@bongos/core 1.19.348 → 1.19.350

package/.bongos-core.json

@@ -2,22 +2,22 @@
   "artifact": "bongos-core",
   "manifest_schema": 1,
   "generator": "scripts/gds/package-core.js",
-  "core_version": "1.19.348",
-  "core_contract": "1.19.348",
-  "source_commit": "d42db56154d01be276f13e04e364e7ced8d8c400",
+  "core_version": "1.19.350",
+  "core_contract": "1.19.350",
+  "source_commit": "b3898b596361d562a903c957d10018ca30a88239",
   "source_ref": "HEAD",
-  "built_at": "2026-08-25T02:48:07.802Z",
+  "built_at": "2026-08-25T04:58:04.601Z",
   "redaction": {
     "model": "docs-redacted+functional-verbatim",
-    "docs_redacted": 328,
+    "docs_redacted": 329,
     "agent_docs_stubbed": 22,
-    "functional_verbatim": 1499,
+    "functional_verbatim": 1506,
     "rules": 3,
     "gate_literals": 3,
     "gate": "passed"
   },
-  "file_count": 1849,
-  "tree_sha256": "3004531bfb70cd33dbca752e2d945c4687d6ea1148f54548b6fcf921f953681f",
+  "file_count": 1857,
+  "tree_sha256": "5f758a2af4bf5a44b2f4f32cbc908d1eff7b70dca35b889880a63f5c768fb78d",
   "files": [
     {
       "path": ".claude/skills/blocker-review/SKILL.md",
@@ -347,12 +347,12 @@
     {
       "path": "clients/bongos-client/README.md",
       "mode": "0000644",
-      "sha256": "615510285a7e398d5f0c188fa32a8d915ecc3b8bc420fc0f0e6b476e1a819a9d"
+      "sha256": "8c0c4d213d8968fe1180a945aa847c5cca97e73ae3497290f69200a02f0e3995"
     },
     {
       "path": "clients/bongos-client/bongos-client.global.js",
       "mode": "0000644",
-      "sha256": "4854a4975a05b0b7914a6c087f85c9b15130debefebde75e438fa73cc85df7d0"
+      "sha256": "762aa91de1b50fa63f8e8d1b1dbdd775b6103c6b8a833dd5f6de4721df7cae15"
     },
     {
       "path": "clients/bongos-client/examples/hello-world.mjs",
@@ -362,17 +362,17 @@
     {
       "path": "clients/bongos-client/index.cjs",
       "mode": "0000644",
-      "sha256": "482572aaeacfa0b195bcb7fa9b812c746a8304b85d4ca423674cff85bc46e71c"
+      "sha256": "5f5c9e0ebb6ef5cded0454b08270938e2ade486e13ede3edd89c23fe93f0798d"
     },
     {
       "path": "clients/bongos-client/index.d.ts",
       "mode": "0000644",
-      "sha256": "ef27d2f4e7e92b3c47c8bb372dd1e4eba7358986471efab9b626597970e4d94e"
+      "sha256": "8a03a6a6fa27ca367cef614e2d03bdf8c2363b50e5a11eca3b9e6faa803080f7"
     },
     {
       "path": "clients/bongos-client/index.mjs",
       "mode": "0000644",
-      "sha256": "5d6cd728c907810d2a55e0c3ef1c73ed122cb2fbbd858c85654860ce42dbdf70"
+      "sha256": "1eb6f3523f67f7a017cb5c28c087aa00363f05335679f3379859aab43bb4d29c"
     },
     {
       "path": "clients/bongos-client/package.json",
@@ -1399,6 +1399,11 @@
       "mode": "0000644",
       "sha256": "e7d0245b21406ddcd118dce29ffb1df5a4797e33d66231aa6bc734316c19530f"
     },
+    {
+      "path": "docs/adr/0184-a-task-visual-inherits-its-summary-audience.md",
+      "mode": "0000644",
+      "sha256": "e9b240d6586225b4b71bfa5cbb9ee06b9067394c8787c228e6572f14c9383391"
+    },
     {
       "path": "docs/adr/0184-ship-requires-an-assurance.md",
       "mode": "0000644",
@@ -1437,22 +1442,22 @@
     {
       "path": "docs/adr/README.md",
       "mode": "0000644",
-      "sha256": "23ee65dab5a7e5eea9e69403f0c49f2e6ec2b37e8a5473562898b122d33d1236"
+      "sha256": "a1fc3b27fff2453bc6d419b118f93cf34be562bb264441b44184176049f878eb"
     },
     {
       "path": "docs/api-reference.md",
       "mode": "0000644",
-      "sha256": "bc46270167b3d63df4dac08b92fcfa5fb2fcf7b2ba243bde906aa84e54541299"
+      "sha256": "f8f2920b3448a54530c8da2ae8a2c809c46b3ad8425fe24e3320d782c92e48bb"
     },
     {
       "path": "docs/api/openapi.json",
       "mode": "0000644",
-      "sha256": "7afa3f34e447b946f948e2629e6529b3b98ed91ead3ff0f9535933e756d2936b"
+      "sha256": "86c346871a6181f8396b8daa5dcaa59180109a414162389786a23a43b51b93d6"
     },
     {
       "path": "docs/architecture.md",
       "mode": "0000644",
-      "sha256": "193c04262908677d4cdee4c9ba20031ed19220c3886cce8f25f54ea3e615079f"
+      "sha256": "92cbe2a55fff82a842e7ac3668c99d4eef05e922079d036a5984f607a64496ae"
     },
     {
       "path": "docs/branding-contract.md",
@@ -1472,12 +1477,12 @@
     {
       "path": "docs/copy-inventory.md",
       "mode": "0000644",
-      "sha256": "0caaef6980475bc4abbb51df79ebe4b14b2a3ad7b97f3e2da13f08d8e1ae1b11"
+      "sha256": "c9747b5e5e84179f9f5b33abd89c7b38e520328273a2f977a8d2abacacf1f318"
     },
     {
       "path": "docs/copy-registry.json",
       "mode": "0000644",
-      "sha256": "d5410ce76bb98ee335363f00e483fd66539b9ac35ffb4ec8a7bd3e0af928faf0"
+      "sha256": "44564011072520a55824d40f2ed824a3a4238c362f41416cf3e43b2bac6a06eb"
     },
     {
       "path": "docs/design-contract.md",
@@ -1587,7 +1592,7 @@
     {
       "path": "docs/file-map.md",
       "mode": "0000644",
