@bongos/core 1.19.813 → 1.19.815

package/modules/government/catalog.js

@@ -164,7 +164,16 @@ const PERMISSIONS = [
   { key: 'task.edit', system: false, floor: 'metic', guards: 'PATCH /tasks/:id' },
   { key: 'task.promote', system: false, floor: 'metic', guards: 'POST /tasks/:id/promote' },
   { key: 'task.demote', system: false, floor: 'metic', guards: 'POST /tasks/:id/demote' },
-  { key: 'task.abandon', system: false, floor: 'metic', guards: 'POST /tasks/:id/abandon — scope removal; undo = POST /tasks/:id/promote (ADR 0152, was archon)' },
+  // task 1002443: now the CROSS-OWNER half of a pair. Floor and guards are
+  // unchanged — what is new is that the key DECLARES its ownership axis, so
+  // `task.abandon.own` (in the ownership block below) can name it as the escalation
+  // path a creator's own-scoped grant is measured against.
+  //
+  // Verb `act`, not `manage`: retiring a task is ONE reach into the row, and
+  // `manage` is the full-control verb — declaring it here would silently dominate
+  // every future narrower `task.*.own` key, which is exactly the verb-blind
+  // escalation task 1003195 closed.
+  { key: 'task.abandon', system: false, floor: 'metic', scope: 'any', resource: 'task', verb: 'act', guards: 'POST /tasks/:id/abandon — scope removal on ANY task; undo = POST /tasks/:id/promote (ADR 0152, was archon). The cross-owner counterpart of task.abandon.own (task 1002443)' },
   { key: 'task.merge', system: false, floor: 'metic', guards: 'POST /tasks/:id/merge — mark a duplicate task merged into another (task 1001478, the idea.triage merge analogue)' },
   { key: 'task.vote', system: false, floor: 'metic', guards: 'POST /tasks/:id/vote' },
   { key: 'task.dependency.manage', system: false, floor: 'metic', guards: 'POST|PUT|DELETE /tasks/:id/dependencies (same-tier)' },
@@ -317,6 +326,24 @@ const PERMISSIONS = [
   // marker here. Exactly why scope is declared data: the suffix rule only runs the
   // safe direction ('.own' ⇒ scope 'own'), never the converse.
   { key: 'me.wandering.set', system: false, floor: 'xenos', scope: 'own', resource: 'builder_prefs', verb: 'set', counterpart: [], guards: 'PATCH /me/wandering (clamped by maxLevelForRank) — ownership-scoped' },
+  // task 1002443 — the owner's 2026-07-25 request: "the creator of that task should
+  // be able to abandon that task directly inside of the UI". Retiring work you
+  // filed yourself is not a triage authority, so it does not want the metic floor
+  // that `task.abandon` carries; it wants the OWNERSHIP axis, which is precisely the
+  // narrower rule a rank cannot express (`whose row is this`).
+  //
+  // counterpart is REAL here, unlike task.act.own/memory.manage.own: `task.abandon`
+  // is the same `act` verb over the same `task` resource across every creator, so it
+  // genuinely subsumes retiring your own — a Metic keeps the power they have today
+  // without needing to be the creator, and the route admits on either branch through
+  // resolver.authorizeOwnedOrAny.
+  //
+  // The floor is the LOOSER half of the gate, never the whole of it (the
+  // `goal.manage.own` posture): holding this key authorizes nothing on its own, and
+  // the STATUS envelope — creator-abandon only while the task is backlog/ready/
+  // blocked, never completed/confirmed/shipped — is enforced in abandonTask under
+  // the same FOR UPDATE lock that performs the write, not here.
+  { key: 'task.abandon.own', system: false, floor: 'xenos', scope: 'own', resource: 'task', verb: 'act', counterpart: ['task.abandon'], guards: 'POST /tasks/:id/abandon on a task you CREATED (tasks.created_by), while it is backlog/ready/blocked and unclaimed — requireBuilder + in-handler authorizeOwnedOrAny; ownership-scoped (task 1002443)' },
   { key: 'cost.log', system: false, floor: 'xenos', guards: 'POST /cost' },
   { key: 'learning.create', system: false, floor: 'xenos', guards: 'POST /learnings' },
   { key: 'blocker.file', system: false, floor: 'xenos', guards: 'POST /blockers' },

