@bongos/core 1.19.841 → 1.19.843

package/.bongos-core.json

@@ -2,22 +2,22 @@
   "artifact": "bongos-core",
   "manifest_schema": 1,
   "generator": "scripts/gds/package-core.js",
-  "core_version": "1.19.841",
-  "core_contract": "1.19.841",
-  "source_commit": "fd701dc457a5344486573c53ca1f4efcc1948007",
+  "core_version": "1.19.843",
+  "core_contract": "1.19.843",
+  "source_commit": "7c57c44f66a63fda88681f46ac67857f8c8ed1e7",
   "source_ref": "HEAD",
-  "built_at": "2026-09-17T18:13:18.546Z",
+  "built_at": "2026-09-17T18:30:58.977Z",
   "redaction": {
     "model": "docs-redacted+functional-verbatim",
     "docs_redacted": 495,
     "agent_docs_stubbed": 26,
-    "functional_verbatim": 2265,
+    "functional_verbatim": 2270,
     "rules": 3,
     "gate_literals": 3,
     "gate": "passed"
   },
-  "file_count": 2786,
-  "tree_sha256": "a54472eaf1c55f1c7f905fb6fd2712a9ab44e8e9f3a731ffba11037c3d9f5b69",
+  "file_count": 2791,
+  "tree_sha256": "9f6bfba9532caa1edab6600efaf86e006add511e45378f5cf2ccf8ad81d81231",
   "files": [
     {
       "path": ".claude/skills/ask-for-help/SKILL.md",
@@ -2577,7 +2577,7 @@
     {
       "path": "docs/module-api-changelog.md",
       "mode": "0000644",
-      "sha256": "79b20e6155f002dd63671b994cbbb8e2f269c3634cd213b5695c0de8bb031cc7"
+      "sha256": "e2083366af3229b576d6d034f1d2e1c6e7e4fa61fba384ba0d0fca9b7911087f"
     },
     {
       "path": "docs/modules-contract.md",
@@ -3679,6 +3679,11 @@
       "mode": "0000644",
       "sha256": "0481e0b8205c707ed002f404c801d3f2059b2b0e0fcfa9bc436968f6665a296f"
     },
+    {
+      "path": "migrations/core_247_discipline_required.sql",
+      "mode": "0000644",
+      "sha256": "e8d3e3f764b61ea559df7f997758e639f8778ee24da4293908e9d45ca30a425b"
+    },
     {
       "path": "modules/agents/CLAUDE.md",
       "mode": "0000644",
@@ -3882,7 +3887,7 @@
     {
       "path": "modules/copy-desk/routes/copy-desk.js",
       "mode": "0000644",
-      "sha256": "63ed245f47d15758ef0926a489ad1fc7ef56d8539e836ed9e319e09b99a4a38e"
+      "sha256": "4839f077aee504947a3bada77fd9c3df882f9005f571ed2e2367b615c111b76b"
     },
     {
       "path": "modules/copy-desk/tests/copy_flags.mjs",
@@ -5477,7 +5482,7 @@
     {
       "path": "modules/ideas/inbox.js",
       "mode": "0000644",
-      "sha256": "683e2234893c9814c2ecec490099c140e273e764e993707bb1cc4c5c9d1baed3"
+      "sha256": "ff6c0346215d1b88309c4c9360cd60c59299b21b45e27cce09c4b748bf3411e1"
     },
     {
       "path": "modules/ideas/migrations/ideas_001_grades.sql",
@@ -5657,7 +5662,7 @@
     {
       "path": "modules/lifecycle/db-tasks.js",
       "mode": "0000644",
-      "sha256": "87b075187493e8026f99912dceb7195d09564bfe3f969f344141661c60ef6558"
+      "sha256": "5d17541d837a06903be832814a74218c9fee8b9119dd870c88273743be5a5efa"
     },
     {
       "path": "modules/lifecycle/db-versions.js",
@@ -5752,7 +5757,7 @@
     {
       "path": "modules/lifecycle/lifecycle.js",
       "mode": "0000644",
-      "sha256": "bdc23f748853a4a39ae416f731052bd29e4fe5788684cb83a166243d9240a364"
+      "sha256": "41ef55efff7f334ee8b19490f03944ca25f22454c718dfb81445539bc6a77aa4"
     },
     {
       "path": "modules/lifecycle/merge-lock.js",
