@bongos/core 1.19.914 → 1.19.916

package/.bongos-core.json

@@ -2,22 +2,22 @@
   "artifact": "bongos-core",
   "manifest_schema": 1,
   "generator": "scripts/gds/package-core.js",
-  "core_version": "1.19.914",
-  "core_contract": "1.19.914",
-  "source_commit": "81b80cbc81505afaf295f223d65f33b098524874",
+  "core_version": "1.19.916",
+  "core_contract": "1.19.916",
+  "source_commit": "47aafa7b40067f457043c59439b6f75ce58010b7",
   "source_ref": "HEAD",
-  "built_at": "2026-09-20T16:45:54.496Z",
+  "built_at": "2026-09-20T17:23:41.647Z",
   "redaction": {
     "model": "docs-redacted+functional-verbatim",
-    "docs_redacted": 504,
+    "docs_redacted": 505,
     "agent_docs_stubbed": 26,
-    "functional_verbatim": 2287,
+    "functional_verbatim": 2294,
     "rules": 3,
     "gate_literals": 3,
     "gate": "passed"
   },
-  "file_count": 2817,
-  "tree_sha256": "1f2169776959966454ca4ed89eb86b91320d410e2212011cb5abd19639550c6a",
+  "file_count": 2825,
+  "tree_sha256": "9fb2e229c3f92268ce44fe9fe75818d005889103f22ac2bf06d12ecfe2e86d84",
   "files": [
     {
       "path": ".claude/skills/ask-for-help/SKILL.md",
@@ -2069,10 +2069,15 @@
       "mode": "0000644",
       "sha256": "bc9dde45a33790e4fbce47682a5734a1adaf4fdd7f9347bb0128c6cca6fcf4e5"
     },
+    {
+      "path": "docs/adr/0316-the-ignite-floor-is-not-the-trusted-tier.md",
+      "mode": "0000644",
+      "sha256": "d0597a50d8f9a23c8d6c81a595fe6af73640cf574ae32f64730078ac7e19c7a5"
+    },
     {
       "path": "docs/adr/README.md",
       "mode": "0000644",
-      "sha256": "a6bf1805ee02ca941a1910d722cfc61e4f0e519aa79c9d102aadfb8bf7d95a5a"
+      "sha256": "005b960dede2131ea0e2f3b81afcb119d7b65ddb6ed81bb246896eff64a69320"
     },
     {
       "path": "docs/api-reference.md",
@@ -2642,7 +2647,7 @@
     {
       "path": "docs/module-api-changelog.md",
       "mode": "0000644",
-      "sha256": "b47e1d07dc8f26cc6a93d8c0af9ced52c80949e0d118c68acb6f6408024b40f2"
+      "sha256": "ef9352b603ffafd1863959527fd70807e22baeee2daf3234155f0215e8b7c42c"
     },
     {
       "path": "docs/modules-contract.md",
@@ -4272,7 +4277,7 @@
     {
       "path": "modules/government/board.js",
       "mode": "0000644",
-      "sha256": "68bf53ab31ec3f21359665eea42127f1691b8dc17b59100c65cc1f56a04ad6a7"
+      "sha256": "88a52649894a03171ae46d6e517b9828923e033eaf161f387c7434cd78871750"
     },
     {
       "path": "modules/government/catalog.js",
@@ -5334,11 +5339,21 @@
       "mode": "0000644",
       "sha256": "07e5666362c91f92d34388b4f6f4507cc5387866d317970478e6cae417c19975"
     },
+    {
+      "path": "modules/ideas/config.js",
+      "mode": "0000644",
+      "sha256": "70caf7fe901380679ec4a418056e2688efe4afe26d6d5a6058ff64fa36445109"
+    },
     {
       "path": "modules/ideas/descent.js",
       "mode": "0000644",
       "sha256": "778558f148d8b403b64f0714b27436b08c41ae0d21ed18b4ed73939928e05cd4"
     },
+    {
+      "path": "modules/ideas/grades.js",
+      "mode": "0000644",
+      "sha256": "a445024a9da1f91d1b5842066599e12422f6252a71fd0c30c4a60c2ecfb6ae51"
+    },
     {
       "path": "modules/ideas/homeless-home.js",
       "mode": "0000644",
@@ -5347,12 +5362,12 @@
     {
       "path": "modules/ideas/inbox.js",
       "mode": "0000644",
-      "sha256": "ff6c0346215d1b88309c4c9360cd60c59299b21b45e27cce09c4b748bf3411e1"
+      "sha256": "85d629f2ac8ad36dd7dfd274a95ac40d9a7dfe3501dbff207dedc7846d981e53"
     },
     {
       "path": "modules/ideas/landing-preview.js",
       "mode": "0000644",
-      "sha256": "912c7007c534a198adce9c83a56e39da8a1475bfe5b09b2a6fe1ff8914d775c9"