package/modules/government/migrations/government_015_task_abandon_own.sql

@@ -0,0 +1,64 @@
+-- government_015_task_abandon_own.sql — grant the new `task.abandon.own` atom to
+-- every rank (task 1002443, ADR 0297).
+--
+-- WHAT IT IS. The owner's 2026-07-25 request: "the creator of that task should be
+-- able to abandon that task directly inside of the UI." Retiring a task was a rank
+-- power only (`task.abandon`, floor metic, governance_003), so a sub-Metic builder
+-- could file a task and then could not withdraw their own proposal. The new key is
+-- the ADR 0151 §3 OWNERSHIP axis, not a rank widening.
+--
+-- A BRAND-NEW key: nobody holds it yet, so every rung the floor implies is granted
+-- here. RANK_SEED is a cumulative superset and this key floors at `xenos`, the
+-- bottom of the ladder — so ALL FOUR rank-roles get a block. The drift guard
+-- (tests/government_seed.mjs) compares the union of the run-once seed plus every
+-- later grant migration against the floor-derived seed, per rank; minting the
+-- catalog row WITHOUT this migration is exactly what that guard catches, and it did.
+--
+-- GRANTING IT TO EVERY RANK GIVES NOBODY THE POWER TO RETIRE ANYTHING ON ITS OWN.
+-- That is the whole point of an ownership-scoped key and the reason a floor this low
+-- is safe: holding it authorizes nothing until a handler supplies the concrete row's
+-- owner. `requirePermission` REFUSES an own-scoped key outright (auth.js, R100) so it
+-- can never gate a route unconditionally, and `resolveBuilderPermissions` returning
+-- it is only ever half a question. The other half — `tasks.created_by` equals the
+-- caller, and the task is still backlog/ready/blocked — is answered inside
+-- `abandonTask`'s FOR UPDATE transaction (modules/lifecycle/abandon-authz.js).
+--
+-- `task.abandon` (floor metic) is UNCHANGED and is not re-granted here: governance_003
+-- already granted it and migrations are run-once. It becomes this key's declared
+-- cross-owner counterpart — same `act` verb, same `task` resource — so a Metic keeps
+-- retiring any task without being its creator.
+--
+-- Additive only: one new permission key granted to four ranks; nothing is revoked.
+-- Idempotent (ON CONFLICT DO NOTHING); forward-safe (INSERT only).
+--
+-- One block PER RANK, in the government_004/009/010/011 shape: the drift guard scans
+-- for `SELECT '<rank>', unnest(ARRAY[…])` literally, so a combined
+-- `unnest(ARRAY['xenos','thetes']), 'key'` form parses as zero grants and reds it.
+
+BEGIN;
+
+INSERT INTO government_rank_permissions (rank_key, permission_key)
+SELECT 'xenos', unnest(ARRAY[
+  'task.abandon.own'
+])
+ON CONFLICT (rank_key, permission_key) DO NOTHING;
+
+INSERT INTO government_rank_permissions (rank_key, permission_key)
+SELECT 'thetes', unnest(ARRAY[
+  'task.abandon.own'
+])
+ON CONFLICT (rank_key, permission_key) DO NOTHING;
+
+INSERT INTO government_rank_permissions (rank_key, permission_key)
+SELECT 'metic', unnest(ARRAY[
+  'task.abandon.own'
+])
+ON CONFLICT (rank_key, permission_key) DO NOTHING;
+
+INSERT INTO government_rank_permissions (rank_key, permission_key)
+SELECT 'archon', unnest(ARRAY[
+  'task.abandon.own'
+])
+ON CONFLICT (rank_key, permission_key) DO NOTHING;
+
+COMMIT;