-      "sha256": "bbe32c152ba31a68953f318f9a94e010252e70a6e076d64d7dca820f5c19777b"
+      "sha256": "74102dbb050a3e9df3ade05ef25d8704319e7b1fac801b784f1ed8c3ea1b7566"
     },
     {
       "path": "docs/handoff-template.md",
@@ -2479,6 +2484,11 @@
       "mode": "0000644",
       "sha256": "8fc38c0353811699e19d861321d4fca8fe8fd5cca1f66ff96312d7f44fb0290e"
     },
+    {
+      "path": "migrations/core_223_task_visual.sql",
+      "mode": "0000644",
+      "sha256": "45e57200c3fe78481afb0be2941002ec052bb85bd0953385f08ee82243ba0281"
+    },
     {
       "path": "migrations/core_224_goal_subtitle.sql",
       "mode": "0000644",
@@ -2847,7 +2857,7 @@
     {
       "path": "modules/dev-box/app/src/vendor/bongos-client.cjs",
       "mode": "0000644",
-      "sha256": "482572aaeacfa0b195bcb7fa9b812c746a8304b85d4ca423674cff85bc46e71c"
+      "sha256": "5f5c9e0ebb6ef5cded0454b08270938e2ade486e13ede3edd89c23fe93f0798d"
     },
     {
       "path": "modules/dev-box/app/test/unit.mjs",
@@ -3537,12 +3547,12 @@
     {
       "path": "modules/hall-ui/public/hall-kit.js",
       "mode": "0000644",
-      "sha256": "4d5ec8f334fc00f23e81fe21283b7ea2fb173b253c638a08ef48b97111cc654f"
+      "sha256": "eea1102877233794d84a6f76187a9fbd26c4a58cf523df3bf0a31c041ead9933"
     },
     {
       "path": "modules/hall-ui/public/hall-render.js",
       "mode": "0000644",
-      "sha256": "704726830539538f916a8d6a704f6aff77084dcec0445619c185feb5ecb0c43f"
+      "sha256": "f9be7f42df75e5cac2ef917ddac0f22c294ab0eba687c0dbffc15a5fe31a36dd"
     },
     {
       "path": "modules/hall-ui/public/hall-widgets.js",
@@ -3687,12 +3697,12 @@
     {
       "path": "modules/hall-ui/public/profile.html",
       "mode": "0000644",
-      "sha256": "b8d5fb31d92f6d65e8f257d10c77f4ee0aa0ebec50d977d4c7d918ff2253da1e"
+      "sha256": "b40e046ca91cb99f0f8a701bd4cc96c03b23432691e256c97cd55527c0be604b"
     },
     {
       "path": "modules/hall-ui/public/profile.js",
       "mode": "0000644",
-      "sha256": "ddd95350fa5c3696452996d4c79bb7e9c5d4d2b1034ed31a082dd568195b6543"
+      "sha256": "a63cb32c0c8b8fa5628e80bcf1d27b8a556340d585c38f98a7c3bee629eb6804"
     },
     {
       "path": "modules/hall-ui/public/ranks.html",
@@ -3767,7 +3777,7 @@
     {
       "path": "modules/hall-ui/public/style.css",
       "mode": "0000644",
-      "sha256": "aec0a07f929b88d95d4ec2e7809f0b8cba24855441c8d719a137f2d2f184adf6"
+      "sha256": "2c2f2196d75881495c8ba4dcec5e4e69bb78860e993ed3d22a8ee5299d250dcb"
     },
     {
       "path": "modules/hall-ui/public/task-detail.js",
@@ -3787,7 +3797,7 @@
     {
       "path": "modules/hall-ui/public/task.js",
       "mode": "0000644",
-      "sha256": "25e487bb73e1c36397350fe89953a07c0a7742670e89589ad1c4cea07c830d74"
+      "sha256": "f2c4c154920e8f1019fb1628e187201e6e582ec61b04fa9fb9620be097f44b62"
     },
     {
       "path": "modules/hall-ui/public/watch.css",
@@ -3917,7 +3927,7 @@
     {
       "path": "modules/lifecycle/db-analytics.js",
       "mode": "0000644",
-      "sha256": "b0cb5fb6853d39fd99feaa0b8e3b1040b0877a8476273789dad8976be42070cd"
+      "sha256": "1291eaf95b6518537312e894b15a4ad3ebbfea783d2e3bd2fbab1d0b9a08ea90"
     },
     {
       "path": "modules/lifecycle/db-claim-reads.js",
@@ -3997,7 +4007,7 @@
     {
       "path": "modules/lifecycle/github-push.js",
       "mode": "0000644",
-      "sha256": "127b6666bfbc4b85baebe85b0bf5501ad73b517faf4dafbc1a76a5535ac04ebc"
+      "sha256": "d50b04376a9725bae0f8fe9c81166224eb47242655fec49f33f89b0f87b555f0"
     },
     {
       "path": "modules/lifecycle/goal-advisory.js",
@@ -4062,7 +4072,7 @@
     {
       "path": "modules/lifecycle/module.json",
       "mode": "0000644",
-      "sha256": "8f94f0609ee66725a31147da7ced78d4a9736ec1ee1f88daf6f3cf5df6b984c4"
+      "sha256": "2c7c98cd6d811d23abfbd6448572ec44c6199f7c15514b0c09924126199e23f9"
     },
     {
       "path": "modules/lifecycle/pollers/publish-reconciler.js",
@@ -4132,13 +4142,18 @@
     {
       "path": "modules/lifecycle/routes/tasks.js",
       "mode": "0000644",
-      "sha256": "07a56f93428baf4d8cbf7a69a76c052e706ec7759134fcf3db153a37c9ab575c"
+      "sha256": "b29d9bffce9c81e0f5e02ea2da387e15dc6f0bf8d96820931c29275861eeaf66"
     },
     {
       "path": "modules/lifecycle/routes/versions.js",
       "mode": "0000644",
       "sha256": "044ca86e5605c19dd8e523da9eb061b4a90ed0af199ec1288c3c5f1b1bb8f46b"
     },
+    {
+      "path": "modules/lifecycle/routes/visuals.js",
+      "mode": "0000644",
+      "sha256": "e6e64fe479722f147dce98b9ff190348cd40949ada3a207236655d632bdef94b"
+    },
     {
       "path": "modules/lifecycle/ship-assurance.js",
       "mode": "0000644",
@@ -4159,6 +4174,16 @@
       "mode": "0000644",
       "sha256": "205bbe37f27191c0404fe03d1e84ce313fc3fdbde0bfcd00c65aca2971c6e163"