@@ -5877,7 +5882,7 @@
     {
       "path": "modules/lifecycle/routes/goals.js",
       "mode": "0000644",
-      "sha256": "eb3137c30f6471aa0900f98f0fa45752808609e4e1e99f9ecb1f6df0d3e7c5ab"
+      "sha256": "17f7c0ccfc87eec24c662bf8d5599223562e773430802cd054b27a3ddadab46e"
     },
     {
       "path": "modules/lifecycle/routes/help-requests.js",
@@ -5922,7 +5927,7 @@
     {
       "path": "modules/lifecycle/routes/task-write-routes.js",
       "mode": "0000644",
-      "sha256": "9cff3bcd27467dc413aa975cd20262b47e8595a50a845d93b557a24828719bbf"
+      "sha256": "bb172485d8d5f84d96cdb611b0d57cd5f69ee768bdceddeb1eea42dc3f5676c1"
     },
     {
       "path": "modules/lifecycle/routes/tasks.js",
@@ -5962,7 +5967,7 @@
     {
       "path": "modules/lifecycle/task-classifier.js",
       "mode": "0000644",
-      "sha256": "9299590b71b194087174ff0212dc70f5f28fbafd5678923c81a3db13c6b78db5"
+      "sha256": "39047afd6440d589cee978887ce4b5fa285b00d55ed2b023546fce41e59bdc9c"
     },
     {
       "path": "modules/lifecycle/task-list-limits.js",
@@ -7892,12 +7897,12 @@
     {
       "path": "package-lock.json",
       "mode": "0000644",
-      "sha256": "d507a842a2ad14e85f0e5564998ab1288afad232febc358f932736b51fd12bd7"
+      "sha256": "090497aae4ab83f6ab3f821417ece5fcc50b86a09e026b3e4644aa660333d191"
     },
     {
       "path": "package.json",
       "mode": "0000644",
-      "sha256": "81e581275d29c80dc0c2496d83b2a5317da29e43d65aabf7a49309aed72b1003"
+      "sha256": "e7d47a1c39751137250a2cc087fb288d3c349b44d8faebc38f70e841f6475560"
     },
     {
       "path": "public-docs/index.html",
@@ -8064,6 +8069,11 @@
       "mode": "0000644",
       "sha256": "9c03bf914c4a1a6f5d9936bb5542a4e3952873de65b0518254808bfbd1901b40"
     },
+    {
+      "path": "scripts/gds/backfill-disciplines.js",
+      "mode": "0000644",
+      "sha256": "cc9bd2d437e6a7d6eb2b48504cc7d7c44a674403a0d00625a0526719825f88d2"
+    },
     {
       "path": "scripts/gds/backfill-session-earnings.js",
       "mode": "0000644",
@@ -8432,7 +8442,7 @@
     {
       "path": "scripts/gds/fitness-ratchets.js",
       "mode": "0000644",
-      "sha256": "b3f4092fffd30e50cb145b524beeed5d483132f52e77e37a7ab9c18bbf300bc7"
+      "sha256": "178d2cfb91c97c107d60cc3895ba1b3eff74c45d383646e7a64621d018c21b47"
     },
     {
       "path": "scripts/gds/fitness.js",
@@ -8577,7 +8587,7 @@
     {
       "path": "scripts/gds/init.js",
       "mode": "0000644",
-      "sha256": "9f0b3c283caf637ff6e3b514a417ae3e42572b323a14c83cd89beda270c49c37"
+      "sha256": "e1fbe45a7619cd5000b5bb34c80bbd63c2591dcc78a64188870847e5da049448"
     },
     {
       "path": "scripts/gds/install-git-hooks.js",
@@ -9367,7 +9377,7 @@
     {
       "path": "scripts/gds/triage.js",
       "mode": "0000644",
-      "sha256": "de0673313c1eb5e052f993138cd2d5686f9c1de1f9acd00f8a5fca73ed361db2"
+      "sha256": "a4af12591b829f9b89a5768858e8a2ba02a44d7e7ebd848e945e77f95fc55da7"
     },
     {
       "path": "scripts/gds/turn-end-sound.js",
@@ -9827,7 +9837,7 @@
     {
       "path": "src/module-api.js",
       "mode": "0000644",
-      "sha256": "d01a900eabeae11f0d03aa7aff1ea89af23f58a3e01c07fc79a4e4ea8b68f4a4"
