@bongos/core 1.19.895 → 1.19.897

package/.bongos-core.json

@@ -2,22 +2,22 @@
   "artifact": "bongos-core",
   "manifest_schema": 1,
   "generator": "scripts/gds/package-core.js",
-  "core_version": "1.19.895",
-  "core_contract": "1.19.895",
-  "source_commit": "e1f8d85b302ea3a742b16cc5ec06911132ae7f78",
+  "core_version": "1.19.897",
+  "core_contract": "1.19.897",
+  "source_commit": "bee6c40d5b1e4600a59cace9b3068cfb1626de0d",
   "source_ref": "HEAD",
-  "built_at": "2026-09-19T23:04:46.322Z",
+  "built_at": "2026-09-20T02:58:37.233Z",
   "redaction": {
     "model": "docs-redacted+functional-verbatim",
-    "docs_redacted": 498,
+    "docs_redacted": 500,
     "agent_docs_stubbed": 26,
-    "functional_verbatim": 2274,
+    "functional_verbatim": 2277,
     "rules": 3,
     "gate_literals": 3,
     "gate": "passed"
   },
-  "file_count": 2798,
-  "tree_sha256": "b3d7ed781a5cfdc09c1f4cb1d361b1630e18adb02f1d9abf09c70b8867d6b496",
+  "file_count": 2803,
+  "tree_sha256": "649ca49d792d2d5a87fa5ae51bad0373270f0551dc7d8f82929bfa9112592e21",
   "files": [
     {
       "path": ".claude/skills/ask-for-help/SKILL.md",
@@ -2044,10 +2044,15 @@
       "mode": "0000644",
       "sha256": "9c8eff827f7c676cb8fb73475383812746d31c9ca35e2ec4ccb3845c48d2cd63"
     },
+    {
+      "path": "docs/adr/0311-an-idea-is-a-permanent-origin-tag.md",
+      "mode": "0000644",
+      "sha256": "6046995188cef5e8652787eca38ccc6a69393f0985891764d6573f3379bbe6ab"
+    },
     {
       "path": "docs/adr/README.md",
       "mode": "0000644",
-      "sha256": "ca64ff12d272ebf2a1b7f6752193ad464c6b7c03118c6f9555a58d8b4a0f6e0c"
+      "sha256": "16fdd3b239a9a161d70e3432c35705590d0103f798f2e5f00db53cffcbf5cb81"
     },
     {
       "path": "docs/api-reference.md",
@@ -2114,6 +2119,11 @@
       "mode": "0000644",
       "sha256": "67391accbb08e35e37df89e225476bae1b2a8957534a92ba63f49f3f53fcfdeb"
     },
+    {
+      "path": "docs/design/ideator-surface-direction.md",
+      "mode": "0000644",
+      "sha256": "0ca62887b7345136ed669d2a6c279cd59c0cea2dce9cc91a3af1680ce0a31449"
+    },
     {
       "path": "docs/design/landing-page-direction-v2.md",
       "mode": "0000644",
@@ -2612,7 +2622,7 @@
     {
       "path": "docs/module-api-changelog.md",
       "mode": "0000644",
-      "sha256": "14add7d8f56069acae77405671c2b1b4e7dadfd03eb4cd36ab08cbcd9f6ed9a9"
+      "sha256": "a14d4e32aa8cd8793cdc535db0aa0047d7381de2e95cd6dd629c15b3ba0089b5"
     },
     {
       "path": "docs/modules-contract.md",
@@ -3709,6 +3719,11 @@
       "mode": "0000644",
       "sha256": "ae3e405c7e59fbc13e23ae2a4ba945176f2369a150c997d9b8134e49991f273b"
     },
+    {
+      "path": "migrations/core_250_cascade_requests_do_not_auto_promote.sql",
+      "mode": "0000644",
+      "sha256": "599449a48b3850eb457a34630a7bd5d95d354602f1a9e9b887593183a457cd21"
+    },
     {
       "path": "modules/agents/CLAUDE.md",
       "mode": "0000644",
@@ -5477,7 +5492,7 @@
     {
       "path": "modules/lifecycle/db-tasks.js",
       "mode": "0000644",
-      "sha256": "5d17541d837a06903be832814a74218c9fee8b9119dd870c88273743be5a5efa"
+      "sha256": "ba8a41a33d3612f41509d50c65533f169b4008bbc8a01df783dbd03fe872afa4"
     },
     {
       "path": "modules/lifecycle/db-versions.js",
@@ -7717,12 +7732,12 @@
     {
       "path": "package-lock.json",
       "mode": "0000644",
-      "sha256": "9ae4e1d11cdbeca421ec3a967b7130085744c14df5901d501bd8129974f65c20"
+      "sha256": "ea53354ce229c7ec74a1909c0d0153363ee9f18969b0916c6dc832e36d2e9e8f"
     },
     {
       "path": "package.json",
       "mode": "0000644",
-      "sha256": "adcd6bd6b27ed6e43e143613beb81d9d063244bf5ccdf948ec3b59a89bd15401"
+      "sha256": "6cec6fa876274d23ee1da877b77841482b5b2558ddebac5adad801535deffa0d"
     },
     {
       "path": "public-docs/index.html",
@@ -8347,7 +8362,7 @@
     {
       "path": "scripts/gds/gds-literal-scan.js",
       "mode": "0000644",
-      "sha256": "30a05f9d8d476e83740f0630e17d1accc3e29d67cebfc74d19abfeae6608e514"
+      "sha256": "c7722e0ea9f0b6f1bc6cd2f791fd79f148861bd9c52eaf910859efebc6a13e94"
     },
     {
       "path": "scripts/gds/gen-api-client.js",
@@ -8944,6 +8959,11 @@
       "mode": "0000644",
       "sha256": "fe6f67019515067a6147506ad5a29fcb38df06f66239b879ed9acf7d16f1b06a"
     },
+    {
+      "path": "scripts/gds/seed-bv2-ideator-surface-tasks.js",
+      "mode": "0000644",
+      "sha256": "1e74a2b1582922bbab8be30e62f8276f9d22e69d42210783940abcfcb618c603"
+    },
     {
       "path": "scripts/gds/seed-gds-v4-tasks.js",
       "mode": "0000644",
@@ -9727,7 +9747,7 @@
     {
       "path": "src/module-api.js",
       "mode": "0000644",
-      "sha256": "ae29e03c67edd61e903c64c4583c3febdfdea3ac75422e7b3075125f0b79f4e4"
+      "sha256": "dc291210b4d1b471b7e946fc451381204d9eece987e0d0df49f364e41a240594"
     },
     {
       "path": "src/module-loader/catalog.js",
@@ -11027,7 +11047,7 @@
     {
       "path": "tests/fitness_gds_ratchet.mjs",
       "mode": "0000644",
-      "sha256": "10b3d6db55dd8d20de69fe8757575cf965ca8a14e91512c2f7b71b62ba3af855"
+      "sha256": "230e532b54a69a3ee2c009b3a018a6cb920c92fb402364427cbdc244434d4c1b"
     },
     {
       "path": "tests/fitness_ratchets.mjs",
@@ -12672,7 +12692,12 @@
     {
       "path": "tests/promotion_sweep.mjs",
       "mode": "0000644",
-      "sha256": "43246276a75ec8e7d01610b4f6c6988434144338804614b37b062c7a43a8beca"
+      "sha256": "c0c88682ef2b43ae582cfe41ac39e0213b50aaf0cae2e9cbd314007a7aa64b89"
+    },
+    {
+      "path": "tests/promotion_triggers_skip_cascade.mjs",
+      "mode": "0000644",
+      "sha256": "ce1de49cfe554f3e5fa4ae9a784a8ba41d537571c9ae6307f72c2710e693f6aa"
     },
     {
       "path": "tests/prose_edits.mjs",
@@ -13722,7 +13747,7 @@
     {
       "path": "tests/task_unblocked_open_blocker.mjs",
       "mode": "0000644",
-      "sha256": "57a776dc56011bfe792a7a30ab29598bfc1b5b52f26ea0ef74faae5fbba26f6d"
+      "sha256": "503692cc227e43292c133abba0fe17307fedd4b32be56e457a690b7be88c1586"
     },
     {
       "path": "tests/task_visual_route_gate.mjs",

package/docs/adr/0311-an-idea-is-a-permanent-origin-tag.md

@@ -0,0 +1,52 @@
+# ADR 0311 — An idea is a permanent origin tag, and the payout follows its descent
+
+**Status:** accepted · **Date:** 2026-09-19 · **Task:** [task 1004076](https://cloudbongos.com/builders#/task/1004076) (goal 1000095 — BONGOS-V2)
+
+**Related:** [ADR 0262](0262-a-bug-never-lands-in-the-inbox.md) + the landing matrix it governs (`modules/ideas/routing.js`) · [ADR 0175](0175-the-board-room-full-idea-ratification.md) (the Board Room, unchanged by this) · [ADR 0054](0054-session-token-reward-cost-plus.md) (the credit the payout rides on) · [ADR 0015](0015-task-dependencies-and-auto-promotion.md) (why spikes do not auto-promote) · [ADR 0086](0086-goal-scoped-work-hierarchy.md) (goals, which a Full Idea may now become)
+
+## Context
+
+An idea, today, is a **container for work**. It sits in `idea_inbox` until it names a goal, and then it becomes a task and leaves the ideas world entirely. The better-aimed the thought, the faster it disappears from the person who had it — and the ideas page, which shows only what is left, is named after the leftovers.
+
+This was reported as a small confusion and turned out to be structural. On 2026-09-19 the owner filed a thought from the hall, it routed into a goal as a task, the confirmation line was cleared by the next keystroke, and five minutes later they could not find it. The signal existed; its half-life was about four seconds. The routing decision that caused it was made by a `<select>` nobody notices.
+
+Three facts found while mapping the live mechanism shaped everything below:
+
+- **`karma_log` carries no task key and no idea key**, deliberately (`migrations/040_builder_karma.sql`). "The karma a thought caused" is not a quantity this system can compute.
+- **Task parentage is capped at one level and refuses cross-version parents** (`modules/lifecycle/hierarchy.js`), by design — ship rollup and claim safety lean on it.
+- **Nothing anywhere records that shipped work was later removed.** `shipped` is terminal, there is no reverted state, and `tasks.merged_into_task_id` is CHECK-constrained to abandoned rows, so it can only describe work cut before it landed.