     },
+    {
+      "path": "modules/lifecycle/task-visual-db.js",
+      "mode": "0000644",
+      "sha256": "f37de3d572a5a283986222c223b91447e0994d4b5253a51c5dc83073ed08bf45"
+    },
+    {
+      "path": "modules/lifecycle/task-visuals.js",
+      "mode": "0000644",
+      "sha256": "f5133f1a27404712a7cce9e9fa43ff016ba2342571fd8e109228e46486941c47"
+    },
     {
       "path": "modules/lifecycle/version-close.js",
       "mode": "0000644",
@@ -4752,22 +4777,22 @@
     {
       "path": "modules/status-ui/public/status.js",
       "mode": "0000644",
-      "sha256": "bd0fcd32548c7b2cc7c6d36b0f31cba3e0575c95ff3dc85fdb15b11decbdfe42"
+      "sha256": "792c478f89a21a71161417a5a1842d603d48cc6d46a1c984abf9b2797e6fc6e2"
     },
     {
       "path": "modules/status-ui/public/style.css",
       "mode": "0000644",
-      "sha256": "9839f1cafe48e8ff8aafd6b4ade4752b46de36dd6219ef35868d0743b1363e37"
+      "sha256": "75a40d70207669ab57b0be05e4b6be70a2936cb9febf333b0a34224a80047e7e"
     },
     {
       "path": "package-lock.json",
       "mode": "0000644",
-      "sha256": "6745e4e181b20731968d02f8e4dac7cb864acbf3fbbd6ec6054c799a41487618"
+      "sha256": "2fd58f9d0189864a4c8d2c3162a8770850b9c2e40a424f770d7674680215ccb6"
     },
     {
       "path": "package.json",
       "mode": "0000644",
-      "sha256": "65ce6bcba41342833cd48800e028fd1e3420a4d9d7fb82c1250cfca724baa0ad"
+      "sha256": "ed85b50d7ee00f78cda9cd034c43d319d0d99c2350a63f48b92fc374df73f5e4"
     },
     {
       "path": "public-docs/index.html",
@@ -6072,7 +6097,7 @@
     {
       "path": "scripts/gds/ship-flow.js",
       "mode": "0000644",
-      "sha256": "c63d7bcdf4c25de60ad4106495e09bccfd98a19b223111988e4339a4460558b8"
+      "sha256": "9cc28796753779cc054036bbaae841ff798d27c92ad98e37ff877662b3f063ce"
     },
     {
       "path": "scripts/gds/ship-git.js",
@@ -6102,7 +6127,7 @@
     {
       "path": "scripts/gds/ship-land.js",
       "mode": "0000644",
-      "sha256": "c3224ab05621b1e1e523b926c7a3d0e09b36c7de3fc6d984ee6c588dfcdd1e38"
+      "sha256": "e091557b4cc29c081cb82f9cd650b4c110f1dede4e72b704893f8397cd7bbaf2"
     },
     {
       "path": "scripts/gds/ship-memory-sync.js",
@@ -6144,6 +6169,11 @@
       "mode": "0000644",
       "sha256": "ff7e9d74c4349a3c5bb41df121165f4868fd78913211872c4b055a7282463144"
     },
+    {
+      "path": "scripts/gds/ship-visual.js",
+      "mode": "0000644",
+      "sha256": "21ce15f1e49388bb3f8a46b9cfd8b05b23b77efbe93228ca04d9b13740e6d901"
+    },
     {
       "path": "scripts/gds/ship.js",
       "mode": "0000644",
@@ -6212,7 +6242,7 @@
     {
       "path": "scripts/gds/task.js",
       "mode": "0000644",
-      "sha256": "3abde7739869f26348f9dd624dce50d81beac18f2bde68634bb57d9a078f536f"
+      "sha256": "88b9b721b3911957b13aa5e8023e6d41534e34afd4bbc70f40435efc52e2017b"
     },
     {
       "path": "scripts/gds/triage.js",
@@ -6492,7 +6522,7 @@
     {
       "path": "src/bongos/routes.js",
       "mode": "0000644",
-      "sha256": "d0d7cd19a80e20946fa8d3ecdcb41f74871194d2c4e4518aeddc07a30e274630"
+      "sha256": "ede634ea623ec035a5ebab896f1f97e67e142c882cade5afaeb3e3c253fc28f8"
     },
     {
       "path": "src/bongos/routes/CLAUDE.md",
@@ -6567,7 +6597,7 @@
     {
       "path": "src/bongos/routes/public.js",
       "mode": "0000644",
-      "sha256": "a6cf425b755630a6720ed4099ecb187131d8c0dbb9d2d6a02d0a4f5915e2ecb5"
+      "sha256": "b4f0f1d10bebd66259b48bb72af121ae9ef94e774c8b840456aa7c2e0aabdf52"
     },
     {
       "path": "src/bongos/routes/security.js",
@@ -6622,7 +6652,7 @@
     {
       "path": "src/module-api.js",
       "mode": "0000644",
-      "sha256": "7eca632fc6880711d60fad718a743301e62e99ca990a8a4cf07767726f86f0cf"
+      "sha256": "60a8faf9804d21e1e7a71b48b407d0f1e3ef9fcc01532ca382dce975ef440e6d"
     },
     {
       "path": "src/module-loader/catalog.js",
@@ -8977,7 +9007,7 @@
     {
       "path": "tests/ship_publish_error.mjs",
       "mode": "0000644",
-      "sha256": "b6ca6ac4802b035c02be382a8aa7f63f5381b02524343d5fe002336c1aadc512"
+      "sha256": "5c0d5961408ac202eb53fe648c4c8b00e5552b231b35f39a39e006b705cb34f1"
     },
     {
       "path": "tests/ship_resume.mjs",
@@ -9134,6 +9164,16 @@
       "mode": "0000644",
       "sha256": "cfb57e35ce65f991309e4de64c03f9252e19117a1ad406cf9bb04c1716f57746"
     },
+    {
+      "path": "tests/task_visual_route_gate.mjs",
+      "mode": "0000644",
+      "sha256": "35654aab981213d7a944183e8710f1bef967c109886f996dfeb7dfc82bf665e7"
+    },
+    {
+      "path": "tests/task_visuals.mjs",
+      "mode": "0000644",
+      "sha256": "3ff18b286a68b244a272b3f2606ae33b298622347aae97305152f235ca57b330"
+    },
     {
       "path": "tests/tool-scan-fixtures/README.md",
       "mode": "0000644",

