@bongos/core 1.19.814 → 1.19.815

package/.bongos-core.json

@@ -2,22 +2,22 @@
   "artifact": "bongos-core",
   "manifest_schema": 1,
   "generator": "scripts/gds/package-core.js",
-  "core_version": "1.19.814",
-  "core_contract": "1.19.814",
-  "source_commit": "1f01e14964d5ea0ba6bc679b6545e33b7858829c",
+  "core_version": "1.19.815",
+  "core_contract": "1.19.815",
+  "source_commit": "49e12ef5bf0e0f642be16e2d07f3a8e4126088a3",
   "source_ref": "HEAD",
-  "built_at": "2026-09-17T07:24:36.013Z",
+  "built_at": "2026-09-17T07:58:43.512Z",
   "redaction": {
     "model": "docs-redacted+functional-verbatim",
     "docs_redacted": 489,
     "agent_docs_stubbed": 26,
-    "functional_verbatim": 2214,
+    "functional_verbatim": 2215,
     "rules": 3,
     "gate_literals": 3,
     "gate": "passed"
   },
-  "file_count": 2729,
-  "tree_sha256": "7a2511fd82d8a030199059a73c74669bc0c447fb5860e4eca010231226cd32a1",
+  "file_count": 2730,
+  "tree_sha256": "8f4f7be2444b6e33f3772cc07af105a80fdd6a416ab122c91973dcb9600c0cf4",
   "files": [
     {
       "path": ".claude/skills/ask-for-help/SKILL.md",
@@ -2542,7 +2542,7 @@
     {
       "path": "docs/module-api-changelog.md",
       "mode": "0000644",
-      "sha256": "2e01c98f75c74643cc843b80f507635d1d674749fed9185414cfce51eeac3cf8"
+      "sha256": "0f668e27938e73ba4769f2c5a1ee40205ffb350b25ad5c09bc7d660e2bb90b1d"
     },
     {
       "path": "docs/modules-contract.md",
@@ -3672,7 +3672,7 @@
     {
       "path": "modules/agents/lib/validate.js",
       "mode": "0000644",
-      "sha256": "cd3659ad5831c767fe6600fabbe883f33b3429107a0b999092158dfa7c95b4e7"
+      "sha256": "3ff56e388e9ae4cccb09fb072793b5544f771aeae51e8477f8a221f0c78b9515"
     },
     {
       "path": "modules/agents/migrations/agents_001_definitions.sql",
@@ -4167,7 +4167,7 @@
     {
       "path": "modules/discord/discord-channels.js",
       "mode": "0000644",
-      "sha256": "aeeb86c5d61b4a06ae5429fb69bb4720d54f4782ead5d23cdce640344a568246"
+      "sha256": "683174f64823c296d74acbdedff3c67085336aeae067d8014873a43c23eace68"
     },
     {
       "path": "modules/discord/discord-inbound.js",
@@ -4217,7 +4217,7 @@
     {
       "path": "modules/discord/routes/discord.js",
       "mode": "0000644",
-      "sha256": "2229a563e11bd05f0eb047f0afc0e1d66eaddb6a7fa2fb07c429e162684246f0"
+      "sha256": "6e771cafa4330cd6cba274040e8d0881f6a9b99dd566366fce266bd6f30b1ebf"
     },
     {
       "path": "modules/discord/ship-broadcast.js",
@@ -5412,7 +5412,7 @@
     {
       "path": "modules/ideas/inbox.js",
       "mode": "0000644",
-      "sha256": "d70b4564c8178f4752c5bd08c5cbb19e495828b5a3dd5081f71d3d7743609ab2"
+      "sha256": "36481a27a5921e3eb930268bf96bccd178259d3f7cce67b19b0dc4246f7d9bf1"
     },
     {
       "path": "modules/ideas/migrations/ideas_001_grades.sql",
@@ -5497,7 +5497,7 @@
     {
       "path": "modules/lifecycle/cascade.js",
       "mode": "0000644",
-      "sha256": "507fe63cf677dbe1a536d5fae1a55518f6fe5c8ec4d908ac1941164029b17593"
+      "sha256": "0f7c3c6b75216ddca36d49e9a112fce98de2e4123e9756879ba51b44b77c0f06"
     },
     {
       "path": "modules/lifecycle/claim-eligibility.js",
@@ -5817,7 +5817,7 @@
     {
       "path": "modules/lifecycle/routes/lifecycle.js",
       "mode": "0000644",
-      "sha256": "09b84f7f8a39be03b690e220d10af135f43d845db67c5f86b7f846d548d6361f"
+      "sha256": "e09bbf8000ada41c6eac7ab64dcfe476650a246a0b561a8b693992885136b3bd"
     },
     {
       "path": "modules/lifecycle/routes/mingle.js",
@@ -7792,12 +7792,12 @@
     {
       "path": "package-lock.json",
       "mode": "0000644",
-      "sha256": "bc7f846af00793ffc9d682071391f110593648a25297cd15050385b9c3a8828f"
+      "sha256": "48fba5427217aab544717eef126aa155f404dc6ba71ad21e2b2c4db586da9be7"
     },
     {
       "path": "package.json",
       "mode": "0000644",
-      "sha256": "db09d4c1609d9b4b0547b052326785367cfe19a5838cd3f9d458dac40ef70685"
+      "sha256": "abc68f18878f7339c9dba180f3b965c6b2cb253f91255b509ccb9fbd47c3b21b"
     },
     {
       "path": "public-docs/index.html",
@@ -9687,7 +9687,7 @@
     {
       "path": "src/module-api.js",
       "mode": "0000644",
-      "sha256": "2b104850c999f4a9c71f7f205c640b9525a9a812031c1bad6d13cdcd06c05706"
+      "sha256": "15e7fcbcb8377bea7245c66e4784accaecd09d92bd9baf3ecda20aab73faadac"
     },
     {
       "path": "src/module-loader/catalog.js",
@@ -9847,7 +9847,7 @@
     {
       "path": "tests/agents_validate.mjs",
       "mode": "0000644",
-      "sha256": "82c7bcef316f5c0068cb53a43b2ef4a01367ff285939f132f01b0d8633d36353"
+      "sha256": "9376185bc6e11571b050dcf61a993faf780cea66aa4c0844d114b1cb738043e2"
     },
     {
       "path": "tests/agents_write_routes.mjs",
@@ -10732,7 +10732,7 @@
     {
       "path": "tests/discord_channels.mjs",
       "mode": "0000644",
-      "sha256": "981d34c2fb5ecb6e9b9f38ece947c6c7a400dceadf8bbcf09546c8b3a92eb899"
+      "sha256": "02e03ca2651755084e134ba0c4568c76d5eb7d1d66d0cec1fdd7cb3b4901f106"
     },
     {
       "path": "tests/discord_channels_snapshot.mjs",
@@ -11584,6 +11584,11 @@
       "mode": "0000644",
       "sha256": "fb129f6ee327d946ba2e7ee46bab3b9795621f7f405637e1e8ed2b29807a84cf"
     },
+    {
+      "path": "tests/idea_cascade.mjs",
+      "mode": "0000644",
+      "sha256": "e14c3157cd9c1a5889fa2d5cc90bc036d5b9f3aa1e062bb13623a01adb81d20c"
+    },
     {
       "path": "tests/idea_completeness.mjs",
       "mode": "0000644",
@@ -13357,7 +13362,7 @@
     {
       "path": "tests/task_goal_required.mjs",
       "mode": "0000644",
-      "sha256": "2e311d02f87c562c2e8ed7cec24100efe3d1c750cb145e9e9e6bb1dac8043228"
+      "sha256": "04e7a36f7c2f5a94f847fcb4b77f017f6399fc96041cdaee1123c9a6fecb3d5d"
     },
     {
       "path": "tests/task_lib.mjs",

package/docs/module-api-changelog.md

@@ -2102,5 +2102,7 @@ is load-bearing: the script throws rather than guess if it is missing, and
         landed since 1.19.812 with no explicit bump. run 35193306517. (task 1002620)
   1.19.814 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
         landed since 1.19.813 with no explicit bump. run 35194334679. (task 1002620)
+  1.19.815 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+        landed since 1.19.814 with no explicit bump. run 35197139985. (task 1002620)
 ---------------------------------------------------------------------------
 ```

package/modules/agents/lib/validate.js

@@ -45,7 +45,7 @@
 
 // The WIRED event set for v1. Widening this is a deliberate act that must land
 // together with something that actually dispatches the new event.