+
+## The decision
+
+**An idea stops being a container and becomes a permanent origin tag** — never edited, never editing, and the only thing that can answer where a piece of work came from. It may become a task, a criterion or a goal depending on scope; the tag itself never changes.
+
+**The tag survives every fork, and the payout follows it.** The ideator's credit split (`modules/economy/credits.js` `awardIdeaTaskShipCredit`) resolves only the earliest lineage link today, so a task split off later pays nobody. It is extended to follow the whole descent, **decaying with depth** — full share at the direct task, halving each hop, so an infinite descent is worth at most twice the direct task. This is what gives the tag teeth: if it does not survive a fork, *someone does not get paid*. Descendant **work** pays the origin; a separate idea that merely cites the origin does not, or early filers farm the project.
+
+**Size and brightness are two independent channels.** Size is the sum of those payouts and **never falls**; brightness is how much of that work is **still alive**. A thought that caused a great deal of work the project later tore out renders **large and dead**. A single number would have made that indistinguishable from a thought that never mattered, which is the failure the split exists to prevent.
+
+**Karma is rejected as the basis for size** — see Context. Credits are already idea-attributed at ship; karma is not, and is left as it is.
+
+**The task hierarchy is not widened.** Provenance is a different relation from work decomposition and belongs with `ideas_task_lineage`, which is already many-ideas-to-one-task and carries none of the hierarchy's invariants.
+
+**Removal is proposed by the system and confirmed by a person.** `modules/lifecycle/cascade.js` already implements ship-generates-work and declares an empty rule set; the first rule files a **question** when a ship deletes an earlier shipped task's work. A derived-only signal dims the sky for refactors, renames and file moves; a declared-only one rots because nobody remembers. An unanswered proposal rots on the existing clock; confirming sits at the nod's floor on the nod's existing surface.
+
+**A ratified Full Idea becomes the structure, not another point inside it** — a goal, or a criterion inside one. The Full Idea carries a **recommendation** and the board decides which, because scope is the thing you learn last. The five questions are replaced with the owner's set and **versioned**, so ideas already filed keep scoring against the questions they were actually asked. The Board Room flow is unchanged.
+
+**Two settings belong to the project, not the platform**, and share one home: who may ignite a thought directly into claimable work, and the decay rate.
+
+**Existing ideas get their lineage backfilled, not their payouts.** Size for a pre-existing idea is computed from the descent it has, so the picture is meaningful on day one without spending credits twice — and because that number is then not a sum of payouts actually made, it must be **marked as historical** rather than quietly presented as one.
+
+## Consequences
+
+- **The hard part is now load-bearing rather than optional.** Before this, a lineage tag that died at the first fork produced a worse picture. After it, it produces a wrong ledger. That is deliberate: it puts the effort where the value is.
+- **Ideator payouts become open-ended in principle**, bounded in practice by the decay. A project that dislikes the shape turns the dial rather than arguing with the platform.
+- **The visible record will be dominated by large dead rings in a project that churns.** Accepted: failure is fine, and a record that only ever grows brighter is not a record.
+- **Three tasks were dropped** as this direction invalidated them — a text-only ancestry trail ([task 1004054](https://cloudbongos.com/builders#/task/1004054)), a `held` inbox status ([task 1002832](https://cloudbongos.com/builders#/task/1002832)), and backfilled Full Idea answers on old goals ([task 1003678](https://cloudbongos.com/builders#/task/1003678)) — and one was amended ([task 1003852](https://cloudbongos.com/builders#/task/1003852)), whose title asserted the exact exclusivity this reverses.
+- **Working area 6 now carries ten criteria.** A consequence of the owner's instruction to add here rather than open a new goal.
+
+## Does not decide
+
+- The **exact decay rate** beyond its default of halving — it is a per-instance dial, and what a given project should set it to is that project's call.
+- **What precisely counts as removed** — the shape is propose-then-confirm; the derivation is [task 1004081](https://cloudbongos.com/builders#/task/1004081)'s spike to settle.
+- **How provenance edges are physically recorded** — [task 1004080](https://cloudbongos.com/builders#/task/1004080)'s spike, constrained only by "not by widening the task hierarchy".
+- **How any of this is drawn.** The agreed visual direction is `docs/design/ideator-surface-direction.md` and the mockups beside it; the criteria deliberately name the *model* — the states, the channels, the rules — and leave the picture free to change.

package/docs/adr/README.md

@@ -402,3 +402,4 @@ This keeps the decision history honest and traceable.
 | 0308 | [**An eleventh working area: Autobongos** ([task 1003900](https://cloudbongos.com/builders#/task/1003900), goal 1000119). Amends [ADR 0264](0264-the-ten-working-areas.md), which nine days earlier collapsed 38 goals into **ten** areas held until 5,000 builders. Area 11 is Autobongos ([goal 1000119](https://cloudbongos.com/builders#/goal/1000119), owner Lars). **Area 6 was the obvious home and was rejected**: area 6 is about a human's experience of the platform, and this area has no human in it — which limits to spend, which fences hold unsupervised, how it recovers with nobody at the keyboard. Those get less attention next to work with a user in front of it, not better answers. It **reopens** goal 1000028 (*Autonomy groundwork*), archived in the 38→10 cut with no successor and carried as `succeeds_goal_id`, so the lineage is in the ledger rather than the prose — and ADR 0264 §3 had already left "fold, keep as an eleventh, or close" as a live owner question. Admitting it cost something recorded: BONGOS-V2 is `building`, so its goal set is closed (ADR 0250) and `POST /goals` refuses `version_not_planning` — an Archon reopened it with a stored `admit_reason`, which is the cut holding well enough that adding to it left evidence. Does not decide: the ten-area discipline stands (one exception, written reason, 5,000-builder horizon unchanged), 0264 §3's other two open rows, or a second goal for the area.](0308-an-eleventh-working-area.md) | methodology / goals |
 | 0309 | [**Module enablement is a database row, above the committed pack and below env** ([task 1002857](https://cloudbongos.com/builders#/task/1002857), goal 1000091). The hall Modules-tab toggle ([ADR 0107](0107-module-upstreaming-contribution-to-core-catalog.md) §9) wrote `config/modules.json` and reloaded the cache, so it looked like it worked — but that file is the committed instance pack and the pull-deploy runs `git reset --hard origin/main`, so the toggle reverted on the next deploy, **silently**. Enablement moves to `module_enablement_overrides` (migration `core_248`), read as one precedence layer: neutral pack → instance pack → **DB override** → env → default. **Above the pack** because the pack is what a deploy restores, so an override below it would be erased by the event it exists to survive; **below env** because `<PREFIX>_MODULE_<KEY>` is the incident knob and must not need a reachable database. **Auto-committing to `main` stays rejected** ([ADR 0016](<redacted>.md)): durability belongs in the DB, not in an HTTP handler that writes to the default branch. Two open design points settled: the **scope key** is the resolved instance pack path (the only axis two instances sharing one database differ on, so one sibling's toggle cannot flip the other's module), and the DB is read into a **snapshot** refreshed at boot and on write rather than inline, because `loadModules()` is synchronous and making it async would ripple into every consumer of a module flag. An unreachable database is a **no-op** — no row means "no opinion", not "off". Does not decide: whether a toggle should also restart the process so remounting is immediate.](0309-durable-module-enablement-db-override.md) | modules / ops |
 | 0310 | [**A speciality OFFERS skills; the adopter turns them on, one at a time, having been shown what each does** ([task 1003978](https://cloudbongos.com/builders#/task/1003978), goal 1000095). Completes [ADR 0296](0296-a-role-speciality-is-data-over-three-existing-surfaces.md), which defined a speciality as knowledge + skills + an interaction contract and shipped two of the three: `grep -i skill` across the module's schema, domain and routes returns only the header sentences describing a thing that is not there — prose asserting behaviour the code does not have, and the feature's own definition at that. Task 1003978 withheld an implementation until the authority question was answered, and the answer is the strong one: **naming a skill GRANTS NOTHING**. Skills are materialised by `claude-materialize.js` and permission is rank-gated server-side with no caching ([ADR 0016](<redacted>.md)); a speciality offers a menu, and a menu is not an entitlement. **Two layers, because one layer is the blanket the owner ruled against**: the catalog holds what a speciality OFFERS, the already-per-builder `specialities_adoptions` row holds what THIS builder turned on — so two economist ideators share a speciality's knowledge and contract and need not share one enabled skill. **The default is nothing enabled, and that is a position about LEARNING rather than a safe default**: the owner's ruling is that adoption must *walk through what comes with each* because *people need to learn the system*. A settings page of unchecked boxes satisfies the letter and defeats the intent, so the bar is a user test — a person who has finished adopting can say what each skill does. Sharing needs no new mechanism: `owner_kind` / `visibility` / `offered` / `sellable` already ship the private→project→public ladder, and skills ride it. Builds nothing; the three-task order (schema, walkthrough, injection) is filed, and the four documentation sites that claimed a shipped ingredient now say decided-not-built.](0310-a-speciality-offers-skills-and-the-adopter-chooses-them.md) | specialities / methodology |
+| 0311 | [**An idea is a permanent origin tag, and the payout follows its descent** ([task 1004076](https://cloudbongos.com/builders#/task/1004076), goal 1000095 — BONGOS-V2). An idea today is a CONTAINER for work: it leaves `idea_inbox` when it names a goal and lives on as a task, so the better-aimed the thought the faster it vanishes from whoever had it. Reported as a small confusion — a thought filed from the hall routed into a goal, the confirmation line cleared on the next keystroke, and five minutes later the owner could not find it. The idea becomes an **immutable origin tag** instead, the only thing that can answer where a piece of work came from, and **the ideator payout follows its whole descent** rather than stopping at the earliest lineage link (`awardIdeaTaskShipCredit`), decaying by depth — full at the direct task, halving each hop — so an infinite descent is worth at most twice the direct task. That is what gives the tag teeth: if it does not survive a fork, someone does not get paid. **Size and brightness are two channels, not one number**: size is the sum of those payouts and never falls, brightness is how much of that work is still alive, so a thought whose work the project tore out renders LARGE AND DEAD rather than looking like one that never mattered. **Karma was rejected as the basis** — `karma_log` carries no task key and no idea key, deliberately ([`migrations/040_builder_karma.sql`](../../migrations/040_builder_karma.sql)), so "the karma a thought caused" is not computable; credits already are idea-attributed. **The task hierarchy is NOT widened** to carry the descent — it is capped at one level and refuses cross-version parents because ship rollup and claim safety lean on it, and provenance is a different relation from work decomposition. **Nothing records that shipped work was later removed** (`shipped` is terminal, `merged_into_task_id` is CHECK-constrained to abandoned rows), so the first `cascade.js` rule PROPOSES a removal and a person confirms it — derived-only would dim for refactors and renames, declared-only would rot. A ratified **Full Idea becomes a goal or a criterion**, carrying a recommendation the board rules on, because scope is the thing you learn last; the five questions are replaced and VERSIONED so prior filings keep their own. Dropped three tasks this invalidated and amended a fourth whose title asserted the exact exclusivity it reverses. Does not decide: the decay rate beyond its default, what precisely counts as removed, how the edges are physically recorded, or how any of it is drawn.](0311-an-idea-is-a-permanent-origin-tag.md) | ideas / economy |

package/docs/design/ideator-surface-direction.md

@@ -0,0 +1,77 @@
+# Design direction — the ideator surface
+
+> **Status:** agreed 2026-09-19 with the area owner. Planning session meta task 1004076; the decisions live on idea 1001072; the scope is `docs/specs/<redacted>.md`.