package/modules/hall-ui/public/task.js

@@ -509,6 +509,18 @@
     // should carry these permissions is a governance change that needs its own
     // ADR, so this surfaces controls only for builders who already hold the atoms.
     const canShape = isSupervisor;
+    // task 1002443 — the CREATOR axis, which is not a rank and so cannot live in
+    // canShape. `task.abandon.own` (floor xenos, ADR 0297) lets a builder retire a
+    // task THEY filed while it is still backlog/ready/blocked. Same display-hint
+    // posture as canShape: the server re-decides this under a row lock, and this
+    // line only chooses whether to draw the control.
+    //
+    // created_by is null on every task filed before core_227 and on system vectors
+    // (seed, restock, the Discord bug path), so isCreator is false for them and the
+    // control simply does not appear — never a button that would 403.
+    const CREATOR_RETIRABLE = ['backlog', 'ready', 'blocked'];
+    const isCreator = !!(viewer && t.created_by != null
+      && String(t.created_by) === String(viewer.id));
     // render() rebuilds #task-body wholesale, so a disclosure cannot keep its
     // state in the DOM. This re-renders the SAME data without a refetch — the
     // toggle is a view change, not a reason to ask the server anything.
@@ -713,7 +725,23 @@
     // active claim must be released first — both are 409s the server will raise
     // anyway, and both are knowable from this record. Offering the control and
     // letting it fail would teach the reader that the page guesses.
+    //
+    // task 1002443 — the control now has TWO audiences, and they are offered
+    // different amounts of it. A Metic+ keeps every branch below, over any task. A
+    // CREATOR who is not Metic+ gets it only on their own task and only while it is
+    // backlog/ready/blocked, because that is exactly what the server will admit:
+    // past the grader a retire is a ledger correction, not an author changing their
+    // mind. Outside that window the creator is told so in words, for the same reason
+    // the two refusals below are pre-answered — a control that cannot work teaches
+    // the reader that the page guesses.
     const claimIsLive = !!(lastClaim && !lastClaim.released_at);
+    // The creator's narrower window. This is a DISPLAY MIRROR of the server's own
+    // CREATOR_ABANDONABLE (modules/lifecycle/abandon-authz.js) — a browser file
+    // cannot require it, so the list is restated here and the server re-decides
+    // every call under a row lock. If that list moves, this one moves with it.
+    const creatorMayRetire = isCreator && !claimIsLive
+      && CREATOR_RETIRABLE.indexOf(t.status) !== -1;
+    const mayRetire = canShape || creatorMayRetire;
     let retire = '';
     if (canShape && t.status === 'shipped') {
       retire = '<p class="rec-actnote">A shipped task cannot be retired — it is immutable history now.</p>';
@@ -721,7 +749,28 @@
       retire = '<p class="rec-actnote">Someone is holding a claim on this task. It has to be released before the task can be retired.</p>';
     } else if (canShape && t.status === 'abandoned') {
       retire = '<p class="rec-actnote">This task is already retired. Promote restores it to the backlog.</p>';
-    } else if (canShape) {
+    // THE CREATOR'S REFUSALS ARE ORDERED BY WHAT WOULD ACTUALLY UNBLOCK THEM, which
+    // is not the same order as the supervisor's above. Each branch names the ONE
+    // thing standing in the way, and must not promise a remedy that would still be
+    // refused — the failure this file's own rule warns about, applied to the words
+    // rather than to a button.
+    //
+    //   shipped   → immutable for EVERYONE, so it must not read as 'ask a Metic'.
+    //   abandoned → already done.
+    //   a live claim, on a task that is otherwise retirable (or 'active', which
+    //               releases back to 'ready') → releasing genuinely unblocks it.
+    //   anything else outside the window (completed/confirmed) → authority is the
+    //               blocker, and a Metic really can act there.
+    } else if (!canShape && isCreator && t.status === 'shipped') {
+      retire = '<p class="rec-actnote">You created this task, but it has shipped. Shipped work is immutable history — nobody can retire it, whatever their rank.</p>';
+    } else if (!canShape && isCreator && t.status === 'abandoned') {
+      retire = '<p class="rec-actnote">You created this task and it is already retired.</p>';
+    } else if (!canShape && isCreator && claimIsLive
+               && (t.status === 'active' || CREATOR_RETIRABLE.indexOf(t.status) !== -1)) {
+      retire = '<p class="rec-actnote">You created this task, but someone is holding a claim on it. Once that is released you can retire it yourself.</p>';
+    } else if (!canShape && isCreator && !creatorMayRetire) {
+      retire = '<p class="rec-actnote">You created this task, but it has already moved past planning. Retiring it now is a change to the record, so it needs a Metic.</p>';
+    } else if (mayRetire) {
       retire = abandonOpen
         ? `
           <div class="td-form" id="abandon-form">

package/modules/ideas/inbox.js

@@ -1198,7 +1198,35 @@ async function developSpark(ideaId, { developedBy, templateKey = DEFAULT_TEMPLAT
   // null = "this row was not a developable spark when we looked". THREE ways to
   // get here, and the caller re-reads to say which: it was never a spark,
   // somebody else developed it first, or a triager closed the idea underneath us.
-  return rows[0] ?? null;
+  const graded = rows[0] ?? null;
+
+  // task 1003856: a Full Idea is the ideator's hand-off point, and the
+  // cross-role cascade that turns it into an engineer's scoping request needs a
+  // transition to hang on. Emitted only on a REAL transition — the UPDATE's
+  // `AND grade = 'spark'` means a no-op re-grade returns null and fires nothing,
+  // so the event cannot repeat for one idea.
+  //
+  // Wrapped and awaited-free by the same reasoning as every other kernel emit
+  // here: a listener must never be able to fail the write that preceded it. The
+  // cascade runner catches everything of its own accord as well.
+  if (graded) {
+    // The payload carries the WHOLE idea, not just its id. The listener lives in
+    // the lifecycle module, which owns no idea table and has no read port for one
+    // (ideas provides only `ideas.capture`) — so the read happens here, inside the
+    // module that owns the row, rather than by widening another module's surface.
+    try {
+      const idea = await getIdea(ideaId);
+      api.emit('idea.graded.full', {
+        ...(idea || {}),
+        id: ideaId,
+        idea_id: ideaId,
+        grade: 'full',
+        completeness_score: graded.completeness_score,
+        developed_by: graded.developed_by,
+      });
+    } catch { /* a listener, or the read that feeds it, must never cost the ideator their grade */ }
+  }
+  return graded;
 }
 