package/clients/bongos-client/README.md

@@ -5,7 +5,7 @@ A **generated**, zero-dependency typed client for the Bongos API — produced fr
 by hand; it regenerates when the spec changes, so it can never drift from the routes.
 
 - API version: **v1** (served at `/api/bongos/v1`)
-- 304 operations across 48 resource groups
+- 307 operations across 49 resource groups
 
 ## Install
 

package/clients/bongos-client/bongos-client.global.js

@@ -716,6 +716,10 @@ function createClient(opts = {}) {
       // POST /sso/token — rank: public — POST /sso/token
       postSsoToken: (args) => request("POST", "/sso/token", { hasBody: true }, args),
     },
+    "taskVisuals": {
+      // GET /task-visuals/{name} — rank: public — GET /task-visuals/:name
+      getTaskVisualsName: (args) => request("GET", "/task-visuals/{name}", { hasBody: false }, args),
+    },
     "tasks": {
       // GET /tasks — rank: any-builder — GET /tasks
       getTasks: (args) => request("GET", "/tasks", { hasBody: false }, args),
@@ -759,6 +763,10 @@ function createClient(opts = {}) {
       getTasksIdPublishStatus: (args) => request("GET", "/tasks/{id}/publish-status", { hasBody: false }, args),
       // POST /tasks/{id}/ship — rank: any-builder — POST /tasks/:id/ship
       postTasksIdShip: (args) => request("POST", "/tasks/{id}/ship", { hasBody: true }, args),
+      // DELETE /tasks/{id}/visual — rank: any-builder — DELETE /tasks/:id/visual
+      deleteTasksIdVisual: (args) => request("DELETE", "/tasks/{id}/visual", { hasBody: false }, args),
+      // POST /tasks/{id}/visual — rank: any-builder — POST /tasks/:id/visual
+      postTasksIdVisual: (args) => request("POST", "/tasks/{id}/visual", { hasBody: true }, args),
       // POST /tasks/{id}/vote — rank: metic+archon — POST /tasks/:id/vote
       postTasksIdVote: (args) => request("POST", "/tasks/{id}/vote", { hasBody: true }, args),
       // GET /tasks/claimable — rank: any-builder — GET /tasks/claimable

package/clients/bongos-client/index.cjs

@@ -715,6 +715,10 @@ function createClient(opts = {}) {
       // POST /sso/token — rank: public — POST /sso/token
       postSsoToken: (args) => request("POST", "/sso/token", { hasBody: true }, args),
     },
+    "taskVisuals": {
+      // GET /task-visuals/{name} — rank: public — GET /task-visuals/:name
+      getTaskVisualsName: (args) => request("GET", "/task-visuals/{name}", { hasBody: false }, args),
+    },
     "tasks": {
       // GET /tasks — rank: any-builder — GET /tasks
       getTasks: (args) => request("GET", "/tasks", { hasBody: false }, args),
@@ -758,6 +762,10 @@ function createClient(opts = {}) {
       getTasksIdPublishStatus: (args) => request("GET", "/tasks/{id}/publish-status", { hasBody: false }, args),
       // POST /tasks/{id}/ship — rank: any-builder — POST /tasks/:id/ship
       postTasksIdShip: (args) => request("POST", "/tasks/{id}/ship", { hasBody: true }, args),
+      // DELETE /tasks/{id}/visual — rank: any-builder — DELETE /tasks/:id/visual
+      deleteTasksIdVisual: (args) => request("DELETE", "/tasks/{id}/visual", { hasBody: false }, args),
+      // POST /tasks/{id}/visual — rank: any-builder — POST /tasks/:id/visual
+      postTasksIdVisual: (args) => request("POST", "/tasks/{id}/visual", { hasBody: true }, args),
       // POST /tasks/{id}/vote — rank: metic+archon — POST /tasks/:id/vote
       postTasksIdVote: (args) => request("POST", "/tasks/{id}/vote", { hasBody: true }, args),
       // GET /tasks/claimable — rank: any-builder — GET /tasks/claimable

package/clients/bongos-client/index.d.ts

@@ -13,6 +13,7 @@ export interface DeleteInboxIdSparkResponse { idea: unknown; sparked: boolean; u
 export interface DeleteMemoryFileResponse { deleted: boolean; builder_id: unknown; path: unknown }
 export interface DeleteTasksIdCriteriaCriterionIdResponse { ok: boolean; removed: unknown }
 export interface DeleteTasksIdDependenciesDepIdResponse { ok: boolean; removed: unknown }
+export interface DeleteTasksIdVisualResponse { ok: boolean; visual_url: unknown }
 export interface ErrorEnvelope { error: ApiErrorObject }
 export interface GetAccessRequestsResponse { requests: unknown }
 export interface GetAccessRequestsStatusResponse { github_login: unknown; status: unknown; admitted: unknown }
@@ -332,6 +333,8 @@ export interface PostTasksIdOverrideRequestResponse { ok: boolean; request: unkn
 export interface PostTasksIdPublishBranchRequest { branch: string; head_sha: string; bundle_b64: string; value_summary?: string }
 export interface PostTasksIdPublishBranchResponse { ok: boolean; pr_url: unknown; pr_number: unknown; head_sha: unknown; auto_merge: unknown }
 export interface PostTasksIdShipResponse { ok: boolean; task: unknown }
+export interface PostTasksIdVisualRequest { image_b64: string; content_type: string; alt?: string }
+export interface PostTasksIdVisualResponse { ok: boolean; visual_url: unknown; visual_alt: unknown; bytes: unknown }
 export interface PostTasksIdVoteRequest { vote: -1 | 0 | 1 }
 export interface PostTasksIdVoteResponse { ok: boolean; task_id: unknown; my_vote: unknown; net_votes: unknown; total_votes: unknown }
 export interface PostTasksNewcomerRestockResponse { ok: boolean; stamped: unknown; results: unknown }
@@ -989,6 +992,10 @@ export interface BongosClient {
     /** POST /sso/token — rank: public */
     postSsoToken(args: RequestArgs & { body: PostSsoTokenRequest }): Promise<PostSsoTokenResponse>;
   };
+  "taskVisuals": {
+    /** GET /task-visuals/{name} — rank: public */
+    getTaskVisualsName(args?: RequestArgs): Promise<ApiResponse>;
+  };
   "tasks": {
     /** GET /tasks — rank: any-builder */
     getTasks(args?: RequestArgs): Promise<GetTasksResponse>;
@@ -1032,6 +1039,10 @@ export interface BongosClient {
     getTasksIdPublishStatus(args?: RequestArgs): Promise<ApiResponse>;
     /** POST /tasks/{id}/ship — rank: any-builder */
     postTasksIdShip(args?: RequestArgs): Promise<PostTasksIdShipResponse>;
+    /** DELETE /tasks/{id}/visual — rank: any-builder */
+    deleteTasksIdVisual(args?: RequestArgs): Promise<DeleteTasksIdVisualResponse>;
+    /** POST /tasks/{id}/visual — rank: any-builder */
+    postTasksIdVisual(args: RequestArgs & { body: PostTasksIdVisualRequest }): Promise<PostTasksIdVisualResponse>;
     /** POST /tasks/{id}/vote — rank: metic+archon */
     postTasksIdVote(args: RequestArgs & { body: PostTasksIdVoteRequest }): Promise<PostTasksIdVoteResponse>;
     /** GET /tasks/claimable — rank: any-builder */