+>
+> This file is the **visual** half. The spec is the build; the criteria on goal 1000095 are the done-when. Where this file and the spec disagree about behaviour, the spec wins; where a criterion and either of them disagree, the criterion wins.
+
+## The problem this answers
+
+An idea, today, is a container for work. When it succeeds — when it names a goal and becomes a task — it leaves the ideas world entirely and lives on as a task. So the better aimed the thought, the faster it disappears from the person who had it. The ideas page is named after the leftovers.
+
+The session that produced this direction started from a real confusion: a filed thought silently became a task under a goal, the confirmation line vanished on the next keystroke, and the owner could not find what they had written five minutes earlier.
+
+## The shift
+
+**An idea stops being a container and becomes a permanent origin tag** — never edited, never editing, and the only thing that can answer where a piece of work came from. It can become a task, a criterion or a goal depending on scope, but the tag itself never changes.
+
+Two flows, not one:
+
+- **New ideas file fast.** One line, one gesture. Aiming is optional. Nothing about filing gets slower.
+- **Past ideas are explored as a descent** — one thought at the top, everything that grew from it falling away below.
+
+## The world
+
+The project's own design system (`DESIGN.md`, "Cloud Bongos — The Chrome World") already supplies the vocabulary: a pure black void, hairline structure, and one warm salmon accent whose single law is that it **lights only what is pressable or live**. That law is why this direction reads as a sky without inventing anything: a living thing glows, a dead thing does not, and the accent's rarity is what makes it believed.
+
+### Gravity
+
+The project's open goals are gravity wells. A thought released near one is caught by it and becomes work inside it; a thought nothing catches floats in open space.
+
+This is **not new machinery**. It is the capture-time routing that already runs, drawn instead of hidden inside a `<select>`. The invisible dropdown is the direct cause of the confusion that started the session, so making the catch visible is the fix, not a decoration on top of it.
+
+A goal's **criteria are the rings inside its well**, closing as each is satisfied.
+
+### The five objects
+
+Dim and dark are different states and must be different objects, not one dot at two opacities.
+
+| Object | What it means |
+|---|---|
+| **star** | caused work that is still alive. it dims as pieces of that work are removed |
+| **protostar** | filed, not yet ignited. inside a well it awaits a nod; in open space nothing has claimed it |
+| **satellite** | folded into another thought. it orbits that one now, and its value counts there |
+| **remnant** | it burned, then the project removed it. it keeps every bit of its size |
+| **cold body** | declined at triage. it never ignited, so it has no size at all |
+
+Position carries a distinction the object alone cannot: a protostar **inside a well** has a home and is waiting for a nod; a protostar in **open space** has no home at all. That makes the nod queue something a person can see rather than a list someone must remember to open.
+
+### Size and brightness are two channels
+
+- **Size** is what a thought caused — the ideator's total payout from its descent — and it **never falls**.
+- **Brightness** is how much of that work is **still alive**.
+
+Two facts, two encodings. A thought that caused a great deal of work which the project later tore out renders **large and dead**: a big hollow ring. A single number would have made that look identical to a thought that never mattered, which is the failure this split exists to prevent.
+
+Karma is not the basis. `karma_log` carries no task key and no idea key and never has, so "the karma a thought caused" is not a quantity the system can compute. Credits are already idea-attributed at ship, so they are.
+
+Size is long-tailed, so it is **compressed for drawing** while the true figure is shown in the panel.
+
+## Four surfaces
+
+The mockup sources are committed at [`mocks/ideator-surface/`](mocks/ideator-surface/) — see that folder's README. They are the agreed shape, not a pixel contract.
+
+1. **File** — the fast path. One line, an optional aim, and a receipt that does not evaporate. Filing never gets slower than it is today.
+2. **The room** — the plain, everyday overview: what you filed, what it became, its size and whether it is still burning. This is the page a person opens daily, and it does the real work.
+3. **The descent** — one thought at the top and everything it caused falling away below, through rewrites, splits and merges, including the branches that went out.
+4. **The sky** — the ambient view. It is drawn from numbers the other three already produce, it arrives last, and **it is never the only path to anything it shows**.
+
+## What this direction refuses
+
+- **A galaxy is not trivial, and it must never be load-bearing.** Every fact the sky shows is reachable without it.
+- **Filing does not get slower to serve the picture.** A spark's whole value is that it costs nothing to have; the sky redraws in the background.
+- **The sky will be dominated by large dead rings in a project that churns.** That is honest, and it is the accepted trade — failure is fine, and a bright sky should be earned.
+- **Brightness never claws back credits.** The ledger is not rewritten when the project changes its mind; only the picture changes.
+
+## Provenance
+
+Owner-led ideation, 2026-09-19, following the Ideator pack's stance (the human drives, Claude is the sounding board). Every decision above is the owner's, recorded as it was made on idea 1001072. The clickable mockup lives on claude.ai and is linked from that idea; the committed sources beside this file are what survives if that link does not.

package/docs/module-api-changelog.md

@@ -2264,5 +2264,9 @@ is load-bearing: the script throws rather than guess if it is missing, and
         landed since 1.19.893 with no explicit bump. run 35473999345. (task 1002620)
   1.19.895 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
         landed since 1.19.894 with no explicit bump. run 35475074265. (task 1002620)
+  1.19.896 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+        landed since 1.19.895 with no explicit bump. run 35478072367. (task 1002620)
+  1.19.897 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+        landed since 1.19.896 with no explicit bump. run 35485346707. (task 1002620)
 ---------------------------------------------------------------------------
 ```

package/migrations/core_250_cascade_requests_do_not_auto_promote.sql

@@ -0,0 +1,126 @@
+-- core_250 a cascade REQUEST is never auto-promoted out of backlog
+-- Applied under task 1004077.
+--
+-- WHY. 'backlog' means two different things and only one of them is drainable
+-- by a machine:
+--
+--   waiting on a TRIGGER   a dependency has not shipped -- mechanically
+--                          unblockable, and what these triggers are for
+--   waiting on a PERSON    a generated REQUEST nobody has triaged
+--
+-- modules/lifecycle/cascade.js files every task it generates at 'backlog' and
+-- never 'ready' (one of the four properties tests/cascade.mjs pins), and writes
+-- a preamble onto each one telling the reader it "is a REQUEST, filed at
+-- backlog, and it goes through the board's ordinary triage". Nothing enforced
+-- that downstream, so the board's ordinary triage was skipped by a machine.
+--
+-- WHAT IT COST. modules/hall-ui/public/studio.js reads the artist's queue as
+-- `?discipline=artist&status=backlog`. A cascade task carries no dependencies,
+-- so task_is_fully_unblocked() is trivially true and it qualified for promotion
+-- the instant it existed. Task 1004037 was filed at 19:53:57 and promoted at
+-- 19:54:54 -- 57 seconds, no person involved. Every artist review was swept out
+-- of the artist's room about a minute after arriving and reappeared in
+-- /builder-start as ordinary claimable work; all four open on 2026-09-19 had
+-- been drained. One was then claimed into a git worktree and judged by a grader
+-- panel whose four lenses explicitly do not read a sentence (ADR 0298): an
+-- artist review carried out without an artist, while the studio sat empty.
+--
+-- WHY HERE AS WELL AS IN THE SWEEP. The report-only sweep in
+-- modules/lifecycle/db-tasks.js (PROMOTABLE_BACKLOG_WHERE) is fixed in the same
+-- task, but it is not the only promoter. Each trigger below matches a
+-- dependency edge that may be anchored at the task OR AT ITS GOAL
+-- (`d.from_kind = 'goal' AND d.from_id = t.goal_id`), and a cascade review
+-- INHERITS the reviewed task's goal (cascade.js property 3). So a goal-level
+-- edge promotes a cascade row that has no dependencies of its own. Fixing only
+-- the sweep would leave that path open and the defect would return
+-- intermittently, which is worse than leaving it alone.
+--
+-- SHAPE. `AND t.source IS DISTINCT FROM 'cascade'` sits beside the existing
+-- `AND t.kind <> 'spike'`, which is the established precedent in these same
+-- functions for "this sort of row does not auto-promote". IS DISTINCT FROM, not
+-- <>, because source is nullable and `NULL <> 'cascade'` is NULL, which would
+-- silently stop promoting every task that has no source at all.
+--
+-- NOT task_is_fully_unblocked(). That predicate answers "are this task's
+-- dependencies satisfied", it is shared with the claim gate, and teaching it to
+-- also mean "has a human triaged this" would change what a refused claim means.
+--
+-- Forward-safe: CREATE OR REPLACE only, no DROP, no column change, and the
+-- bodies are 163's verbatim apart from the one added line. A rolled-back code
+-- pin runs fine against these -- the clause narrows what promotes and an older
+-- release neither reads nor writes `tasks.source` on this path.