+      "sha256": "a24a8e5c67584fff7c871ad60afaa3bc9f81a2c77189629597dd4fd63cd43c31"
     },
     {
       "path": "src/module-loader/catalog.js",
@@ -9969,6 +9979,11 @@
       "mode": "0000644",
       "sha256": "919ca0ea3fe5f78a194781f6b634b9da23212073cf0c7cbe8ae36a65cc3fecdb"
     },
+    {
+      "path": "tests/agents_roster.mjs",
+      "mode": "0000644",
+      "sha256": "acc25f4d72cb22719d6977f939b41f9f17e0d102880976699b6ebcda1c64c523"
+    },
     {
       "path": "tests/agents_routes.mjs",
       "mode": "0000644",
@@ -11984,6 +11999,11 @@
       "mode": "0000644",
       "sha256": "416d413757a13fbddb5841ea8a2c503077d7e6067bc1c58ce1f4d416b8d8487f"
     },
+    {
+      "path": "tests/knip_ratchet_ambient.mjs",
+      "mode": "0000644",
+      "sha256": "b48d7f46c4518ef7da8e252d8009edd25ec5771f7be320f889f437762af72b54"
+    },
     {
       "path": "tests/known_failing_ratchet.mjs",
       "mode": "0000644",
@@ -12857,7 +12877,7 @@
     {
       "path": "tests/rank_floor_wiring.mjs",
       "mode": "0000644",
-      "sha256": "f81f559b5428497b2246580c7921ecd1ba5a2f1034cf29eb5e5c21b04675f216"
+      "sha256": "973fc0768bd52f3e25c98306c21cc6a9c6268daae033e1329c68620a847bc0a9"
     },
     {
       "path": "tests/rank_gate.mjs",
@@ -12967,7 +12987,7 @@
     {
       "path": "tests/reward_gate.mjs",
       "mode": "0000644",
-      "sha256": "1ed242c879472dd872c1327c8e7c91de61886dcb108ece3fa455ae6be4b4e025"
+      "sha256": "0cd9f335da162c3562c099a2dbe4375b009f5a8a8321f4ef84b7a577be816bdc"
     },
     {
       "path": "tests/reward_mode_cost_plus_only.mjs",
@@ -13614,6 +13634,11 @@
       "mode": "0000644",
       "sha256": "0bc0d93696b5ce80fb4307b7991bff640316e46fd6fcdebf0ba5a62397ffbe8f"
     },
+    {
+      "path": "tests/task_discipline_required.mjs",
+      "mode": "0000644",
+      "sha256": "2fda6816614259699227a21f97b81d816f20fdd654c861e24a282c1d178ddff4"
+    },
     {
       "path": "tests/task_field_bounds_match_db.mjs",
       "mode": "0000644",
@@ -13632,7 +13657,7 @@
     {
       "path": "tests/task_goal_required.mjs",
       "mode": "0000644",
-      "sha256": "04e7a36f7c2f5a94f847fcb4b77f017f6399fc96041cdaee1123c9a6fecb3d5d"
+      "sha256": "073581d9a97095666ee2ed7ebb0a6b280f3e8ea1efc53015c2f77eb5d08c4975"
     },
     {
       "path": "tests/task_lib.mjs",

package/docs/module-api-changelog.md

@@ -2156,5 +2156,9 @@ is load-bearing: the script throws rather than guess if it is missing, and
         landed since 1.19.839 with no explicit bump. run 35254616836. (task 1002620)
   1.19.841 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
         landed since 1.19.840 with no explicit bump. run 35257419225. (task 1002620)
+  1.19.842 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+        landed since 1.19.841 with no explicit bump. run 35258288930. (task 1002620)
+  1.19.843 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+        landed since 1.19.842 with no explicit bump. run 35259228465. (task 1002620)
 ---------------------------------------------------------------------------
 ```

package/migrations/core_247_discipline_required.sql

@@ -0,0 +1,58 @@
+-- core_247_discipline_required.sql — task 1002988: every task row carries a craft.
