@bongos/core 1.19.501 → 1.19.503

package/.bongos-core.json

@@ -2,22 +2,22 @@
   "artifact": "bongos-core",
   "manifest_schema": 1,
   "generator": "scripts/gds/package-core.js",
-  "core_version": "1.19.501",
-  "core_contract": "1.19.501",
-  "source_commit": "d6bac950eb66f758928e815cf88f2d6ddacaf30a",
+  "core_version": "1.19.503",
+  "core_contract": "1.19.503",
+  "source_commit": "df473e8241e4225ae20d599c3158e244199d4e16",
   "source_ref": "HEAD",
-  "built_at": "2026-09-03T15:41:46.721Z",
+  "built_at": "2026-09-03T17:20:56.366Z",
   "redaction": {
     "model": "docs-redacted+functional-verbatim",
-    "docs_redacted": 426,
+    "docs_redacted": 427,
     "agent_docs_stubbed": 24,
-    "functional_verbatim": 1942,
+    "functional_verbatim": 1943,
     "rules": 3,
     "gate_literals": 3,
     "gate": "passed"
   },
-  "file_count": 2392,
-  "tree_sha256": "d4ef43893ca56f9d2d4e0df1823f7fdb2692bb3f3a18d8bb2fece9221dc83925",
+  "file_count": 2394,
+  "tree_sha256": "d2fa5b6500a8ab75eb8c81b3ce9e8b56dfe858dad8ac0ac161f7b9653f0b83d9",
   "files": [
     {
       "path": ".claude/skills/blocker-review/SKILL.md",
@@ -317,7 +317,7 @@
     {
       "path": ".gitattributes",
       "mode": "0000644",
-      "sha256": "106e3a8a087cf1a9dd932513115d16c387cfeebea0e22ed269a672f95efdac1e"
+      "sha256": "3848ed851a03fd11f8dae94c1e94b802c4aa625efaa7f4aff27438a1fdfb67ac"
     },
     {
       "path": "CLAUDE.md",
@@ -877,7 +877,7 @@
     {
       "path": "docs/adr/0082-server-side-merge-conflict-auto-resolution.md",
       "mode": "0000644",
-      "sha256": "ce00626058783ba42629d88da8d03ef868d4743d4b01ed87b6348d20fcbca395"
+      "sha256": "7da7140202139c123e832f527167c96de18eb498ae21243cd30cea6b133c8f90"
     },
     {
       "path": "docs/adr/0083-modular-architecture-strangler-build-plan.md",
@@ -1684,10 +1684,15 @@
       "mode": "0000644",
       "sha256": "f3573d82c77dc2b7d006f4ee8051b9b5a247669d2ac4c046c2de7c282d4e65ff"
     },
+    {
+      "path": "docs/adr/0236-many-ideas-one-task-the-lineage-key-is-the-pair.md",
+      "mode": "0000644",
+      "sha256": "87b350049a0ed1b7be0c58fc2ae6ecd18a077b21ca689563a8763f925a37eef6"
+    },
     {
       "path": "docs/adr/README.md",
       "mode": "0000644",
-      "sha256": "43d782f6ca3f187f280e13466830ceceaf6ba74da2cc669e8b7dd6ece166d657"
+      "sha256": "16d284a7a9b1b70f1ba2aa3550a380ed76ace41b985c5f6a309c9899acf6b5f8"
     },
     {
       "path": "docs/api-reference.md",
@@ -2572,7 +2577,7 @@
     {
       "path": "docs/module-api-changelog.md",
       "mode": "0000644",
-      "sha256": "49c673ec2ee31c6174bdc48d1b124905bd1f47a51db4e0a3a75e4d937a25ba0a"
+      "sha256": "617f270d120002ae0d222e6454744f946f25c7f531557365389f199bf0d2555c"
     },
     {
       "path": "docs/modules-contract.md",
@@ -4117,7 +4122,7 @@
     {
       "path": "modules/economy/credits.js",
       "mode": "0000644",
-      "sha256": "594d0eee9447bbc4b0e5dde91e2aba58bd762cf7e046c466df0527ec6ba24138"
+      "sha256": "08890c50f8c8b2551a495e8a54e0e4fb2925b928ece5dc9aaf2090ea1c37adb3"
     },
     {
       "path": "modules/economy/migrations/economy_001_fix_gds_shipper_description.sql",
@@ -5137,7 +5142,7 @@
     {
       "path": "modules/ideas/inbox.js",
       "mode": "0000644",
-      "sha256": "9a010cd361fc4d190e2dcf1d496b80061f1e2395a831f23adf61d98d6fdea259"
+      "sha256": "5ebd1524a5593b70f74a83bdaa3a6d772eb820ea3d962f48dedace970efcc119"
     },
     {
       "path": "modules/ideas/migrations/ideas_001_grades.sql",
@@ -5164,6 +5169,11 @@
       "mode": "0000644",
       "sha256": "3c7a48505c922bd0742888bc9c0598d776a4de0cc3d2745bd08d6452e07f34b9"
     },
+    {
+      "path": "modules/ideas/migrations/ideas_006_lineage_many_ideas_one_task.sql",
+      "mode": "0000644",
+      "sha256": "51f790ec7d5c0ad9941ed16174e260db0de18be4d4cb18af0d704a1190a1beee"
+    },
     {
       "path": "modules/ideas/module.json",
       "mode": "0000644",
@@ -7217,12 +7227,12 @@
     {
       "path": "package-lock.json",
       "mode": "0000644",
-      "sha256": "79dfc35495b354b8e53ac84d6210c5c84e8d1bd6a97fc08c84dcbcfd7cc7379d"
+      "sha256": "74063906121c7bd41daa897aa6710baff1f0737e954fb570e86f3374194cce85"
     },
     {
       "path": "package.json",
       "mode": "0000644",
-      "sha256": "5c08ffd017c27b4ac3a97a55988bbd1fd9958a1ac15ab9e4a689af04531889b6"
+      "sha256": "a56c6e485d5d87daba754dce001fc77ee52e566801e333a5e03221d161bc3682"
     },
     {
       "path": "public-docs/index.html",
@@ -7737,7 +7747,7 @@
     {
       "path": "scripts/gds/git-merge-regen.js",
       "mode": "0000644",
-      "sha256": "75130de4a880fc7d76f5a8d79ed65750238df94847c1ccfdc974188f9300a1e6"
+      "sha256": "f9a391ac6f32b2d5ca939b48186b6d9cb7aa171554652a5b5afbc4a408aae203"
     },
     {
       "path": "scripts/gds/go-live.js",
@@ -8892,7 +8902,7 @@
     {
       "path": "src/module-api.js",
       "mode": "0000644",
-      "sha256": "980689b2fd9c8e0db4213b6ef449b68cef246f40ff3752925562f0f7ed818a16"
+      "sha256": "24b41b0c2d49f19e302831644599b853f1f10ded65aeb56b3024b9de6a9d4cf7"
     },
     {
       "path": "src/module-loader/catalog.js",
@@ -9882,7 +9892,7 @@
     {
       "path": "tests/git_merge_regen.mjs",
       "mode": "0000644",
-      "sha256": "3c718cdd83f7c997a89bcf55120ad641a2c8ed4bea7cbbf5aa253792f867a467"
+      "sha256": "2d3574914c1f9c843396f498a8e68c2fd8ec2a5bc574c98f64dc2505aa1ccba8"
     },
     {
       "path": "tests/github_push_ancestry.mjs",
@@ -10507,7 +10517,7 @@
     {
       "path": "tests/idea_task_lineage.mjs",
       "mode": "0000644",
-      "sha256": "cd782459f1e4e6ca6df8a0349521aedcc6a867128240a78d2f00e15f0fd5f259"
+      "sha256": "ee3271a4964f4bc30748bc101e9d276dac5575b9b5bcebd41f655391d1b7df35"
     },
     {
       "path": "tests/idea_task_ship_credit.mjs",

package/.gitattributes

@@ -74,6 +74,16 @@ src/bongos/CLAUDE.md          merge=otb-regen
 src/bongos/routes/CLAUDE.md   merge=otb-regen
 scripts/gds/CLAUDE.md      merge=otb-regen
 
+# docs/copy-registry.json + docs/copy-inventory.md (task 1003543): the copy
+# registry's committed pair (scripts/gds/copy-inventory.js) — fully generated from
+# a tree scan, nothing hand-authored in either, so two branches that each touch
+# hall/status/landing copy regenerate them differently and conflict like ordinary
+# files. Same otb-regen shape as docs/session-log-index.md above (whole-file
+# rebuild, all three merge sides ignored); REGENERABLE in git-merge-regen.js
+# carries the matching rule.
+docs/copy-registry.json    merge=otb-regen
+docs/copy-inventory.md     merge=otb-regen
+
 # Append-only index tables (task 1385 / ADR 0082). docs/adr/README.md is a
 # hand-maintained ADR index whose ONLY recurring conflict is two branches each
 # appending a new row — there is no generator to regen it from, so `otb-regen`

package/docs/adr/0082-server-side-merge-conflict-auto-resolution.md

@@ -48,6 +48,10 @@ The PR's required checks (unit / trufflehog / audit / gate-review) re-run on the
 - `docs/adr/README.md` itself now carries `merge=union`, so this ADR's own index row — and every future one — stops conflicting.
 - The generated-artifact set is defined once (`REGENERABLE` in `git-merge-regen.js`, mirrored by `.gitattributes` and the `fitness.js` freshness gate); adding a future generated file means adding it in those places together.
 