+
+-- (a) a task shipped
+CREATE OR REPLACE FUNCTION promote_dependents_on_ship()
+RETURNS TRIGGER AS $$
+BEGIN
+  IF NEW.status = 'shipped' AND (OLD.status IS DISTINCT FROM 'shipped') THEN
+    UPDATE tasks t
+       SET status = 'ready', promoted_at = COALESCE(t.promoted_at, now()), updated_at = now()
+     WHERE t.status = 'backlog'
+       AND t.kind <> 'spike'
+       AND t.source IS DISTINCT FROM 'cascade'
+       AND EXISTS (
+         SELECT 1 FROM dependencies d
+          WHERE d.to_kind = 'task' AND d.to_id = NEW.id
+            AND ( (d.from_kind = 'task'      AND d.from_id = t.id)
+               OR (d.from_kind = 'goal'      AND d.from_id = t.goal_id)
+               OR (d.from_kind = 'criterion' AND d.from_id IN (
+                     SELECT tc.criterion_id FROM task_criteria tc WHERE tc.task_id = t.id)) )
+       )
+       AND task_is_fully_unblocked(t.id);
+  END IF;
+  RETURN NEW;
+END;
+$$ LANGUAGE plpgsql;
+
+-- (b) a criterion satisfied
+CREATE OR REPLACE FUNCTION promote_dependents_on_criterion_satisfy()
+RETURNS TRIGGER AS $$
+BEGIN
+  IF NEW.satisfied = true AND (OLD.satisfied IS DISTINCT FROM true) THEN
+    UPDATE tasks t
+       SET status = 'ready', promoted_at = COALESCE(t.promoted_at, now()), updated_at = now()
+     WHERE t.status = 'backlog'
+       AND t.kind <> 'spike'
+       AND t.source IS DISTINCT FROM 'cascade'
+       AND EXISTS (
+         SELECT 1 FROM dependencies d
+          WHERE d.to_kind = 'criterion' AND d.to_id = NEW.id
+            AND ( (d.from_kind = 'task'      AND d.from_id = t.id)
+               OR (d.from_kind = 'goal'      AND d.from_id = t.goal_id)
+               OR (d.from_kind = 'criterion' AND d.from_id IN (
+                     SELECT tc.criterion_id FROM task_criteria tc WHERE tc.task_id = t.id)) )
+       )
+       AND task_is_fully_unblocked(t.id);
+  END IF;
+  RETURN NEW;
+END;
+$$ LANGUAGE plpgsql;
+
+-- (c) a goal achieved
+CREATE OR REPLACE FUNCTION promote_dependents_on_goal_achieve()
+RETURNS TRIGGER AS $$
+BEGIN
+  IF NEW.status = 'achieved' AND (OLD.status IS DISTINCT FROM 'achieved') THEN
+    UPDATE tasks t
+       SET status = 'ready', promoted_at = COALESCE(t.promoted_at, now()), updated_at = now()
+     WHERE t.status = 'backlog'
+       AND t.kind <> 'spike'
+       AND t.source IS DISTINCT FROM 'cascade'
+       AND EXISTS (
+         SELECT 1 FROM dependencies d
+          WHERE d.to_kind = 'goal' AND d.to_id = NEW.id
+            AND ( (d.from_kind = 'task'      AND d.from_id = t.id)
+               OR (d.from_kind = 'goal'      AND d.from_id = t.goal_id)
+               OR (d.from_kind = 'criterion' AND d.from_id IN (
+                     SELECT tc.criterion_id FROM task_criteria tc WHERE tc.task_id = t.id)) )
+       )
+       AND task_is_fully_unblocked(t.id);
+  END IF;
+  RETURN NEW;
+END;
+$$ LANGUAGE plpgsql;
+
+-- The triggers themselves are unchanged; 163 created them and CREATE OR REPLACE
+-- above swaps the bodies underneath them in place.

package/modules/lifecycle/db-tasks.js

@@ -1129,8 +1129,36 @@ async function updateTaskStatus(id, status) {
 //
 // The UPDATE repeats the WHERE rather than trusting the ids it just read, so a
 // row that stops qualifying between the two statements is not promoted anyway.
+// 'backlog' MEANS TWO DIFFERENT THINGS, and this sweep may only drain one of
+// them (task 1004077). A task waiting on a TRIGGER — a dependency that has not
+// shipped — is mechanically unblockable, and draining those is what this sweep
+// was built for. A task waiting on a PERSON is a generated REQUEST nobody has
+// triaged, and "no unmet dependency" says nothing about whether a human has
+// looked at it. The system already knows the two are different: /backlog-review
+// exists to "separate rows waiting on a PERSON from rows waiting on a TRIGGER",
+// and it separates them by hand because nothing in the data did.
+//
+// Every cascade row is the second kind. cascade.js files at 'backlog' and never
+// 'ready' — one of the four properties tests/cascade.mjs pins — and the preamble
+// it writes onto every generated task says so to the reader: "it is a REQUEST,
+// filed at backlog, and it goes through the board's ordinary triage".
+//
+// WHAT IT COST. A cascade task carries dependencies: [], so it was trivially
+// "fully unblocked" and qualified the instant it existed. Measured on task
+// 1004037: filed 19:53:57, promoted 19:54:54 — 57 seconds, by this sweep, with
+// no person involved. studio.js:476 reads the artist's queue as
+// `?discipline=artist&status=backlog`, so every artist review was swept out of
+// the artist's room about a minute after arriving and reappeared in
+// /builder-start as ordinary claimable work. All four reviews open on
+// 2026-09-19 had been drained. One was then claimed into a worktree and graded
+// by a panel whose four lenses do not read a sentence (ADR 0298) — an artist
+// review performed without an artist, while the studio sat empty.
+//
+// The exclusion is by SOURCE, not by discipline: engineer-scoping-on-full-idea
+// is equally a request, and the preamble above is written on both.
 const PROMOTABLE_BACKLOG_WHERE = `
    WHERE t.status = 'backlog'
+     AND t.source IS DISTINCT FROM 'cascade'
      AND task_is_fully_unblocked(t.id)
      AND NOT EXISTS (
            SELECT 1

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.895",
+  "version": "1.19.897",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.19.895",
+      "version": "1.19.897",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.895",
+  "version": "1.19.897",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/scripts/gds/gds-literal-scan.js

@@ -88,6 +88,25 @@ const GDS_RULE_FILES = new Set([
 // legal on any line in any counted file.
 const GDS_VERSION_ID_RE = /GDS-V\d+/g;
 
+// An opaque encoded payload is not vocabulary. A committed design mock carries
+// its own content as a base64'd bundle (docs/design/mocks/ideator-surface/
+// ideator-surface.html embeds one in a <script type="__bundler/manifest">), and
+// a three-letter run turns up inside any large base64 blob by chance — five did,
+// which is enough to red the ratchet on a change that introduced no literal at
+// all. The blob cannot be edited to remove them, and the page cannot be
+// committed without it: the manifest IS the page content.
+//
+// So: an unbroken base64-shaped run of 200+ characters is stripped before
+// matching, exactly the way a version id is. The threshold is what makes this
+// safe. The acronym is a WORD wherever it is vocabulary, so it always sits
+// against a boundary — whitespace, punctuation, a case change, an underscore.
+// No line of prose or code reaches 200 unbroken base64 characters, and the
+// blobs that do carry nothing to rename. This is deliberately narrower than a
+// path exclusion on the mocks tree: that tree still counts, so a real literal
+// in a mock's own comment (docs/design/mocks/landing/v1.html:345) is still
+// caught.
+const GDS_ENCODED_BLOB_RE = /[A-Za-z0-9+/=]{200,}/g;
+
 // The literal itself: case-sensitive, so the lowercase path/env spellings that
 // criterion C2 owns (`scripts/gds/`, `/api/gds`, `gds_session`) are counted
 // only where they appear in their SHOUTING form. Case-sensitivity is the point
@@ -105,7 +124,9 @@ function isExcludedPath(relPath) {
 // (the checkErrorEnvelope precedent: a gate whose detector drifts from its
 // sweep is worse than no gate).
 function countInText(text) {
-  const stripped = text.replace(GDS_VERSION_ID_RE, '');
+  const stripped = text
+    .replace(GDS_ENCODED_BLOB_RE, '')
+    .replace(GDS_VERSION_ID_RE, '');
   return (stripped.match(GDS_LITERAL_RE) || []).length;
 }
 

package/scripts/gds/seed-bv2-ideator-surface-tasks.js

@@ -0,0 +1,399 @@
+// Seed the tasks for the ideator surface on goal 1000095 (BONGOS-V2, Working area 6).
+// Source of truth: docs/specs/bongos-v2-ideator-surface.md (status: final).
+// Visual direction: docs/design/ideator-surface-direction.md. Decisions: idea 1001072.
+// Planning session 2026-09-19, meta task 1004076.
+//
+// Idempotent on (source, source_ref). Re-running resolves to the existing rows.
+// criterion_ids are SLUGS, never positional "Cn" — goal 1000095 is one of several
+// goals on this version, so a positional ref resolves against the wrong scope and
+// POST /tasks now refuses it outright (learning 1000188, task 1003108).
+//
+// Ends by diffing the criterion links it planned against what the goal actually
+// carries, and exits non-zero on any mismatch (the seeding contract's self-check).
+//
+// Run: node scripts/gds/seed-bv2-ideator-surface-tasks.js
+const os = require('os');
+const { expectedCriterionCounts, verifySeedCriteriaLinks } = require('./seed-verify-criteria');
+const sess = require(os.homedir() + '/.config/cloudbongos/gds-session.json');
+const BASE = sess.api_base.replace(/\/$/, '');
+const TOKEN = sess.token;
+const VER = 'BONGOS-V2';
+const GOAL = 1000095;
+const SRC = 'planning-session';
+const REF_PREFIX = 'bv2-ideator-surface';
+const H = { Authorization: `Bearer ${TOKEN}`, 'Content-Type': 'application/json' };
+
+const CRIT = {
+  lost: 'ideator-nothing-is-lost',
+  fork: 'ideator-tag-survives-the-fork',
+  sky: 'ideator-sky-tells-the-truth',
+  full: 'ideator-full-idea-shapes-the-space',
+};
+
+const SPEC = 'Spec: `docs/specs/bongos-v2-ideator-surface.md` (final). Design of record: idea 1001072 + `docs/design/ideator-surface-direction.md`.';
+
+const sleep = (ms) => new Promise((r) => setTimeout(r, ms));
+async function api(method, path, body, _tries = 0) {
+  await sleep(400); // base throttle to stay under the per-IP rate limit
+  const res = await fetch(`${BASE}/api/bongos${path}`, {
+    method, headers: H, body: body ? JSON.stringify(body) : undefined,
+  });
+  const text = await res.text();
+  let json; try { json = JSON.parse(text); } catch { json = { _raw: text.slice(0, 300) }; }
+  if (res.status === 429 && _tries < 8) {
+    const wait = ((json.error && json.error.details && json.error.details.retry_after_seconds) || 30) + 1;
+    console.log(`  …rate-limited, waiting ${wait}s`);
+    await sleep(wait * 1000);
+    return api(method, path, body, _tries + 1);
+  }
+  return { status: res.status, ok: res.ok, json };
+}
+
+// TOPOLOGICAL ORDER. The BV2.R## prefix is assigned from this array's index, so
+// for any task A depending on B, B sits earlier and carries the lower number.