 // The grade row on its own. null = no row, which reads as grade='quick'

package/modules/lifecycle/abandon-authz.js

@@ -0,0 +1,132 @@
+// modules/lifecycle/abandon-authz.js — the PURE authorization decision behind
+// POST /tasks/:id/abandon: may THIS builder retire THIS task, right now?
+//
+// WHY IT IS ITS OWN FILE. Two authorities reach that transition and only one of
+// them is rank-shaped (ADR 0297):
+//
+//   • `task.abandon` (floor metic) — retire ANY task. Triage authority; the
+//     inverse of /promote, re-ranked to match it (ADR 0152).
+//   • `task.abandon.own` (floor xenos) — retire a task you CREATED, while it is
+//     still backlog/ready/blocked. The owner's 2026-07-25 request: "the creator
+//     of that task should be able to abandon that task directly inside of the
+//     UI." A predicate over tasks.created_by, which no rank floor can express —
+//     the ADR 0151 ownership axis.
+//
+// The second one is a rule about a ROW, so it cannot be a middleware and it must
+// not be re-derived at each call site. Carving it out follows the
+// goal-route-authz.js / shouldRefuseSessionClaim precedent: PURE and exported, so
+// every branch is pinned by a DB-free unit test instead of only through a live
+// route, and so the hall's display hint and the server's decision are provably
+// reading the same rule.
+//
+// PURE — no DB, no clock, no I/O. The caller resolves the RANK fact before its
+// transaction opens (request-scoped, uncached, ADR 0016) and supplies the ROW
+// fact from inside its FOR UPDATE lock. Splitting them is what makes the decision
+// both fresh and race-free: reading created_by outside the lock would be a TOCTOU
+// window, and resolving permissions inside it would hold a row lock across a
+// second pool acquire.
+//
+// MODULE BOUNDARY: reaches core only through the published doorway.
+
+'use strict';
+
+// The statuses a CREATOR may retire their own task in. Deliberately the
+// not-yet-started, not-yet-judged window:
+//   • backlog / ready / blocked — the task is still a plan. Retiring it is the
+//     author withdrawing their own proposal, which is what the owner asked for.
+//   • active   — excluded here AND by the active-claim guard in abandonTask: a
+//     live claim means a session still owns the work.
+//   • completed / confirmed — excluded ON PURPOSE. Past the grader a retire is a
+//     correction to the ledger, not an author changing their mind, so it stays
+//     with the cross-owner `task.abandon` authority.
+//   • shipped / abandoned — never reached from here; abandonTask refuses shipped
+//     outright and treats abandoned as an idempotent no-op.
+const CREATOR_ABANDONABLE = Object.freeze(['backlog', 'ready', 'blocked']);
+
+// The permission pair this decision is spelled in, exported so the route, the
+// tests and the denial text all name the same two atoms.
+const ABANDON_ANY_KEY = 'task.abandon';
+const ABANDON_OWN_KEY = 'task.abandon.own';
+
+// Does this builder hold enough to be worth locking the row for? The cheap
+// pre-transaction half: `false` here is a flat 403 and no transaction is opened.
+// Holding only the own-scoped key is NOT an admit — it is permission to be ASKED
+// the ownership question, which is the whole point of the `.own` axis.
+function mayAttemptAbandon({ holdsAny = false, holdsOwn = false } = {}) {
+  return holdsAny === true || holdsOwn === true;
+}
+
+// The row-scoped verdict. ORDERED and FAIL-CLOSED — every path that is not an
+// explicit admit returns { ok: false } with a reason the caller can map to a
+// refusal, and the default at the bottom denies rather than falls through.
+//
+// `sameOwner` is INJECTED rather than hand-rolled: Postgres hands bigints back as
+// strings and JS code carries them as numbers, so 7 and '7' must compare equal
+// while null, '', objects and NaN must match nothing. That normalization already
+// exists once, in the government resolver, and duplicating it here is exactly how
+// an ownership comparison quietly widens. A caller that supplies no comparator
+// gets a strict scalar fallback with the same posture — never a loose `==`.
+function strictSameOwner(a, b) {
+  const norm = (v) => {
+    if (typeof v === 'number') return Number.isFinite(v) ? String(v) : null;
+    if (typeof v === 'bigint') return String(v);
+    if (typeof v === 'string') return v === '' ? null : v;
+    return null;
+  };
+  const left = norm(a);
+  const right = norm(b);
+  return left !== null && right !== null && left === right;
+}
+
+function abandonVerdict({
+  holdsAny = false,
+  holdsOwn = false,
+  builderId = null,
+  createdBy = null,
+  status = null,
+  sameOwner = strictSameOwner,
+} = {}) {
+  // The cross-owner branch: reaches every creator's row, so no predicate applies.
+  // Checked FIRST so a Metic+ is never refused by the creator-only window below —
+  // their authority is wider, not narrower.
+  if (holdsAny === true) return { ok: true, via: ABANDON_ANY_KEY };
+
+  if (holdsOwn !== true) {
+    return {
+      ok: false,
+      reason: 'missing_permission',
+      message: `missing permission: ${ABANDON_ANY_KEY} (floor: metic), or ${ABANDON_OWN_KEY} on a task you created`,
+    };
+  }
+
+  // An own-scoped key is never sufficient on its own — it is half a question, and
+  // this is the other half. A null created_by (every task filed before core_227,
+  // and every system vector) matches nobody, by construction.
+  const compare = typeof sameOwner === 'function' ? sameOwner : strictSameOwner;
+  if (!compare(createdBy, builderId)) {
+    return {
+      ok: false,
+      reason: 'not_task_creator',
+      message: `you did not create this task — retiring someone else's task needs ${ABANDON_ANY_KEY} (floor: metic)`,
+    };
+  }
+
+  if (!CREATOR_ABANDONABLE.includes(String(status))) {
+    return {
+      ok: false,
+      reason: 'creator_status_not_abandonable',
+      message: `this task is '${status}' — a creator can retire their own task only while it is ${CREATOR_ABANDONABLE.join(', ')}; past that it needs ${ABANDON_ANY_KEY} (floor: metic)`,
+    };
+  }
+
+  return { ok: true, via: ABANDON_OWN_KEY };
+}
+
+module.exports = {
+  CREATOR_ABANDONABLE,
+  ABANDON_ANY_KEY,
+  ABANDON_OWN_KEY,
+  mayAttemptAbandon,
+  abandonVerdict,
+  strictSameOwner,
+};

