req.query.template_key === 'string' && req.query.template_key
+      ? req.query.template_key
+      : inbox.DEFAULT_TEMPLATE_KEY;
+    const template = templateFor(key);
+    if (!template) {
+      return res.fail('unknown_template', 404, { template_key: key });
+    }
+    // Projected rather than passed through: the declaration is frozen and the
+    // composer needs exactly these four things per field.
+    const byKey = new Map(template.fields.map((f) => [f.key, f]));
+    return res.json({
+      template: {
+        key: template.key,
+        label: template.label,
+        // ORDER from fieldOrder (which returns KEYS — the one legal source of
+        // display order, since jsonb does not preserve key order), DATA from the
+        // declaration itself. Spelled as a lookup rather than mapping over
+        // template.fields directly so the provenance of the order is visible at
+        // the call site and cannot drift into an Object.keys() somewhere.
+        fields: fieldOrder(template).map((key) => {
+          const f = byKey.get(key);
+          return {
+            key: f.key,
+            label: f.label,
+            required: !!f.required,
+            substance_min: f.substanceMin || 0,
+          };
+        }),
+      },
+    });
+  }, { errorCode: 'template_read_failed' }));
+
+  router.post('/inbox/score', api.requireBuilder, api.asyncHandler('POST /inbox/score', async (req, res) => {
+    if (validateOrRespond(req, res, {
+      field_values: { required: true, type: 'object' },
+      template_key: { type: 'string', maxLength: inbox.TEMPLATE_KEY_MAX },
+    })) return;
+    const templateKey = req.body.template_key || undefined;
+    // scoreFieldValues NEVER throws (R142's contract) and answers
+    // { score: null, fields: [] } for anything it cannot score — an unknown
+    // template, a non-object, a non-string field. A draft in progress is exactly
+    // that kind of half-formed input, so the composer wants the null rather than
+    // a 400: "not scorable yet" is a legal state on the way to a Full Idea.
+    const { score, fields } = scoreFieldValues(req.body.field_values, templateKey ? { templateKey } : undefined);
+    return res.json({ score, fields, template_key: templateKey || null });
+  }, { errorCode: 'score_failed' }));
   // GET /inbox/sparks — THE SPARK QUEUE (task 1002921 / BV1.R145, goal 1000062).
   //
   // Big Idea Sparks awaiting development: the ideator craft's pickup surface,
@@ -614,16 +702,15 @@ module.exports = function buildInboxRouter() {
   // to tell a 404 apart from a 409 and to give a useful message; it is not the
   // guard, and it deliberately does not try to be.
   //
-  // WHAT THIS ROUTE DELIBERATELY DOES NOT DO: pay the stream-2 "Full Idea passed"
-  // credit. Capture and resubmit both fire it, but on those paths the recipient
-  // is unambiguously the author. Here there are two people, and choosing between
-  // them is R147's job (task 1002923 — "karma for a ratified Full Idea, scaled by
-  // completeness and SPLIT WITH THE SPARK AUTHOR"). Firing it here would not just
-  // pre-empt that decision, it would corrupt it: awardIdeaFullPassCredit's
-  // idempotency predicate is (builder_id, `idea.credit.full_pass:<id>`), so a
-  // payment to the DEVELOPER does not block a later payment to the AUTHOR — one
-  // idea would pay twice. The credit is idempotent per idea+builder, so R147 can
-  // still pay it at the right time, to the right people, in the right shares.
+  // THE STREAM-2 CREDIT IS PAID HERE, SPLIT (task 1002923 / R147, ADR 0185).
+  // R146 shipped this route paying nothing on purpose: with two people involved,
+  // the recipient was ambiguous, and awardIdeaFullPassCredit's idempotency
+  // predicate is (builder_id, reason) — so guessing the developer would NOT have
+  // blocked a later payment to the author, and one idea would have paid twice.
+  // R147 resolved that by moving the payee decision INTO the economy module: it
+  // reads captured_by + developed_by itself and books 70% to the developer, 30%
+  // to the spark author (one payee at 100% when they are the same person). This
+  // route can therefore call it safely — it no longer chooses who earns.
   //
   // The board window IS opened, because it is recipient-agnostic (it takes an
   // idea and a score, not a builder) and without it a developed Full Idea could
@@ -716,6 +803,28 @@ module.exports = function buildInboxRouter() {
       developed_at: row.developed_at,
     };
 