package/clients/bongos-client/index.mjs

@@ -712,6 +712,10 @@ export function createClient(opts = {}) {
       // POST /sso/token — rank: public — POST /sso/token
       postSsoToken: (args) => request("POST", "/sso/token", { hasBody: true }, args),
     },
+    "taskVisuals": {
+      // GET /task-visuals/{name} — rank: public — GET /task-visuals/:name
+      getTaskVisualsName: (args) => request("GET", "/task-visuals/{name}", { hasBody: false }, args),
+    },
     "tasks": {
       // GET /tasks — rank: any-builder — GET /tasks
       getTasks: (args) => request("GET", "/tasks", { hasBody: false }, args),
@@ -755,6 +759,10 @@ export function createClient(opts = {}) {
       getTasksIdPublishStatus: (args) => request("GET", "/tasks/{id}/publish-status", { hasBody: false }, args),
       // POST /tasks/{id}/ship — rank: any-builder — POST /tasks/:id/ship
       postTasksIdShip: (args) => request("POST", "/tasks/{id}/ship", { hasBody: true }, args),
+      // DELETE /tasks/{id}/visual — rank: any-builder — DELETE /tasks/:id/visual
+      deleteTasksIdVisual: (args) => request("DELETE", "/tasks/{id}/visual", { hasBody: false }, args),
+      // POST /tasks/{id}/visual — rank: any-builder — POST /tasks/:id/visual
+      postTasksIdVisual: (args) => request("POST", "/tasks/{id}/visual", { hasBody: true }, args),
       // POST /tasks/{id}/vote — rank: metic+archon — POST /tasks/:id/vote
       postTasksIdVote: (args) => request("POST", "/tasks/{id}/vote", { hasBody: true }, args),
       // GET /tasks/claimable — rank: any-builder — GET /tasks/claimable

package/docs/adr/0184-a-task-visual-inherits-its-summary-audience.md

@@ -0,0 +1,49 @@
+# ADR 0184 — A task's visual is its value summary in another medium, and inherits that audience
+
+- **Status:** accepted
+- **Date:** 2026-08-25
+- **Task:** 1003109 (from owner idea 1000400, filed in Discord `#ideas` 2026-06-24)
+- **Goal:** 1000072 — Human legibility
+
+## Context
+
+`value_summary` — the plain-language "what this means for a reader" line collected at ship time — already answers *what changed* for someone who does not read code. What it cannot answer is *what it looks like*. The owner's ask was explicit: a builder should be able to show "what they have built in the task … for the whole city to understand the impacts."
+
+Everything else in that idea already shipped (the note itself, and the spend half via `/cost`). What was missing was a picture. The only visual path a builder had was a Discord post — outside the ledger, and on a CDN whose links expire.
+
+Adding an image to a work-tracking record raises one question that is easy to answer badly: **who may see it?** A screenshot is not a sentence. It carries whatever was on the screen — an unshipped surface, another builder's name, a token in a terminal pane. The tempting move is to give visuals their own visibility control.
+
+## Decision
+
+**A visual has no audience of its own. It is the same claim as the task's `value_summary`, in another medium, and inherits that summary's audience exactly.**
+
+Consequences, in the order they bite:
+
+1. **One predicate, stated once.** `task-visuals.isPubliclyViewable(task)` — public means `status ∈ {shipped, confirmed}`, byte-for-byte the test `routes/public.js:projectPublicTask` already applies to a title and a summary. Anything else is served to any authenticated builder, which is the ordinary GDS posture: **not-public means un-published, never hidden**.
+2. **The gate lives inside the serve handler, not in the mounted middleware.** The audience is a property of the *row*, and Express middleware cannot express that. The stored filename therefore carries the task id (`task-<id>-<16hex>.<ext>`), so one lookup resolves it. Every step fails closed — unparseable name → absent task → not-public → `auth.requireBuilder`, never past it.
+3. **The public shipped feed mirrors the predicate in SQL** (`db.recentShippedTasks` nulls the URL for a `security_sensitive` row) so the unauthenticated status dashboard never advertises an image the serve route would refuse. Nulling the URL, rather than selecting the flag and filtering in JS, also keeps `security_sensitive` itself off the public wire. **Change one, change the other** — the two are noted in each other's comments.
+4. **One deliberate narrowing vs `value_summary`:** a `security_sensitive` task's image stays builders-only even once shipped. A summary is a sentence its author chose; a screenshot is whatever was on the screen, and on a security task that is the wrong default to publish.
+
+### The optionality is load-bearing
+
+"Where relevant" was the owner's own wording, so *optional* is a contract, not a default:
+
+- Nothing on the ship path calls the upload. `ship.js --visual` screens the file **before** the claim resolves (bad input costs a retyped command, never a claim) and uploads it **after** (a failed picture prints a warning and the re-attach command; it never fails a ship that already landed).
+- A task with no visual renders **nothing at all** — no placeholder, no empty frame, no "no visual" line. A task without one must never read as unfinished.
+- It is removable. `DELETE /tasks/:id/visual` exists because an image is not prose: the write-once rule of task 1003102 guards a written *claim*, not the picture beside it.
+
+### Not an arbitrary-file host
+
+Uploads are screened by an extension allowlist, a magic-byte sniff (a mislabeled content-type cannot smuggle a non-image onto disk), a 4 MB cap, and a server-minted filename. **SVG is deliberately absent** from the allowlist: it is an executable document, and these are served from our own origin. The serve route adds `nosniff`, `Content-Disposition: inline`, and a `default-src 'none'; sandbox` CSP. Files live under `var/task-visuals/` — outside the git tree, like the `#bugs` re-hosts (task 936), so a deploy's `git reset --hard` never wipes them.
+
+## Alternatives considered
+
+- **A per-visual visibility flag.** Rejected: it invents a second privacy axis over the same fact, and two axes over one fact drift. The first time they disagreed, a reader would have to guess which one was the truth.
+- **Reusing `modules/discord/bug-attachments.js` directly.** Rejected: ADR 0083 forbids one module requiring another, and the intake genuinely differs (that lib *downloads* from a CDN and needs an SSRF host allowlist; this one receives bytes from the shipping builder). The shapes are re-stated under the ADR 0091 §2 boundary-forced-duplication rule and cross-referenced in both file headers.
+- **Rendering the image full-size in every feed.** Rejected as unreadable at scale: the ship ledger, a profile, and the status dashboard are scannable lists, so they show a small thumbnail that links to the full file. The task page renders it properly — that is where someone goes to *look*.
+
+## Consequences
+
+- A non-engineer can open the public status dashboard and **see** what shipped, not only read about it.
+- Any future surface that renders `value_summary` inherits a settled answer for the visual beside it: same place, same audience, no new decision.
+- The two mirrored copies of the audience rule (JS predicate, feed SQL) are a maintenance obligation, accepted deliberately over the alternative of the public feed learning what `security_sensitive` means.