+--
+-- `unclassified` is a triage state, not a craft. It was the DEFAULT on every create
+-- vector, so it accumulated: 1,189 rows on this instance as of 2026-09-17 (1,025
+-- real + 164 __smoke__ test rows), of which only 208 were live work. A row nobody's
+-- craft owns is a row nobody picks up.
+--
+-- THE ACCEPTED SET IS FOUR, NOT THREE. The task was written on 2026-08-16 naming
+-- {engineer, artist, ideator}. ADR 0272 (2026-09-09) postdates it and KEEPS `ui` as
+-- a module-contributed discipline, and the owner reconfirmed that on 2026-09-17 when
+-- abandoning the sibling task 1002987 ("Delete the ui role across the platform") for
+-- exactly this reason. Narrowing to three would break 50+ live `ui` rows and
+-- contradict a live ADR, so migration 176's `ui` entry survives untouched here.
+--
+-- WHY THE BACKFILL IS IN THE MIGRATION. The good classification is done by
+-- scripts/gds/backfill-disciplines.js, which runs the real JS heuristic
+-- (classifyTaskDiscipline) and cannot be expressed in SQL. But a migration that
+-- assumes a script was run by hand is a migration that breaks the next fresh
+-- install, the next instance, and any checkout where nobody remembered. So the
+-- UPDATE below is the LAST-RESORT NET, not the plan: it catches whatever the script
+-- left (or everything, if the script never ran) and parks it on 'engineer' — the
+-- value ~99% of confidently-classified rows resolve to.
+--
+-- That fallback is a GUESS and is recorded as one. The owner chose it on 2026-09-17
+-- over the alternative (backfill live work only, leave history alone), accepting
+-- that the ~273 rows the classifier refuses get a best guess rather than a known
+-- answer. Do not read a post-migration `discipline` on an old row as evidence that
+-- anyone determined it.
+--
+-- Idempotent: safe to re-run. The UPDATE matches nothing on a second pass, and the
+-- constraint is dropped before being re-added (the pattern of migrations 086/176).
+-- Forward-safe: the column is unchanged and the previous release wrote only values
+-- this constraint still accepts, EXCEPT 'unclassified' — a rolled-back deploy whose
+-- code still defaults to 'unclassified' would have its INSERTs rejected. That is the
+-- intended behaviour (it is the hole being closed), and it is why the application
+-- side of this task resolves the discipline at db-tasks.createTask, the single
+-- chokepoint every create vector passes through, rather than only at the two routes.
+
+BEGIN;
+
+-- 1. The last-resort net (see header). Everything the classifier could call should
+--    already have been PATCHed by backfill-disciplines.js before this runs.
+UPDATE tasks SET discipline = 'engineer' WHERE discipline = 'unclassified' OR discipline IS NULL;
+
+-- 2. Narrow the accepted set: drop 'unclassified', keep 'ui' (ADR 0272).
+ALTER TABLE tasks DROP CONSTRAINT IF EXISTS tasks_discipline_check;
+ALTER TABLE tasks ADD CONSTRAINT tasks_discipline_check
+  CHECK (discipline IN ('engineer', 'artist', 'ideator', 'ui'));
+
+-- builders.preferred_disciplines already excludes 'unclassified' (migration 176 —
+-- "Never carries 'unclassified' — that's a task state, not an interest area"), so it
+-- needs no change here. Named rather than silently skipped, so the next reader does
+-- not have to re-check.