+## Addendum (task 1003543, 2026-09-03) — the copy registry joined the whole-file set
+
+Two hall PRs in one session (526 for task 1003069, 531 for task 1003157) both ran `scripts/gds/copy-inventory.js` and sat `confirmed` with GitHub `mergeable=CONFLICTING` for 20+ minutes: `docs/copy-inventory.md` + `docs/copy-registry.json` carried no `.gitattributes` entry and no `REGENERABLE` rule, so they conflicted as ordinary text/JSON and the server resolver could not heal them (`resolveBranchConflicts` *did* run — its log line fired for both PRs — but the `otb-regen` driver refused the unregistered paths and the merge came back non-zero, which the resolver correctly reported as `unresolvable_conflict`; the reconciler dispatch was never the gap). Both files are, like `docs/repo-map.md` and `docs/session-log-index.md`, 100% generated from a tree scan with nothing hand-authored in either — `copy-inventory.js`'s own header says so ("Deterministic on a given tree — regenerate and commit rather than hand-editing"), so they needed the whole-file `otb-regen` shape, not `union`. The fix: `docs/copy-registry.json merge=otb-regen` + `docs/copy-inventory.md merge=otb-regen` in `.gitattributes`, both added to `REGENERABLE` in `git-merge-regen.js` with a regeneration rule that calls `copy-inventory.js`'s `buildRegistry()`/`renderReport()` directly (ignoring all three merge sides, same as the repo-map heal). No change was needed to `conflict-resolve.js`, `publish-reconciler.js`, or `ship-preflight-steps.js` — none of the three keeps its own copy of the generated-file list; all three read `REGENERABLE` (or, for the resolver, register the driver that reads it), so the new pair is covered everywhere the existing four already were.
+
 ## Alternatives considered
 
 - **Lower deploy/merge access to `thetes`** (the owner's first instinct) — rejected: reopens the Builder 25 hole for zero benefit here (the stranded session was already Archon; rank was never the blocker).

package/docs/adr/0236-many-ideas-one-task-the-lineage-key-is-the-pair.md

@@ -0,0 +1,98 @@
+# 0236 — Many ideas → one task: the lineage key is the pair
+
+- **Status:** Accepted
+- **Date:** 2026-09-03
+- **Tasks:** [#1003515](https://cloudbongos.com/builders#/task/1003515) (this decision, promoted from
+  idea 1000815), [#1002997](https://cloudbongos.com/builders#/task/1002997) (created the lineage table),
+  [#1003065](https://cloudbongos.com/builders#/task/1003065) (the R01 diff whose grader flagged the shape)
+- **Goal:** [#1000071](https://cloudbongos.com/builders#/goal/1000071) — Idea routing
+- **Related:** [ADR 0172](<redacted>.md) (the ideator credit lane this
+  table is the rail for), [ADR 0185](<redacted>.md) (the other place an idea has more
+  than one claimant), [ADR 0234](<redacted>.md)
+  (routing, the third `origin`)
+
+## 1. The problem
+
+`ideas_002_idea_tasks.sql` made `task_id` the **primary key** of
+`ideas_task_lineage`, on the stated reasoning that "a task descends from at most
+one idea". `linkIdeaTask` matched it:
+
+```sql
+ON CONFLICT (task_id) DO UPDATE SET idea_id = EXCLUDED.idea_id, origin = EXCLUDED.origin
+```
+
+So promoting a **second** idea into a task that already had a link did not fail
+and did not warn — it *replaced* the first idea's lineage. `updateIdea` fires
+`linkIdeaTask` on any promote that sets `promoted_to_task_id`, so two ordinary
+triage promotes at one task were enough. That happened on prod on 2026-08-21:
+ideas 1000811 and 1000812 were both promoted into task 1003150 (two call sites of
+one mechanism), and idea 1000811's link is gone — only its weaker
+`idea_inbox.promoted_to_task_id` pointer survived.
+
+This table is the rail [ADR 0172](<redacted>.md)'s
+stream 1 pays against (`<redacted>`, `sourceIdeaForTask`), so an
+overwritten row is an ideator silently not paid for work their idea produced,
+with no trace anywhere that it happened. It also made "N duplicate reports merged
+into one task" a **lossy** operation — the exact triage move the inbox exists to
+encourage.
+
+The grading panel's hacker worker named this shape on the R01 diff and was told
+it was unreachable. It was unreachable on the *routing* path it examined and
+fully reachable on the ordinary *promote* path, which needs no idempotency edge
+at all. The finding was right about the shape and wrong about the reach, and only
+the half it named was checked.
+
+## 2. The decision
+
+**Many ideas → one task is a real relation, so the key is the pair.**
+`ideas_006_lineage_many_ideas_one_task.sql` drops the single-column primary key
+and re-adds `ideas_task_lineage_pkey` as `PRIMARY KEY (task_id, idea_id)`. Both
+INSERT sites (`linkIdeaTask` and `routeIdeaToGoal`'s transaction) target the pair
+and `DO UPDATE SET origin` — never `idea_id`, which is now part of the identity
+rather than a mutable field. `created_at` is left alone by the upsert, so *which
+link came first* is a durable fact a re-link cannot rewrite.
+
+The alternatives were considered and rejected. **Refusing the second link**
+(assert-no-existing-lineage) turns a legitimate triage merge into an error and
+teaches triagers to avoid merging. **Logging the replacement loudly** keeps a
+correct-by-luck ledger that is still lossy. The table was already the
+"many-tasks" side table with a non-unique `idea_id`; making the other direction
+real is the smaller change, not the bigger one.
+
+**Where one row is still required, the earliest link wins** —
+`ORDER BY created_at, idea_id`, stated in SQL rather than left to the planner.
+That rule is shared by `sourceIdeaForTask`, `credits.awardIdeaTaskShipCredit`,
+and the nod queue's one-row-per-task predicate (a single constant embedded in
+both the list and its count, so the pill can never disagree with the rows).
+
+## 3. Consequences
+
+- **A task subsumed from N ideas counts once toward *each* idea's shipped-task
+  credit.** Every co-source idea keeps its own row, so
+  `<redacted>` no longer drops to zero for whoever was overwritten,
+  and the idea trail on a builder's profile shows the shared task under each of
+  their ideas. It cannot double-count within one idea: the pair is unique.
+- **The per-ship payout still names one idea — the earliest.** Whether a shared
+  task should pay *every* co-source ideator is a decision about how much a
+  shipped task is worth in total, not a bug fix, and it is deliberately not made
+  here. The idempotency key is already `idea.credit.task_ship:<idea>:<task>`, so
+  it is a small change whenever the owner wants it.
+- **The migration backfills.** Every `idea_inbox` row with a
+  `promoted_to_task_id` whose task carries no row for *that* idea gets its link
+  back (`ON CONFLICT DO NOTHING`, so surviving rows keep their own `origin` and
+  `created_at`). Restored rows are labelled `origin='promote'`: where the erased
+  row had been a routed one, its `'route'` provenance is unrecoverable from that
+  column alone, and a restored link with a coarse origin beats a missing one —
+  `origin` weighs a payout, the link is whether there is one.
+- **A lineage write that fails is now reported.** `updateIdea` still swallows the
+  failure (the triage verdict has already committed; lineage is a ledger
+  convenience, not a gate) but logs a `LINEAGE GAP` line through
+  `api.logger('ideas')`. A silent swallow on top of a silent overwrite was two
+  layers of the same mistake.
+- **`DROP CONSTRAINT` here is additive.** Postgres has no "widen a key" verb, so
+  the change is drop-then-re-add of the same-named constraint — the shape
+  `fitness.js`'s `isConstraintWidening` exempts, and the one
+  [`ideas_003`](../../modules/ideas/migrations/<redacted>.sql)
+  already recorded for a CHECK. The new key permits a strict superset of the old
+  one, so no existing row can be invalidated. The migration asserts its own
+  effect and raises if the primary key is still single-column.