-const EVENT_CATALOG = Object.freeze(['task.shipped']);
+const EVENT_CATALOG = Object.freeze(['task.shipped', 'idea.graded.full']);
 
 // Mirrors agents_definitions_trigger_type_chk. 'event' consumes the catalog above;
 // 'on-demand' is the historian shape (a builder asks, the agent answers).

package/modules/discord/discord-channels.js

@@ -40,7 +40,46 @@ const VIEW_CHANNEL = 1024n;
 // `view: "<rank>"` grants that rank and everyone above it.
 const RANK_LADDER = ['xenos', 'thetes', 'metic', 'archon'];
 
-const CONFIG_PATH = path.resolve(__dirname, '..', '..', 'docs', 'discord', 'channels.json');
+// WHERE channels.json LIVES (task 1003973). The layout file describes ONE
+// guild's channels, names and topics — instance identity, which ADR 0062 §7
+// puts on the HOST side of the core/host cut. So it is NOT published in the
+// neutral core, and resolving it against the core package (as this module used
+// to) means that on a deployed instance — where the module lives under
+// node_modules/@bongos/core/modules/discord/ — the file is simply not there and
+// every plan/apply died as a bare 500.
+//
+// Resolution order, first hit wins:
+//   1. <instance root>/docs/discord/channels.json  (ADR 0108's instance-root
+//      injection: <PREFIX>_INSTANCE_ROOT env, a bongos.config.json pointer, or
+//      process.cwd()) — each instance reads its OWN layout.
+//   2. <core root>/docs/discord/channels.json — the historical path, kept so a
+//      core checkout that is not the instance root still resolves.
+// In a single checkout (the live instance today) instance root === core root, so
+// this is byte-identical to the old constant.
+const CORE_CONFIG_PATH = path.resolve(__dirname, '..', '..', 'docs', 'discord', 'channels.json');
+
+function instanceConfigPath() {
+  // Through the published doorway (ADR 0083), which is where resolveInstanceRoot
+  // lives — the same core/host resolution the government pack already uses.
+  try {
+    const root = require('../../src/module-api').resolveInstanceRoot();
+    return path.resolve(root, 'docs', 'discord', 'channels.json');
+  } catch (e) { return null; }
+}
+
+// The path channels.json is actually read from, or the instance-root candidate
+// when neither exists (so the error names where the operator should put it).
+function resolveConfigPath() {
+  const inst = instanceConfigPath();
+  for (const c of [inst, CORE_CONFIG_PATH]) {
+    if (c && fs.existsSync(c)) return c;
+  }
+  return inst || CORE_CONFIG_PATH;
+}
+
+// Back-compat alias for the old export. Callers that want the live answer use
+// resolveConfigPath(); this stays the core-package path it always named.
+const CONFIG_PATH = CORE_CONFIG_PATH;
 
 // ---------------------------------------------------------------------------
 // PURE helpers (no Discord, no IO) — the load-bearing, fully-tested logic.
@@ -340,11 +379,41 @@ function planChannelReconcile(snapshot, config, ctx) {
 // IO + Discord REST (impure) — invoked by the bot sweep and the Archon command.
 // ---------------------------------------------------------------------------
 
-function loadConfig(configPath = CONFIG_PATH) {
-  const raw = fs.readFileSync(configPath, 'utf8');
+// Throws a TAGGED error when the layout file is absent (code CONFIG_NOT_FOUND,
+// carrying the path it looked at) so the callers below can report 'channels.json
+// not readable at <path>' instead of collapsing into a bare 500 — the silent
+// failure half of task 1003973.
+function loadConfig(configPath) {
+  const p = configPath || resolveConfigPath();
+  let raw;
+  try {
+    raw = fs.readFileSync(p, 'utf8');
+  } catch (e) {
+    if (e && e.code === 'ENOENT') {
+      const err = new Error(`channels.json not readable at ${p}`);
+      err.code = 'CONFIG_NOT_FOUND';
+      err.configPath = p;
+      throw err;
+    }
+    throw e;
+  }
   return JSON.parse(raw);
 }
 
+// Run a deps.loadConfig() that may be missing its file, and turn the tagged
+// CONFIG_NOT_FOUND into the same {ok:false, reason} shape the no_guild /
+// no_token paths already use, so every caller reports it the same way.
+function tryLoadConfig(deps) {
+  try {
+    return { config: deps.loadConfig() };
+  } catch (err) {
+    if (err && err.code === 'CONFIG_NOT_FOUND') {
+      return { fail: { ok: false, reason: 'no_config', configPath: err.configPath, detail: err.message } };
+    }
+    throw err;
+  }
+}
+
 // The managing bot's own user id, used to grant it an explicit VIEW overwrite on
 // any channel it restricts so it never locks itself out. Best-effort: returns
 // null if the client/user isn't resolvable (then the self-lockout guard is a
@@ -407,7 +476,9 @@ async function discordRest(token, method, urlPath, body) {
 function computePlan(deps = realDeps) {
   const guild = deps.getGuild();
   if (!guild) return { ok: false, reason: 'no_guild', ops: [], warnings: [] };
-  const config = deps.loadConfig();
+  const loaded = tryLoadConfig(deps);
+  if (loaded.fail) return { ...loaded.fail, ops: [], warnings: [] };
+  const config = loaded.config;
   const roleMap = deps.loadRoleMap();
   const ctx = { everyoneId: String(guild.id), roleMap, botId: botIdFromGuild(guild) };
   const snapshot = snapshotFromGuild(guild);
@@ -435,7 +506,9 @@ async function reconcileChannels(deps = realDeps) {
   const token = deps.loadBotToken();
   if (!token) return { ok: false, reason: 'no_token', applied: 0, failed: 0 };
 
-  const config = deps.loadConfig();
+  const loaded = tryLoadConfig(deps);
+  if (loaded.fail) return { ...loaded.fail, applied: 0, failed: 0 };
+  const config = loaded.config;
   const roleMap = deps.loadRoleMap();
   const ctx = { everyoneId: String(guild.id), roleMap, botId: botIdFromGuild(guild) };
   const snapshot = snapshotFromGuild(guild);
@@ -509,11 +582,13 @@ module.exports = {
   planChannelReconcile,
   // io
   loadConfig,
+  resolveConfigPath,
   snapshotFromGuild,
   computePlan,
   computeSnapshotConfig,
   reconcileChannels,
   CONFIG_PATH,
+  CORE_CONFIG_PATH,
   VIEW_CHANNEL,
   RANK_LADDER,
 };

package/modules/discord/routes/discord.js

@@ -79,6 +79,18 @@ function registerSeams() {
       console.log('[discord] role-sync (non-blocking):', e && e.message)));
 }
 
+// A !ok result from the channels module is either 'the bot is not connected'
+// or 'the layout file is not where I looked'. The second used to surface as a
+// bare 500 with the reason only in the server log, which made a missing
+// channels.json indistinguishable from a bot outage (task 1003973) — so it gets
+// its own code and names the path it tried.