+    // Fail-open, exactly like the capture and resubmit paths: the development has
+    // already committed, and a credit-lane hiccup must never roll back somebody's
+    // work. The split (and who is in it) is decided inside the economy module.
+    try {
+      const reward = api.resolveOptional && api.resolveOptional('reward');
+      if (reward && reward.awardIdeaFullPassCredit) {
+        const r = await reward.awardIdeaFullPassCredit(api.pool, {
+          ideaId: id,
+          authorId: idea.captured_by,
+          completenessScore: row.completeness_score,
+        });
+        if (r && r.credited > 0) {
+          out.ideator_credit = r.credited;
+          // The per-payee breakdown, so a developer can see their share and the
+          // author theirs without reading the ledger.
+          if (r.payees) out.ideator_credit_split = r.payees;
+        }
+      }
+    } catch (creditErr) {
+      api.logger('ideas').error(`develop: pass-credit failed (development intact, credit skipped): ${creditErr && creditErr.message}`);
+    }
+
     let board_window;
     try {
       const government = api.resolveOptional && api.resolveOptional('government');

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.297",
+  "version": "1.19.299",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.19.297",
+      "version": "1.19.299",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.297",
+  "version": "1.19.299",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/src/bongos/serve-internal.js

@@ -927,6 +927,11 @@ function mountInternalSurfaces(app) {
   // flag is open to every rank by design (see the nav comment in shell.js), so
   // the page's only real gate is sign-in — the writes behind it self-gate, and
   // closing someone else's flag is checked server-side at metic-or-author.
+  // task 1002928: `ideas` (the R152 Full Idea composer) joins the same tier for
+  // the same reason — goal 1000062's settled decision is that there is NO
+  // permission gate on Full Ideas; scoring and triage do the filtering. Its two
+  // reads (GET /inbox/template, POST /inbox/score) are pure and any-builder, and
+  // the file itself goes through POST /inbox, which carries its own rules.
   //
   // NB the assignment below must stay `const NAME_RE = /…/;` with NOTHING between
   // the `=` and the literal: tests/hall_page_gate_map.mjs reconstructs the whole
@@ -934,7 +939,7 @@ function mountInternalSurfaces(app) {
   // the regex out of its map — which reads as "every page on this tier is
   // ungated". It fails loudly by design; keep prose above the const.
   const SIGNEDIN_BUILDERS_PAGE_RE =
-    /^\/builders\/(?:work|pair|settings|atlas|modules|goals|roadmap|copy-desk|primer(?:\.md)?|diagrams)(?:\.html)?\/?$/;
+    /^\/builders\/(?:work|pair|settings|atlas|modules|goals|roadmap|copy-desk|ideas|primer(?:\.md)?|diagrams)(?:\.html)?\/?$/;
   // The diagram image assets under /builders/diagrams/ ride the same tier as the
   // page that embeds them.
   const SIGNEDIN_BUILDERS_PREFIX_RE = /^\/builders\/diagrams\//;

package/src/module-api.js

@@ -1021,8 +1021,12 @@ const { validateOrRespond, LIMITS, parseId, asyncHandler, corsPublicGet, parsePa
 //         landed since 1.19.295 with no explicit bump. run 32591155887. (task 1002620)
 //   1.19.297 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
 //         landed since 1.19.296 with no explicit bump. run 32592502621. (task 1002620)
+//   1.19.298 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+//         landed since 1.19.297 with no explicit bump. run 32597859474. (task 1002620)
+//   1.19.299 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+//         landed since 1.19.298 with no explicit bump. run 32600322268. (task 1002620)
 // ---------------------------------------------------------------------------
-const CORE_VERSION = '1.19.297'; // CI auto-patch carrier (ADR 0161); see changelog above
+const CORE_VERSION = '1.19.299'; // CI auto-patch carrier (ADR 0161); see changelog above
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('dev-box'); log.info('mounted');