package/docs/adr/README.md

@@ -323,5 +323,6 @@ This keeps the decision history honest and traceable.
 | 0233 | [**A copy proposal is a task carrying a patch, and the applier is the only writer** ([task 1003114](https://cloudbongos.com/builders#/task/1003114) · goal 1000074, criterion `artist-edits-land-as-tasks`). Goal 1000074 asks for two things that pull against each other in its own text: the artist must change copy WITHOUT an engineer, and there must be NO LIVE CMS because every copy change is a claimed, graded, shipped task. R02 shipped the half that needs no reconciliation (the flag) and [ADR 0178](<redacted>.md) §3 pinned the absence of any column that could hold replacement text, naming this task as the one that would have to keep it true. Decisions: (1) the shape is **borrowed from the design half, not invented** — ADR 0081 already has a tool authoring and an `adapter.export()` landing the output as a committed diff under a claim inside a path guard, so the artist is the tool, the copy desk is where they author, and the proposal is the export. (2) A proposal is a **TASK carrying a fenced `copy-proposal` patch**, never a row: the ledger is where a proposal belongs anyway, nothing renders a task description as product copy, a reviewer can read the change without running anything, and `copy-desk` gains NO migration (the obvious-but-wrong R03 is a `copy_desk_proposals` table, which is the forbidden column with extra steps). The module gains `consumes: ["lifecycle"]` and calls `createTask` through the port — it can put a request INTO the ledger and nothing can pull copy OUT of it. (3) `scripts/gds/copy-apply.js` **re-derives the position** rather than trusting the patch, which required teaching R01s extractor to record a source SPAN and deliberately dropping it from the committed registry: an offset goes stale the moment anything above it changes, while the id is designed to survive exactly that movement, so the span is recomputed at the moment of the edit by the same code that decided the string was copy. (4) The **placeholder arithmetic** is what makes a patch mechanical rather than a note for an engineer — the applier puts the sources own `${expr}` back, k-th hole to k-th expression, so an artist may MOVE a value within a sentence but never add or drop one, checked at proposal time and again against the real source. (5) Every ambiguity is a **named refusal** (`target_gone`, `ambiguous_target`, `no_exact_span`, `placeholder_mismatch`, `path_outside_surface` — the design adapters path guard, derived from R01s own SURFACES), because a wrong edit is worse than no edit; after writing, the applier regenerates the registry and checks that what it wrote is what the inventory now reads. (6) Proposing is **open to every rank** (an artist is a craft, not a rank) and lands at `backlog`, so a proposal is a request that passes ordinary triage. Rejected: a proposals table, a column beside the flag, trusting the patchs line number, an escape-aware index map to buy spans for nine strings, auto-closing the flag a proposal answers.](<redacted>.md) | copy-desk / the artist loop |
 | 0234 | [**Idea routing: capture-time promotion, the landing matrix, and the homeless-only inbox** ([task 1003064](https://cloudbongos.com/builders#/task/1003064) · goal 1000071, "Idea routing"). Idea 1000771 named the failure: Discord `#bugs` created tasks DIRECTLY against a hardcoded, already-shipped version — no `captured_by`, no lineage, so the ideator-credit lane had nothing to pay against — while every other open idea sat waiting for a human triage pass that dropped its promotion into a version catch-all, because nothing in capture ever named a goal. Records what R01/R02/R05/R07/R13 shipped. `captureIdea` (`modules/ideas/inbox.js`) stays the ONE capture chokepoint — routing is one optional `goalId` argument, never a second creation door — and when the matrix routes, `routeIdeaToGoal` writes the idea row, the task (via the `lifecycle.createTask` port) and an `ideas_task_lineage` row (`origin='route'`) in ONE transaction, so a route can never mint attribution-free work the way `#bugs` did. `modules/ideas/routing.js`'s `decideLanding` is PURE and fail-closed: a bug from a Metic+ filer hard-lands `ready`, a sub-Metic bug or any other kind with a goal soft-lands `backlog`, a Full Idea or `criterion-proposal`/`decision` never routes, no goal named stays the pre-routing inbox path. `authorizeRoutedLanding` is the BINDING gate underneath the matrix's decision — a goal reaching protected scope raises the task's rank floor to Metic and REFUSES a sub-Metic filer outright, while membership is deliberately NOT required (reporting isn't authoring). `core_222`'s `suggested_goal_id` is an advisory hint only — the real home is `tasks.goal_id`, set by construction — and `/idea-triage` (`scripts/gds/triage.js`) now sends `goal_id` on promotion, so the inbox is homeless-only. Divergence recorded: R11 (Discord `#bugs`) hard-lands a linked Metic+ builder's bug immediately through the SAME shared matrix rather than the spec's "always soft-land, pending queue" design, because a local copy of the rank split would only drift from the one definition; and R12 (Discord `#ideas` hints) is NOT YET SHIPPED, so `#ideas` carries no goal hint today despite the interview decision that it should, hint-only, never route.](<redacted>.md) | ideas / lifecycle |
 | 0235 | [**A fix category is `kind='bug'` under a goal, not a new column** ([task 1003215](https://cloudbongos.com/builders#/task/1003215) · goal 1000071, "Idea routing" — the structural half of idea 1000828; task 1003214 shipped the advisory's first quiet case, task 1003157 extended it). A fix for something that should already work needs a home under an existing goal WITHOUT a new goal being born and WITHOUT a stored column restating what `tasks.kind` already says. Not a global "Bugs" goal either: a goal spanning every module makes the [ADR 0086](<redacted>.md) scope wall either everything or nothing, and a goal that can never reach `achieved` (a bug container never finishes) pollutes the exact signal [ADR 0183](<redacted>.md)'s auto-satisfy depends on. Not [ADR 0192 "a category orients and authorises nothing"](<redacted>.md) either, despite the structural resemblance: that decision forbids any gate from branching on a goal's category, while THIS decision is two decision surfaces deliberately branching on `kind='bug'` — `adviseGoal()` (`modules/lifecycle/goal-advisory.js`) goes silent for a bug under all three of its reasons (`no_goal`, `catch_all`, `no_criterion_link` — "a fix is the goal's 'fix category', not a delivery against one of its stated outcomes," its own doc comment) and `countTasksWithoutCriterionLink()` (`modules/lifecycle/db-deps-criteria.js`, surfaced on the hall's goal detail view) excludes `kind='bug'` from its count for the same reason. No hall/status change was needed for GROUPING bugs under a goal: every task card already renders its `kind` as a visible tag and the goal detail view's Filters already offer a `Kind` lens with `bug` as a value — verified against the live code, not built new. Rejected: a `tasks.category`/`fix_category` column or enum, a global cross-module "Bugs" goal, a bug-specific grouping widget beside the general-purpose kind facility that already works.](<redacted>.md) | ideas / lifecycle |
+| 0236 | [**Many ideas → one task: the lineage key is the pair** ([task 1003515](https://cloudbongos.com/builders#/task/1003515) · goal 1000071, "Idea routing" — promoted from idea 1000815; the table was built by [task 1002997](https://cloudbongos.com/builders#/task/1002997)). `ideas_task_lineage.task_id` was the PRIMARY KEY on the reasoning that "a task descends from at most one idea", and `linkIdeaTask` wrote `ON CONFLICT (task_id) DO UPDATE SET idea_id = EXCLUDED.idea_id` — so promoting a SECOND idea into a task that already had a link **silently replaced the first idea's lineage**: no error, no warning, no log line. Two ordinary triage promotes at one task were enough, and it happened on prod on 2026-08-21 (ideas 1000811 + 1000812 → task 1003150). Because this table is the rail [ADR 0172](<redacted>.md) stream 1 pays against, an overwritten row is an **ideator not paid** for work their idea produced, with nothing recording it — and it makes merging duplicate reports into one task a LOSSY move, which is the triage the inbox exists to encourage. The R01 grader named this shape and was told it was unreachable; it was unreachable on the ROUTING path examined and fully reachable on the ordinary PROMOTE path. **Decision: many ideas → one task is a real relation, so the key is the pair** — `ideas_006` re-adds `ideas_task_lineage_pkey` as `PRIMARY KEY (task_id, idea_id)` and both INSERT sites `DO UPDATE SET origin`, never `idea_id`. Refusing the second link would turn a legitimate merge into an error; logging the replacement keeps a lossy ledger. **Where one row is still required the EARLIEST link wins** (`ORDER BY created_at, idea_id`, stated in SQL rather than left to the planner): `sourceIdeaForTask`, `credits.awardIdeaTaskShipCredit`, and the nod queue's one-row-per-task predicate — one constant shared by the list and its count, so the pill can never disagree with the rows. Consequences: a task subsumed from N ideas **counts once toward each idea's** shipped-task credit (and cannot double-count within one — the pair is unique); the per-ship payout still names one idea, the earliest, because paying every co-source ideator is a decision about total worth, not a bug fix; the migration **backfills** from `idea_inbox.promoted_to_task_id`, the weaker pointer that survived each overwrite, labelling restored rows `origin='promote'`; and `updateIdea` still swallows a lineage failure but now reports it as a `LINEAGE GAP` through `api.logger` — a silent swallow on top of a silent overwrite was two layers of one mistake.](<redacted>.md) | ideas / economy |
 
 > ⚠️ **Numbering collisions are now machine-enforced, not narrated.** Twenty numbers are shared by two ADRs each — assigned in parallel sessions before anything checked. The files keep their filenames (renumbering would break every existing citation, and a number once assigned is never reused), and this table disambiguates each pair as `NNNN-a` / `NNNN-b`. The authoritative list is `LEGACY_DUPLICATE_ADRS` in [`scripts/gds/adr-namespace.js`](../../scripts/gds/adr-namespace.js), frozen by exact filename: a **new** collision — or a third file joining a legacy number, or a rename of either half — hard-fails the `unit` CI gate, as does an index row that points at no file or an ADR with no row. The list may only shrink. This paragraph used to narrate the collisions one by one and had fallen eight behind reality; see [ADR 0195](<redacted>.md) for why the check exists and why the pairs are grandfathered rather than renumbered.