+
+INSERT INTO schema_migrations (version) VALUES ('core_247_discipline_required')
+  ON CONFLICT (version) DO NOTHING;
+
+COMMIT;

package/modules/copy-desk/routes/copy-desk.js

@@ -429,6 +429,12 @@ module.exports = function buildCopyDeskRouter() {
         // opinion mint claimable work.
         status: 'backlog',
         kind: 'feature',
+        // task 1002988: named explicitly rather than inferred. A copy patch is
+        // reader-facing wording, which is artist work — cascade.js already treats
+        // `source: 'copy-proposal'` as an artist surface (hasCopyOrVisualWork), so
+        // inferring it from the patch text would risk the two disagreeing about
+        // the same row.
+        discipline: 'artist',
         priority: 4,
         touches: [patch.file],
         source: 'copy-proposal',

package/modules/ideas/inbox.js

@@ -405,9 +405,11 @@ async function routeIdeaToGoal({
     //    own floor and takes the HIGHER of the two, so this can raise the bar and
     //    never lower it. Deliberately NOT passed at all: `creditsReward` (server
     //    default — createTask auto-assigns the capped suggestion) and
-    //    `discipline` (left 'unclassified', exactly as the other non-authored
-    //    create vectors leave it).
+    //    `discipline` — NO LONGER 'unclassified' (task 1002988). createTask refuses a
+    //    craft it cannot infer; refusing a filer is the wrong trade for an INBOX, so we
+    //    ask the same question and fall back to 'engineer' (free to re-triage; a lost capture is not).
     const task = await lifecycle.createTask({
+      discipline: (lifecycle.resolveWriteDiscipline?.({ title, description: bodyMd, touches: declaredTouches })?.discipline) || 'engineer',
       versionId: goal.version_id,
       title,
       description: bodyMd,

package/modules/lifecycle/db-tasks.js

@@ -18,6 +18,7 @@ const { matchProtected } = api.permissionPathCheck;
 const { decorateGoalMembership, capNewcomerTasks } = require('./claim-feed.js');
 const { deriveRequiredRank, highestRank } = require('./db-rank-authz.js');
 const { executorFor } = require('./db-executor.js');
+const { resolveWriteDiscipline, WRITABLE_DISCIPLINES } = require('./task-classifier.js');
 
 // -------------------------------------------------------------------------
 // Tasks
@@ -123,7 +124,13 @@ async function createTask({
   sourceRef = null,
   valueSummary = null,
   kind = 'unclassified',
-  discipline = 'unclassified',
+  // task 1002988 — NOT defaulted to 'unclassified' any more. This is the single
+  // chokepoint every create vector passes through, including the ones that never
+  // touch an HTTP route (idea promotion, copy-desk, newcomer-restock, kickoff-seed,
+  // cascade), so resolving here is what makes "no row is born role-less" true of
+  // the whole path rather than of the two routes. Resolved just below; `undefined`
+  // means "work it out from the text".
+  discipline = undefined,
   parallelSafe = null,
   newcomerFriendly = false,
   needsMigration = false,
@@ -198,6 +205,25 @@ async function createTask({
     }
     goalIdEffective = await generalGoalIdForVersion(versionId);
   }
+
+  // task 1002988 (owner decision 2026-09-17): every row is born with a craft.
+  // An absent or 'unclassified' discipline is INFERRED from title + description +
+  // touches; a task whose text says nothing about its craft is REFUSED rather than
+  // filed under a word that means "nobody looked". Throwing here rather than
+  // silently defaulting is the point — 1,189 role-less rows accumulated precisely
+  // because the default was quiet. A caller that cannot tolerate a refusal passes
+  // an explicit discipline, which is then visible at its call site instead of
+  // hidden in this signature.