+function failFor(res, r) {
+  if (r.reason === 'no_config') {
+    return res.fail('config_not_found', 503, { reason: r.reason, detail: r.detail, config_path: r.configPath });
+  }
+  return res.fail('bot_unavailable', 503, { reason: r.reason });
+}
+
 module.exports = function buildDiscordRouter() {
   registerSeams();
   const router = express.Router();
@@ -92,7 +104,7 @@ module.exports = function buildDiscordRouter() {
       const channels = require('../discord-channels');
       const plan = channels.computePlan();
       if (!plan.ok) {
-        return res.fail('bot_unavailable', 503, { reason: plan.reason });
+        return failFor(res, plan);
       }
       return res.json({ ok: true, guild_id: plan.guildId, op_count: plan.ops.length, ops: plan.ops, warnings: plan.warnings });
     } catch (err) {
@@ -131,7 +143,7 @@ module.exports = function buildDiscordRouter() {
       const channels = require('../discord-channels');
       const result = await channels.reconcileChannels();
       if (!result.ok) {
-        return res.fail('bot_unavailable', 503, { reason: result.reason });
+        return failFor(res, result);
       }
       return res.json({ ok: true, applied: result.applied, failed: result.failed, total: result.total, warnings: result.warnings });
     } catch (err) {

package/modules/ideas/inbox.js

@@ -1198,7 +1198,35 @@ async function developSpark(ideaId, { developedBy, templateKey = DEFAULT_TEMPLAT
   // null = "this row was not a developable spark when we looked". THREE ways to
   // get here, and the caller re-reads to say which: it was never a spark,
   // somebody else developed it first, or a triager closed the idea underneath us.
-  return rows[0] ?? null;
+  const graded = rows[0] ?? null;
+
+  // task 1003856: a Full Idea is the ideator's hand-off point, and the
+  // cross-role cascade that turns it into an engineer's scoping request needs a
+  // transition to hang on. Emitted only on a REAL transition — the UPDATE's
+  // `AND grade = 'spark'` means a no-op re-grade returns null and fires nothing,
+  // so the event cannot repeat for one idea.
+  //
+  // Wrapped and awaited-free by the same reasoning as every other kernel emit
+  // here: a listener must never be able to fail the write that preceded it. The
+  // cascade runner catches everything of its own accord as well.
+  if (graded) {
+    // The payload carries the WHOLE idea, not just its id. The listener lives in
+    // the lifecycle module, which owns no idea table and has no read port for one
+    // (ideas provides only `ideas.capture`) — so the read happens here, inside the
+    // module that owns the row, rather than by widening another module's surface.
+    try {
+      const idea = await getIdea(ideaId);
+      api.emit('idea.graded.full', {
+        ...(idea || {}),
+        id: ideaId,
+        idea_id: ideaId,
+        grade: 'full',
+        completeness_score: graded.completeness_score,
+        developed_by: graded.developed_by,
+      });
+    } catch { /* a listener, or the read that feeds it, must never cost the ideator their grade */ }
+  }
+  return graded;
 }
 
 // The grade row on its own. null = no row, which reads as grade='quick'

package/modules/lifecycle/cascade.js

@@ -168,6 +168,68 @@ const CASCADES = Object.freeze([
   }),
 ]);
 
+// THE TRIGGERS. A cascade reacts to a state transition; there are two, and this
+// table is what lets one runner serve both without either pretending to be the
+// other. `subject` names what the rule's when/title/body receive, and the pair is
+// what the generated task's preamble says happened. Adding a third trigger is a
+// row here plus a rule list — deliberately not a condition language.
+const TRIGGERS = Object.freeze({
+  ship: Object.freeze({ subject: 'task', happened: (s) => `task ${s.id} shipped` }),
+  idea: Object.freeze({ subject: 'idea', happened: (s) => `idea ${s.id} was graded Full` }),
+});
+
+// Cascades triggered by an IDEA reaching grade 'full' (the ideator's finished
+// article), rather than by a ship. Kept as its own list rather than a `trigger`
+// field on one list, so a rule cannot be evaluated against a subject shape it was
+// never written for — an idea has no touches[], a task has no completeness score.
+const IDEA_CASCADES = Object.freeze([
+  Object.freeze({
+    key: 'engineer-scoping-on-full-idea',
+    discipline: 'engineer',
+    kind: 'unclassified',
+    // A Full Idea is the ideator's hand-off point: the five questions are
+    // answered and the thing is described well enough to cost. What it still
+    // lacks is an engineer's read on what building it would actually mean, and
+    // that read is the scoping task this files.
+    //
+    // The anti-recursion guard is FIRST, as in the ship rule. An idea that a
+    // cascade itself filed cannot file another.
+    when: (idea) => !!idea
+      && idea.grade === 'full'
+      && idea.source !== CASCADE_SOURCE
+      && String(idea.status || 'open') === 'open',
+    title: (idea) => `Scope the Full Idea: ${String(idea.title || '').trim() || `idea ${idea.id}`}`,
+    body: fullIdeaScopingBody,
+  }),
+]);
+
+// The body of the engineer's scoping request. Says what the ideator already
+// settled so the engineer does not re-ask it, and what the scoping is FOR.
+function fullIdeaScopingBody(idea) {
+  const score = idea.completeness_score != null ? ` (completeness ${idea.completeness_score})` : '';
+  const author = idea.captured_by ? ` by builder ${idea.captured_by}` : '';
+  // The idea's goal HINT, surfaced for a triager rather than acted on. It is
+  // advisory by its column's own definition, so it may inform a human decision and
+  // may not silently place this task.
+  const hint = idea.suggested_goal_id != null
+    ? `\nThe idea carried a routing hint — it may belong to goal ${idea.suggested_goal_id}. That is advisory; place this task wherever triage decides.\n`
+    : '';
+  return [
+    `Idea ${idea.id} reached **Full**${score}${author} — the ideator's five questions are answered, so the WHAT is settled.`,
+    hint,
+    '',
+    'What this asks for is the engineer\'s read the idea cannot give itself:',
+    '',
+    '- What would building it actually touch, and roughly what size is it?',
+    '- What already exists that it should sit on rather than duplicate?',
+    '- What is genuinely unknown, and what would cheaply settle it?',
+    '',
+    'Answer by turning it into real tasks, or by saying plainly why it should not be built — a scoping that concludes "not worth it, because X" is a complete answer and a useful one.',
+    '',
+    `The idea's own body is the brief; read it at the hall rather than re-deriving it here.`,
+  ].join('\n');
+}
+
 // The (source, source_ref) pair the generated task is keyed on. `source` is a
 // constant so every cascade-generated row is findable as a class; the ref pins
 // it to one rule and one originating ship.