package/docs/module-api-changelog.md

@@ -1439,5 +1439,9 @@ is load-bearing: the script throws rather than guess if it is missing, and
         landed since 1.19.499 with no explicit bump. run 33772499045. (task 1002620)
   1.19.501 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
         landed since 1.19.500 with no explicit bump. run 33774087943. (task 1002620)
+  1.19.502 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+        landed since 1.19.501 with no explicit bump. run 33777587058. (task 1002620)
+  1.19.503 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+        landed since 1.19.502 with no explicit bump. run 33783963947. (task 1002620)
 ---------------------------------------------------------------------------
 ```

package/modules/economy/credits.js

@@ -529,6 +529,17 @@ async function awardIdeaFullPassCredit(client, { ideaId, authorId, completenessS
 // every no-pay path (no source idea, lane off, already paid). Idempotent per
 // (idea, task) via reason='idea.credit.task_ship:<idea>:<task>', builder-scoped
 // so the NOT EXISTS hits idx_credit_log_builder (the IC2 index lesson).
+//
+// ONE SOURCE IDEA, THE EARLIEST (task 1003515 / ADR 0236). ideas_006 made
+// (task_id, idea_id) the lineage key, so a task subsumed from several ideas now
+// keeps a row for EACH — which means this read must choose, and an unordered
+// rows[0] would have let the query planner choose the payee. It pays the link
+// recorded FIRST, matching inbox.sourceIdeaForTask so the ledger and the money
+// name the same idea. Paying EVERY co-source idea is a separate decision about
+// how much a shipped task is worth in total, not a bug fix — and the reason key
+// above is already per-(idea, task), so it is a small change if the owner wants
+// it. What this task fixes is that a co-source idea is no longer ERASED: it
+// still counts in countShippedTasksForIdea and still shows in the idea trail.
 async function awardIdeaTaskShipCredit(client, { taskId, config = rewardConfig() } = {}) {
   if (config && config.ideatorCredit === false) {
     return { credited: 0, reason: 'ideator_lane_off' };
@@ -543,7 +554,9 @@ async function awardIdeaTaskShipCredit(client, { taskId, config = rewardConfig()
        FROM ideas_task_lineage l
        JOIN idea_inbox i        ON i.id = l.idea_id
        LEFT JOIN ideas_grades g ON g.idea_id = l.idea_id
-      WHERE l.task_id = $1`,
+      WHERE l.task_id = $1
+      ORDER BY l.created_at ASC, l.idea_id ASC
+      LIMIT 1`,
     [taskId]
   );
   if (rows.length === 0 || rows[0].captured_by == null) {

package/modules/ideas/inbox.js

@@ -445,11 +445,16 @@ async function routeIdeaToGoal({
     // d. The lineage row — origin='route' (ideas_003 widened the CHECK for
     //    exactly this). THIS is the row goal 1000067's ideator credit will pay
     //    against, and the reason all of this is one transaction.
+    //
+    //    The conflict target is the PAIR (task 1003515 / ADR 0236): ideas_006
+    //    made (task_id, idea_id) the primary key, so a second idea landing on
+    //    the same task ADDS a link instead of erasing the first one's. See
+    //    linkIdeaTask below for why the surviving row's origin is refreshed.
     await client.query(
       `INSERT INTO ideas_task_lineage (task_id, idea_id, origin)
        VALUES ($1, $2, 'route')
-       ON CONFLICT (task_id) DO UPDATE
-          SET idea_id = EXCLUDED.idea_id, origin = EXCLUDED.origin`,
+       ON CONFLICT (task_id, idea_id) DO UPDATE
+          SET origin = EXCLUDED.origin`,
       [task.id, idea.id]
     );
 
@@ -786,17 +791,46 @@ async function updateIdea(id, { status, kind, promoted_to_task_id, reviewed_at,
   // later pay "5 per task shipped under this idea". This is ADDITIVE to the
   // existing single-FK promoted_to_task_id (unchanged) — best-effort so it can
   // never fail a triage verdict that already committed on the line above.
+  //
+  // STILL SWALLOWED, NO LONGER SILENT (task 1003515 / ADR 0236). The catch stays
+  // — the triage verdict committed on the line above and a ledger convenience
+  // must not fail it — but a lineage row that never landed is an ideator who
+  // will never be paid, and until now nothing anywhere said so. It reports
+  // through the module's logger seam (api.logger, the same one routes/inbox.js
+  // uses) rather than console.*, which is what the whole codebase logs through.
   if (promoted_to_task_id !== undefined && promoted_to_task_id !== null) {
     try { await linkIdeaTask(id, promoted_to_task_id, 'promote'); }
-    catch (e) { /* the promote succeeded; lineage is a ledger convenience, not a gate */ }
+    catch (e) {
+      api.logger('ideas').error(
+        `LINEAGE GAP: idea ${id} promoted to task ${promoted_to_task_id} but its ideas_task_lineage row failed (the promote stands; ideator credit for this task will not pay): ${e && e.message}`
+      );
+    }
   }
   return rows[0];
 }
 
 // Record that a task descends from an idea (task 1002997 / BV1.R173). The
-// one-idea-many-tasks lineage stream 1 reads. Keyed by task_id (a task has at
-// most one source idea), idempotent: re-linking the same (idea, task) is a
-// no-op; re-pointing a task to a different idea updates its source.
+// many-ideas-many-tasks lineage stream 1 reads. Keyed by the PAIR
+// (task_id, idea_id), idempotent: re-linking the same (idea, task) refreshes
+// only its origin, and linking a SECOND idea to a task ADDS a link.
+//
+// WHY THE PAIR, AND WHY THIS FUNCTION IS THE REASON (task 1003515 / ADR 0236).
+// task_id alone was the primary key until ideas_006, and this INSERT carried
+// `ON CONFLICT (task_id) DO UPDATE SET idea_id = EXCLUDED.idea_id` — so
+// promoting a second idea into one task SILENTLY ERASED the first idea's
+// lineage, and with it that ideator's claim on everything the task goes on to
+// ship. It happened on prod (ideas 1000811 + 1000812 → task 1003150, 2026-08-21).
+// Merging duplicate reports into one task is a normal triage move, so the schema
+// now says so.
+//
+// DO UPDATE SET origin, not DO NOTHING. The pair is what must never be lost;
+// `origin` is a mutable FACT ABOUT that pair (how the task came from the idea)
+// and the caller writing it now knows more than the caller who wrote it first —
+// a route later re-promoted through triage is genuinely both, and the newest
+// call is the more specific description. Nothing hangs on the old value: origin
+// weighs a payout, it never gates one. created_at is left alone by the DO
+// UPDATE, so "which link came first" — the tie-break every single-row read below
+// uses — stays the ORIGINAL answer and cannot be rewritten by a re-link.
 //
 // TWO ORIGINS, ONE WIRED TODAY. `origin='promote'` is called live below, from
 // updateIdea, on every triage promote. `origin='develop'` is the SEAM for R146
@@ -810,8 +844,8 @@ async function linkIdeaTask(ideaId, taskId, origin = 'promote') {
   await pool.query(
     `INSERT INTO ideas_task_lineage (task_id, idea_id, origin)
      VALUES ($1, $2, $3)
-     ON CONFLICT (task_id) DO UPDATE
-        SET idea_id = EXCLUDED.idea_id, origin = EXCLUDED.origin`,
+     ON CONFLICT (task_id, idea_id) DO UPDATE
+        SET origin = EXCLUDED.origin`,
     [taskId, ideaId, origin]
   );
 }
@@ -819,6 +853,12 @@ async function linkIdeaTask(ideaId, taskId, origin = 'promote') {
 // Count tasks that have SHIPPED under an idea (task 1002997 / BV1.R173). This is
 // the query stream 1 (IC4) pays against: `WHERE idea_id = N` hits the index, and
 // the tasks join filters to shipped. Returns a plain integer.
+//
+// A task SUBSUMED FROM SEVERAL IDEAS counts ONCE for EACH of them (task 1003515
+// / ADR 0236) — the composite key gives every co-source idea its own row, so
+// this count no longer silently drops to zero for whichever ideator was
+// overwritten. It cannot double-count within one idea either: (task_id, idea_id)
+// is unique, so one idea can hold at most one link to a given task.
 async function countShippedTasksForIdea(ideaId) {
   const { rows } = await pool.query(
     `SELECT COUNT(*)::int AS n
@@ -833,12 +873,24 @@ async function countShippedTasksForIdea(ideaId) {
 // The source idea of a task, or null (task 1002997 / BV1.R173). The reverse
 // lookup stream 1's ship hook (IC4) uses: given a task that just shipped, which
 // idea — and which author — does it pay?
+//
+// ONE ROW, AND IT IS THE EARLIEST LINK (task 1003515 / ADR 0236). Since ideas_006