package/modules/lifecycle/cascade.js

@@ -168,6 +168,68 @@ const CASCADES = Object.freeze([
   }),
 ]);
 
+// THE TRIGGERS. A cascade reacts to a state transition; there are two, and this
+// table is what lets one runner serve both without either pretending to be the
+// other. `subject` names what the rule's when/title/body receive, and the pair is
+// what the generated task's preamble says happened. Adding a third trigger is a
+// row here plus a rule list — deliberately not a condition language.
+const TRIGGERS = Object.freeze({
+  ship: Object.freeze({ subject: 'task', happened: (s) => `task ${s.id} shipped` }),
+  idea: Object.freeze({ subject: 'idea', happened: (s) => `idea ${s.id} was graded Full` }),
+});
+
+// Cascades triggered by an IDEA reaching grade 'full' (the ideator's finished
+// article), rather than by a ship. Kept as its own list rather than a `trigger`
+// field on one list, so a rule cannot be evaluated against a subject shape it was
+// never written for — an idea has no touches[], a task has no completeness score.
+const IDEA_CASCADES = Object.freeze([
+  Object.freeze({
+    key: 'engineer-scoping-on-full-idea',
+    discipline: 'engineer',
+    kind: 'unclassified',
+    // A Full Idea is the ideator's hand-off point: the five questions are
+    // answered and the thing is described well enough to cost. What it still
+    // lacks is an engineer's read on what building it would actually mean, and
+    // that read is the scoping task this files.
+    //
+    // The anti-recursion guard is FIRST, as in the ship rule. An idea that a
+    // cascade itself filed cannot file another.
+    when: (idea) => !!idea
+      && idea.grade === 'full'
+      && idea.source !== CASCADE_SOURCE
+      && String(idea.status || 'open') === 'open',
+    title: (idea) => `Scope the Full Idea: ${String(idea.title || '').trim() || `idea ${idea.id}`}`,
+    body: fullIdeaScopingBody,
+  }),
+]);
+
+// The body of the engineer's scoping request. Says what the ideator already
+// settled so the engineer does not re-ask it, and what the scoping is FOR.
+function fullIdeaScopingBody(idea) {
+  const score = idea.completeness_score != null ? ` (completeness ${idea.completeness_score})` : '';
+  const author = idea.captured_by ? ` by builder ${idea.captured_by}` : '';
+  // The idea's goal HINT, surfaced for a triager rather than acted on. It is
+  // advisory by its column's own definition, so it may inform a human decision and
+  // may not silently place this task.
+  const hint = idea.suggested_goal_id != null
+    ? `\nThe idea carried a routing hint — it may belong to goal ${idea.suggested_goal_id}. That is advisory; place this task wherever triage decides.\n`
+    : '';
+  return [
+    `Idea ${idea.id} reached **Full**${score}${author} — the ideator's five questions are answered, so the WHAT is settled.`,
+    hint,
+    '',
+    'What this asks for is the engineer\'s read the idea cannot give itself:',
+    '',
+    '- What would building it actually touch, and roughly what size is it?',
+    '- What already exists that it should sit on rather than duplicate?',
+    '- What is genuinely unknown, and what would cheaply settle it?',
+    '',
+    'Answer by turning it into real tasks, or by saying plainly why it should not be built — a scoping that concludes "not worth it, because X" is a complete answer and a useful one.',
+    '',
+    `The idea's own body is the brief; read it at the hall rather than re-deriving it here.`,
+  ].join('\n');
+}
+
 // The (source, source_ref) pair the generated task is keyed on. `source` is a
 // constant so every cascade-generated row is findable as a class; the ref pins
 // it to one rule and one originating ship.
@@ -218,7 +280,7 @@ function validateCascades(rules = CASCADES) {
 // A rule whose `when` THROWS is treated as no-match and reported in `errors`,
 // never propagated: one broken predicate must not cost the other rules their
 // tasks, and it certainly must not reach the ship.
-function cascadesFor(task, rules = CASCADES, ctx = {}) {
+function cascadesFor(task, rules = CASCADES, ctx = {}, trigger = TRIGGERS.ship) {
   const matched = [];
   const errors = [];
   if (!task || task.id == null) return { matched, errors: ['no task'] };
@@ -234,7 +296,7 @@ function cascadesFor(task, rules = CASCADES, ctx = {}) {
     }
     if (!hit) continue;
     try {
-      matched.push({ rule, spec: cascadeTaskSpec(rule, task) });
+      matched.push({ rule, spec: cascadeTaskSpec(rule, task, trigger) });
     } catch (e) {
       errors.push(`cascade "${rule.key}": title/body threw (${e && e.message})`);
     }
@@ -244,17 +306,26 @@ function cascadesFor(task, rules = CASCADES, ctx = {}) {
 