@@ -218,7 +280,7 @@ function validateCascades(rules = CASCADES) {
 // A rule whose `when` THROWS is treated as no-match and reported in `errors`,
 // never propagated: one broken predicate must not cost the other rules their
 // tasks, and it certainly must not reach the ship.
-function cascadesFor(task, rules = CASCADES, ctx = {}) {
+function cascadesFor(task, rules = CASCADES, ctx = {}, trigger = TRIGGERS.ship) {
   const matched = [];
   const errors = [];
   if (!task || task.id == null) return { matched, errors: ['no task'] };
@@ -234,7 +296,7 @@ function cascadesFor(task, rules = CASCADES, ctx = {}) {
     }
     if (!hit) continue;
     try {
-      matched.push({ rule, spec: cascadeTaskSpec(rule, task) });
+      matched.push({ rule, spec: cascadeTaskSpec(rule, task, trigger) });
     } catch (e) {
       errors.push(`cascade "${rule.key}": title/body threw (${e && e.message})`);
     }
@@ -244,17 +306,26 @@ function cascadesFor(task, rules = CASCADES, ctx = {}) {
 
 // The createTask payload for one matched rule. The attribution preamble is
 // prepended here rather than left to each rule, so no rule can forget it.
-function cascadeTaskSpec(rule, task) {
+function cascadeTaskSpec(rule, task, trigger = TRIGGERS.ship) {
   const body = String(rule.body(task) || '').trim();
   const preamble =
-    `Filed automatically when task ${task.id} shipped — the "${rule.key}" cascade `
+    `Filed automatically when ${trigger.happened(task)} — the "${rule.key}" cascade `
     + `(modules/lifecycle/cascade.js). Nobody typed this; it is a REQUEST, filed at backlog, `
     + `and it goes through the board's ordinary triage. If the rule that made it is wrong, fix `
     + `the rule rather than only this task.`;
   return {
-    versionId: task.version_id,
+    // An idea carries a GUESS where a task carries a fact. `suggested_version` is
+    // inherited because a version is a label; `suggested_goal_id` is NOT, because
+    // its own column header forbids exactly that read — see goalId below.
+    versionId: task.version_id != null ? task.version_id : (task.suggested_version ?? null),
     // A cascade INHERITS its parent's goal — the follow-up belongs wherever the
     // work that triggered it belongs.
+    // NOT inherited from an idea's `suggested_goal_id`. That column documents
+    // itself as "Strictly advisory: no rank check, no scope wall, and no payout
+    // may read it... The BINDING home for 'which goal' is tasks.goal_id" — and a
+    // generated task's goal is binding. So an idea-triggered cascade lands in the
+    // catch-all and gets triaged like any other homeless work; the hint travels in
+    // the body instead, where a human can act on it.
     goalId: task.goal_id != null ? Number(task.goal_id) : null,
     // BV1.R11 (task 1003598): …and when the parent has none, says so. A shipped
     // task can still be goal-less — the 53 legacy catch-all rows, or any task
@@ -283,6 +354,59 @@ function cascadeTaskSpec(rule, task) {
 // The runner — the only part that touches a database
 // ---------------------------------------------------------------------------
 
+// FILE ONE SUBJECT'S MATCHES. Shared by both runners so the idempotency read,
+// the per-rule isolation and the reporting cannot drift apart between triggers —
+// the two runners differ only in how they FETCH a subject and which rule list and
+// context they bring.
+async function fileMatches({ matched, deps, report, trigger, subject }) {
+  for (const { rule, spec } of matched) {
+    try {
+      const existing = deps.findTaskBySourceRef
+        ? await deps.findTaskBySourceRef({ source: CASCADE_SOURCE, sourceRef: spec.sourceRef })
+        : null;
+      if (existing) { report.skipped.push({ key: rule.key, taskId: existing.id, reason: 'already filed' }); continue; }
+      const created = await deps.createTask(spec);
+      report.created.push({ key: rule.key, taskId: created && created.id, discipline: rule.discipline });
+      deps.log?.info?.(`[cascade] ${trigger.happened(subject)} → filed ${created && created.id} for ${rule.discipline} ("${rule.key}")`);
+    } catch (e) {
+      // One rule failing costs that rule its task and nothing else.
+      report.errors.push(`cascade "${rule.key}": ${e && e.message}`);
+    }
+  }
+}
+
+// React to one idea reaching grade 'full'. Same guarantees as the ship runner —
+// returns a report, never throws, never rejects — because an ideator grading
+// their own idea must not be able to fail on a follow-up task's account.
+//
+//   deps.getIdea(id)                 -> the full idea row (the event payload may
+//                                       carry only the id)
+//   deps.findTaskBySourceRef({...})  -> an existing row or null
+//   deps.createTask(spec)            -> the created row
+//   deps.log                         -> optional { info, error }
+async function runCascadesForIdea(graded, deps = {}) {
+  const report = { created: [], skipped: [], errors: [] };
+  try {
+    const id = graded && (graded.id ?? graded.idea_id);
+    if (id == null) { report.errors.push('cascade: idea payload carried no idea id'); return report; }
+
+    // The emitter sends the whole idea (it owns the row; this module does not),
+    // so the payload IS the subject. deps.getIdea stays supported for a caller
+    // that would rather re-read — and when one is injected and returns nothing,
+    // that is an error rather than a silent fall-back to a payload it rejected.
+    const idea = deps.getIdea ? await deps.getIdea(id) : graded;
+    if (!idea) { report.errors.push(`cascade: idea ${id} not readable after grading`); return report; }
+
+    const { matched, errors } = cascadesFor(idea, deps.rules || IDEA_CASCADES, {}, TRIGGERS.idea);
+    report.errors.push(...errors);
+    await fileMatches({ matched, deps, report, trigger: TRIGGERS.idea, subject: idea });
+  } catch (e) {
+    report.errors.push(`cascade: ${e && e.message}`);
+  }
+  if (report.errors.length) deps.log?.error?.(`[cascade] ${report.errors.length} problem(s): ${report.errors.join(' | ')}`);
+  return report;
+}
+
 // React to one shipped task. Returns a report, NEVER throws and never rejects:
 // property 1 in the header. `deps` is injected so the whole runner is testable
 // with two stubs and no database.
@@ -323,20 +447,7 @@ async function runCascadesForShip(shipped, deps = {}) {
     const { matched, errors } = cascadesFor(task, deps.rules || CASCADES, ctx);
     report.errors.push(...errors);
 
-    for (const { rule, spec } of matched) {
-      try {
-        const existing = deps.findTaskBySourceRef
-          ? await deps.findTaskBySourceRef({ source: CASCADE_SOURCE, sourceRef: spec.sourceRef })
-          : null;
-        if (existing) { report.skipped.push({ key: rule.key, taskId: existing.id, reason: 'already filed' }); continue; }
-        const created = await deps.createTask(spec);
-        report.created.push({ key: rule.key, taskId: created && created.id, discipline: rule.discipline });
-        log?.info?.(`[cascade] task ${id} shipped → filed ${created && created.id} for ${rule.discipline} ("${rule.key}")`);
-      } catch (e) {
-        // One rule failing costs that rule its task and nothing else.