+// a task may descend from SEVERAL ideas, so "the source idea" is a choice this
+// function has to make rather than a fact the key hands it. It returns the link
+// that was recorded FIRST — the idea the work was actually opened for — and says
+// so in SQL rather than leaving it to whatever order Postgres happens to return,
+// because an unordered LIMIT-less rows[0] is a payee chosen by the planner. The
+// tie-break on idea_id keeps two links written in the same transaction
+// deterministic. Callers wanting the COMPLETE ancestry read the table (or the
+// trail's lineage array), not this.
 async function sourceIdeaForTask(taskId) {
   const { rows } = await pool.query(
     `SELECT l.idea_id, l.origin, i.captured_by
        FROM ideas_task_lineage l
        JOIN idea_inbox i ON i.id = l.idea_id
-      WHERE l.task_id = $1`,
+      WHERE l.task_id = $1
+      ORDER BY l.created_at ASC, l.idea_id ASC
+      LIMIT 1`,
     [taskId]
   );
   return rows[0] || null;
@@ -864,6 +916,24 @@ async function sourceIdeaForTask(taskId) {
 // Deliberately NOT filtered by goal membership or by the viewer: any Metic+ may
 // give the nod (Q3 rejected goal-member-first review as surface cost), so every
 // Metic+ sees one queue. The route is what gates rank; this is a plain read.
+//
+// ONE ROW PER TASK (task 1003515 / ADR 0236). Since ideas_006 a task can hold
+// several lineage rows, so a plain JOIN through the lineage would list — and
+// count — the same task once per source idea, showing a Metic+ the same nod
+// twice. Two routed links on one task should be unreachable (a route mints its
+// task with sourceRef `idea-<id>`, so each routed idea gets its own), but
+// "unreachable in practice" is the precise reasoning that produced the bug this
+// task fixes, and the queue must not be the place it is discovered. The
+// predicate keeps the EARLIEST routed link, the same rule sourceIdeaForTask
+// uses, and BOTH the list and the count below embed this one constant so the
+// pill can never disagree with the rows.
+const ROUTE_LINK_IS_EARLIEST = `NOT EXISTS (
+          SELECT 1 FROM ideas_task_lineage l2
+           WHERE l2.task_id = l.task_id
+             AND l2.origin  = 'route'
+             AND (l2.created_at, l2.idea_id) < (l.created_at, l.idea_id)
+        )`;
+
 async function listRoutedAwaitingNod({ limit = 20 } = {}, deps = {}) {
   const activePool = (deps.pool && process.env.NODE_ENV === 'test') ? deps.pool : pool;
   const { rows } = await activePool.query(
@@ -878,6 +948,7 @@ async function listRoutedAwaitingNod({ limit = 20 } = {}, deps = {}) {
        LEFT JOIN goals g    ON g.id = t.goal_id
       WHERE l.origin = 'route'
         AND t.status = 'backlog'
+        AND ${ROUTE_LINK_IS_EARLIEST}
       ORDER BY t.created_at ASC
       LIMIT $1`,
     // The origin filter rides idx_ideas_task_lineage_route (ideas_004): a PARTIAL
@@ -898,8 +969,10 @@ async function countRoutedAwaitingNod(deps = {}) {
     `SELECT COUNT(*)::int AS n
        FROM ideas_task_lineage l
        JOIN tasks t ON t.id = l.task_id
-      WHERE l.origin = 'route' AND t.status = 'backlog'`
-    // Same predicate ⇒ same index (ideas_004) as the list above.
+      WHERE l.origin = 'route' AND t.status = 'backlog'
+        AND ${ROUTE_LINK_IS_EARLIEST}`
+    // Same predicate ⇒ same index (ideas_004) as the list above — including the
+    // one-row-per-task clause, which is shared as a constant rather than copied.
   );
   return rows[0] ? rows[0].n : 0;
 }

package/modules/ideas/migrations/ideas_006_lineage_many_ideas_one_task.sql

@@ -0,0 +1,98 @@
+-- ideas_006_lineage_many_ideas_one_task.sql — a task may descend from MANY ideas
+-- (task 1003515, goal 1000071 "Idea routing"; ADR 0236).
+--
+-- WHY. ideas_002 made task_id the PRIMARY KEY of ideas_task_lineage, on the
+-- reasoning that "a task descends from AT MOST ONE idea". linkIdeaTask therefore
+-- wrote `ON CONFLICT (task_id) DO UPDATE SET idea_id = EXCLUDED.idea_id`, so
+-- promoting a SECOND idea into a task that already had a link SILENTLY REPLACED
+-- the first idea's lineage. No error, no warning, no log line. It happened on
+-- prod on 2026-08-21: ideas 1000811 and 1000812 were both promoted into task
+-- 1003150 (two call sites of one mechanism — a normal and desirable triage move)
+-- and idea 1000811's link was erased, leaving only the weaker
+-- idea_inbox.promoted_to_task_id pointer behind.
+--
+-- WHY IT IS WORTH CHANGING THE KEY. This table is the rail goal 1000067
+-- (ideator compensation) pays against — countShippedTasksForIdea and
+-- sourceIdeaForTask are the queries that pay it. A silently overwritten row
+-- means an ideator is simply not paid for work that descended from their idea,
+-- with nothing anywhere recording that it happened. It also makes "N ideas
+-- subsumed into one task" a LOSSY operation, and merging duplicate reports into
+-- one task is exactly the triage move the inbox is supposed to encourage.
+--
+-- THE DECISION: many ideas → one task is a REAL relation, so the key is the
+-- PAIR. The table already permitted one idea → many tasks (idea_id was never
+-- unique); this makes the symmetric direction real instead of destructive.
+-- Wherever a SINGLE-row answer is still required — sourceIdeaForTask, the ship
+-- hook's credit read, the nod queue — the EARLIEST link wins, deterministically
+-- (created_at, then idea_id). ADR 0236.
+--
+-- WHY THIS IS ADDITIVE DESPITE THE `DROP CONSTRAINT`. The same shape ideas_003
+-- recorded for its CHECK: Postgres has no "widen a key" verb, so the change is
+-- necessarily drop-then-re-add of the SAME-named constraint, and fitness.js's
+-- isConstraintWidening exempts exactly that pattern. It is additive in EFFECT —
+-- the new key permits a strict SUPERSET of the old one (every row legal before
+-- is legal after), no existing row is touched and no data is lost. The dropped
+-- name must be Postgres's auto-generated `ideas_task_lineage_pkey` from the
+-- ideas_002 inline PRIMARY KEY, or the DROP silently no-ops and the erasure
+-- continues; the safety net at the bottom is what proves the widening took.
+--
+-- The other indexes are untouched and stay valid: idx_ideas_task_lineage_idea
+-- (ideas_002, on idea_id — the credit count's index) and
+-- idx_ideas_task_lineage_route (ideas_004, partial on task_id WHERE
+-- origin='route' — the nod queue's) are independent objects; only the implicit
+-- unique index behind the primary key is rebuilt, now over both columns.
+--
+-- Module migrations are ADDITIVE and NAMESPACED: every object here is
+-- ideas_-prefixed, no down-migration, idempotent (safe to re-run).
+
+BEGIN;
+
+ALTER TABLE ideas_task_lineage DROP CONSTRAINT IF EXISTS ideas_task_lineage_pkey;
+ALTER TABLE ideas_task_lineage ADD CONSTRAINT ideas_task_lineage_pkey
+  PRIMARY KEY (task_id, idea_id);
+
+-- BACKFILL — restore every link the old upsert could have erased, not only the
+-- one incident we happen to know about. idea_inbox.promoted_to_task_id is the
+-- weaker pointer that SURVIVED each overwrite (updateIdea writes it in the same
+-- call that wrote the lineage row), so it is the standing record of what the
+-- lineage lost: every promoted idea whose task carries no row for THAT idea gets
+-- its link back.
+--
+-- origin='promote' for all of them. promoted_to_task_id is written by the triage
+-- promote path, so that is the right label for the overwhelming majority; where
+-- the erased row had been a ROUTED one its 'route' provenance is unrecoverable
+-- from this column alone and it is relabelled promote. A restored link with a
+-- slightly coarse origin beats a missing one — origin only WEIGHS a payout,
+-- while the link is whether there is a payout at all.
+--
+-- ON CONFLICT DO NOTHING, so a link that survived keeps its own origin and
+-- created_at untouched, and re-running this migration writes nothing.
+INSERT INTO ideas_task_lineage (task_id, idea_id, origin)
+SELECT i.promoted_to_task_id, i.id, 'promote'
+  FROM idea_inbox i
+ WHERE i.promoted_to_task_id IS NOT NULL
+ON CONFLICT (task_id, idea_id) DO NOTHING;
+
+-- SAFETY NET — a migration that cannot prove its own effect must not report
+-- success (the ideas_003 / ideas_005 precedent). Read-only, no DDL: if the
+-- primary key is still the single column task_id then the DROP above targeted a
+-- differently-named constraint, the widening did not take, and the very next
+-- double promote silently erases attribution again — the exact failure this file