+      "sha256": "735571069c131d0ee9f88b0925b5dc50c0583f295220027ab88e791bc940fe3c"
     },
     {
       "path": "modules/ideas/migrations/ideas_001_grades.sql",
@@ -5399,6 +5414,21 @@
       "mode": "0000644",
       "sha256": "80faf8d20df4f051000460a0453472bd1a177ca4e9e9a31e8c5b7f3065575995"
     },
+    {
+      "path": "modules/ideas/projection.js",
+      "mode": "0000644",
+      "sha256": "2548cb8ac60664efaf11221333d445bb3ce07365b7e98d64f041cef60fd2fd53"
+    },
+    {
+      "path": "modules/ideas/ratify.js",
+      "mode": "0000644",
+      "sha256": "2988a93940cd1eba73fb0c9e04f8326108466ba81901f86b3768b29115f17237"
+    },
+    {
+      "path": "modules/ideas/reads.js",
+      "mode": "0000644",
+      "sha256": "d7a55415e6fdfca47bca5579ceac0e877de0b1a041b5173253f43d3a9a90d1b4"
+    },
     {
       "path": "modules/ideas/routes/blockers.js",
       "mode": "0000644",
@@ -5412,7 +5442,7 @@
     {
       "path": "modules/ideas/routing.js",
       "mode": "0000644",
-      "sha256": "da653f475d6c91db8e84bff46c797bb68b61e48d561eacf7bfd228a119ac7266"
+      "sha256": "ec26fc6a2481e1f13d1141f6f1248132ed282f73ddba37c525af5ecae7fd1f0e"
     },
     {
       "path": "modules/ideas/skill-friction.js",
@@ -5434,6 +5464,11 @@
       "mode": "0000644",
       "sha256": "f1e60dbc8c6dc0e9f5f5cb93bf26c659422503e8ec66937a3dcee5b64971e995"
     },
+    {
+      "path": "modules/ideas/trail.js",
+      "mode": "0000644",
+      "sha256": "35dfa6abb78efdac695b89805d660ff4bb0e0d2bc2587f0d1945310dcffb2980"
+    },
     {
       "path": "modules/lifecycle/CLAUDE.md",
       "mode": "0000644",
@@ -7797,12 +7832,12 @@
     {
       "path": "package-lock.json",
       "mode": "0000644",
-      "sha256": "7a0bf95c593548a4af11e8cacd4e79ab9b72edc7fff191c5922e0b0e04959393"
+      "sha256": "6da05875d670e2a4abe086ff6b24c3dd762dbb82943a155050be68774fde0516"
     },
     {
       "path": "package.json",
       "mode": "0000644",
-      "sha256": "f0ee3eff2afb0f48e77843723d28397dfd39e06149216d8e41e05cf3d73fd698"
+      "sha256": "68a643c532ef428f18f6232a001fad93cceeb3f8af6ef1f4f5b853e21cd52163"
     },
     {
       "path": "public-docs/index.html",
@@ -9802,7 +9837,7 @@
     {
       "path": "src/module-api.js",
       "mode": "0000644",
-      "sha256": "6002aa90924229eb6418bed7f42c380a0c3de8f15f77a0381b44270f37b7dad0"
+      "sha256": "df4b0f103f4790210ad2f94b8431893d4ff4e43faa88004ddb952b25cf1735b8"
     },
     {
       "path": "src/module-loader/catalog.js",
@@ -11812,7 +11847,7 @@
     {
       "path": "tests/idea_cascade.mjs",
       "mode": "0000644",
-      "sha256": "e14c3157cd9c1a5889fa2d5cc90bc036d5b9f3aa1e062bb13623a01adb81d20c"
+      "sha256": "7e49b96f4c3365b0d7240d92775022fdea988049d30041885e13eca61f18e5b1"
     },
     {
       "path": "tests/idea_completeness.mjs",
@@ -11959,6 +11994,11 @@
       "mode": "0000644",
       "sha256": "c7ba20839a7b33df0eb7e8bfc2f463217e7d3a538d888e89774107d55d34556d"
     },
+    {
+      "path": "tests/ideas_config.mjs",
+      "mode": "0000644",
+      "sha256": "35334314ea15cfa5cd262c18def917bea04f569cfa52a0a86b663710de2bd172"
+    },
     {
       "path": "tests/idp_device_exchange.mjs",
       "mode": "0000644",

package/docs/adr/0316-the-ignite-floor-is-not-the-trusted-tier.md

@@ -0,0 +1,98 @@
+# ADR 0316 — The ignite floor is a scheduling dial, not the trusted tier
+
+- **Status:** Accepted
+- **Date:** 2026-09-20
+- **Task:** 1004084 (BV2.R05) · goal 1000095 · spec `docs/specs/<redacted>.md` decisions 3 and 16
+- **Supersedes nothing.** Narrows how spec decision 3 is to be read.