package/tests/hall_nav.mjs

@@ -137,7 +137,12 @@ test('sidebar groups read by audience, in order', () => {
   // whose subject is a person rather than the product. Deliberate addition to
   // this oracle: the group is pinned exactly so a new tab in the hall's most
   // valuable nav real estate is a reviewed decision, not a drift.
-  assert.deepEqual(nav[0].items.map((i) => i.id), ['home', 'roadmap', 'goals', 'work', 'copy-desk'],
+  // task 1002928 (R152 of goal 1000062): 'ideas' — the Full Idea composer — joins
+  // the same group, placed BEFORE copy-desk so the run reads as the four project
+  // pages followed by the two CRAFT surfaces side by side: the ideator's queue and
+  // the artist's. Same reasoning as copy-desk for why it is here rather than Docs
+  // (a place you act, not reference material) or You (its subject is the project).
+  assert.deepEqual(nav[0].items.map((i) => i.id), ['home', 'roadmap', 'goals', 'work', 'ideas', 'copy-desk'],
     'the unlabeled group is the project itself (task 1002425 order)');
   assert.deepEqual(nav[1].items.map((i) => i.id), ['standing', 'profile'], 'You = your own numbers');
   // People (task 1002577): the /scouting directory graduated into the hall.

package/tests/idea_credit_split.mjs

@@ -0,0 +1,224 @@
+// tests/idea_credit_split.mjs
+//
+// task 1002923 (BV1.R147, goal 1000062; ADR 0185) — the spark-handoff credit
+// split: 70% developer / 30% spark author, on both ideator streams.
+//
+// The three properties that are REAL BUGS if missed, asserted first:
+//   1. the total is CONSERVED under rounding (round(3.5)+round(1.5) = 6 from a
+//      5-credit payout is the naive mistake);
+//   2. a SELF-DEVELOPED idea collapses to ONE payee — two rows for one builder
+//      would be silently UNDER-paid, because the idempotency predicate is
+//      (builder_id, reason) and the second insert is refused;
+//   3. zero-value rows are DROPPED, not booked as 0-credit ledger noise.
+//
+// Then the two streams end-to-end against a stub client, and the develop route
+// actually paying (the gap R146 deliberately left open).
+//
+// Run:  node tests/idea_credit_split.mjs
+
+import { strict as assert } from 'node:assert';
+import { createRequire } from 'node:module';
+
+const require = createRequire(import.meta.url);
+const credits = require('../modules/economy/credits.js');
+const { splitIdeaCredit, IDEA_DEVELOPER_SHARE, IDEA_FULL_PASS_CREDIT, IDEA_TASK_SHIP_BASE } = credits;
+
+let passed = 0;
+let failed = 0;
+async function test(name, fn) {
+  try { await fn(); passed++; console.log(`  ok  ${name}`); }
+  catch (err) { failed++; console.error(`  FAIL ${name}\n    ${err.message}`); }
+}
+
+const sum = (ps) => ps.reduce((n, p) => n + p.delta, 0);
+
+// --- property 1: the total is conserved ---------------------------------
+
+await test('the split CONSERVES the total at every payout size', () => {
+  for (let total = 1; total <= 120; total += 1) {
+    const ps = splitIdeaCredit(total, { authorId: 9, developedBy: 42 });
+    assert.equal(sum(ps), total, `total ${total} must not gain or lose a credit`);
+  }
+});
+
+await test('a 5-credit payout splits 4/1, not 4/2 — the rounding trap', () => {
+  const ps = splitIdeaCredit(5, { authorId: 9, developedBy: 42 });
+  assert.equal(sum(ps), 5);
+  const dev = ps.find((p) => p.role === 'developer');
+  const author = ps.find((p) => p.role === 'spark_author');
+  assert.equal(dev.delta, 4, 'round(5 * 0.70) = 4');
+  assert.equal(author.delta, 1, 'the author gets the REMAINDER, not round(1.5)=2');
+});
+
+await test('the developer gets the larger share, and it tracks the constant', () => {
+  assert.equal(IDEA_DEVELOPER_SHARE, 0.70, 'the owner decision, 2026-08-22');
+  const ps = splitIdeaCredit(100, { authorId: 9, developedBy: 42 });
+  assert.equal(ps.find((p) => p.role === 'developer').delta, 70);
+  assert.equal(ps.find((p) => p.role === 'spark_author').delta, 30);
+});
+
+// --- property 2: self-development collapses -----------------------------
+
+await test('a SELF-developed idea is ONE payee at the full amount', () => {
+  const ps = splitIdeaCredit(5, { authorId: 9, developedBy: 9 });