-        report.errors.push(`cascade "${rule.key}": ${e && e.message}`);
-      }
-    }
+    await fileMatches({ matched, deps: { ...deps, log }, report, trigger: TRIGGERS.ship, subject: task });
   } catch (e) {
     report.errors.push(`cascade: ${e && e.message}`);
   }
@@ -346,6 +457,10 @@ async function runCascadesForShip(shipped, deps = {}) {
 
 module.exports = {
   CASCADES,
+  IDEA_CASCADES,
+  TRIGGERS,
+  fullIdeaScopingBody,
+  runCascadesForIdea,
   CASCADE_SOURCE,
   COPY_VISUAL_MODULES,
   hasCopyOrVisualWork,

package/modules/lifecycle/routes/lifecycle.js

@@ -44,12 +44,30 @@ const cascade = require('../cascade');
 // leave it. Nothing here can affect the ship: the emitters fire post-commit and
 // already wrap the emit, and `runCascadesForShip` resolves rather than throws.
 let _cascadeListenerOff = null;
+let _ideaCascadeListenerOff = null;
 
 function registerSeams() {
   if (!api.hasProvider('lifecycle')) {
     api.registerProvider('lifecycle', lifecycle);
   }
   if (_cascadeListenerOff) _cascadeListenerOff();
+  // Torn down with its sibling: the factory runs again every time a test rebuilds
+  // the router, and a leaked subscription would fire this cascade twice.
+  if (_ideaCascadeListenerOff) _ideaCascadeListenerOff();
+  // task 1003856: the second cross-role cascade. Same module, same runner
+  // guarantees, different trigger — an idea reaching Full rather than a ship.
+  _ideaCascadeListenerOff = api.on('idea.graded.full', (graded) => cascade.runCascadesForIdea(graded, {
+    // No getIdea: the ideas module owns that row and sends it whole. Injecting a
+    // reader here would mean lifecycle querying another module's table.
+    findTaskBySourceRef: (q) => db.findTaskBySourceRef(q),
+    createTask: (spec) => db.createTask(spec),
+    // INVOKED, like its sibling below. api.logger is a FACTORY (api.logger(ns)),
+    // so passing it bare left every log?.info?.() call resolving to undefined and
+    // silently doing nothing — the optional chaining that makes the runner safe is
+    // also what hid this.
+    log: api.logger ? api.logger('lifecycle') : null,
+  }));
+
   _cascadeListenerOff = api.on('task.shipped', (shipped) => cascade.runCascadesForShip(shipped, {
     getTask: (id) => db.getTask(id),
     findTaskBySourceRef: (ref) => db.findTaskBySourceRef(ref),

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.814",
+  "version": "1.19.815",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.19.814",
+      "version": "1.19.815",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.814",
+  "version": "1.19.815",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/src/module-api.js

@@ -71,7 +71,7 @@ const { responsibilityFor, ROLE_RESPONSIBILITIES } = require('./role-responsibil
 // there. scripts/gds/bump-version.js still rewrites the literal below; it appends
 // the entry to that file. Look for a version's history there, not here.
 // ---------------------------------------------------------------------------
-const CORE_VERSION = '1.19.814'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
+const CORE_VERSION = '1.19.815'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('dev-box'); log.info('mounted');

package/tests/agents_validate.mjs

@@ -11,6 +11,9 @@
 //
 // Run:  node tests/agents_validate.mjs
 
+import fs from 'node:fs';
+import path from 'node:path';
+import { fileURLToPath } from 'node:url';
 import { strict as assert } from 'node:assert';
 import { createRequire } from 'node:module';
 
@@ -73,9 +76,37 @@ await test('a failed validation returns NO value — nothing downstream can inse
 
 // --- THE EVENT CATALOG — the fail-closed rule -------------------------------
 
-await test('EVENT_CATALOG is exactly the v1 wired set, and is frozen', () => {
-  assert.deepEqual(EVENT_CATALOG, ['task.shipped']);
+await test('EVENT_CATALOG is frozen, and every entry is REALLY dispatched', () => {
   assert.equal(Object.isFrozen(EVENT_CATALOG), true, 'a caller must not be able to widen the catalog at runtime');
+  assert.ok(EVENT_CATALOG.includes('task.shipped'), 'the original wired event stays wired');
+
+  // The catalog's own comment is the rule: widening it "must land together with
+  // something that actually dispatches the new event". Pinned as that rule rather
+  // than as a frozen list, because a list cannot tell a legitimate widening from
+  // one that ships an entry nothing emits — and the second produces an agent that
+  // looks armed and never fires, which is the failure the catalog exists to stop.
+  const ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
+  const files = [];
+  const walk = (dir) => {
+    let ents = [];
+    try { ents = fs.readdirSync(dir, { withFileTypes: true }); } catch { return; }
+    for (const e of ents) {
+      const full = path.join(dir, e.name);
+      if (e.isDirectory()) { if (e.name !== 'node_modules') walk(full); continue; }
+      if (e.name.endsWith('.js')) files.push(full);
+    }
+  };
+  for (const d of ['src', 'modules']) walk(path.join(ROOT, d));
+  const tree = files.map((f) => fs.readFileSync(f, 'utf8')).join('\n');
+
+  for (const event of EVENT_CATALOG) {
+    // Any quote style, emit or emitAsync. A plain substring scan rather than a
+    // built regex: the thing being asserted is "somebody emits this string".
+    const dispatched = ['emit(', 'emitAsync('].some((call) =>
+      [String.fromCharCode(39), '"', String.fromCharCode(96)].some((q) => tree.includes(call + q + event + q)));
+    assert.ok(dispatched,
+      `"${event}" is in the catalog but nothing in src/ or modules/ emits it — an agent armed on it would never fire`);
+  }
 });
 
 await test('an UNWIRED event name is REFUSED, never silently accepted', () => {

package/tests/discord_channels.mjs

@@ -24,6 +24,9 @@
 // Run:  node tests/discord_channels.mjs
 
 import { strict as assert } from 'node:assert';
+import fs from 'node:fs';
+import path from 'node:path';
+import os from 'node:os';
 import { createRequire } from 'node:module';
 const require = createRequire(import.meta.url);
 const ch = require('../modules/discord/discord-channels.js');
@@ -365,5 +368,168 @@ await t('the real config plans cleanly against an empty guild and never deletes'
   assert.ok(!ops.some((o) => String(o.op).startsWith('delete')), 'reconcile must never delete');
 });
 
+// ---- seeding channels.json from a live guild (task 1003841) ----------------
+//
+// WHY THESE EXIST. Seeding hangs on one subtle rule, and I read it wrong the
+// first time: an omitted `view` has TWO possible causes that look identical in
+// the config, and only one of them is a problem.
+//
+//   • the channel's view EQUALS its category's  -> omitted, NO warning  (fine)
+//   • the channel has no managed VIEW overwrite -> omitted, WITH a warning
+//
+// configFromSnapshot emits `view` only when it differs from the parent, because
+// the planner reads `ch.view || cat.view` and repeating the value is noise that
+// drifts later. So "the field is missing" is NOT evidence that a channel is
+// unmanaged — the WARNING is. These pin that distinction, because acting on the
+// wrong one means writing view values into the file that the module deliberately
+// omits, which is a diff against the guild rather than a record of it.