+-- exists to end, which would otherwise be discovered the same way it was the
+-- first time: by accident, months later, with the evidence already gone.
+DO $$
+DECLARE pk_cols text;
+BEGIN
+  SELECT string_agg(a.attname, ',' ORDER BY a.attname) INTO pk_cols
+    FROM pg_constraint c
+    JOIN unnest(c.conkey) AS k(attnum) ON true
+    JOIN pg_attribute a ON a.attrelid = c.conrelid AND a.attnum = k.attnum
+   WHERE c.conrelid = 'ideas_task_lineage'::regclass
+     AND c.contype  = 'p';
+  IF pk_cols IS DISTINCT FROM 'idea_id,task_id' THEN
+    RAISE EXCEPTION
+      'ideas_006: ideas_task_lineage primary key is (%) — expected the composite (task_id, idea_id); the widening did not take.', COALESCE(pk_cols, 'none');
+  END IF;
+END $$;
+
+COMMIT;

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.501",
+  "version": "1.19.503",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.19.501",
+      "version": "1.19.503",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.501",
+  "version": "1.19.503",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/scripts/gds/git-merge-regen.js

@@ -28,6 +28,7 @@ const { spawnSync } = require('node:child_process');
 const G = require('./gen-repo-map');
 const FM = require('./gen-file-map');
 const SI = require('./gen-session-index');
+const CI = require('./copy-inventory');
 
 const REPO_ROOT = path.resolve(__dirname, '..', '..');
 
@@ -36,10 +37,18 @@ const REPO_ROOT = path.resolve(__dirname, '..', '..');
 // hand-written prose with one generated block; docs/file-map.md is hand-written
 // prose with TWO generated section blocks (ADR 0066). (task 1385: session-log-index
 // joined so a confirmed PR that only conflicts on it self-heals like the rest.)
+// docs/copy-inventory.md + docs/copy-registry.json (task 1003543) are the copy
+// registry's own pair — like repo-map.md, `copy-inventory.js` writes them
+// wholesale from a tree scan with nothing hand-authored in either, so any two
+// branches that both touch hall/status/landing copy regenerate them differently
+// and conflict on ordinary text; they join the whole-file group for the same
+// reason session-log-index.md did.
 const REGENERABLE = new Set([
   'docs/repo-map.md',
   'docs/file-map.md',
   'docs/session-log-index.md',
+  'docs/copy-inventory.md',
+  'docs/copy-registry.json',
   ...G.NESTED_DIRS.map((d) => `${d}/CLAUDE.md`),
 ]);
 
@@ -86,6 +95,17 @@ function regenerateResolved(relpath, { base = '', ours = '', theirs = '' } = {})
     return { content: SI.renderIndex(SI.collectEntries()), ok: true };
   }
 
+  // docs/copy-registry.json / docs/copy-inventory.md: both artifacts of one scan
+  // (copy-inventory.js), fully generated — ignore all three sides, rebuild from
+  // the merged tree. Reuse buildRegistry() rather than shelling out to write() so
+  // this stays in-process like the repo-map/session-index heals above.
+  if (relpath === 'docs/copy-registry.json') {
+    return { content: `${JSON.stringify(CI.buildRegistry(), null, 2)}\n`, ok: true };
+  }
+  if (relpath === 'docs/copy-inventory.md') {
+    return { content: CI.renderReport(CI.buildRegistry()), ok: true };
+  }
+
   const model = G.buildModel();
 
   // docs/repo-map.md is fully generated — ignore all three sides, rebuild it.

package/src/module-api.js

@@ -45,7 +45,7 @@ const { validateOrRespond, LIMITS, parseId, asyncHandler, corsPublicGet, parsePa
 // there. scripts/gds/bump-version.js still rewrites the literal below; it appends
 // the entry to that file. Look for a version's history there, not here.
 // ---------------------------------------------------------------------------
-const CORE_VERSION = '1.19.501'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
+const CORE_VERSION = '1.19.503'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('dev-box'); log.info('mounted');

package/tests/git_merge_regen.mjs

@@ -14,6 +14,14 @@
 //      markers remain) so a human resolves it — the heal never clobbers real edits.
 //   4. The merge-driver entrypoint writes %A + exits 0 (heal) / 1 (real conflict).
 //   5. A non-generated path is never touched (not in REGENERABLE).
+//   6. END-TO-END: a real `git merge` invokes the driver via .gitattributes.
+//   7. .gitattributes' merge=otb-regen lines and REGENERABLE agree (task 1003543).
+//   8. docs/copy-registry.json + docs/copy-inventory.md (task 1003543) — the copy
+//      registry's own pair — regenerate clean from the merged tree, same as
+//      repo-map.md, ignoring the conflicted sides.
+//   9. END-TO-END for docs/copy-registry.json: two branches that each regenerate
+//      it differently merge without conflict markers via the real .gitattributes +
+//      git-config wiring, and the result equals a fresh regeneration.
 //
 // Run:  node tests/git_merge_regen.mjs
 
@@ -30,6 +38,7 @@ const here = path.dirname(fileURLToPath(import.meta.url));
 const repo = path.resolve(here, '..');
 const regen = require('../scripts/gds/git-merge-regen.js');
 const G = require('../scripts/gds/gen-repo-map.js');
+const CI = require('../scripts/gds/copy-inventory.js');
 
 const MARKERS = /^(<{7}|={7}|>{7})/m;
 
@@ -148,4 +157,82 @@ function withBlockBody(src, body) {
   }
 }
 
+// ── 7) .gitattributes' merge=otb-regen lines and REGENERABLE agree (task 1003543) ─
+// The whole scheme is two hand-maintained lists naming the same files (one in
+// .gitattributes, one in REGENERABLE) — nothing checked that they still matched, so
+// docs/copy-inventory.md + docs/copy-registry.json could be (and were) added to
+// neither and merge like ordinary text. This pins the two lists as one set.
+{
+  const attrsText = fs.readFileSync(path.join(repo, '.gitattributes'), 'utf8');
+  const otbRegenPaths = [...attrsText.matchAll(/^(\S+)\s+merge=otb-regen\s*$/gm)].map((m) => m[1]);
+  assert.ok(otbRegenPaths.length > 0, 'expected at least one merge=otb-regen line in .gitattributes');
+  for (const p of otbRegenPaths) {
+    assert.ok(regen.REGENERABLE.has(p), `.gitattributes declares merge=otb-regen for ${p} but REGENERABLE (git-merge-regen.js) does not know it`);
+  }
+  for (const p of regen.REGENERABLE) {
+    assert.ok(otbRegenPaths.includes(p), `REGENERABLE (git-merge-regen.js) knows ${p} but .gitattributes has no merge=otb-regen line for it`);
+  }
+}
+
+// ── 8) docs/copy-registry.json + docs/copy-inventory.md regenerate clean ────────
+// (task 1003543 — the copy registry's own pair, from copy-inventory.js. Both
+// artifacts of one scan, fully generated — like docs/repo-map.md, all three
+// conflicted sides are ignored and the merged tree is rebuilt from scratch.)
+{
+  const freshReg = CI.buildRegistry();
+  const freshJson = `${JSON.stringify(freshReg, null, 2)}\n`;
+  const freshMd = CI.renderReport(freshReg);
+
+  const rJson = regen.regenerateResolved('docs/copy-registry.json', {
+    base: '{}\n', ours: '<<<<<<< ours\n{"a":1}\n=======\n{"b":2}\n>>>>>>> theirs\n', theirs: 'nonsense\n',
+  });
+  assert.equal(rJson.ok, true, 'copy-registry.json heal must succeed');
+  assert.ok(!MARKERS.test(rJson.content), 'copy-registry.json heal must leave no conflict markers');
+  assert.equal(rJson.content, freshJson, 'copy-registry.json heal must equal a fresh regeneration');
+
+  const rMd = regen.regenerateResolved('docs/copy-inventory.md', {
+    base: '# base\n', ours: '<<<<<<< ours\n# a\n=======\n# b\n>>>>>>> theirs\n', theirs: 'nonsense\n',
+  });
+  assert.equal(rMd.ok, true, 'copy-inventory.md heal must succeed');
+  assert.ok(!MARKERS.test(rMd.content), 'copy-inventory.md heal must leave no conflict markers');
+  assert.equal(rMd.content, freshMd, 'copy-inventory.md heal must equal a fresh regeneration');
+}
+
+// ── 9) END-TO-END: two branches that both regenerate docs/copy-registry.json ────
+// differently merge clean via the real .gitattributes + git-config wiring — the
+// exact PR 526/531 shape from task 1003543 (two hall PRs both ran copy-inventory.js
+// concurrently and conflicted as ordinary JSON/markdown). Mirrors test 6 above.
+{
+  const driver = path.join(repo, 'scripts/gds/git-merge-regen.js');
+  const tmp = fs.mkdtempSync(path.join(os.tmpdir(), 'otb-gitmerge-copyreg-'));
+  const g = (...a) => {
+    const r = spawnSync('git', a, { cwd: tmp, encoding: 'utf8' });
+    return { status: r.status, out: `${r.stdout || ''}${r.stderr || ''}` };
+  };
+  const writeReg = (s) => fs.writeFileSync(path.join(tmp, 'docs', 'copy-registry.json'), s);
+  try {
+    g('init', '-q');