+// Nothing else on BONGOS-V2 uses a rank prefix; these 27 carry one so the batch
+// reads in its planned order inside each priority bucket.
+const TASKS = [
+  // ---- T1: the two spikes. Neither auto-promotes (kind='spike', ADR 0015).
+  {
+    ref: 'R07', kind: 'spike', discipline: 'engineer', priority: 5, crit: [CRIT.fork],
+    title: 'Spike: how provenance is recorded without widening the task hierarchy',
+    desc: `Output an ADR naming the edge shape, where it is written, and who writes it when work is split or rewritten.
+
+**The constraint that makes this a spike.** \`modules/lifecycle/hierarchy.js\` caps task parentage at ONE level (a parent may not itself have a parent; a task with children may not become a child) and refuses cross-version trees. Both are deliberate — ship rollup and claim safety lean on them. A descent of the shape idea → task → rewrite → split → removal is four levels and crosses a version boundary, so it cannot ride on that relation, and **widening it is explicitly out of scope** (spec decision 8).
+
+Provenance is a different relation from work decomposition. The expected home is \`ideas_task_lineage\`, which is already many-ideas-to-one-task and carries none of those invariants — but confirm that before assuming it.
+
+**Also settle:** who writes the edge. Parentage today is a manual explicit act, so an edge that depends on someone remembering will have holes. ${SPEC}`,
+  },
+  {
+    ref: 'R14', kind: 'spike', discipline: 'engineer', priority: 5, crit: [CRIT.sky],
+    title: 'Spike: what counts as removed, and who says so',
+    desc: `Output an ADR settling the removal signal: its source, and whether it is derived or declared.
+
+**Nothing records this today.** \`shipped\` is terminal (\`modules/lifecycle/rot.js\` says so in as many words), there is no reverted status, and \`tasks.merged_into_task_id\` is CHECK-constrained to abandoned rows so it can only ever describe work that was cut before it landed. This signal is what lets brightness fall at all.
+
+**The owner's decision (spec decision 13) is the shape, not the detail:** the system PROPOSES and a person CONFIRMS. \`modules/lifecycle/cascade.js\` already implements ship-generates-work and ships with an EMPTY rule set, so the mechanism exists and only the rule is new. A derived-only signal dims the sky for refactors, renames and file moves; a declared-only one rots because nobody remembers.
+
+Nearest existing signal to build the derivation on: \`modules/economy/credits.js\` \`netNegativeBonusAmount\`, which already reads \`lines_removed > lines_added\` from a ship's own diff — the only place the system counts deletion. ${SPEC}`,
+  },
+
+  // ---- Zero-dep surfaces and settings.
+  {
+    ref: 'R01', kind: 'feature', discipline: 'ui', priority: 4, crit: [CRIT.lost],
+    title: 'The receipt persists',
+    desc: `A filing's outcome is stated and survives the next keystroke; the last several outcomes stay reachable on the surface that filed them.
+
+**This is the bug that started the session.** The hall already prints "Filed as task N under <goal>" on a routed capture (\`modules/hall-ui/public/ideas.js\`, the \`#fq-result\` line) — and then clears it the moment the composer is touched again. The signal exists; its half-life is about four seconds.
+
+Done-when: a person files a thought, keeps working, and can still see what became of it without navigating anywhere. ${SPEC}`,
+  },
+  {
+    ref: 'R02', kind: 'feature', discipline: 'ui', priority: 4, crit: [CRIT.lost],
+    title: 'Gravity is visible before release',
+    desc: `The goal that will catch a thought is shown while composing, and letting it float is an explicit choice rather than an empty dropdown.
+
+**No new routing.** \`modules/ideas/routing.js\` \`decideLanding\` already decides this at capture time, and \`GET /goals/suggestions\` already feeds the composer's goal select. This task makes the decision legible at the moment it is made — the invisible dropdown is the direct cause of the confusion this whole scope came from (spec decision 2).
+
+Done-when: before releasing a thought, a person can see which goal will catch it, change it, or deliberately let it float. ${SPEC}`,
+  },
+  {
+    ref: 'R05', kind: 'feature', discipline: 'engineer', priority: 3, crit: [CRIT.lost],
+    title: 'The per-instance dials: the ignite floor and the decay rate',
+    desc: `Both configured rather than constant, sharing one home. Defaults preserve today's behaviour and halving respectively.
+
+**Two dials, one surface** (spec decisions 3 and 16). The ignite floor — who may convert a quick idea directly into claimable work — is today the \`METIC_PLUS\` constant in \`modules/ideas/routing.js\`. The decay rate — how fast an ideator's share falls per hop of the descent — is new in R11. The owner's ruling is that both belong to the project, not to the platform: a project of one wants every thought claimable, a project of fifty wants a nod.
+
+They are scoped together deliberately so a second dial does not grow its own separate home. Do not widen either default as a side effect. ${SPEC}`,
+  },
+  {
+    ref: 'R20', kind: 'feature', discipline: 'engineer', priority: 4, crit: [CRIT.full],
+    title: 'The new five questions as a versioned template',
+    desc: `\`base-v2\` ships beside \`base-v1\`; ideas already filed keep scoring against the questions they were actually asked.
+
+**The owner's question set, in order:** what made you have the idea; scope as best as you can here; what should an engineer or artist know prior to building; how is this long term justified in the project; what does a successful implementation of the idea look like.
+
+**This is cheaper than it looks.** \`modules/ideas/templates.js\` already registers templates by key and every idea stores its \`template_key\`, so this is a second entry in the registry, NOT a migration. Renaming a label is free; only renaming a key would be a data migration, and this does not need to.
+
+One field survives outright (what made you have the idea ≈ \`why_had\`) and one roughly (the long-term justification ≈ \`fit\`). Three are new and one is dropped. ${SPEC}`,
+  },
+
+  // ---- The provenance spine.
+  {
+    ref: 'R08', kind: 'feature', discipline: 'engineer', priority: 5, crit: [CRIT.fork], deps: ['R07'],
+    title: 'Provenance edges on the idea lineage ledger',
+    desc: `task→task descent edges recorded, to arbitrary depth and across version boundaries. The task hierarchy's one-level cap and its cross-version refusal are untouched.
+
+Build to whatever R07's ADR settled. The write side that exists today is \`modules/ideas/inbox.js\` \`linkIdeaTask\`, an upsert on \`(task_id, idea_id)\`; \`ideas_task_lineage\` has been many-ideas-to-one-task since \`ideas_006\`.
+
+**The property that matters:** the tag must survive a rewrite, a split and a merge. If it only survives one hop the result is a link, not a story — and, after R11, someone does not get paid. ${SPEC}`,
+  },
+  {
+    ref: 'R04', kind: 'refactor', discipline: 'ui', priority: 3, crit: [CRIT.lost], deps: ['R01'],
+    title: 'Fold the Full Idea form and the spark queue into the new surface',
+    desc: `Developing a thought is a step taken AFTER a one-line filing, never a gate before it. No dead links from \`/idea/:id\`, the command palette, or the nav.
+
+**What the ideas page actually is today:** three stacked sections — the spark queue ("waiting to be developed"), the quick composer, and the five-field Full Idea composer with its live completeness meter. All three need a home. The Board Room does NOT — it is reached from the left nav and is not behind this page.
+
+**The risk this task carries** (spec decision 18): a spark's whole value is that it costs nothing to have. Folding a five-question form onto the same surface is the most likely way to slow the one-line path. R06a exists to catch that; do not treat it as someone else's problem. ${SPEC}`,
+  },
+  {
+    ref: 'R11', kind: 'feature', discipline: 'engineer', priority: 5, crit: [CRIT.fork], deps: ['R08'],
+    title: 'The ideator payout follows the descent, decayed by depth',
+    desc: `A descendant's ship pays the origin at the decayed rate. Idempotent. Existing first-hop behaviour preserved exactly.
+
+**The seam exists.** \`modules/economy/credits.js\` \`awardIdeaTaskShipCredit\` already resolves a shipped task back to its source idea and splits the payout — but only via the EARLIEST lineage link, one hop. A task split off later, or a child of a child, pays nobody.
+
+**Decay** (spec decision 16): full share at the direct task, halving at each hop, so an infinite descent is worth at most twice the direct task. The rate is a dial (R05), not a constant.
+
+**The boundary that stops farming** (spec decision 7): descendant WORK pays the origin; a separate idea that merely cites the origin does not. The descent displays more than the payout counts. ${SPEC}`,
+  },
+  {
+    ref: 'R09', kind: 'feature', discipline: 'engineer', priority: 4, crit: [CRIT.fork], deps: ['R08'],
+    title: 'The descent reads to arbitrary depth and across versions',
+    desc: `One query, not per-hop round trips.
+
+**Three findings inherited from abandoned task 1004054**, whose predecessor was built, graded and lost. They are free design requirements, not someone else's mess:
+
+1. **Test at the RENDERED layer, not just the data layer.** The prior attempt tested only the server-side trail builder, which is exactly why finding 2 went uncaught.
+2. **A merged idea's triage note lives on the MERGED row, not the target row.** The prior attempt read it from the target, so the headline scenario was the broken one.
+3. **Collapse the hops into one query or a CTE.** The prior attempt ran 4–6 serial round trips per read.
+
+Today's reader is \`modules/ideas/inbox.js\` \`listIdeaTrailForBuilder\`, which returns \`lineage_tasks[]\` — one hop only. ${SPEC}`,
+  },
+  {
+    ref: 'R15', kind: 'feature', discipline: 'engineer', priority: 4, crit: [CRIT.sky], deps: ['R14'],
+    title: 'The cascade rule that proposes a removal',
+    desc: `A ship that deletes an earlier shipped task's work files a QUESTION, not a verdict. \`shipped\` stays terminal and no credit is ever clawed back.