+
+const V_ALLOW = String(ch.VIEW_CHANNEL);
+const allowEveryone = [{ id: EVERYONE, type: 0, allow: V_ALLOW, deny: '0' }];
+const publicCat = (catOverwrites, chOverwrites) => ({
+  categories: [{ id: 'CAT_PUB', name: 'PUBLIC', overwrites: catOverwrites }],
+  channels: [{ id: 'CH_NEWS', type: 0, name: '📯-ship-news', parentId: 'CAT_PUB', topic: 'Ships land here.', overwrites: chOverwrites }],
+});
+
+await t('an omitted view means INHERITS when the channel matches its category — and warns nothing (task 1003841)', () => {
+  const { config, warnings } = ch.configFromSnapshot(publicCat(allowEveryone, allowEveryone), CTX);
+  const news = config.categories[0].channels[0];
+  assert.equal(news.view, undefined, 'a view identical to the category is deliberately omitted');
+  assert.deepEqual(warnings, [], 'and nothing is wrong, so nothing is warned about');
+});
+
+await t('an omitted view means UNMANAGED when the channel has no overwrite — and that WARNS (task 1003841)', () => {
+  // The distinguishing signal. Same missing field, different meaning.
+  const { config, warnings } = ch.configFromSnapshot(publicCat(allowEveryone, []), CTX);
+  assert.equal(config.categories[0].channels[0].view, undefined, 'also omitted — the config alone cannot tell them apart');
+  assert.equal(warnings.length, 1, 'but the warning does');
+  assert.match(warnings[0], /no VIEW overwrite/);
+});
+
+await t('the seeded file round-trips to ZERO ops for every channel that exists (task 1003841)', () => {
+  // The done-when, demonstrated rather than argued. Feeding the snapshot-derived
+  // config back against the same guild must plan to nothing — that is the whole
+  // correctness property of configFromSnapshot, and it is what makes committing
+  // the snapshot safe: applying it cannot edit a live channel.
+  const guild = publicCat(allowEveryone, allowEveryone);
+  const { config } = ch.configFromSnapshot(guild, CTX);
+  assert.deepEqual(ch.planChannelReconcile(guild, config, CTX).ops, [], 'a faithful snapshot is a no-op plan');
+});
+
+await t('writing view:everyone where the snapshot omitted it would ADD an op — which is why it is not written (task 1003841)', () => {
+  // The mistake this file avoids. Spelling out a value identical to the category
+  // is harmless to READ, but it is not what the module emits, and on a channel
+  // that genuinely lacks an overwrite it turns a record into an edit of the live
+  // guild. Pinned so nobody "tidies" the omitted fields back in.
+  const guild = publicCat(allowEveryone, []);
+  const spelled = {
+    categories: [{
+      name: 'PUBLIC', view: 'everyone',
+      channels: [{ key: 'ship-news', name: '📯-ship-news', view: 'everyone', topic: 'Ships land here.' }],
+    }],
+  };
+  const { ops } = ch.planChannelReconcile(guild, spelled, CTX);
+  assert.ok(ops.some((o) => o.op === 'edit-channel'), 'it edits the live channel');
+});
+
+await t('the committed file is the guild, plus board-room (task 1003841)', () => {
+  const cfg = ch.loadConfig();
+  const keys = cfg.categories.flatMap((c) => c.channels.map((x) => x.key));
+  assert.ok(keys.length >= 15, `expected the seeded guild, got ${keys.length} channels`);
+  assert.ok(keys.includes('board-room'), 'board-room stays declared — the bot never deletes');
+  for (const cat of cfg.categories) {
+    assert.ok(cat.view, `category ${cat.name} needs a view`);
+    for (const c of cat.channels) assert.ok(c.key && c.name, 'every channel carries its key and real name');
+  }
+  // The four PUBLIC channels inherit deliberately; asserting they have no view
+  // is what stops a later edit from spelling them out and creating a diff.
+  const pub = cfg.categories.find((c) => c.name === 'PUBLIC');
+  assert.equal(pub.view, 'everyone');
+  for (const c of pub.channels) assert.equal(c.view, undefined, `${c.key} must inherit, not repeat, its category view`);
+});
+
+// ---- the config path on a DEPLOYED instance (task 1003973) ---------------
+//
+// channels.json describes ONE guild, so it is instance identity and is NOT
+// published in the neutral core (ADR 0062 §7). The module used to resolve it
+// against its OWN directory, which on a deployed instance is
+// node_modules/@bongos/core/modules/discord/ — the file is not there, readFileSync
+// threw ENOENT, computePlan() threw, and the route returned a bare 500 that was
+// indistinguishable from a bot outage. These pin both halves of the fix.
+
+await t('resolveConfigPath prefers the INSTANCE root over the core package', () => {
+  // Point the instance root somewhere that is NOT the core checkout and give it
+  // its own channels.json. If resolution still lands on the core copy, a deployed
+  // instance would read cloudbongos.com's channel names — the thing ADR 0062 §7
+  // forbids — so this must fail loudly rather than pass because the two roots
+  // happen to coincide in a single checkout.
+  const root = fs.mkdtempSync(path.join(os.tmpdir(), 'bongos-inst-1003973-'));
+  const own = path.join(root, 'docs', 'discord', 'channels.json');
+  fs.mkdirSync(path.dirname(own), { recursive: true });
+  fs.writeFileSync(own, JSON.stringify({ categories: [{ name: 'X', channels: [] }] }));
+  const prev = process.env.BONGOS_INSTANCE_ROOT;
+  process.env.BONGOS_INSTANCE_ROOT = root;
+  try {
+    assert.equal(ch.resolveConfigPath(), own,
+      'a deployed instance must read its OWN docs/discord/channels.json, not the core package copy');
+    assert.notEqual(ch.resolveConfigPath(), ch.CORE_CONFIG_PATH);
+    assert.deepEqual(ch.loadConfig().categories.map((c) => c.name), ['X'],
+      'loadConfig must follow the same resolution, not a stale module-scope constant');
+  } finally {
+    if (prev === undefined) delete process.env.BONGOS_INSTANCE_ROOT;
+    else process.env.BONGOS_INSTANCE_ROOT = prev;
+    fs.rmSync(root, { recursive: true, force: true });
+  }
+  // and with no pointer set, a single checkout still resolves to the repo file
+  assert.ok(fs.existsSync(ch.resolveConfigPath()), 'the single-checkout path must still resolve');
+});
+
+await t('loadConfig on a missing file throws a TAGGED error naming the path', () => {
+  const missing = path.join(os.tmpdir(), 'bongos-no-such-channels-1003973.json');
+  assert.throws(() => ch.loadConfig(missing), (err) => {
+    assert.equal(err.code, 'CONFIG_NOT_FOUND', 'ENOENT must be tagged, not left as a raw fs error');
+    assert.equal(err.configPath, missing);
+    assert.ok(err.message.includes(missing), 'the message must name the path the operator should fix');
+    return true;
+  });
+});
+
+await t('computePlan with no config returns {ok:false, no_config} instead of throwing', () => {
+  const missing = path.join(os.tmpdir(), 'bongos-no-such-channels-1003973.json');
+  const deps = {
+    getGuild: () => ({ id: '1', channels: { cache: new Map() } }),
+    loadConfig: () => ch.loadConfig(missing),
+    loadRoleMap: () => ({}),
+  };
+  const r = ch.computePlan(deps);
+  assert.equal(r.ok, false);
+  assert.equal(r.reason, 'no_config', 'a missing layout file must be its own reason, never a thrown 500');
+  assert.equal(r.configPath, missing, 'the caller needs the path to report it');
+  assert.deepEqual(r.ops, []);
+});
+
+await t('reconcileChannels with no config returns {ok:false, no_config} and writes nothing', async () => {
+  const missing = path.join(os.tmpdir(), 'bongos-no-such-channels-1003973.json');
+  const deps = {
+    getGuild: () => ({ id: '1', channels: { cache: new Map() } }),
+    loadBotToken: () => 'tok',
+    loadConfig: () => ch.loadConfig(missing),
+    loadRoleMap: () => ({}),
+  };
+  const r = await ch.reconcileChannels(deps);
+  assert.equal(r.ok, false);
+  assert.equal(r.reason, 'no_config');
+  assert.equal(r.applied, 0);
+});
+
+await t('a non-ENOENT read failure still propagates — only ENOENT is tagged', () => {
+  // A directory reads as EISDIR: a genuine internal error must NOT be laundered
+  // into the friendly 'put the file here' path.