package/docs/adr/README.md

@@ -257,6 +257,7 @@ This keeps the decision history honest and traceable.
 | 0181 | [**Teardown accepts every state but `torn_down`, and deliberately keeps the address** ([task 1003042](https://cloudbongos.com/builders#/task/1003042), goal 1000058). Walk finding N5: an instance at `status='error'` could never be removed — the owner's teardown answered 409 `not_teardownable` and the archon `force-teardown`, which exists as the escape hatch, answered the SAME refusal, because both read one hand-kept whitelist `['provisioning','active','tearing_down']` that omitted `requested` and `error`. No role had a path out, so errored rows accumulated permanently (instance 15 `swag` from 2026-08-07). The whitelist justified itself as "nothing running to tear down", which is FALSE for `error`: a provision failing mid-run lands there AFTER it may have created the database, taken a port, and written the systemd unit, Caddy block and DNS record — a partial standup is the thing most in need of reclaiming. `TEARDOWN_FROM` is now DERIVED from `INSTANCE_STATES` minus `torn_down`, so a future state is teardownable by DEFAULT — the bug was an allow-list that silently omitted states, and for a failure mode whose signature is "a row with no exit", the safe default is that an exit exists. The runner needed no change (its steps are each `allowFail`); only the web guard refused. The one surviving refusal is now ONE shared helper: the copies had drifted, and force-teardown's positional `res.fail` form put the bare code `not_teardownable` on the wire as the human text. **The `port` and `domain` are deliberately NOT released** — releasing the port alone would be WORSE than the status quo, because the `<slug>.caddy` block survives teardown and proxies the hostname to a PORT NUMBER, so a later instance given that port would answer at the torn-down project's still-live address (verified live: two projects torn down 2026-08-13 still resolved on 2026-08-19). Holding the port is what keeps the address inert at a harmless 502; releasing both is [task 1002897](https://cloudbongos.com/builders#/task/1002897). Retention is also correct for revive, which re-uses the same hostname. Copy was corrected to match: it had promised "the address stops answering", which was never true.](0181-teardown-state-gate-and-address-retention.md) | provisioning / lifecycle |
 | 0182 | [**Project visibility is TWO axes: a derived publish gate and a stored join door** ([task 1002320](https://cloudbongos.com/builders#/task/1002320), goal 1000046). Goal 1000046 seeded 31 tasks each citing "per R01" — this ADR — so nothing in the goal could start until it landed: it gated **29 open tasks**, the largest single chokepoint in the repo, while itself parked at `backlog` with no dependencies. The spec its planning task cites was never written, so this is the design of record. The goal's criterion says **four** states (Public/Private/Stealth/Unlisted) and R04 says **three** stored plus a derived dark-matter; both are right and conflating them is the trap. There are two INDEPENDENT axes: **publishability** (DERIVED from the identity gate — name + description, per the owner interview) decides whether a project is on the map at all, and **the join door** (STORED `visibility ∈ public|private|stealth`, owner-set) decides how it renders and who gets in. Four user-facing states = 3 × publishable + one derived state that collapses all three. The column name `visibility` is a mild lie kept for consistency with `goals.visibility` (ADR 0112) — it does NOT decide visibility, publishability does — and the ADR is the mitigation. All three stored states are VISIBLE; only the derived state is invisible, which is what makes the 3+1 split honest rather than a workaround. `private` inherits ADR 0112's exact meaning (visible-but-closed); `stealth` exposes EXISTENCE but not IDENTITY, and its redaction is **server-side in the feed** — the naive client-side version leaks to anyone opening the network tab, and the orbs page is a static site OUTSIDE this repo (R09) so it could never be enforced there. Three mechanisms touch "does this appear" and are separated: `status` (operational), `visibility` (owner), `featured` (Archon editorial) — on the map iff `status='active' AND publishable`, with `featured` only ranking among those. That is a real behaviour change: today's predicate is `featured=true AND status='active'`, so **featuring is currently load-bearing for visibility at all** and the goal's owner-control premise silently does not work without it. Visibility is owned by the INSTANCE and the hub row is a CACHE (ADR 0141 §3 + the admin-console spike's D1) — so `owner_github_id` being "advisory, not an authority" is CORRECT rather than a gap, R05 moves to an instance surface, and R08's absent-report default is fail-closed (unreported ⇒ dark matter, off the map rather than exposed by omission). Per-state join rules compose with the separate `open|closed` join policy ([task 1002817](https://cloudbongos.com/builders#/task/1002817)) by one rule: **visibility sets the ceiling, join policy may only narrow** — otherwise the two settings are a coin-flip decided by evaluation order. Finally, `stealth` COLLIDES with the existing instance-wide pre-launch password gate (`STEALTH_PASSWORD`, `src/bongos/stealth-gate.js`), which means nearly the opposite (a whole instance made unreadable vs a project publicly on the map, anonymously); per ADR 0174 the product meaning keeps the word and the infra rename is filed separately rather than decided by an ADR about visibility. Rejected: a stored 4-valued enum (makes `unlisted` compete with `private`, and lets publishable+unlisted disagree), a separate `published` boolean (can drift from the identity it summarises; derived cannot), and keeping `featured` as the visibility gate (an owner who sets public and appears nowhere has not been given control).](<redacted>.md) | platform-identity / project visibility |
 | 0183 | [**A done-when criterion closes itself; the review queue becomes a place to look** ([task 1002069](https://cloudbongos.com/builders#/task/1002069), goal 1000072, owner request 2026-07-05). ADR 0086 §6 made `satisfied` reachable exactly one way — a Metic+ calling `POST /done-when/:id/satisfy` — even though the signal it gated on is unambiguous (**every** gating task shipped) and a human confirming it adds no information. When nobody runs `/goal-review` the result is not a careful pause but a **lying board**: this session measured goal 1000072 at `6/9 shipped, 0/5 criteria`. Now one helper, `doneWhen.autoSatisfyShippedCriteria(exec, {taskId})`, runs from **two** places for two different reasons — inside `shipTask`'s txn (scoped, **immediate**, on the txn client so a rolled-back ship cannot leave a goal achieved) and unscoped on every `publish-reconciler` tick (**backlog drain** for criteria whose tasks shipped before this existed, since nothing will ship against them again, plus **self-heal**). Idempotent by construction — it reads only `satisfied=false` rows — which is what makes an every-tick sweep safe. **The load-bearing subtlety is the delivery guard.