+  assert.equal(ps.length, 1, 'two rows for one builder would be silently under-paid');
+  assert.equal(ps[0].delta, 5);
+  assert.equal(ps[0].builderId, 9);
+  assert.equal(ps[0].role, 'author_developer');
+});
+
+await test('string/number id mismatch still counts as the same person', () => {
+  // captured_by and developed_by come back from pg as strings on a bigint column.
+  const ps = splitIdeaCredit(5, { authorId: '9', developedBy: 9 });
+  assert.equal(ps.length, 1, 'a type difference must not become a phantom second payee');
+});
+
+await test('an UNDEVELOPED idea pays its author everything', () => {
+  const ps = splitIdeaCredit(5, { authorId: 9, developedBy: null });
+  assert.deepEqual(ps, [{ builderId: 9, delta: 5, role: 'author' }]);
+});
+
+// --- property 3: no zero rows -------------------------------------------
+
+await test('a 1-credit payout pays the developer 1 and books NOTHING for the author', () => {
+  const ps = splitIdeaCredit(1, { authorId: 9, developedBy: 42 });
+  assert.equal(sum(ps), 1);
+  assert.equal(ps.length, 1, 'a 0-credit ledger row reads like a payment that was not made');
+  assert.equal(ps[0].role, 'developer');
+});
+
+await test('a zero or negative payout pays nobody', () => {
+  assert.deepEqual(splitIdeaCredit(0, { authorId: 9, developedBy: 42 }), []);
+  assert.deepEqual(splitIdeaCredit(-5, { authorId: 9, developedBy: 42 }), []);
+});
+
+await test('no author means no payment at all', () => {
+  assert.deepEqual(splitIdeaCredit(5, { authorId: null, developedBy: 42 }), []);
+});
+
+// --- stream 2, end to end ----------------------------------------------
+
+// A stub client that records every INSERT and answers the parties lookup.
+function stubClient({ authorId, developedBy, alreadyPaid = [] }) {
+  const inserts = [];
+  return {
+    inserts,
+    query: async (sql, params = []) => {
+      if (/FROM idea_inbox i/i.test(sql) && /developed_by/i.test(sql)) {
+        return { rows: [{ captured_by: authorId, developed_by: developedBy }] };
+      }
+      if (/FROM ideas_task_lineage/i.test(sql)) {
+        return { rows: [{ idea_id: '77', captured_by: authorId, grade: 'full', completeness: 100, developed_by: developedBy }] };
+      }
+      if (/INSERT INTO credit_log/i.test(sql)) {
+        const [builderId, , delta, reason] = params;
+        if (alreadyPaid.some((a) => String(a.builderId) === String(builderId) && a.reason === reason)) {
+          return { rowCount: 0 };
+        }
+        inserts.push({ builderId, delta, reason, description: params[4] });
+        return { rowCount: 1 };
+      }
+      return { rows: [], rowCount: 0 };
+    },
+  };
+}
+
+const ON = { ideatorCredit: true };
+
+await test('stream 2: a developed Full Idea pays BOTH parties under one reason key', async () => {
+  const c = stubClient({ authorId: '9', developedBy: '42' });
+  const r = await credits.awardIdeaFullPassCredit(c, { ideaId: 77, authorId: '9', completenessScore: 100, config: ON });
+  assert.equal(r.credited, IDEA_FULL_PASS_CREDIT, 'the whole payout is booked, split across two rows');
+  assert.equal(c.inserts.length, 2);
+  // One reason key for both — which is exactly why the idempotency predicate
+  // must include builder_id, or the second payee would be refused.
+  assert.equal(new Set(c.inserts.map((i) => i.reason)).size, 1);
+  assert.equal(c.inserts.find((i) => i.builderId === '42').delta, 4);
+  assert.equal(c.inserts.find((i) => i.builderId === '9').delta, 1);
+  assert.match(c.inserts.find((i) => i.builderId === '42').description, /developer/);
+  assert.match(c.inserts.find((i) => i.builderId === '9').description, /spark author/);
+});
+
+await test('stream 2: the PARTIES come from the DB, not from the caller', async () => {
+  // A caller naming the wrong author cannot redirect the money — the whole
+  // reason R146 could not safely pay.
+  const c = stubClient({ authorId: '9', developedBy: '42' });
+  await credits.awardIdeaFullPassCredit(c, { ideaId: 77, authorId: '999', completenessScore: 100, config: ON });
+  assert.ok(!c.inserts.some((i) => i.builderId === '999'), 'the caller-supplied author is ignored when the row is readable');
+  assert.deepEqual(c.inserts.map((i) => i.builderId).sort(), ['42', '9']);