+
+Build to R14's ADR. \`modules/lifecycle/cascade.js\` already implements ship-generates-work and declares an EMPTY rule set — this is the first rule, so expect the mechanism to be sound and unexercised.
+
+**Do not make this a verdict.** The owner chose propose-then-confirm precisely because refactors, renames and file moves all look like deletions to a diff. A rule that marks work removed on its own evidence will dim the sky for reasons that are not real. ${SPEC}`,
+  },
+  {
+    ref: 'R21', kind: 'feature', discipline: 'engineer', priority: 3, crit: [CRIT.full], deps: ['R20'],
+    title: 'Substance floors for the new Full Idea fields',
+    desc: `Floors chosen deliberately for each new field, because the completeness score feeds credits.
+
+\`modules/ideas/completeness.js\` scores against the per-field \`substanceMin\` declared in the template; \`base-v1\` used a flat 40 characters for all five. The new fields are not interchangeable — "scope as best as you can here" and "what made you have the idea" do not deserve the same floor.
+
+**The never-invent-a-field rule gets stronger here, not weaker** (the Ideator pack). The new set is deliberately resistant to ghost-writing: nobody but the filer can answer what made them have the idea. A floor that pushes an agent to pad a thin answer destroys exactly that property. A short answer scores short — that is the scorer working. ${SPEC}`,
+  },
+  {
+    ref: 'R22', kind: 'feature', discipline: 'engineer', priority: 4, crit: [CRIT.full], deps: ['R20'],
+    title: 'A Full Idea carries a recommendation: goal or criterion',
+    desc: `The recommendation is carried from filing through to the board item and shown to voters.
+
+**The ideator does not decide** (spec decision 9). They recommend; the board decides. The reasoning the owner accepted is that scope is the thing you learn last — the person who had the thought writes it, the people reading it judge how big it turned out to be.
+
+The board item payload is \`boardWindowPayload\` in \`modules/ideas/routes/inbox.js\`; the section labels the Board Room renders are a hand-mirror of the template's field keys (\`modules/hall-ui/public/board-room.js\`, test-pinned) — so a template change and a board change move together. **The Board Room's own flow is unchanged.** ${SPEC}`,
+  },
+  {
+    ref: 'R12', kind: 'feature', discipline: 'engineer', priority: 4, crit: [CRIT.fork], deps: ['R11'],
+    title: 'Size is the sum of those payouts',
+    desc: `Computable from the ledger for any idea. Compressed for drawing, with the true figure available.
+
+**Size is credits, not karma** (spec decision 5). \`karma_log\` carries no task key and no idea key — \`migrations/040_builder_karma.sql\` states that this is deliberate — so "the karma a thought caused" is not a quantity that can be computed. Credits are already idea-attributed at ship, so they can.
+
+Size never falls. That is what makes it independent of brightness, and what lets a thought whose work was torn out still render large. Sums are long-tailed, so compress for drawing and show the real number in the panel. ${SPEC}`,
+  },
+  {
+    ref: 'R10', kind: 'feature', discipline: 'ui', priority: 4, crit: [CRIT.fork], deps: ['R09'],
+    title: 'The descent surface on the idea detail page',
+    desc: `One thought at the top, everything it caused falling away below — including the branches that went out.
+
+\`/idea/:id\` (\`modules/hall-ui/public/idea.js\`) is the canonical per-idea record and stays; this is its new section. It already renders a one-line "became task N" outcome, which this replaces with the full story.
+
+Done-when: a person can trace a thing shipped months later back to the line that caused it, through rewrites, splits and merges. See \`docs/design/mocks/ideator-surface/Descent.dc.html\` for the agreed shape — it is a shape, not a pixel contract. ${SPEC}`,
+  },
+  {
+    ref: 'R15a', kind: 'feature', discipline: 'engineer', priority: 4, crit: [CRIT.sky], deps: ['R15'],
+    title: 'Confirming or dismissing a removal proposal',
+    desc: `On the existing awaiting-nod surface, at the same floor as the nod (Metic+, \`task.promote\`). No new permission and no new page.
+
+An unanswered proposal **rots on the normal clock** (spec decision 14) rather than accumulating — \`modules/lifecycle/rot.js\` and the \`GET /inbox/rotting\` feed already exist and this rides them.
+
+The surface is \`modules/hall-ui/public/goal-inbox.js\`, which already renders the awaiting-nod queue and the rot feed side by side. Confirming is what makes brightness fall; dismissing is what stops a refactor from dimming the sky. ${SPEC}`,
+  },
+  {
+    ref: 'R23', kind: 'feature', discipline: 'engineer', priority: 3, crit: [CRIT.full], deps: ['R22'],
+    title: 'Ratify a Full Idea into a goal',
+    desc: `The goal half beside the existing criterion half. One transaction. The five answers land on the goal.
+
+**The criterion half already exists** and is the model to follow: \`modules/ideas/inbox.js\` \`ratifyCriterionProposal\` writes \`done_when_criteria\` + the idea status + karma + the audit row in a single transaction, and \`POST /inbox/:id/ratify\` fronts it.
+
+**Nothing today turns a filed thought into a goal** — goals come from a separate planning act — so this is the genuinely new path of the four in this criterion. \`POST /goals\` validates \`scope_modules\` against the live roster and escalates to Archon for a protected scope; a ratification path has to respect both. ${SPEC}`,
+  },
+  {
+    ref: 'R12a', kind: 'feature', discipline: 'engineer', priority: 4, crit: [CRIT.fork], deps: ['R12'],
+    title: 'Backfill lineage for existing ideas, without backfilling money',
+    desc: `Pre-existing ideas carry a size computed from the descent they actually have. No credits are paid retroactively.
+
+**And the consequence is surfaced, not hidden** (spec decision 17). For those ideas size is NOT a sum of payouts actually made, so it needs a historical marker or the number quietly lies about what it means. The owner chose this deliberately: it makes the sky meaningful on day one without spending credits again on work already paid for once.
+
+Done-when: every idea filed before this shipped has a size, and anywhere that size is shown makes clear which kind of number it is. ${SPEC}`,
+  },
+  {
+    ref: 'R03', kind: 'feature', discipline: 'ui', priority: 3, crit: [CRIT.lost], deps: ['R12'],
+    title: 'The room',
+    desc: `A plain overview of one's own thinking: what was filed, what it became, its size, and whether it still burns.
+
+**This is the page a person opens daily**, and it does the real work — the sky is ambient, the room is useful. It is deliberately unglamorous: rows, a size, a state.
+
+**It is the author's own view. The profile keeps a compact public trail** (spec decision 19) — the two are not the same surface. \`modules/hall-ui/public/profile.js\` already renders an idea trail from \`GET /inbox/by-builder/:id\`; that stays as what someone else sees on you.
+
+See \`docs/design/mocks/ideator-surface/Room.dc.html\` for the agreed shape. ${SPEC}`,
+  },
+  {
+    ref: 'R16', kind: 'feature', discipline: 'engineer', priority: 4, crit: [CRIT.sky], deps: ['R15a', 'R12'],
+    title: 'Brightness — the live share of a descent',
+    desc: `Computable per idea, and it falls when a removal is confirmed.
+
+**Graded, not binary** (spec decision 20): a thought whose descent is five things with three still alive is partly lit, and goes out only when nothing survives. That is what makes a star visibly dim as the project removes pieces of what it caused.
+
+**Brightness never claws back credits.** The ledger is not rewritten when the project changes its mind — only the picture changes. Size, which R12 owns, does not move. ${SPEC}`,
+  },
+  {
+    ref: 'R06', kind: 'verify', discipline: 'engineer', priority: 3, crit: [CRIT.lost], deps: ['R01', 'R03'],
+    title: 'Proof: a thought filed from the hall is traceable an hour later without asking anyone',
+    desc: `**The live demonstration that \`ideator-nothing-is-lost\` is met.**
+
+A person files a thought, leaves, comes back later, and finds what became of it unaided — no asking, no database, no one else's help. If they filed it aimed, they can see which goal caught it; if they let it float, they can see that nothing has claimed it yet.
+
+This is the exact scenario that failed on 2026-09-19 and produced this whole scope: a thought was filed, it silently became a task under a goal, and the person who filed it could not find it five minutes later. The proof is that this can no longer happen. ${SPEC}`,
+  },
+  {
+    ref: 'R06a', kind: 'verify', discipline: 'engineer', priority: 3, crit: [CRIT.lost], deps: ['R04'],
+    title: 'Proof: the one-line path did not get slower',
+    desc: `**The guard on spec decision 18**, which is the decision in this scope carrying the most risk.
+
+Filing a spark takes the same gestures and the same time it does today, with the Full Idea form present on the same surface. Measure it against today's path, not against an impression.
+
+A spark's whole value is that it costs nothing to have. If the fast path picks up an extra step, a scroll, or a decision, this scope will have built something beautiful that people stop using — and they will go back to firing one-liners into Discord. A green build is not the evidence here; a timed comparison is. ${SPEC}`,
+  },
+  {
+    ref: 'R13', kind: 'verify', discipline: 'engineer', priority: 3, crit: [CRIT.fork], deps: ['R10', 'R12'],
+    title: 'Proof: a task split twice pays its origin at the decayed rate and appears in the descent',
+    desc: `**The live demonstration that \`ideator-tag-survives-the-fork\` is met.**
+
+A real thought becomes a real task; that task is split; one of its children is split again; each ships. The origin is paid at the decayed rate at every hop, and the whole chain reads as one descent.
+
+This is the criterion everything else stands on. If the tag dies at the first fork, the descent is a link, the size is wrong, and the sky is decoration over a number that does not mean anything. Demonstrate it on real work, not a fixture. ${SPEC}`,
+  },
+  {
+    ref: 'R17', kind: 'feature', discipline: 'engineer', priority: 4, crit: [CRIT.sky], deps: ['R16'],
+    title: 'The five states resolve from ledger facts',
+    desc: `star / protostar / satellite / remnant / cold body — each DERIVED, none a UI guess.