** Auto-close needs BOTH "nothing still pending" AND **≥ 1 task actually `shipped`**; the second is not redundant, because since [task 1002651](https://cloudbongos.com/builders#/task/1002651) made `abandoned` terminal-not-pending, a criterion whose tasks were **all cut** satisfies the first clause *vacuously* and would auto-close on ZERO delivered work, cascading its goal to `achieved` (measured: `buildCriterionProgress` returns `pending_review:true` for exactly that shape). Yet `pending_review` **keeps** that wider meaning on purpose — it asks "should a human LOOK at this", and 1002651 chose that an all-abandoned criterion surfaces so someone decides whether it still means anything. So: everything that auto-closes was flagged; not everything flagged auto-closes. An earlier draft "aligned" the two predicates and broke that intent — `tests/criterion_progress.mjs` caught it; **do not re-align them**, the gap is the design. `/goal-review` is kept, demoted from gate to viewing surface; manual `POST /satisfy` stays for what automation cannot judge (a criterion with no linked tasks never auto-closes). Honest limits recorded: auto-satisfy cannot help a criterion nothing is LINKED to, and the in-txn close logs before commit (accepted — threading the summary out through `withTx` would cost ~5 lines in the over-threshold `db.js` under shrink-only ratchet policy). Rejected: sweep-only (up to 5 min to see your own goal close), hook-only (never drains the backlog), a stored `pending_review` column (second source of truth), deleting `/goal-review`.](<redacted>.md) | lifecycle / goal tier |
+| 0184 | [**A task's visual is its value summary in another medium, and inherits that audience** ([task 1003109](https://cloudbongos.com/builders#/task/1003109), goal 1000072, from owner idea 1000400 filed in Discord `#ideas` 2026-06-24). A shipped task can now carry ONE optional image beside its `value_summary` — a screenshot of the surface that changed, a before/after, a diagram — so a reader who does not read code can **see** what shipped instead of reading about it. The rest of that idea had already landed (the note itself; the spend half via `/cost`); the picture was the whole gap, and the only path a builder had was a Discord post — outside the ledger, on a CDN whose links expire. The decision that keeps it from rotting is a REFUSAL to invent a second privacy axis: **a visual has no audience of its own.** One predicate says who may see it — `task-visuals.isPubliclyViewable` (public = `shipped|confirmed`, byte-for-byte the test `routes/public.js:projectPublicTask` already applies to a title/summary) — so any future surface rendering `value_summary` inherits a settled answer for the picture beside it. Three consequences are load-bearing. (1) The serve gate lives **inside** the handler, not in mounted middleware, because the audience is a property of the ROW; the stored filename therefore carries the task id (`task-<id>-<16hex>.<ext>`), which is simultaneously the path-traversal defense and how the route finds the task, and every step fails CLOSED (unparseable name → absent task → not-public → `requireBuilder`, never past it). (2) The public shipped feed **mirrors the predicate in SQL** — `db.recentShippedTasks` nulls the URL for a `security_sensitive` row, rather than selecting the flag and filtering in JS, so the unauthenticated dashboard never advertises an image the serve route would refuse AND never learns the flag; change one, change the other. (3) The single deliberate narrowing vs `value_summary`: a security-sensitive task's image stays builders-only even once shipped — a summary is a sentence its author chose, a screenshot is whatever was on the screen. Nothing is HIDDEN by that; non-public means un-published, not invisible. **Optionality is a contract, not a default** ("where relevant" is the owner's wording): `ship.js --visual` screens the file BEFORE the claim resolves (bad input costs a retyped command, never a claim) and uploads AFTER (a failed picture warns and prints the re-attach command; it never fails a ship that already landed), a task with no visual renders **nothing at all** — no placeholder, so it never reads as unfinished — and `DELETE /tasks/:id/visual` exists because an image is not prose (task 1003102's write-once rule guards a written CLAIM, not the picture beside it). Not an arbitrary-file host: extension allowlist + magic-byte sniff + 4 MB cap + server-minted name, **SVG deliberately excluded** (an executable document served from our own origin), `nosniff`/`inline`/`default-src 'none'; sandbox` on the way out, files under `var/task-visuals/` outside the git tree so a deploy's `git reset --hard` cannot wipe them. Rejected: a per-visual visibility flag (two axes over one fact drift, and the first disagreement leaves a reader guessing which is true); requiring `modules/discord/bug-attachments.js` (ADR 0083 forbids module→module, and the intake genuinely differs — that one DOWNLOADS from a CDN and needs an SSRF allowlist; duplication is re-stated under ADR 0091 §2 and cross-referenced in both headers); full-size images in every feed (the ledger, a profile and the dashboard are scannable lists — they get a thumbnail linking to the file; the task page is where you go to look).](<redacted>.md) | lifecycle / hall-ui / status-ui |
 | 0184 | [**A ship must account for itself: `shipTask` requires a land proof or a declared no-artifact** ([task 1002483](https://cloudbongos.com/builders#/task/1002483), goal 1000024). `db.shipTask` is the confirmed→shipped flip and, since [ADR 0120](<redacted>.md), where the CREDIT is booked — yet its only precondition was `WHERE status = 'confirmed'`, nothing about whether code reached main. The two AUTOMATED paths each proved the land first; the MANUAL route passed nothing, so a task confirmed with no pushed code could be shipped by its claim holder **or by any Metic+ sweeping `/merge-mode`**, booking its `task.shipped` credit. It stayed untracked for two months because its tracking task was closed in June asserting task 1001547 had delivered the gate — it had not, blocker 1000047's own final update says so, and the code agreed with the blocker rather than the closure note: **a hole hidden by a record nobody checked**, which is the same failure the gate is about. Decision: the gate lives at the WRITE, not the route (a route gate leaves the invariant unenforced at the layer that moves the ledger, so the next caller reopens it silently), and `shipTask` is FAIL-CLOSED on a required `landAssurance`. TWO kinds, and the second is why this does not make things worse: `proof` (this task's commit is on main) and **`no_artifact`** — a deliberate DB-only ship, an explicitly supported shape (CLAUDE.md "Direct DB writes are work too") that [task 1002478](https://cloudbongos.com/builders#/task/1002478) documents as a dead end below Archon. A naive proof-only gate would have made 1002478 strictly worse; naming no-artifact as a KIND turns it from an absence the gate must be talked out of into a recorded answer. Both carry a reason, audited post-commit and best-effort (an audit miss must never roll back a landed ship). `ship.js` now declares its own `--db-only`/`--allow-empty` lands, without which this fix would have regressed the very flow CLAUDE.md calls supported. Rejected: (b) gate only the route — leaves the write unguarded; (c) record the residual as tolerable — defensible on blast radius and genuinely close, but it would have been the FOURTH record asserting this was handled with nothing checkable behind it. Does NOT gate confirm: a codeless confirm is still accepted, it simply cannot reach `shipped` or pay.](<redacted>.md) | lifecycle / integrity |