+});
+
+await test('stream 2: an undeveloped Full Idea still pays its author the full 5', async () => {
+  const c = stubClient({ authorId: '9', developedBy: null });
+  const r = await credits.awardIdeaFullPassCredit(c, { ideaId: 77, authorId: '9', completenessScore: 100, config: ON });
+  assert.equal(r.credited, IDEA_FULL_PASS_CREDIT);
+  assert.equal(c.inserts.length, 1);
+  assert.equal(c.inserts[0].builderId, '9');
+  assert.equal(c.inserts[0].delta, IDEA_FULL_PASS_CREDIT);
+});
+
+await test('stream 2: a PARTIALLY booked split completes on a re-run, never double-pays', async () => {
+  const reason = 'idea.credit.full_pass:77';
+  // The developer's row landed; the author's did not (a crash between inserts).
+  const c = stubClient({ authorId: '9', developedBy: '42', alreadyPaid: [{ builderId: '42', reason }] });
+  const r = await credits.awardIdeaFullPassCredit(c, { ideaId: 77, authorId: '9', completenessScore: 100, config: ON });
+  assert.equal(c.inserts.length, 1, 'only the missing row is written');
+  assert.equal(c.inserts[0].builderId, '9');
+  assert.equal(r.credited, 1, 'credited reports only what was NEWLY booked');
+});
+
+await test('stream 2: a fully booked split reports already_paid and writes nothing', async () => {
+  const reason = 'idea.credit.full_pass:77';
+  const c = stubClient({ authorId: '9', developedBy: '42', alreadyPaid: [{ builderId: '42', reason }, { builderId: '9', reason }] });
+  const r = await credits.awardIdeaFullPassCredit(c, { ideaId: 77, authorId: '9', completenessScore: 100, config: ON });
+  assert.equal(c.inserts.length, 0);
+  assert.equal(r.credited, 0);
+  assert.equal(r.reason, 'already_paid');
+});
+
+await test('stream 2: below the bar nobody is paid, developed or not', async () => {
+  const c = stubClient({ authorId: '9', developedBy: '42' });
+  const r = await credits.awardIdeaFullPassCredit(c, { ideaId: 77, authorId: '9', completenessScore: 10, config: ON });
+  assert.equal(r.credited, 0);
+  assert.equal(r.reason, 'below_bar');
+  assert.equal(c.inserts.length, 0);
+});
+
+await test('stream 2: the lane can still be switched off entirely', async () => {
+  const c = stubClient({ authorId: '9', developedBy: '42' });
+  const r = await credits.awardIdeaFullPassCredit(c, { ideaId: 77, authorId: '9', completenessScore: 100, config: { ideatorCredit: false } });
+  assert.equal(r.reason, 'ideator_lane_off');
+  assert.equal(c.inserts.length, 0);
+});
+
+// --- stream 1, end to end ----------------------------------------------
+
+await test('stream 1: a task shipped under a DEVELOPED idea splits the same way', async () => {
+  const c = stubClient({ authorId: '9', developedBy: '42' });
+  const r = await credits.awardIdeaTaskShipCredit(c, { taskId: 100, config: ON });
+  assert.equal(r.credited, IDEA_TASK_SHIP_BASE, 'a 100% full idea pays the full base, split');
+  assert.equal(c.inserts.length, 2);
+  assert.equal(sum(c.inserts.map((i) => ({ delta: i.delta }))), IDEA_TASK_SHIP_BASE);
+  assert.equal(c.inserts.find((i) => i.builderId === '42').delta, 4);
+  assert.equal(c.inserts.find((i) => i.builderId === '9').delta, 1);
+  // Same rule, so the same wording — one rule to explain, not two.
+  assert.match(c.inserts.find((i) => i.builderId === '42').description, /stream 1/);
+  assert.match(c.inserts.find((i) => i.builderId === '42').description, /developer/);
+});
+
+await test('stream 1: an undeveloped idea is unchanged — the author gets it all', async () => {
+  const c = stubClient({ authorId: '9', developedBy: null });
+  const r = await credits.awardIdeaTaskShipCredit(c, { taskId: 100, config: ON });
+  assert.equal(r.credited, IDEA_TASK_SHIP_BASE);
+  assert.equal(c.inserts.length, 1);
+  assert.equal(c.inserts[0].builderId, '9');
+});
+
+await test('stream 1: the per-(idea,task) reason key still scopes idempotency', async () => {
+  const c = stubClient({ authorId: '9', developedBy: '42' });
+  await credits.awardIdeaTaskShipCredit(c, { taskId: 100, config: ON });
+  for (const i of c.inserts) assert.equal(i.reason, 'idea.credit.task_ship:77:100');
+});
+
+console.log(`\nidea_credit_split: ${passed} passed, ${failed} failed`);
+if (failed > 0) process.exit(1);