+
+- **star** — caused work that is still alive
+- **protostar** — filed, not yet ignited. Include the well-vs-open-space distinction: caught by a goal and awaiting a nod is a different state from claimed by nothing, and position is what carries it (spec decision, direction doc)
+- **satellite** — folded into another thought; its value counts there
+- **remnant** — it burned, then the project removed it; it keeps its size
+- **cold body** — declined at triage; it never ignited, so it has no size at all
+
+Done-when: every state is computed from the ledger, and no surface has to infer one. ${SPEC}`,
+  },
+  {
+    ref: 'R24', kind: 'verify', discipline: 'engineer', priority: 3, crit: [CRIT.full], deps: ['R23'],
+    title: 'Proof: a Full Idea ratified as a goal produces a goal carrying its five answers',
+    desc: `**The live demonstration that \`ideator-full-idea-shapes-the-space\` is met.**
+
+A Full Idea is written through the new five questions, carries a recommendation, goes to the Board Room unchanged, is ratified as a GOAL, and the resulting goal carries those five answers natively — scope from "scope as best as you can here", done-when from "what does a successful implementation look like".
+
+Run it end to end through the real Board Room. The point of this criterion is that an ideator's best work becomes the structure other people's thinking lands in; a goal that arrives without its answers has not demonstrated that. ${SPEC}`,
+  },
+  {
+    ref: 'R18', kind: 'feature', discipline: 'ui', priority: 3, crit: [CRIT.sky], deps: ['R17', 'R03'],
+    title: 'The sky',
+    desc: `The ambient view over the five states: size compressed, brightness live, goals as gravity wells and their criteria as the rings inside them.
+
+**It arrives last on purpose.** By this point it draws numbers and states the rest of the work has already produced, which is what keeps it cheap. A galaxy is not trivial, and this scope only earns it because nothing else depends on it.
+
+**It is never the only path to anything it shows** (spec decision 11). Every fact in the sky is reachable from the room or the descent.
+
+See \`docs/design/mocks/ideator-surface/Sky.dc.html\`, and \`docs/design/ideator-surface-direction.md\` for why the project's own design system — a black void and one accent that lights only what is live — already supplies this. ${SPEC}`,
+  },
+  {
+    ref: 'R19', kind: 'verify', discipline: 'engineer', priority: 3, crit: [CRIT.sky], deps: ['R18'],
+    title: 'Proof: a large dead thought renders large and dead',
+    desc: `**The live demonstration that \`ideator-sky-tells-the-truth\` is met**, and the single scenario this criterion exists for.
+
+A thought that caused substantial work which the project has since removed shows at **full size and zero brightness**, and is distinguishable at a glance from a thought that never caused anything at all.
+
+That distinction is the whole reason size and brightness are two channels instead of one number. If those two render alike, the criterion is not met however green the build is. ${SPEC}`,
+  },
+];
+
+async function main() {
+  const ids = {};
+  const criterionIdListsPerTask = [];
+
+  // BASELINE. verifySeedCriteriaLinks unions the plan's slugs with EVERY criterion
+  // the goal carries, so a criterion this seed does not touch is compared against an
+  // expected zero. Goal 1000095 already held six criteria with live task links before
+  // this seed existed, so an unbaselined check would report six false mismatches and
+  // exit(1) on a correct run. Snapshot the untouched criteria's real counts HERE,
+  // before anything is written, and fold them into the plan — the check then still
+  // catches any drift on the four this seed owns, which is what it is for.
+  const OURS = new Set(Object.values(CRIT));
+  const baseline = {};
+  const pre = await api('GET', `/goals/${GOAL}`);
+  if (!pre.ok || !pre.json || !Array.isArray(pre.json.criteria)) {
+    console.error(`Could not read goal ${GOAL} to baseline its existing criteria (status ${pre.status}). Refusing to seed blind.`);
+    process.exit(1);
+  }
+  for (const row of pre.json.criteria) {
+    if (!OURS.has(row.criterion_id)) baseline[row.criterion_id] = Number(row.linked_tasks) || 0;
+  }
+  console.log(`Baselined ${Object.keys(baseline).length} pre-existing criteria on goal ${GOAL}.`);
+
+  console.log(`Seeding ${TASKS.length} tasks into goal ${GOAL} (${VER})…\n`);
+
+  for (let i = 0; i < TASKS.length; i++) {
+    const t = TASKS[i];
+    const rank = String(i + 1).padStart(2, '0');
+    const title = `BV2.R${rank} — ${t.title}`;
+    const r = await api('POST', '/tasks', {
+      version_id: VER,
+      goal_id: GOAL,
+      title,
+      description: t.desc,
+      kind: t.kind,
+      discipline: t.discipline,
+      priority: t.priority,
+      criterion_ids: t.crit,
+      source: SRC,
+      source_ref: `${REF_PREFIX}-${t.ref}`,
+    });
+    if (!r.ok) {
+      console.log(`  ${t.ref} FAILED (${r.status}): ${JSON.stringify(r.json).slice(0, 300)}`);
+      continue;
+    }
+    ids[t.ref] = r.json.task.id;
+    criterionIdListsPerTask.push(t.crit);
+    console.log(`  ${t.ref} → ${r.json.task.id}  ${title.slice(0, 74)}`);
+  }
+
+  console.log('\nWiring dependencies…');
+  for (const t of TASKS) {
+    if (!t.deps || !t.deps.length) continue;
+    const id = ids[t.ref];
+    if (!id) { console.log(`  ${t.ref}: skipped, task was not created`); continue; }
+    const depIds = t.deps.map((d) => ids[d]).filter(Boolean);
+    if (depIds.length !== t.deps.length) {
+      console.log(`  ${t.ref}: WARNING — ${t.deps.length - depIds.length} dep(s) unresolved`);
+    }
+    if (!depIds.length) continue;
+    const r = await api('POST', `/tasks/${id}/dependencies`, { depends_on_task_ids: depIds });
+    console.log(`  ${t.ref} depends on ${t.deps.join(', ')} → ${r.ok ? 'OK' : `FAILED ${r.status} ${JSON.stringify(r.json).slice(0, 180)}`}`);
+  }
+
+  console.log('');
+  await verifySeedCriteriaLinks({
+    goalId: GOAL,
+    expectedCounts: { ...baseline, ...expectedCriterionCounts(criterionIdListsPerTask) },
+    fetchGoal: (gid) => api('GET', `/goals/${gid}`),
+  });
+}
+
+main().catch((e) => { console.error(e); process.exit(1); });

package/src/module-api.js

@@ -71,7 +71,7 @@ const { responsibilityFor, ROLE_RESPONSIBILITIES } = require('./role-responsibil
 // there. scripts/gds/bump-version.js still rewrites the literal below; it appends
 // the entry to that file. Look for a version's history there, not here.
 // ---------------------------------------------------------------------------
-const CORE_VERSION = '1.19.895'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
+const CORE_VERSION = '1.19.897'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('dev-box'); log.info('mounted');

package/tests/fitness_gds_ratchet.mjs

@@ -38,6 +38,24 @@ test('a version id is NOT counted — it is a row key, not vocabulary', () => {
   assert.equal(scan.countInText(`${LITERAL}-V3 and the ${LITERAL} acronym`), 1);
 });
 
+test('an encoded blob is NOT counted — a chance run inside base64 is not vocabulary', () => {
+  // A committed design mock embeds its own page content as one base64 payload,
+  // and three letters turn up inside a large blob by chance. Five did, which
+  // was enough to red the ratchet on a change that introduced no literal at all.
+  const blob = `AAAA${LITERAL}BBBB`.repeat(40); // > 200 unbroken base64 chars
+  assert.ok(blob.length > 200, `the fixture must exceed the threshold, got ${blob.length}`);
+  assert.equal(scan.countInText(blob), 0);
+
+  // …and the strip must not blind the detector to a REAL literal beside it:
+  // the same failure mode the version-id case above guards against.
+  assert.equal(scan.countInText(`the ${LITERAL} acronym, then ${blob}`), 1);
+
+  // A SHORT base64-ish run is still counted. The threshold is what keeps this
+  // safe, so a change that lowers it has to fail here rather than silently
+  // blinding the gate to ordinary identifiers.
+  assert.equal(scan.countInText(`AAAA${LITERAL}BBBB`), 1);
+});
+
 test('the frozen record is excluded — an ADR or session log may say the old name', () => {
   for (const p of [
     'docs/adr/0064-rename.md',

package/tests/promotion_sweep.mjs

@@ -61,6 +61,11 @@ const EXCLUDED = [
   { id: 2000001, title: 'a dependency has not shipped', goal_id: 1000106, why: 'unmetDep' },
   { id: 2000002, title: 'carries an open blocker', goal_id: 1000106, why: 'openBlocker' },
   { id: 2000003, title: 'already out of backlog', goal_id: 1000106, why: 'notBacklog' },
+  // task 1004077. A cascade-filed REQUEST waits on a PERSON, not on a trigger,
+  // so this sweep must never drain it. It is the row most likely to qualify by
+  // accident: cascade.js files with no dependencies at all, so every other
+  // guard here passes it.
+  { id: 2000004, title: 'a cascade request nobody has triaged', goal_id: 1000106, why: 'cascade' },
 ];
 const FIXTURE = [...QUALIFIES, ...EXCLUDED];
 
@@ -69,10 +74,15 @@ function admittedBy(sql, rows) {
   const backlogGuard = /status\s*=\s*'backlog'/i.test(sql);
   const depGuard = /task_is_fully_unblocked\s*\(/i.test(sql);
   const blockerGuard = /task_blockers/i.test(sql) && /b\.status\s*=\s*'open'/i.test(sql);
+  // IS DISTINCT FROM, not <>: source is nullable, and `NULL <> 'cascade'` is
+  // NULL, which would stop promoting every sourceless task instead. A <>
+  // spelling must NOT satisfy this guard.
+  const cascadeGuard = /source\s+IS\s+DISTINCT\s+FROM\s+'cascade'/i.test(sql);
   return rows.filter((r) => {
     if (r.why === 'notBacklog' && backlogGuard) return false;
     if (r.why === 'unmetDep' && depGuard) return false;
     if (r.why === 'openBlocker' && blockerGuard) return false;
+    if (r.why === 'cascade' && cascadeGuard) return false;
     return true;
   });
 }
@@ -135,6 +145,36 @@ await test('a task carrying an open blocker is NOT promoted', async () => {
   assert.ok(!idsOf(out.promoted).includes(2000002), 'and never promoted');
 });
 
+await test('a cascade REQUEST is NOT promoted — it waits on a person, not a trigger', async () => {
+  // task 1004077. This is the regression the whole task exists for. cascade.js
+  // files every generated task at 'backlog' and never 'ready', and tells its
+  // reader it "goes through the board's ordinary triage" — but a cascade row
+  // carries no dependencies, so before this guard it was trivially "fully
+  // unblocked" and this sweep promoted it within a minute of filing. That
+  // emptied the studio, whose queue is `?discipline=artist&status=backlog`:
+  // measured on task 1004037, filed 19:53:57 and promoted 19:54:54.