+
+## Context
+
+BV2 decision 3 makes the **ignite floor** — who may turn a quick idea directly into
+claimable work — a per-instance setting: "a project of one wants every thought
+claimable; a project of fifty wants a nod." Decision 16 adds a second dial, the
+**descent decay rate**, and rules that the two should share one home rather than
+growing separately.
+
+Both the spec and the seeded task described the implementation the same way: the
+ignite floor *is* the `METIC_PLUS` constant in `modules/ideas/routing.js`, so this
+is "a setting, not a refactor."
+
+Tracing the code before building showed that premise is false. `METIC_PLUS` is
+spelled once but **read for four semantically different gates**:
+
+1. `decideLanding`, the homeless-bug branch — land at `ready` or at `backlog`.
+2. `decideLanding`, the goal-carrying bug branch — the same split.
+3. `mayProposeCriterion` (and the 403 in `routes/inbox.js`) — who may file a
+   `kind='criterion-proposal'`, a planning-scope write that reshapes a version's
+   scope-truth.
+4. The protected-scope wall in `authorizeRoutedLanding` — who may route work into
+   the permission / ship-grade / deploy / migration core.
+
+Only (1) and (2) are the ignite floor. Making the *constant* configurable, as
+written, would mean an instance setting its floor to `xenos` — precisely the
+"project of one" case the owner asked for — would **also** grant every Xenos the
+right to file criterion-proposals and to put rows into the protected core's queue.
+
+The codebase already said so, in three places, and none of them had been read into
+the spec:
+
+- `routing.js` at the constant's definition: "It grants nothing — the server-side
+  rank floor and the goal's scope wall are separate, load-bearing gates."
+- The protected-scope branch: "the two are layers, not alternatives."
+- `tests/filing_abuse_matrix.mjs` models the widening as an **attack**, recording
+  in its header that "METIC_PLUS widened to include xenos ... 4 of 23 fail", and
+  pinning the literal.
+
+## Decision
+
+**The ignite floor is a separate dial from the trusted tier, and only the dial is
+configurable.**
+
+- A new per-instance config home, `modules/ideas/config.js` +
+  `config/ideas.neutral.json`, carries both dials. Precedence mirrors
+  `modules/government/config.js`: env override → `config/ideas.json` at the
+  **instance** root → `config/ideas.neutral.json` at the **core** root. The
+  dual-root split matters here for the reason ADR 0268 records.
+- `igniteFloor` defaults to `metic`, which resolves to exactly the `METIC_PLUS`
+  set, so the default is a true no-op. It is threaded into `decideLanding` as a
+  ready-made `trustedRanks` Set by the callers, keeping `routing.js` pure and
+  free of both config and DB.
+- `descentDecayRate` defaults to `0.5`. R11 is its intended consumer and has not
+  landed, so it ships as a contract with no production caller — the same
+  deliberate slice boundary `modules/government/config.js` documents for itself,
+  and what decision 16 asked for when it said the two dials should share one home.
+- **`METIC_PLUS` stays a fixed constant** for gates (3) and (4). Neither takes a
+  floor argument, and `tests/ideas_config.mjs` asserts structurally that
+  `authorizeRoutedLanding`'s signature never grows one.
+
+## Consequences
+
+- An instance may open its ignite floor all the way to `xenos` without opening any
+  authority surface. The worst a wide-open floor can do is put a row at `ready`
+  that a human can move back to `backlog`.