+    g('config', 'user.email', 't@t'); g('config', 'user.name', 't');
+    g('config', 'merge.otb-regen.driver', `node ${driver} %O %A %B %P`);
+    fs.writeFileSync(path.join(tmp, '.gitattributes'), 'docs/copy-registry.json merge=otb-regen\n');
+    fs.mkdirSync(path.join(tmp, 'docs'));
+    writeReg('{"schema":0}\n'); g('add', '-A'); g('commit', '-qm', 'base');
+    g('checkout', '-qb', 'feature');
+    writeReg('{"schema":0,"feature":true}\n'); g('add', '-A'); g('commit', '-qm', 'feat');
+    g('checkout', '-q', 'master');
+    if (g('rev-parse', '--verify', 'master').status !== 0) g('checkout', '-q', 'main');
+    writeReg('{"schema":0,"master":true}\n'); g('add', '-A'); g('commit', '-qm', 'mast');
+    const merge = g('merge', '--no-edit', 'feature');
+    assert.equal(merge.status, 0, `real git merge must auto-resolve via the driver; got ${merge.status} :: ${merge.out}`);
+    const unmerged = g('diff', '--name-only', '--diff-filter=U').out.trim();
+    assert.equal(unmerged, '', `no file may be left unmerged; got: ${unmerged}`);
+    const healed = fs.readFileSync(path.join(tmp, 'docs', 'copy-registry.json'), 'utf8');
+    assert.ok(!MARKERS.test(healed), 'merged copy-registry.json must have no conflict markers');
+    assert.equal(healed, `${JSON.stringify(CI.buildRegistry(), null, 2)}\n`,
+      'merged copy-registry.json must equal a fresh regeneration from the (real) merged tree');
+  } finally {
+    fs.rmSync(tmp, { recursive: true, force: true });
+  }
+}
+
 console.log('git_merge_regen: all assertions passed');

package/tests/idea_task_lineage.mjs

@@ -1,54 +1,85 @@
 // tests/idea_task_lineage.mjs
 //
 // task 1002997 (BV1.R173, goal 1000067) — idea → task lineage.
+// task 1003515 (goal 1000071, ADR 0236) — the key is the PAIR, so a second idea
+//   promoted into one task no longer ERASES the first idea's attribution.
 //
 // The done-when as assertions: an idea can be traced to every task descended
-// from it; a promote sets the link (additive to the single-FK
-// promoted_to_task_id, which is unchanged); counting "tasks shipped under idea
-// N" is one query; the reverse lookup names the source idea + author for a
-// task that just shipped (what stream 1's ship hook reads).
+// from it; a task can be traced back to every idea it descends from; a promote
+// sets the link (additive to the single-FK promoted_to_task_id, which is
+// unchanged); counting "tasks shipped under idea N" is one query and credits a
+// SHARED task to each of its source ideas; the reverse lookup names ONE source
+// idea deterministically — the earliest — for the ship hook that pays; and a
+// lineage write that fails is reported rather than swallowed in silence.
 //
 // DB-free the tests/idea_grades.mjs way: pool.query patched on the doorway
-// before inbox.js loads. The stub models ideas_task_lineage as an in-memory
-// map keyed by task_id, so the ON CONFLICT (task_id) upsert and the joins
-// behave like Postgres.
+// before inbox.js loads. The stub models ideas_task_lineage as an in-memory map
+// keyed by (task_id, idea_id) — the ideas_006 primary key — so the ON CONFLICT
+// upsert, the ORDER BY created_at tie-break and the joins behave like Postgres.
 //
 // Run:  node tests/idea_task_lineage.mjs
 
 import { strict as assert } from 'node:assert';
+import { readFileSync } from 'node:fs';
 import { createRequire } from 'node:module';
 
 const require = createRequire(import.meta.url);
 const api = require('../src/module-api.js');
 
 // in-memory stand-ins for the two tables the lineage queries touch
-let lineage = new Map();          // task_id -> { idea_id, origin }
+let lineage = new Map();          // "task_id|idea_id" -> { task_id, idea_id, origin, created_at }
 let tasks = new Map();            // task_id -> { status }
 let ideaInbox = new Map();        // idea_id -> { captured_by }
 let lastUpdate = null;
+let logged = [];                  // what api.logger('ideas').error was told
+let clock = 0;                    // stands in for created_at DEFAULT now()
+let linkShouldThrow = null;
+
+const key = (taskId, ideaId) => `${taskId}|${ideaId}`;
+const linksForTask = (taskId) => [...lineage.values()]
+  .filter((r) => r.task_id === String(taskId))
+  .sort((a, b) => (a.created_at - b.created_at) || (Number(a.idea_id) - Number(b.idea_id)));
 
 api.pool.query = async (sql, params = []) => {
-  // linkIdeaTask: INSERT ... ON CONFLICT (task_id) DO UPDATE
+  // linkIdeaTask / the route INSERT: ON CONFLICT (task_id, idea_id) DO UPDATE
   if (/INSERT INTO ideas_task_lineage/i.test(sql)) {
+    if (linkShouldThrow) throw new Error(linkShouldThrow);
+    assert.match(sql, /ON CONFLICT \(task_id, idea_id\)/,
+      'the conflict target is the PAIR — keying on task_id alone is what erased attribution');
     const [taskId, ideaId, origin] = params;
-    lineage.set(String(taskId), { idea_id: String(ideaId), origin });
+    const k = key(taskId, ideaId);
+    const existing = lineage.get(k);
+    // DO UPDATE SET origin — created_at is NOT rewritten, so "which link came
+    // first" survives a re-link (the tie-break every single-row read uses).
+    lineage.set(k, {
+      task_id: String(taskId),
+      idea_id: String(ideaId),
+      origin: origin ?? 'promote',
+      created_at: existing ? existing.created_at : clock++,
+    });
     return { rowCount: 1, rows: [] };
   }
   // countShippedTasksForIdea: JOIN tasks, WHERE idea_id=$1 AND status='shipped'
   if (/COUNT\(\*\)::int AS n/i.test(sql)) {
     const ideaId = String(params[0]);
     let n = 0;
-    for (const [taskId, row] of lineage) {
-      if (row.idea_id === ideaId && (tasks.get(taskId) || {}).status === 'shipped') n++;
+    for (const row of lineage.values()) {
+      if (row.idea_id === ideaId && (tasks.get(row.task_id) || {}).status === 'shipped') n++;
     }
     return { rows: [{ n }] };
   }
-  // sourceIdeaForTask: JOIN idea_inbox, WHERE task_id=$1
+  // sourceIdeaForTask: JOIN idea_inbox, WHERE task_id=$1, earliest link only
   if (/l\.idea_id, l\.origin, i\.captured_by/i.test(sql)) {
-    const taskId = String(params[0]);
-    const row = lineage.get(taskId);
+    assert.match(sql, /ORDER BY l\.created_at ASC, l\.idea_id ASC/,
+      'the one row it returns is CHOSEN in SQL, not by the planner');
+    assert.match(sql, /LIMIT 1/);
+    const row = linksForTask(params[0])[0];
     if (!row) return { rows: [] };
-    return { rows: [{ idea_id: row.idea_id, origin: row.origin, captured_by: (ideaInbox.get(row.idea_id) || {}).captured_by ?? null }] };
+    return { rows: [{
+      idea_id: row.idea_id,
+      origin: row.origin,
+      captured_by: (ideaInbox.get(row.idea_id) || {}).captured_by ?? null,
+    }] };
   }
   // updateIdea's CTE UPDATE ... RETURNING — record it, return a plausible row
   if (/UPDATE idea_inbox/i.test(sql)) {
@@ -59,12 +90,25 @@ api.pool.query = async (sql, params = []) => {
   return { rows: [{ id: params[0], status: 'open', grade: 'quick' }] };
 };
 
+// The module logs through the published seam (api.logger), never console.* —
+// capture it so "the swallow now reports" is an assertion, not a promise.
+api.logger = () => ({
+  error: (msg) => { logged.push(String(msg)); },
+  warn: () => {}, info: () => {}, debug: () => {},
+});
+
 const inbox = require('../modules/ideas/inbox.js');
 
+const SRC = (p) => readFileSync(new URL(p, import.meta.url), 'utf8').replace(/\r\n/g, '\n');
+const MIGRATION = SRC('../modules/ideas/migrations/ideas_006_lineage_many_ideas_one_task.sql');
+const INBOX_SRC = SRC('../modules/ideas/inbox.js');
+const CREDITS_SRC = SRC('../modules/economy/credits.js');
+
 let passed = 0;
 let failed = 0;
 async function test(name, fn) {
-  lineage = new Map(); tasks = new Map(); ideaInbox = new Map(); lastUpdate = null;
+  lineage = new Map(); tasks = new Map(); ideaInbox = new Map();
+  lastUpdate = null; logged = []; clock = 0; linkShouldThrow = null;
   try { await fn(); passed++; console.log(`  ok  ${name}`); }
   catch (err) { failed++; console.error(`  FAIL ${name}\n    ${err.message}`); }
 }
@@ -74,17 +118,25 @@ await test('linkIdeaTask records one idea → many tasks', async () => {
   await inbox.linkIdeaTask(5, 101, 'promote');
   await inbox.linkIdeaTask(5, 102, 'develop');
   assert.equal(lineage.size, 3);
-  for (const [, row] of lineage) assert.equal(row.idea_id, '5', 'all three trace to idea 5');
+  for (const row of lineage.values()) assert.equal(row.idea_id, '5', 'all three trace to idea 5');
 });
 