+  const pool = mkPool();
+  const out = await dbTasks.promoteUnblockedBacklogTasks(pool, { armed: true });
+  assert.ok(!idsOf(out.candidates).includes(2000004),
+    'a cascade request became a promotion candidate — the source guard is gone from the SELECT, '
+    + 'and every artist review will be swept out of the studio about a minute after it is filed');
+  assert.ok(!idsOf(out.promoted).includes(2000004), 'and never promoted');
+});
+
+await test('the cascade guard is in the SQL as IS DISTINCT FROM, not <>', async () => {
+  // Narrow on purpose. `t.source <> 'cascade'` reads as equivalent and is not:
+  // source is nullable and `NULL <> 'cascade'` is NULL, so the <> spelling
+  // stops promoting every task with no source at all — a much larger, much
+  // quieter bug than the one being fixed.
+  const pool = mkPool();
+  await dbTasks.promoteUnblockedBacklogTasks(pool, { armed: true });
+  const select = pool.calls.find((c) => /^\s*SELECT/i.test(c.sql)).sql;
+  assert.match(select, /source\s+IS\s+DISTINCT\s+FROM\s+'cascade'/i,
+    'the SELECT must exclude cascade rows with IS DISTINCT FROM');
+  assert.doesNotMatch(select, /source\s*<>\s*'cascade'/i,
+    'the <> spelling silently withholds every sourceless task instead');
+});
+
 await test('a task already out of backlog is NOT touched', async () => {
   const pool = mkPool();
   const out = await dbTasks.promoteUnblockedBacklogTasks(pool, { armed: true });

package/tests/promotion_triggers_skip_cascade.mjs

@@ -0,0 +1,117 @@
+// tests/promotion_triggers_skip_cascade.mjs
+//
+// The SECOND promoter (task 1004077). Static shape guard for core_250, in the
+// style of tests/task_unblocked_open_blocker.mjs's guard for core_245 — and for
+// the same reason: CI runs a DB-free unit gate, so a migration that has not
+// been applied anywhere is otherwise asserted by nothing at all.
+//
+// WHY THE TRIGGERS NEED THEIR OWN GUARD. tests/promotion_sweep.mjs covers the
+// JS sweep. The sweep is not the only thing that promotes. Each of the three
+// migration-163 trigger functions matches a dependency edge that may be
+// anchored at the task OR AT ITS GOAL (`d.from_kind = 'goal' AND d.from_id =
+// t.goal_id`), and a cascade review INHERITS the reviewed task's goal
+// (cascade.js property 3). So a goal-level edge promotes a cascade row that has
+// no dependencies of its own. Fixing only the sweep would have left that path
+// open and made the defect come back intermittently — which is worse than not
+// fixing it, because an intermittent drain is much harder to see than a
+// constant one.
+//
+// What this proves and where the proof stops: that the SQL in the migration
+// file carries the guard, and that no later migration has silently redefined
+// these functions without it. It does not prove the migration applied. That
+// needs Postgres and is called out in the ship notes rather than papered over.
+//
+// Run:  node tests/promotion_triggers_skip_cascade.mjs
+
+import { strict as assert } from 'node:assert';
+import { readFileSync, readdirSync } from 'node:fs';
+import { dirname, join } from 'node:path';
+import { fileURLToPath } from 'node:url';
+import { makeRunner } from './helpers.mjs';
+
+const __dirname = dirname(fileURLToPath(import.meta.url));
+const repoRoot = join(__dirname, '..');
+const read = (...p) => readFileSync(join(repoRoot, ...p), 'utf8');
+
+const MIG = 'core_250_cascade_requests_do_not_auto_promote.sql';
+
+// The three promotion triggers, by the state transition each reacts to.
+const TRIGGERS = [
+  'promote_dependents_on_ship',
+  'promote_dependents_on_criterion_satisfy',
+  'promote_dependents_on_goal_achieve',
+];
+
+// Comments carry the rationale; strip them before asserting on the executable
+// body so prose can never stand in for the real SQL.
+const body = read('migrations', MIG).replace(/^\s*--.*$/gm, '').replace(/\s+/g, ' ');
+
+// The body of one function, so a guard present in ONE cannot satisfy an
+// assertion about another — the defect this whole task is about was a guard
+// that existed in one place and not the other.
+function fnBody(name) {
+  const start = body.indexOf(`CREATE OR REPLACE FUNCTION ${name}()`);
+  assert.notEqual(start, -1, `${MIG} does not redefine ${name}`);
+  const after = body.slice(start + 1);
+  const next = after.indexOf('CREATE OR REPLACE FUNCTION');
+  return next === -1 ? after : after.slice(0, next);
+}
+
+const { test, summary } = makeRunner();
+
+await test('core_250 redefines all three promotion triggers', () => {
+  for (const name of TRIGGERS) {
+    assert.match(body, new RegExp(`CREATE OR REPLACE FUNCTION ${name}\\(\\)`), `${name} is redefined`);
+  }
+  assert.doesNotMatch(body, /DROP\s+FUNCTION/i, 'CREATE OR REPLACE only — a DROP would take the triggers with it');
+});
+
+await test('each trigger refuses to promote a cascade row', () => {
+  for (const name of TRIGGERS) {
+    assert.match(fnBody(name), /t\.source IS DISTINCT FROM 'cascade'/,
+      `${name} promotes cascade requests — an artist review reached by a goal-level edge is still `
+      + 'swept out of the studio, and the sweep-only fix does not cover it');
+  }
+});
+
+await test('the guard is IS DISTINCT FROM, never <>', () => {
+  // Narrow on purpose, and not a style note. tasks.source is nullable, so
+  // `NULL <> 'cascade'` is NULL and the <> spelling stops promoting every task
+  // with no source at all — a much larger and much quieter bug than the one
+  // being fixed here.
+  for (const name of TRIGGERS) {
+    assert.doesNotMatch(fnBody(name), /t\.source\s*<>\s*'cascade'/,
+      `${name} uses <>, which withholds every sourceless task instead of every cascade one`);
+  }
+});
+
+await test('nothing else was weakened while adding the guard', () => {
+  // core_250 restates whole function bodies, so it inherits only what it
+  // restates — the exact mechanism by which the open-blocker clause was lost
+  // twice (see tests/task_unblocked_open_blocker.mjs). Assert the guards that
+  // were already there survived the retype.
+  for (const name of TRIGGERS) {
+    const fn = fnBody(name);
+    assert.match(fn, /t\.status = 'backlog'/, `${name} still promotes only from backlog`);
+    assert.match(fn, /t\.kind <> 'spike'/, `${name} still skips spikes`);
+    assert.match(fn, /task_is_fully_unblocked\(t\.id\)/, `${name} still re-checks the shared predicate`);
+    assert.match(fn, /status = 'ready'/, `${name} still promotes to ready`);
+  }
+});
+
+await test('core_250 is the LAST definition of each trigger in migrations/', () => {
+  // The drift tripwire, and the assertion that would have caught migration 177
+  // on the day it landed. A later whole-body redefinition inherits only what it
+  // restates, so this fails the moment someone redefines one of these functions
+  // without carrying the cascade guard forward.
+  const files = readdirSync(join(repoRoot, 'migrations')).filter((f) => f.endsWith('.sql')).sort();
+  for (const name of TRIGGERS) {
+    const defines = new RegExp(`CREATE OR REPLACE FUNCTION ${name}\\(\\)`);
+    const defs = files.filter((f) => defines.test(read('migrations', f)));
+    assert.ok(defs.includes(MIG), `${MIG} defines ${name}`);
+    assert.equal(defs[defs.length - 1], MIG,
+      `a later migration redefines ${name} and must restate the cascade guard: ${defs.join(', ')}`);
+  }
+});
+
+summary('promotion-trigger cascade guard');

package/tests/task_unblocked_open_blocker.mjs

@@ -113,10 +113,22 @@ await test('every OTHER gate still spells "open" the same way', () => {
   // predicate is fixed that guard is belt-and-braces — and it stays, because a
   // sweep that mass-promotes must not inherit a single point of failure from a
   // predicate that has already been reverted twice.
+  // Asserted as the TWO things this test names, not as one verbatim copy of the
+  // whole clause. The literal pin that used to stand here broke on task
+  // 1004077, which ADDED a guard (`t.source IS DISTINCT FROM 'cascade'`) — a
+  // strictly stronger predicate that this test then reported as a regression.
+  // A pin that reds when the clause gets SAFER is testing the string, not the
+  // rule. Both halves are still asserted independently, so neither can be
+  // dropped quietly.
+  const sweepClause = (code('modules', 'lifecycle', 'db-tasks.js')
+    .match(/PROMOTABLE_BACKLOG_WHERE = `([^`]*)`/) || [])[1];
+  assert.ok(sweepClause, 'PROMOTABLE_BACKLOG_WHERE is no longer a single template literal');
+  assert.match(sweepClause, /task_is_fully_unblocked\(t\.id\)/,
+    'the sweep still calls the shared predicate');
   assert.match(
-    code('modules', 'lifecycle', 'db-tasks.js'),
-    /PROMOTABLE_BACKLOG_WHERE = ` WHERE t\.status = 'backlog' AND task_is_fully_unblocked\(t\.id\) AND NOT EXISTS \( SELECT 1 FROM task_blockers tb JOIN blockers b ON b\.id = tb\.blocker_id WHERE tb\.task_id = t\.id AND b\.status = 'open'\)`/,
-    'the sweep still calls the predicate AND keeps its own open-blocker guard'
+    sweepClause,
+    /NOT EXISTS \( SELECT 1 FROM task_blockers tb JOIN blockers b ON b\.id = tb\.blocker_id WHERE tb\.task_id = t\.id AND b\.status = 'open'\)/,
+    'and keeps its OWN open-blocker guard rather than inheriting the predicate as a single point of failure'
   );
 });