+  const resolvedDiscipline = resolveWriteDiscipline({ discipline, title, description, touches });
+  if (resolvedDiscipline.error) {
+    const err = new Error(resolvedDiscipline.unclassifiable
+      ? `Cannot infer a discipline for "${String(title).slice(0, 80)}" from its title and description. Pass discipline explicitly: ${Array.from(WRITABLE_DISCIPLINES).join(' | ')}.`
+      : `discipline must be one of ${Array.from(WRITABLE_DISCIPLINES).join(' | ')} (got ${JSON.stringify(discipline)}).`);
+    err.code = 'BAD_DISCIPLINE';
+    err.unclassifiable = resolvedDiscipline.unclassifiable === true;
+    throw err;
+  }
+  const disciplineEffective = resolvedDiscipline.discipline;
   // task 1498 / ADR 0084: every task carries a deliberate rank floor. Derive it,
   // then let an explicit requiresRank override only UPWARD (highestRank) — a
   // requested rank below the derived floor is clamped up to the floor
@@ -247,7 +273,7 @@ async function createTask({
       sourceRef,
       valueSummary,
       kind,
-      discipline,
+      disciplineEffective,
       parallelSafe,
       newcomerFriendly === true,
       needsMigration === true,

package/modules/lifecycle/lifecycle.js

@@ -37,6 +37,12 @@ module.exports = {
   // (consumer: core cascade-dispatch.js, the dormant System-3 lib).
   get VOTABLE_TASK_STATUSES() { return classifier.VOTABLE_TASK_STATUSES; },
   classifyTaskKind: (...a) => classifier.classifyTaskKind(...a),
+  // task 1002988: createTask now REFUSES a task whose craft it cannot work out, so
+  // a consumer that must not fail (idea capture, copy-desk) needs to ask the same
+  // question first and name its own fallback. Exposed on the port because a module
+  // may not require another module — the boundary rule — and a second copy of this
+  // heuristic living in modules/ideas is exactly the drift this port exists to stop.
+  resolveWriteDiscipline: (...a) => classifier.resolveWriteDiscipline(...a),
   // TASK_KINDS: the kind vocabulary, as an ordered array (consumer: GET /me,
   // which hands it to the hall so a filter can be BUILT from it instead of
   // retyped — task 1003453). VALID_KINDS is a Set and Sets do not survive

package/modules/lifecycle/routes/goals.js

@@ -31,7 +31,7 @@ const goalEdits = require('../goal-edits.js'); // task 1003102 — goal self-edi
 const goalCategory = require('../goal-category.js'); // task 1003275 — the ADVISORY human category (gates nothing)
 const goalRollup = require('../goal-rollup.js'); // task 1003278 — per-goal rollups computed in SQL, not in the browser
 const { suggestCriteria } = require('../criterion-suggest');
-const { classifyTaskKind, VALID_KINDS, VALID_DISCIPLINES, TASK_FIELD_BOUNDS } = require('../task-classifier');
+const { classifyTaskKind, VALID_KINDS, WRITABLE_DISCIPLINES, resolveWriteDiscipline, TASK_FIELD_BOUNDS } = require('../task-classifier');
 const { validateOrRespond, parseId, LIMITS } = api;
 const { isModuleKey, scopeIncludesProtected, moduleKeys } = api.moduleScopeMap;
 // goalScopeCheck — the PURE scope wall (BV1.R59 / ADR 0086 §3), reached through
@@ -1388,10 +1388,23 @@ module.exports = function buildGoalsRouter() {
         const result = classifyTaskKind(body.title, body.description || '');
         kind = result.confidence >= 0.5 ? result.kind : 'unclassified';
       }
-      const discipline = body.discipline ?? 'unclassified';
-      if (!VALID_DISCIPLINES.has(discipline)) {
-        return res.fail('bad_discipline', 400, { valid: Array.from(VALID_DISCIPLINES) });
+      // task 1002988 — the SECOND create path. It carried the same
+      // `body.discipline ?? 'unclassified'` line as POST /tasks, so a fix applied
+      // only there would have left this one minting the rows the task exists to
+      // remove. Both now share resolveWriteDiscipline().