 | 0185 | [**The spark-handoff credit split: 70% developer, 30% spark author** ([task 1002923](https://cloudbongos.com/builders#/task/1002923), BV1.R147, goal 1000062 — completing the chain [task 1002920](https://cloudbongos.com/builders#/task/1002920) mark → [task 1002921](https://cloudbongos.com/builders#/task/1002921) queue → [task 1002922](https://cloudbongos.com/builders#/task/1002922) pickup). [ADR 0172](<redacted>.md) built the ideator streams and paid `captured_by`, the only person an idea then had. The spark handoff created a second: R146 develops a spark IN PLACE, preserving the author while recording a `developed_by`. **R146 therefore shipped paying NOTHING on purpose** — not an oversight but a refusal to guess, because `awardIdeaFullPassCredit`'s idempotency predicate is `(builder_id, reason)`, so paying the DEVELOPER would not have blocked a later payment to the AUTHOR and one idea would have paid twice; the cost of that caution was that a developed Full Idea received stream 2 **never** unless its author resubmitted. Owner decision (2026-08-22): **70/30 favouring the developer**, on BOTH existing streams, one ratio so there is one rule to explain. The reasoning is behavioural, not sentimental — developing someone else's spark is the scarce act the queue depends on, and at an even split it pays HALF what authoring your own Full Idea pays for the same writing work, so the rational move is always to write your own and the R145 queue stays a list nobody reads. The author keeps 30% plus their share of stream 1 on every task shipped under the idea, forever. `IDEA_DEVELOPER_SHARE = 0.70` is a **policy constant in `credits.js`** beside the pass bar and quick factor (ADR 0172's own consequence, the ADR 0023 precedent): a share of someone's earnings deserves a review and a commit, not a runtime edit. **The structural half is what retires R146's caution:** the economy module now derives the payees itself (`ideaCreditParties` reads `captured_by` + `developed_by`), so the caller can no longer choose a recipient — the develop route hands over an idea and a score, never a payee, and books the split like any other path (fail-open; the development has already committed). Three arithmetic properties, each a real bug if missed: the total is **conserved** (developer rounded, author gets the REMAINDER — rounding both pays 6 out of a 5-credit payout); a **self-developed** idea collapses to ONE payee, because two rows for one builder would silently UNDER-pay under the per-builder idempotency predicate, not double-pay (the comparison normalises via `String()` since `bigint` arrives as a string, so a type mismatch cannot become a phantom payee); and **zero-value rows are dropped**. Ids otherwise pass through unconverted — `Number()`-ing a `bigint` risks precision. `builder_id` in the idempotency predicate, which entered as an index optimisation (the R143/IC2 grader finding), is now **load-bearing for correctness**: two payees share one `reason`, so a reason-only predicate would refuse the second, and a partially-booked split completes on the next call. **Not decided here:** stream 3's split (ships with the Board Room, task 1002999), and whether `origin='develop'` in `ideas_task_lineage` belongs to whoever promotes a DEVELOPED idea into a task — ADR 0172 §5 says the row is "set at promotion and at develop (R146)", but R146 creates no task, so that origin stays deliberately unwired rather than invented; it changes who stream 1 pays.](<redacted>.md) | economy / ideator lane |
 | 0186 | [**Per-project idea templates: the seam is already built; the economics are the open problem** ([task 1002932](https://cloudbongos.com/builders#/task/1002932), BV1.R156, goal 1000062 — a SPIKE, output is this ADR plus a task list, no implementation). The literal question — how does a founder define their own idea shape without a schema change or forking the scorer — is **already answered by shipped work**: R141 gave every template function an optional `registry` defaulting to the built-in one, so validation and scoring both read the declaration as data; `ideas_grades.template_key` is per-row with a format CHECK whose own comment says a project key "stays addressable"; and `provisioning_instances.settings jsonb` is an existing per-project home. **No schema change, no fork.** Decision A: a **`project-settings` kernel port**, sibling of `builder-settings`, read via `resolveOptional` so a vanilla instance with no provisioning module degrades to the built-in registry; `base-v1` stays the default and the fallback for an unresolvable key. Rejected a new `ideas_templates` table (second home for data that has one) and a config file (per-instance, but one instance hosts many projects). **Decision B is the finding that matters.** Completeness is normalised 0–100 WITHIN its template (mean of per-field ratios), while karma reads it against an absolute bar (`IDEA_FULL_PASS_BAR = 60`, `IDEA_FULL_PASS_CREDIT = 5`) — so template choice becomes a credit-minting lever: `base-v1` needs ~200 characters for 5 credits, a 1-field template with `substanceMin` 10 needs ~10, a ~20× arbitrage handed to exactly the projects this ADR empowers. Shipping A without B would make the feature a way to print credits. The fix separates the two questions one number is answering: **completeness stays relative** (it is the right signal for triage ordering and the hall meter) and **karma stops reading it**, switching to an absolute substance total the scorer already computes per field and currently discards after averaging. An interim guard (≥3 required fields, ≥120 total `substanceMin`) bounds the arbitrage without fixing it. Decision C: an optional per-field `weight` (default 1) turning the unweighted mean into a weighted one — today's behaviour is the all-weights-1 case, so it is a data addition and one arithmetic line. Decision D: the five base fields are **not** mandatory (forcing them would make "define your own" cosmetic), replaced by two constraints — a template must declare ≥1 required field, and a stored template is validated at WRITE time so a malformed one is refused there rather than discovered inside the capture path, which must never throw. **Boundary note:** goal 1000062's wall is `[ideas, hall-ui]`, so the port task (provisioning + kernel) and the karma task (economy) cannot be claimed under it.](<redacted>.md) | ideas / templates |