 // The createTask payload for one matched rule. The attribution preamble is
 // prepended here rather than left to each rule, so no rule can forget it.
-function cascadeTaskSpec(rule, task) {
+function cascadeTaskSpec(rule, task, trigger = TRIGGERS.ship) {
   const body = String(rule.body(task) || '').trim();
   const preamble =
-    `Filed automatically when task ${task.id} shipped — the "${rule.key}" cascade `
+    `Filed automatically when ${trigger.happened(task)} — the "${rule.key}" cascade `
     + `(modules/lifecycle/cascade.js). Nobody typed this; it is a REQUEST, filed at backlog, `
     + `and it goes through the board's ordinary triage. If the rule that made it is wrong, fix `
     + `the rule rather than only this task.`;
   return {
-    versionId: task.version_id,
+    // An idea carries a GUESS where a task carries a fact. `suggested_version` is
+    // inherited because a version is a label; `suggested_goal_id` is NOT, because
+    // its own column header forbids exactly that read — see goalId below.
+    versionId: task.version_id != null ? task.version_id : (task.suggested_version ?? null),
     // A cascade INHERITS its parent's goal — the follow-up belongs wherever the
     // work that triggered it belongs.
+    // NOT inherited from an idea's `suggested_goal_id`. That column documents
+    // itself as "Strictly advisory: no rank check, no scope wall, and no payout
+    // may read it... The BINDING home for 'which goal' is tasks.goal_id" — and a
+    // generated task's goal is binding. So an idea-triggered cascade lands in the
+    // catch-all and gets triaged like any other homeless work; the hint travels in
+    // the body instead, where a human can act on it.
     goalId: task.goal_id != null ? Number(task.goal_id) : null,
     // BV1.R11 (task 1003598): …and when the parent has none, says so. A shipped
     // task can still be goal-less — the 53 legacy catch-all rows, or any task
@@ -283,6 +354,59 @@ function cascadeTaskSpec(rule, task) {
 // The runner — the only part that touches a database
 // ---------------------------------------------------------------------------
 