+  assert.throws(() => ch.loadConfig(os.tmpdir()), (err) => {
+    assert.notEqual(err.code, 'CONFIG_NOT_FOUND');
+    return true;
+  });
+});
+
 console.log(`\n${passed} passed, ${failed} failed`);
 process.exit(failed ? 1 : 0);

package/tests/idea_cascade.mjs

@@ -0,0 +1,211 @@
+// tests/idea_cascade.mjs — the SECOND cross-role cascade: an ideator lands a Full
+// Idea, an engineer gets a scoping task (task 1003856, part 1's residue).
+//
+// The first cascade (artist-review-on-ship, task 1003549) is covered by
+// modules/lifecycle/tests/cascade.mjs. This file covers what the second one added:
+// a trigger that is not a ship. The mechanism was ship-only, and an idea reaching
+// grade 'full' emitted nothing at all — so the rule could not be a table entry.
+//
+// The runner guarantees are the same four the ship runner's header names, and the
+// one that matters most here is the first: an ideator grading their own idea must
+// never be able to fail on a follow-up task's account.
+import assert from 'node:assert/strict';
+import test from 'node:test';
+import fs from 'node:fs';
+import path from 'node:path';
+import { createRequire } from 'node:module';
+import { fileURLToPath } from 'node:url';
+
+const require = createRequire(import.meta.url);
+const ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
+const C = require(path.join(ROOT, 'modules', 'lifecycle', 'cascade.js'));
+
+const idea = (over = {}) => ({
+  id: '1001030',
+  title: 'Price swaps from mechanism',
+  grade: 'full',
+  status: 'open',
+  completeness_score: 4,
+  captured_by: '1000025',
+  suggested_goal_id: '1000095',
+  suggested_version: 'BONGOS-V2',
+  ...over,
+});
+
+const deps = (over = {}) => {
+  const created = [];
+  return {
+    created,
+    findTaskBySourceRef: async () => null,
+    createTask: async (spec) => { created.push(spec); return { id: '9001' }; },
+    ...over,
+  };
+};
+
+// ---------- the rule ----------
+test('the declaration is well-formed — a malformed rule is a wiring bug, not a silent skip', () => {
+  assert.deepEqual(C.validateCascades(C.IDEA_CASCADES), []);
+});
+
+test('a Full Idea matches, and files for the ENGINEER', () => {
+  const { matched, errors } = C.cascadesFor(idea(), C.IDEA_CASCADES, {}, C.TRIGGERS.idea);
+  assert.deepEqual(errors, []);
+  assert.equal(matched.length, 1);
+  assert.equal(matched[0].rule.discipline, 'engineer');
+  assert.match(matched[0].spec.title, /Scope the Full Idea: Price swaps from mechanism/);
+});
+
+test('a spark or quick idea does NOT match — Full is the hand-off point', () => {
+  for (const grade of ['quick', 'spark', undefined]) {
+    const { matched } = C.cascadesFor(idea({ grade }), C.IDEA_CASCADES, {}, C.TRIGGERS.idea);
+    assert.equal(matched.length, 0, `grade=${grade} should not file a scoping task`);
+  }
+});
+
+test('a CLOSED idea does not file — triage got there first', () => {
+  for (const status of ['discarded', 'merged', 'promoted']) {
+    const { matched } = C.cascadesFor(idea({ status }), C.IDEA_CASCADES, {}, C.TRIGGERS.idea);
+    assert.equal(matched.length, 0, `status=${status} should not file`);
+  }
+});
+
+test('a cascade-sourced idea cannot file another cascade — the anti-recursion guard', () => {
+  const { matched } = C.cascadesFor(idea({ source: C.CASCADE_SOURCE }), C.IDEA_CASCADES, {}, C.TRIGGERS.idea);
+  assert.equal(matched.length, 0);
+});
+
+// ---------- the generated task ----------
+test('the task inherits the version but NEVER the advisory goal hint', () => {
+  // idea_inbox.suggested_goal_id documents itself as "Strictly advisory: no rank
+  // check, no scope wall, and no payout may read it... The BINDING home for
+  // 'which goal' is tasks.goal_id". A generated task's goal IS binding, so
+  // inheriting it from the hint would be exactly the read that column forbids.
+  // A version is a label and carries no such rule.
+  const { matched } = C.cascadesFor(idea(), C.IDEA_CASCADES, {}, C.TRIGGERS.idea);
+  const spec = matched[0].spec;
+  assert.equal(spec.versionId, 'BONGOS-V2');
+  assert.equal(spec.goalId, null, 'an advisory hint must not place a task');
+  assert.equal(spec.allowCatchAll, true, 'so it lands in the catch-all and gets triaged like any other homeless work');
+});
+
+test('the hint is surfaced for a human rather than silently dropped', () => {
+  // Not acting on it is the rule; losing it would be a different mistake.
+  const body = C.fullIdeaScopingBody(idea());
+  assert.match(body, /routing hint/);
+  assert.match(body, /goal 1000095/);
+  assert.match(body, /advisory/);
+});
+
+test('an idea with no hint says nothing about goals at all', () => {
+  const body = C.fullIdeaScopingBody(idea({ suggested_goal_id: null }));
+  assert.doesNotMatch(body, /routing hint/);
+});
+
+test('a goal-less idea still opts into the catch-all rather than vanishing', () => {
+  // The exact regression task 1003598 closed for ships: under the goal guard a
+  // null goalId THROWS, and the throw is caught per-rule — so the task would
+  // disappear with only a console line.