+      const resolvedDiscipline = resolveWriteDiscipline({
+        discipline: body.discipline, title: body.title, description: body.description, touches: body.touches,
+      });
+      if (resolvedDiscipline.error) {
+        return res.fail('bad_discipline', {
+          status: 400,
+          message: resolvedDiscipline.unclassifiable
+            ? `discipline was not supplied and could not be inferred from the title and description. Pass one of ${Array.from(WRITABLE_DISCIPLINES).join(' | ')}.`
+            : `discipline must be one of ${Array.from(WRITABLE_DISCIPLINES).join(' | ')}.`,
+          details: { valid: Array.from(WRITABLE_DISCIPLINES) },
+        });
       }
+      const discipline = resolvedDiscipline.discipline;
 
       // Create. version = the goal's (not client-supplied); status 'ready' so the
       // author can claim it immediately; requiresRank OMITTED → auto-derived

package/modules/lifecycle/routes/task-write-routes.js

@@ -22,7 +22,7 @@ const db = require('../db');
 const hierarchy = require('../hierarchy');
 const { suggestCriteria } = require('../criterion-suggest');
 const { buildGoalAdvisory } = require('../goal-advisory');
-const { classifyTaskKind, VALID_KINDS, VALID_DISCIPLINES, VOTABLE_TASK_STATUSES, TASK_FIELD_BOUNDS } = require('../task-classifier');
+const { classifyTaskKind, VALID_KINDS, WRITABLE_DISCIPLINES, resolveWriteDiscipline, VOTABLE_TASK_STATUSES, TASK_FIELD_BOUNDS } = require('../task-classifier');
 const { isModuleKey, moduleKeys } = api.moduleScopeMap;
 const { validateOrRespond, LIMITS, parseId } = api;
 const { badKind, detectsMigration } = require('./task-route-helpers.js');
@@ -141,10 +141,22 @@ module.exports = function registerTaskWriteRoutes(router) {
       const result = classifyTaskKind(body.title, body.description || '');
       kind = result.confidence >= 0.5 ? result.kind : 'unclassified';
     }
-    const discipline = body.discipline ?? 'unclassified';
-    if (!VALID_DISCIPLINES.has(discipline)) {
-      return res.fail('bad_discipline', 400, { valid: Array.from(VALID_DISCIPLINES) });
+    // task 1002988: a create must never mint a role-less row. An omitted (or
+    // explicitly 'unclassified') discipline is INFERRED from the text; only a
+    // genuinely unclassifiable task is refused.
+    const resolved = resolveWriteDiscipline({
+      discipline: body.discipline, title: body.title, description: body.description, touches: body.touches,
+    });
+    if (resolved.error) {
+      return res.fail('bad_discipline', {
+        status: 400,
+        message: resolved.unclassifiable
+          ? `discipline was not supplied and could not be inferred from the title and description. Pass one of ${Array.from(WRITABLE_DISCIPLINES).join(' | ')}.`
+          : `discipline must be one of ${Array.from(WRITABLE_DISCIPLINES).join(' | ')}.`,
+        details: { valid: Array.from(WRITABLE_DISCIPLINES), inferred: false },
+      });
     }
+    const discipline = resolved.discipline;
     // task 1498 / ADR 0084: an explicit requires_rank must be a live rank. The
     // floor auto-derives from touches + security_sensitive; createTask clamps
     // any explicit value UP to that floor (never below), so this only rejects a
@@ -496,8 +508,15 @@ module.exports = function registerTaskWriteRoutes(router) {
     if (hasKind && !VALID_KINDS.has(body.kind)) {
       return badKind(res);
     }
-    if (hasDiscipline && !VALID_DISCIPLINES.has(body.discipline)) {
-      return res.fail('bad_discipline', 400, { valid: Array.from(VALID_DISCIPLINES) });
+    // task 1002988: a PATCH may not push a row BACK to 'unclassified' — that is a
+    // triage state, not a craft, and letting an edit re-create one would reopen the
+    // hole the create path above just closed.