+- The `filing_abuse_matrix` pin on the `METIC_PLUS` literal stays green and is not
+  to be relaxed. A future change that needs to relax it is almost certainly the
+  widening this ADR exists to refuse.
+- `modules/ideas/config.js` derives the rank ladder from `api.LIVE_RANK_LADDER`
+  on the doorway. The first cut restated it as a literal, reasoning that the file
+  must resolve at load with no port wired; `tests/rank_tier_single_source.mjs`
+  rejected that — a ladder array literal in a tracked `src`/`modules`/`scripts`
+  file fails CI unless allowlisted — and it was right to. The doorway value is a
+  lazy getter over the kernel this module's callers already load, so deriving
+  costs nothing and removes the drift risk instead of merely detecting it.
+- Spec decision 3's phrase "spelled in one place, so this is a setting, not a
+  refactor" should be read as describing the *intent*, not the mechanism. The
+  spec was not edited; this ADR is the correction of record, and the task
+  description was amended in-flight to match.
+
+## Alternatives considered
+
+- **Make `METIC_PLUS` itself configurable, as written.** Rejected: it is a
+  security widening wearing a config file's clothes, and the repo's own tests
+  already classify it as an attack.
+- **Split `METIC_PLUS` into four named constants and configure one.** Rejected as
+  more churn than the decision needs — the other three gates want the *same* fixed
+  tier, and giving them separate names invites someone to configure them later.
+- **Have `routing.js` read the config itself.** Rejected: it would make the
+  landing matrix non-pure and file-system-dependent, and would remove the
+  callers' ability to be tested at a different floor.

package/docs/adr/README.md

@@ -406,4 +406,5 @@ This keeps the decision history honest and traceable.
 | 0312 | [**Provenance is a SECOND ideas-owned edge table, written by the seams that already know** ([task 1004080](https://cloudbongos.com/builders#/task/1004080), goal 1000095 — BONGOS-V2). The spike [ADR 0311](0311-an-idea-is-a-permanent-origin-tag.md) deferred: how the descent edges are physically recorded. A descent (`idea → task → rewrite → split → removal`) is four levels deep and crosses a version boundary, and the task hierarchy refuses both — `attachParent` enforces `SELF_PARENT`, `VERSION_MISMATCH`, `PARENT_HAS_PARENT` and `TARGET_HAS_CHILDREN`, all load-bearing for ship rollup and claim safety. The spike was told to CONFIRM `ideas_task_lineage` rather than assume it, and confirmed one half while refuting the other: the table is right as the **idea→task anchor** (bipartite, no depth cap, no version predicate) but CANNOT carry the task→task edge, because a derivation is a property of the task PAIR and [ADR 0236](0236-many-ideas-one-task-the-lineage-key-is-the-pair.md) made co-source ideas both legal and common — a `derived_from_task_id` column would write the same derivation once per co-source idea and let two rows disagree about where a task came from, the same under-keying that silently lost attribution on prod once already. A merge also gives a task SEVERAL parents, so the relation is a **DAG, not a tree**. Decision: a new `ideas_task_descent` (`task_id`, `parent_task_id`, CHECK'd `relation`, PK on the pair, indexed both ways), with NO depth cap and NO version predicate, and **cycles refused at write time** because the payout walks this graph and a cycle is a non-terminating walk rather than a cosmetic error. On who writes it — the question the task actually set, since an edge depending on memory will have holes — **three seams already know and none is telling anyone**: `cascade.js` encodes the originating task id inside `source_ref` as a STRING nothing can join on, `tasks.merged_into_task_id` already records the fold, and `parent_task_id` already records the split. Only `rewrite` and cross-version `merge` stay manual, which is honest — they are editorial acts with no automatic signal, and their absence degrades the picture rather than corrupting it. What it fixes: `sourceIdeaForTask` and `awardIdeaTaskShipCredit` are both one-hop `LIMIT 1` point reads, so a DERIVED task resolves to `no_source_idea` and the origin is not paid at all. Does not decide: the decay rate beyond its default, what counts as removed ([ADR 0313](0313-a-removal-is-proposed-by-the-ship-and-confirmed-by-a-person.md)), or how any of it is drawn.](0312-provenance-is-a-second-ideas-owned-edge-table.md) | ideas / lifecycle |