+// FILE ONE SUBJECT'S MATCHES. Shared by both runners so the idempotency read,
+// the per-rule isolation and the reporting cannot drift apart between triggers —
+// the two runners differ only in how they FETCH a subject and which rule list and
+// context they bring.
+async function fileMatches({ matched, deps, report, trigger, subject }) {
+  for (const { rule, spec } of matched) {
+    try {
+      const existing = deps.findTaskBySourceRef
+        ? await deps.findTaskBySourceRef({ source: CASCADE_SOURCE, sourceRef: spec.sourceRef })
+        : null;
+      if (existing) { report.skipped.push({ key: rule.key, taskId: existing.id, reason: 'already filed' }); continue; }
+      const created = await deps.createTask(spec);
+      report.created.push({ key: rule.key, taskId: created && created.id, discipline: rule.discipline });
+      deps.log?.info?.(`[cascade] ${trigger.happened(subject)} → filed ${created && created.id} for ${rule.discipline} ("${rule.key}")`);
+    } catch (e) {
+      // One rule failing costs that rule its task and nothing else.
+      report.errors.push(`cascade "${rule.key}": ${e && e.message}`);
+    }
+  }
+}
+
+// React to one idea reaching grade 'full'. Same guarantees as the ship runner —
+// returns a report, never throws, never rejects — because an ideator grading
+// their own idea must not be able to fail on a follow-up task's account.
+//
+//   deps.getIdea(id)                 -> the full idea row (the event payload may
+//                                       carry only the id)
+//   deps.findTaskBySourceRef({...})  -> an existing row or null
+//   deps.createTask(spec)            -> the created row
+//   deps.log                         -> optional { info, error }
+async function runCascadesForIdea(graded, deps = {}) {
+  const report = { created: [], skipped: [], errors: [] };
+  try {
+    const id = graded && (graded.id ?? graded.idea_id);
+    if (id == null) { report.errors.push('cascade: idea payload carried no idea id'); return report; }
+
+    // The emitter sends the whole idea (it owns the row; this module does not),
+    // so the payload IS the subject. deps.getIdea stays supported for a caller
+    // that would rather re-read — and when one is injected and returns nothing,
+    // that is an error rather than a silent fall-back to a payload it rejected.
+    const idea = deps.getIdea ? await deps.getIdea(id) : graded;
+    if (!idea) { report.errors.push(`cascade: idea ${id} not readable after grading`); return report; }
+
+    const { matched, errors } = cascadesFor(idea, deps.rules || IDEA_CASCADES, {}, TRIGGERS.idea);
+    report.errors.push(...errors);
+    await fileMatches({ matched, deps, report, trigger: TRIGGERS.idea, subject: idea });
+  } catch (e) {
+    report.errors.push(`cascade: ${e && e.message}`);
+  }
+  if (report.errors.length) deps.log?.error?.(`[cascade] ${report.errors.length} problem(s): ${report.errors.join(' | ')}`);
+  return report;
+}
+
 // React to one shipped task. Returns a report, NEVER throws and never rejects:
 // property 1 in the header. `deps` is injected so the whole runner is testable
 // with two stubs and no database.
@@ -323,20 +447,7 @@ async function runCascadesForShip(shipped, deps = {}) {
     const { matched, errors } = cascadesFor(task, deps.rules || CASCADES, ctx);
     report.errors.push(...errors);
 
-    for (const { rule, spec } of matched) {
-      try {
-        const existing = deps.findTaskBySourceRef
-          ? await deps.findTaskBySourceRef({ source: CASCADE_SOURCE, sourceRef: spec.sourceRef })
-          : null;
-        if (existing) { report.skipped.push({ key: rule.key, taskId: existing.id, reason: 'already filed' }); continue; }
-        const created = await deps.createTask(spec);
-        report.created.push({ key: rule.key, taskId: created && created.id, discipline: rule.discipline });
-        log?.info?.(`[cascade] task ${id} shipped → filed ${created && created.id} for ${rule.discipline} ("${rule.key}")`);
-      } catch (e) {
-        // One rule failing costs that rule its task and nothing else.
-        report.errors.push(`cascade "${rule.key}": ${e && e.message}`);
-      }
-    }
+    await fileMatches({ matched, deps: { ...deps, log }, report, trigger: TRIGGERS.ship, subject: task });
   } catch (e) {
     report.errors.push(`cascade: ${e && e.message}`);
   }
@@ -346,6 +457,10 @@ async function runCascadesForShip(shipped, deps = {}) {
 
 module.exports = {
   CASCADES,
+  IDEA_CASCADES,
+  TRIGGERS,
+  fullIdeaScopingBody,
+  runCascadesForIdea,
   CASCADE_SOURCE,
   COPY_VISUAL_MODULES,
   hasCopyOrVisualWork,