+    if (hasDiscipline && !WRITABLE_DISCIPLINES.has(body.discipline)) {
+      return res.fail('bad_discipline', {
+        status: 400,
+        message: `discipline must be one of ${Array.from(WRITABLE_DISCIPLINES).join(' | ')}.`,
+        details: { valid: Array.from(WRITABLE_DISCIPLINES) },
+      });
     }
     if (hasNewcomerOrXenos) {
       // V3.R15 #239: prefer newcomer_friendly (canonical); fall back to

package/modules/lifecycle/task-classifier.js

@@ -163,6 +163,42 @@ function classifyTaskKind(title, description) {
 // /design work-mode (discipline-modes.json) instead of /paint.
 const VALID_DISCIPLINES = new Set(['engineer', 'artist', 'ideator', 'ui', 'unclassified']);
 
+// The disciplines a WRITE may set (task 1002988). 'unclassified' is deliberately
+// absent: it is a triage state, not a craft, and a create that lands one produces
+// a row no craft is accountable for — which is how 1,189 of them accumulated.
+// VALID_DISCIPLINES above stays the READ-side set so existing rows and the
+// ?discipline=unclassified filter keep resolving while the backfill runs.
+// 'ui' stays: ADR 0272 keeps it as a module-contributed discipline, and the owner
+// reconfirmed that on 2026-09-17 when abandoning task 1002987.
+const WRITABLE_DISCIPLINES = new Set(['engineer', 'artist', 'ideator', 'ui']);
+
+// Mirrors the `kind` branch in the create routes: act on the classifier only when
+// it is at least half sure, otherwise treat it as no answer at all.
+const DISCIPLINE_CONFIDENCE_FLOOR = 0.5;
+
+// Resolve the discipline for a task WRITE. Honours an explicit valid value,
+// otherwise INFERS from title + description + touches, and reports failure so the
+// caller can 400 — per the owner decision of 2026-09-17, a bare 400 on a missing
+// discipline was rejected because four live paths (idea capture, idea promotion,
+// adopt-import and the new-instance scaffold) create tasks without one.
+//
+// Shared deliberately: POST /tasks and POST /goals/:id/tasks BOTH carried the
+// `body.discipline ?? 'unclassified'` line, so a fix applied to one of them would
+// have left the other quietly minting the very rows this task exists to remove.
+// Returns { discipline, inferred?, confidence? } or { error, unclassifiable? }.
+function resolveWriteDiscipline({ discipline, title, description, touches } = {}) {
+  if (discipline != null && discipline !== 'unclassified') {
+    return WRITABLE_DISCIPLINES.has(discipline) ? { discipline } : { error: 'bad_discipline' };
+  }
+  // Absent, null, or an explicit 'unclassified' (what modules/ideas/inbox.js sends
+  // on promotion) all mean the same thing: nobody told us, so work it out.
+  const guess = classifyTaskDiscipline(title, description || '', touches);
+  if (guess.confidence >= DISCIPLINE_CONFIDENCE_FLOOR && WRITABLE_DISCIPLINES.has(guess.discipline)) {
+    return { discipline: guess.discipline, inferred: true, confidence: guess.confidence };
+  }
+  return { error: 'bad_discipline', unclassifiable: true };
+}
+
 // Numeric field bounds for task creation (POST /tasks). The single source of
 // truth: the route schema in routes/tasks.js references these so the validator
 // and the claim-time context pack (V4.R04 / sessions-start-knowing) can never
@@ -516,6 +552,9 @@ module.exports = {
   _resetVendorCacheForTests,
   VALID_KINDS,
   VALID_DISCIPLINES,
+  WRITABLE_DISCIPLINES,
+  DISCIPLINE_CONFIDENCE_FLOOR,
+  resolveWriteDiscipline,
   VOTABLE_TASK_STATUSES,
   TASK_FIELD_BOUNDS,
 };

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.841",
+  "version": "1.19.843",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.19.841",
+      "version": "1.19.843",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.841",
+  "version": "1.19.843",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",