 | 0313 | [**A removal is derived from the SERVER's own merge diff and confirmed by a person** ([task 1004081](https://cloudbongos.com/builders#/task/1004081), goal 1000095 — BONGOS-V2). The other half [ADR 0311](0311-an-idea-is-a-permanent-origin-tag.md) deferred: what counts as removed, so that brightness can fall at all. Nothing records it today — `shipped` is terminal (`rot.js` says so outright) and `merged_into_task_id` is CHECK'd to `abandoned` rows, describing only work cut BEFORE it landed. Owner decision 13 set the shape (system proposes, person confirms); this settles the detail, and corrects two premises the task was written on. **`cascade.js` is no longer empty** — it carries a production rule and [ADR 0242](0242-a-cascade-is-a-declaration-table-on-the-event-that-already-exists.md) fixed the contract (append an entry, never touch the runner), so there is a precedent to copy including its anti-recursion guard. **`netNegativeBonusAmount` cannot be the trigger** despite being the named nearest signal: it is an aggregate with NO TARGET (it says deletion happened, never what or whose), it is CLIENT-SUPPLIED via `signals.diff_stats`, and `grader-score.js` already documents the forgery it defends against — and brightness sits beside a payout, so a forgeable target-less counter cannot carry it. **Nothing durable records what any ship touched**: `committed_files` and `diff_stats` are client-supplied at grade time and never persisted, `touches[]` is advisory ([ADR 0049](0049-split-parallel-safety-contract.md)), so a removal cannot be reconstructed from history — only derived as a ship lands. Decision: derive it from the SERVER's own merge diff ([ADR 0055](0055-server-mediated-branch-publish.md) — the server holds the repo and does the merge, so it computes the diff rather than being told one), and attribute the deleted hunks through **`claims.published_head_sha`** (`migrations/171`), NOT by parsing `(task NNNN)` out of commit text — only 7 of `main`'s last 15 commits carry a task id, and a convention that holds most of the time cannot underwrite a payout. An UNATTRIBUTABLE deletion files nothing: a wrong proposal costs attention and dims a real star. A rename, a move and a rewrite-in-place are NOT removals, and a cold body is not a remnant — removal applies only below a task that actually shipped. The proposal is an appended `CASCADES` entry filing a QUESTION; confirmation is Metic+/`task.promote` on the existing awaiting-nod surface; an unanswered one rots on the normal clock. Only a CONFIRMED proposal dims a star. The derivation must be NON-BLOCKING — landing work matters more than dimming a star on time. Brightness can only fall forward from here, so historical sizes need a marker or the number lies.](0313-a-removal-is-proposed-by-the-ship-and-confirmed-by-a-person.md) | ideas / lifecycle |
 | 0314 | [**A module owns a protected path without the whole module becoming protected** ([task 1004070](https://cloudbongos.com/builders#/task/1004070), goal 1000095 — BONGOS-V2). Three modules derive `protected` — and so are Archon-only to scope a goal to — because of ONE file that is not their domain: `onboarding` on `scripts/gds/setup.js`, `autonomy` on `scripts/gds/conductor-dispatch.js`, `copy-desk` on `scripts/gds/copy-inventory.js`. The owner chose *narrow what counts as protected*; the task set the fork and required the choice be justified before any glob moved. **Deleting the glob is out**: `MODULE_GLOBS` is also the territory deciding who may AUTHOR a task on a path, and the shared floor is only `tests/`, so an unowned path is authorable by no goal at all. That left reassigning each CLI to an already-protected module — **measured, not reasoned about**, by applying the edit to the source and re-requiring in a fresh process (`MODULE_SCOPE_MAP` is frozen and built from a COPY of `MODULE_GLOBS` at load, so an in-process mutation proves nothing and passes green). The measurement kills it: `copy-desk` and `autonomy` lose the ability to author on their own generator and their own conductor, and — the row that decides it — `devsecops` as the new owner **cannot author the generator together with the two artifacts it writes**, because `docs/copy-registry.json` and `docs/copy-inventory.md` stay `copy-desk`'s. So *change a UI string, regenerate the registry* becomes authorable by no single goal, and that is the ship-check freshness gate every UI task hits. Decision: **protection becomes per-path at the goal-scope wall, as it already is at the other three** — `matchProtected` decides task-authoring, the grader and gate decide ship, the post-push audit decides the dishonest case; only goal-creation asked about the MODULE, and that inconsistency is the whole defect. The derivation stays computed from `PROTECTED_GLOBS` and no flag is hand-set ([ADR 0086](0086-goal-scoped-work-hierarchy.md) §7 / SEC #863), and the Metic floor on those paths does not move. **Corrects the