package/modules/lifecycle/db-ship.js

@@ -953,9 +953,39 @@ async function confirmTask({ taskId, builderId }, deps = {}) {
 //                           still owns the work; release it first so the abandon
 //                           can never race a ship in flight.
 // Any other status (backlog/ready/blocked/completed/confirmed) abandons. The
-// route is metic+archon-gated (ADR 0152; archon-only until then), and the abandon
-// + its reason are captured in audit_log by the writing middleware, so the
-// append-only ledger records who retired what. restoreTask (below) is the undo.
+// route carries the authority gate (ADR 0152, and the creator widening of task
+// 1002443), and the abandon + its reason are captured in audit_log by the writing
+// middleware, so the append-only ledger records who retired what. restoreTask
+// (below) is the undo.
+//
+// `authorize` (task 1002443) — the OPTIONAL row-scoped veto, and the reason this
+// function grew a parameter rather than the route growing a pre-flight read.
+//
+// The owner's 2026-07-25 request widened this transition from "a Metic may retire
+// any task" to "...or a builder may retire a task THEY created". That second half
+// is a predicate over a COLUMN OF THIS ROW (tasks.created_by), so a check made
+// before the transaction would be a TOCTOU window: the row can be re-attributed,
+// claimed, or shipped between the read and the write. The callback therefore runs
+// INSIDE the transaction, against the row this function has already locked FOR
+// UPDATE, and its verdict and the UPDATE commit or roll back together.
+//
+// It is deliberately PURE and DB-FREE. The authority question splits in two (the
+// ADR 0151 ownership axis): the RANK fact — does this builder hold the key — is
+// request-scoped and is resolved by the caller BEFORE the transaction opens; only
+// the OWNER fact needs the lock. Resolving permissions in here would acquire a
+// second pool connection while holding a row lock, which under a saturated pool is
+// a deadlock. So the caller closes over its already-resolved grants and hands in a
+// predicate; this function supplies the row.
+//
+// Contract: called with { taskId, createdBy, status }, returns { ok: true } or
+// { ok: false, reason, message }. FAIL-CLOSED — anything that is not an explicit
+// { ok: true } is a refusal, so a caller that returns undefined (or throws) denies
+// rather than admits. Omitting `authorize` entirely preserves the pre-1002443
+// behaviour for every caller whose route already gated the transition.
+//
+// It runs BEFORE the already-abandoned idempotent return, deliberately: a caller
+// with no authority over this row must not be able to read its state back as a
+// 200, and an unauthorized retry is a refusal, not a no-op.
 //
 // NOTE on dependencies: abandoning a task that is listed in another task's
 // dependencies[] does NOT auto-adjust those dependents — they will simply never
@@ -967,14 +997,16 @@ async function confirmTask({ taskId, builderId }, deps = {}) {
 // so a regression test can drive the txn with a SQL-aware fakeClient, same as
 // confirmTask / decideOverrideRequest. Production callers omit deps → module pool.
 
-async function abandonTask({ taskId, reason }, deps = {}) {
+async function abandonTask({ taskId, reason, authorize = null }, deps = {}) {
   const activePool = (deps.pool && process.env.NODE_ENV === 'test') ? deps.pool : pool;
   const client = await activePool.connect();
   try {
     await client.query('BEGIN');
 
+    // created_by joins the locked SELECT (task 1002443) so the ownership predicate
+    // below reads the SAME row version the UPDATE will write.
     const { rows: taskRows } = await client.query(
-      `SELECT id, title, status FROM tasks WHERE id = $1 FOR UPDATE`,
+      `SELECT id, title, status, created_by FROM tasks WHERE id = $1 FOR UPDATE`,
       [taskId]
     );
     if (taskRows.length === 0) {
@@ -982,6 +1014,28 @@ async function abandonTask({ taskId, reason }, deps = {}) {
     }
     const task = taskRows[0];
 
+    // The row-scoped veto, under the lock and ahead of every status branch below —
+    // see the header for why both of those orderings are load-bearing. Fail-closed:
+    // only an explicit { ok: true } admits.
+    if (typeof authorize === 'function') {
+      let verdict;
+      try {
+        verdict = await authorize({ taskId, createdBy: task.created_by, status: task.status });
+      } catch (authErr) {
+        throw Object.assign(new Error('abandon authorization could not be established'), {
+          code: 'ABANDON_FORBIDDEN',
+          reason: 'authorize_threw',
+          cause: authErr,
+        });
+      }
+      if (!verdict || verdict.ok !== true) {
+        throw Object.assign(new Error((verdict && verdict.message) || 'not authorized to abandon this task'), {
+          code: 'ABANDON_FORBIDDEN',
+          reason: (verdict && verdict.reason) || 'not_authorized',
+        });
+      }
+    }
+
     if (task.status === 'abandoned') {
       await client.query('COMMIT');
       return { taskId, taskTitle: task.title, taskStatus: 'abandoned', previousStatus: 'abandoned', alreadyAbandoned: true };