-await test('re-linking the same task is idempotent; re-pointing updates the source', async () => {
+// THE REGRESSION THIS TASK EXISTS FOR (task 1003515). Before ideas_006 the
+// second promote overwrote the first and idea 5 lost its claim silently.
+await test('two ideas promoted into ONE task keep BOTH links — neither is erased', async () => {
   await inbox.linkIdeaTask(5, 100, 'promote');
-  await inbox.linkIdeaTask(5, 100, 'promote');      // same → no growth
-  assert.equal(lineage.size, 1);
-  await inbox.linkIdeaTask(9, 100, 'develop');       // re-point task 100 to idea 9
-  assert.equal(lineage.size, 1, 'still one row keyed by task_id');
-  assert.equal(lineage.get('100').idea_id, '9', 'source updated');
-  assert.equal(lineage.get('100').origin, 'develop');
+  await inbox.linkIdeaTask(9, 100, 'promote');
+  assert.equal(lineage.size, 2, 'a task descends from both ideas, not from whichever came last');
+  assert.deepEqual(linksForTask(100).map((r) => r.idea_id), ['5', '9'],
+    'both ideas are still attached to task 100');
+});
+
+await test('re-linking the SAME (idea, task) is idempotent and refreshes only origin', async () => {
+  await inbox.linkIdeaTask(5, 100, 'promote');
+  await inbox.linkIdeaTask(5, 100, 'route');
+  assert.equal(lineage.size, 1, 'the pair is unique — no second row');
+  assert.equal(lineage.get('100|5').origin, 'route', 'the newer caller describes the pair');
+  assert.equal(lineage.get('100|5').created_at, 0, 'created_at is NOT rewritten, so "first link" survives');
 });
 
 await test('countShippedTasksForIdea counts only shipped descendants', async () => {
@@ -98,6 +150,17 @@ await test('countShippedTasksForIdea counts only shipped descendants', async ()
   assert.equal(await inbox.countShippedTasksForIdea(404), 0, 'an idea with no tasks counts 0');
 });
 
+// The credit consequence of the composite key: a task subsumed from N ideas
+// counts ONCE toward EACH idea's shipped-task credit, and never twice for one.
+await test('a SHARED task counts once for each of its source ideas', async () => {
+  await inbox.linkIdeaTask(5, 100, 'promote');
+  await inbox.linkIdeaTask(9, 100, 'promote');
+  await inbox.linkIdeaTask(5, 100, 'promote');   // a re-link must not inflate the count
+  tasks.set('100', { status: 'shipped' });
+  assert.equal(await inbox.countShippedTasksForIdea(5), 1, 'idea 5 is credited for the shared task');
+  assert.equal(await inbox.countShippedTasksForIdea(9), 1, 'and so is idea 9 — it used to be credited 0');
+});
+
 await test('sourceIdeaForTask names the idea + author, or null', async () => {
   ideaInbox.set('5', { captured_by: '42' });
   await inbox.linkIdeaTask(5, 100, 'promote');
@@ -108,13 +171,33 @@ await test('sourceIdeaForTask names the idea + author, or null', async () => {
   assert.equal(await inbox.sourceIdeaForTask(999), null, 'a task with no source idea is null');
 });
 
+await test('sourceIdeaForTask returns the EARLIEST link when a task has several', async () => {
+  ideaInbox.set('5', { captured_by: '42' });
+  ideaInbox.set('9', { captured_by: '77' });
+  await inbox.linkIdeaTask(5, 100, 'promote');   // first
+  await inbox.linkIdeaTask(9, 100, 'promote');   // second
+  const src = await inbox.sourceIdeaForTask(100);
+  assert.equal(src.idea_id, '5', 'the idea the work was opened for, not whichever row came back first');
+  assert.equal(src.captured_by, '42');
+  // and re-linking the earlier pair does not move it to the back of the queue
+  await inbox.linkIdeaTask(5, 100, 'promote');
+  assert.equal((await inbox.sourceIdeaForTask(100)).idea_id, '5', 'a re-link cannot rewrite who was first');
+});
+
 await test('a promote through updateIdea sets the lineage AND the legacy single FK', async () => {
   await inbox.updateIdea(5, { status: 'promoted', promoted_to_task_id: 100 });
   // legacy single FK still written (the UPDATE carried it)
   assert.ok(lastUpdate && lastUpdate.params.includes(100), 'promoted_to_task_id still set on idea_inbox');
   // and the many-tasks lineage recorded it too
-  assert.equal(lineage.get('100')?.idea_id, '5', 'lineage row added on promote');
-  assert.equal(lineage.get('100')?.origin, 'promote');
+  assert.equal(lineage.get('100|5')?.idea_id, '5', 'lineage row added on promote');
+  assert.equal(lineage.get('100|5')?.origin, 'promote');
+});
+
+await test('a second promote into the same task through updateIdea keeps the first idea', async () => {
+  await inbox.updateIdea(5, { status: 'promoted', promoted_to_task_id: 100 });
+  await inbox.updateIdea(9, { status: 'promoted', promoted_to_task_id: 100 });
+  assert.equal(lineage.size, 2, 'the exact prod incident (ideas 1000811 + 1000812 → task 1003150)');
+  assert.ok(lineage.has('100|5') && lineage.has('100|9'));
 });
 
 await test('a non-promote update does not touch lineage', async () => {
@@ -122,5 +205,58 @@ await test('a non-promote update does not touch lineage', async () => {
   assert.equal(lineage.size, 0, 'discard writes no lineage row');
 });
 
+// The swallow stays (the triage verdict already committed) but it must SPEAK:
+// a lineage row that never landed is an ideator who will never be paid.
+await test('a failed lineage write is REPORTED, and never fails the promote', async () => {
+  linkShouldThrow = 'connection reset';
+  const row = await inbox.updateIdea(5, { status: 'promoted', promoted_to_task_id: 100 });
+  assert.ok(row, 'the promote still returns — lineage is a ledger convenience, not a gate');
+  assert.equal(logged.length, 1, 'exactly one report, through api.logger');
+  assert.match(logged[0], /LINEAGE GAP/);
+  assert.match(logged[0], /idea 5/);
+  assert.match(logged[0], /task 100/);
+  assert.match(logged[0], /connection reset/, 'the underlying cause rides along');
+});
+
+// ---- the schema half: the migration is the thing that makes all of the above true ----
+
+await test('ideas_006 replaces the task_id primary key with the composite pair', () => {
+  assert.match(MIGRATION, /ALTER TABLE ideas_task_lineage DROP CONSTRAINT IF EXISTS ideas_task_lineage_pkey/,
+    'the dropped name must be the auto-generated one from ideas_002, or the DROP silently no-ops');
+  assert.match(MIGRATION, /ADD CONSTRAINT ideas_task_lineage_pkey\s*\n?\s*PRIMARY KEY \(task_id, idea_id\)/,
+    're-added under the SAME name — the additive-widening shape fitness.js exempts');
+  assert.match(MIGRATION, /RAISE EXCEPTION/, 'a migration that cannot prove its own effect must not report success');
+});
+
+await test('ideas_006 backfills every link the old upsert could have erased', () => {
+  assert.match(MIGRATION, /INSERT INTO ideas_task_lineage \(task_id, idea_id, origin\)/);
+  assert.match(MIGRATION, /FROM idea_inbox i/,
+    'promoted_to_task_id is the weaker pointer that survived each overwrite');
+  assert.match(MIGRATION, /promoted_to_task_id IS NOT NULL/);
+  assert.match(MIGRATION, /ON CONFLICT \(task_id, idea_id\) DO NOTHING/,
+    'a link that survived keeps its own origin and created_at; re-running writes nothing');
+});
+
+await test('no write path keys on task_id alone any more', () => {
+  // comments stripped: linkIdeaTask's header QUOTES the old, erasing statement
+  // as the reason the key changed, and that citation is not a call site.
+  const code = INBOX_SRC.split('\n').filter((l) => !/^\s*\/\//.test(l)).join('\n');
+  assert.ok(!/ON CONFLICT \(task_id\)/.test(code),
+    'both INSERT sites (linkIdeaTask and the route transaction) must target the pair');
+  assert.equal((INBOX_SRC.match(/ON CONFLICT \(task_id, idea_id\)/g) || []).length, 2,
+    'linkIdeaTask + routeIdeaToGoal');
+});
+
+await test('every single-row read of the lineage picks the earliest link', () => {
+  // the nod queue: list and count share ONE predicate constant, so the pill can
+  // never disagree with the rows a Metic+ is shown
+  assert.match(INBOX_SRC, /const ROUTE_LINK_IS_EARLIEST = `NOT EXISTS/);
+  assert.equal((INBOX_SRC.match(/\$\{ROUTE_LINK_IS_EARLIEST\}/g) || []).length, 2,
+    'listRoutedAwaitingNod + countRoutedAwaitingNod');
+  // and the money: the ship hook's credit read must not let the planner choose a payee
+  assert.match(CREDITS_SRC, /FROM ideas_task_lineage l[\s\S]{0,400}ORDER BY l\.created_at ASC, l\.idea_id ASC\s*\n?\s*LIMIT 1/,
+    'awardIdeaTaskShipCredit pays the earliest source idea, matching sourceIdeaForTask');
+});
+
 console.log(`\nidea_task_lineage: ${passed} passed, ${failed} failed`);
 if (failed > 0) process.exit(1);