package/tests/idea_develop_spark.mjs

@@ -93,9 +93,11 @@ const basePoolQuery = async (sql, params = []) => {
 async function test(name, fn) {
   queries = [];
   portsResolved = [];
-  // Restored every test: one case below swaps in a two-phase stub to simulate a
-  // triager closing the idea mid-request, and it must not leak into the next.
+  // Restored every test: cases below swap in a two-phase pool stub (a triager
+  // closing the idea mid-request) and reward/government port stubs, and none of
+  // them may leak into the next test.
   api.pool.query = basePoolQuery;
+  api.resolveOptional = (name) => { portsResolved.push(name); return undefined; };
   // The author is builder 9; the developer in call() defaults to 42.
   idea = {
     id: '77', title: 'a spark', body_md: 'the thought', status: 'open',
@@ -293,16 +295,51 @@ await test('a missing idea is a 404, not a 500', async () => {
 
 // --- the money boundary: R147 owns the split ---------------------------
 
-await test('the stream-2 pass credit is NOT paid here — R147 owns the split', async () => {
+// R146 shipped this route paying NOTHING on purpose: with two people involved the
+// recipient was ambiguous, and awardIdeaFullPassCredit's idempotency predicate is
+// (builder_id, reason) — so guessing the developer would not have blocked a later
+// payment to the author, and one idea would have paid twice. R147 (ADR 0185)
+// resolved that by moving the payee decision INTO the economy module, so this
+// route can now call it safely: it no longer chooses who earns.
+await test('the stream-2 pass credit IS paid here now, and the route does not pick the payee', async () => {
+  let seen = null;
+  api.resolveOptional = (name) => {
+    portsResolved.push(name);
+    if (name === 'reward') {
+      return {
+        awardIdeaFullPassCredit: async (_client, args) => {
+          seen = args;
+          return { credited: 5, reason: 'paid', payees: [
+            { builderId: '42', delta: 4, role: 'developer', booked: true },
+            { builderId: '9', delta: 1, role: 'spark_author', booked: true },
+          ] };
+        },
+      };
+    }
+    return undefined;
+  };
   const r = await call();
   assert.equal(r.status, 200);
-  // Stronger than "no INSERT INTO credit_log": the handler never even asks for
-  // the reward port. awardIdeaFullPassCredit is idempotent per (builder, idea),
-  // so paying the DEVELOPER here would NOT block a later payment to the AUTHOR —
-  // the same idea would pay twice.
-  assert.ok(!portsResolved.includes('reward'), 'the reward port is never resolved on the develop path');
-  assert.ok(!queries.some((q) => /credit_log/i.test(q.sql)), 'no credit is booked');
-  assert.equal(r.payload.ideator_credit, undefined);
+  assert.ok(portsResolved.includes('reward'), 'the reward port is consulted');
+  assert.equal(r.payload.idea.ideator_credit, 5, 'the total is surfaced');
+  assert.equal(r.payload.idea.ideator_credit_split.length, 2, 'and the per-payee breakdown');
+  // The route hands over the idea and the score — never a chosen recipient beyond
+  // the author fallback the economy module overrides from the DB.
+  assert.equal(seen.ideaId, 77);
+  assert.equal(seen.completenessScore, 100);
+  assert.ok(!('developedBy' in seen), 'the route does not tell economy who developed it');
+});
+
+await test('a credit failure does not roll back the development (fail-open)', async () => {
+  api.resolveOptional = (name) => {
+    portsResolved.push(name);
+    if (name === 'reward') return { awardIdeaFullPassCredit: async () => { throw new Error('synthetic credit outage'); } };
+    return undefined;
+  };
+  const r = await call();
+  assert.equal(r.status, 200, 'the development landed');
+  assert.equal(r.payload.developed, true);
+  assert.equal(r.payload.idea.ideator_credit, undefined);
 });
 
 await test('but the board window IS opened — otherwise the handoff dead-ends', async () => {