+  const { matched } = C.cascadesFor(idea({ suggested_goal_id: null }), C.IDEA_CASCADES, {}, C.TRIGGERS.idea);
+  assert.equal(matched[0].spec.allowCatchAll, true);
+});
+
+test('the preamble says what actually happened — an idea was graded, not a task shipped', () => {
+  const { matched } = C.cascadesFor(idea(), C.IDEA_CASCADES, {}, C.TRIGGERS.idea);
+  const d = matched[0].spec.description;
+  assert.match(d, /idea 1001030 was graded Full/);
+  assert.doesNotMatch(d, /shipped/, 'the ship preamble would be a lie on this trigger');
+});
+
+test('the body tells the engineer what is already settled and what is being asked', () => {
+  const body = C.fullIdeaScopingBody(idea());
+  assert.match(body, /reached \*\*Full\*\*/);
+  assert.match(body, /completeness 4/);
+  assert.match(body, /What would building it actually touch/);
+  // A scoping that concludes "don't build it" is a real answer; say so.
+  assert.match(body, /why it should not be built/);
+});
+
+test('the source_ref pins one rule to one idea, so a re-grade cannot double-file', () => {
+  const { matched } = C.cascadesFor(idea(), C.IDEA_CASCADES, {}, C.TRIGGERS.idea);
+  assert.equal(matched[0].spec.sourceRef, C.cascadeSourceRef('engineer-scoping-on-full-idea', '1001030'));
+  assert.equal(matched[0].spec.source, C.CASCADE_SOURCE);
+});
+
+// ---------- the runner ----------
+test('the runner files the task from the event payload alone', async () => {
+  const d = deps();
+  const report = await C.runCascadesForIdea(idea(), d);
+  assert.deepEqual(report.errors, []);
+  assert.equal(report.created.length, 1);
+  assert.equal(d.created.length, 1);
+  assert.equal(d.created[0].discipline, 'engineer');
+});
+
+test('an already-filed cascade is SKIPPED, not filed twice', async () => {
+  const d = deps({ findTaskBySourceRef: async () => ({ id: '8001' }) });
+  const report = await C.runCascadesForIdea(idea(), d);
+  assert.equal(report.created.length, 0);
+  assert.deepEqual(report.skipped.map((s) => s.reason), ['already filed']);
+  assert.equal(d.created.length, 0);
+});
+
+test('a payload with no id is reported, never thrown', async () => {
+  const report = await C.runCascadesForIdea({}, deps());
+  assert.equal(report.created.length, 0);
+  assert.match(report.errors.join(' '), /carried no idea id/);
+});
+
+test('createTask throwing costs that rule its task and NOTHING else', async () => {
+  // Property 1: the ideator's grade is already written. A follow-up task failing
+  // must never surface as a failure of the thing that triggered it.
+  const d = deps({ createTask: async () => { throw new Error('db down'); } });
+  const report = await C.runCascadesForIdea(idea(), d);
+  assert.equal(report.created.length, 0);
+  assert.match(report.errors.join(' '), /db down/);
+});
+
+test('the runner never rejects, whatever the deps do', async () => {
+  const report = await C.runCascadesForIdea(idea(), { findTaskBySourceRef: async () => { throw new Error('boom'); }, createTask: async () => ({ id: '1' }) });
+  assert.ok(Array.isArray(report.errors) && report.errors.length > 0);
+});
+
+test('an injected reader that finds nothing is an error, not a silent fall-back', async () => {
+  const report = await C.runCascadesForIdea(idea(), deps({ getIdea: async () => null }));
+  assert.match(report.errors.join(' '), /not readable after grading/);
+  assert.equal(report.created.length, 0);
+});
+
+// ---------- the wiring, which fails silently when it breaks ----------
+const src = (rel) => fs.readFileSync(path.join(ROOT, rel), 'utf8');
+
+test('the event is in the catalog AND something dispatches it', () => {
+  // The catalog's own comment: widening it is deliberate and must land together
+  // with a real dispatcher. Both halves asserted, because either alone is dead.
+  assert.match(src('modules/agents/lib/validate.js'), /'idea\.graded\.full'/);
+  assert.match(src('modules/ideas/inbox.js'), /api\.emit\('idea\.graded\.full'/);
+});
+
+test('the emit carries the whole idea, not just an id', () => {
+  // The listener lives in lifecycle, which owns no idea table and has no read
+  // port for one — so a bare {id} payload would leave the rules nothing to match.
+  const inbox = src('modules/ideas/inbox.js');
+  assert.match(inbox, /const idea = await getIdea\(ideaId\)/);
+  assert.match(inbox, /\.\.\.\(idea \|\| \{\}\)/);
+});
+
+test('lifecycle subscribes to the idea trigger and tears it down again', () => {
+  const lc = src('modules/lifecycle/routes/lifecycle.js');
+  assert.match(lc, /api\.on\('idea\.graded\.full'/);
+  assert.match(lc, /if \(_ideaCascadeListenerOff\) _ideaCascadeListenerOff\(\)/);
+  // It must NOT reach into the ideas module's table to do it.
+  assert.doesNotMatch(lc, /getIdeaForCascade/, 'lifecycle must not query another module\'s rows');
+});
+
+test('the emit only fires on a REAL transition', () => {
+  // The UPDATE carries `AND grade = 'spark'`, so a no-op re-grade returns null.
+  // The emit is inside `if (graded)`, so it cannot repeat for one idea.
+  const inbox = src('modules/ideas/inbox.js');
+  const at = inbox.indexOf("api.emit('idea.graded.full'");
+  assert.ok(at > 0);
+  assert.match(inbox.slice(0, at).split('\n').slice(-25).join('\n'), /if \(graded\) \{/);
+});

package/tests/task_goal_required.mjs

@@ -134,11 +134,23 @@ test('cascade opts in ONLY when inheritance actually failed', () => {
   // general. A blanket `true` here would quietly re-open the hole for every
   // follow-up task the system files.
   const body = src('modules/lifecycle/cascade.js');
-  assert.match(body, /allowCatchAll: task\.goal_id == null,/);
+  // Pinned on the RULE, not on one spelling of it: task 1003856 added an
+  // idea-triggered cascade whose subject carries its goal as `suggested_goal_id`,
+  // so the condition legitimately grew a term. What must stay true is that the
+  // hatch is conditional and covers every source the spec can inherit from.
+  const hatch = (body.match(/allowCatchAll:.*$/m) || [''])[0];
+  assert.match(hatch, /task\.goal_id == null/, 'the hatch still turns on a missing inherited goal');
   assert.equal(/allowCatchAll: true/.test(body), false,
     'an unconditional hatch here would cover every cascade, not just the legacy ones');
-  assert.match(body, /goalId: task\.goal_id != null \? Number\(task\.goal_id\) : null,/,
-    'inheritance stays the primary path');
+
+  // Every field the spec inherits a goal FROM must also be a field the hatch
+  // checks, or a subject shape could arrive with a real goal and still opt into
+  // the catch-all — the hole this test exists to keep shut.
+  const goalLine = (body.match(/^\s*goalId:[\s\S]*?,$/m) || [''])[0];
+  assert.match(goalLine, /task\.goal_id != null \? Number\(task\.goal_id\)/, 'inheritance stays the primary path');
+  for (const field of (goalLine.match(/task\.[a-z_]*goal[a-z_]*/g) || [])) {
+    assert.ok(hatch.includes(field), `${field} is inherited as a goal but is not checked by the catch-all hatch`);
+  }
 });
 
 test('a goal-less parent does not silently lose its cascade task', async () => {