task's own numbers**: 12 of 26 modules derive protected, not 11, and `agents` (protected by `modules/agents/`, itself a protected glob) is absent from its list of seven — which is why the one thing this ADR SHIPS is a test pinning the full protected key set **by name**, a count assertion passing on the wrong twelve being exactly how that drifted. Implementation is deferred to task 1004109, per the task's own instruction to stop after the ADR. Also filed: `builder-settings` (task 1004110), whose overlap rides the blanket `src/bongos/routes/` prefix and so needs either the `me.js` strangler move or its own security ADR; and **nine protected paths owned by no module at all** (task 1004111) — the freshness generators, the merge-driver pair and `cli-lib.js` among them — found while checking whether deletion was viable, a pre-existing hole rather than one this opens. Does not decide: the floor a protected path carries, whether `scripts/gds/` deserves a shared-floor entry the way `tests/` has one, or how the nine unowned paths get a home.](0314-module-protection-is-per-path-not-per-module.md) | modules / permissions |
+| 0316 | [**The ignite floor is a scheduling dial, not the trusted tier** ([task 1004084](https://cloudbongos.com/builders#/task/1004084), goal 1000095 — BONGOS-V2). BV2 decision 3 makes the ignite floor — who may turn a quick idea straight into claimable work — a per-instance setting, and decision 16 adds the descent decay rate beside it, the two to share one home. Both the spec and the seeded task described the mechanism the same way: the floor IS the `METIC_PLUS` constant in `modules/ideas/routing.js`, so this is "a setting, not a refactor". Tracing the code before building refuted that: `METIC_PLUS` is spelled once but READ for four semantically different gates — the two `decideLanding` bug branches (land at `ready` or at `backlog`), `mayProposeCriterion` (who may file a `kind='criterion-proposal'`, a planning-scope write), and the protected-scope wall in `authorizeRoutedLanding` (who may route work into the permission / ship-grade / deploy / migration core). Only the first two are the ignite floor, so making the CONSTANT configurable would mean an instance setting its floor to `xenos` — exactly the "project of one wants every thought claimable" case the owner asked for — ALSO gaining the right to file criterion-proposals and to breach the protected core. The codebase already said so in three places nobody had read into the spec: the constant's own header ("It grants nothing — the server-side rank floor and the goal's scope wall are separate, load-bearing gates"), the protected-scope branch ("the two are layers, not alternatives"), and `tests/filing_abuse_matrix.mjs`, which models the widening as an ATTACK and pins the literal. Decision: a separate dial. `modules/ideas/config.js` + `config/ideas.neutral.json` carry both knobs on the `modules/government/config.js` precedence (env -> instance root `config/ideas.json` -> core root neutral; the ADR 0268 dual-root split matters, since one root reads the host pack out of `node_modules` where `npm ci` erases it). `igniteFloor` defaults to `metic`, resolving to exactly the `METIC_PLUS` set, and is threaded into `decideLanding` as a ready-made `trustedRanks` **Set** by the callers — `routing.js` is TOLD the floor and never reads config, staying pure and DB-free — while `METIC_PLUS` stays a FIXED constant for the other two gates, neither of which takes a floor argument (pinned structurally). `descentDecayRate` defaults to 0.5 and ships with no production caller, because R11 is its intended reader and depends on the unbuilt R08 — the same deliberate slice boundary `modules/government/config.js` documents for itself, and what decision 16 asked for. Everything fails to VANILLA rather than dead: a malformed pack, an unknown rank or an out-of-band rate falls back, and an unrecognised floor yields the DEFAULT set, never an empty one (failing closed would stop every ignition on a typo). Rejected: configuring `METIC_PLUS` as written (a security widening in a config file's clothes); splitting it into four named constants (the other three want the same fixed tier, and naming them invites configuring them); having `routing.js` read the config itself (makes the landing matrix impure and untestable at a different floor). Spec decision 3's "spelled in one place" describes the intent, not the mechanism; the spec was not edited and the task description was amended in flight.](0316-the-ignite-floor-is-not-the-trusted-tier.md) | ideas / permissions |
 | 0315 | [**A plane with no proxy is refused, not given a no-op ingress** ([task 1004017](https://cloudbongos.com/builders#/task/1004017), goal 1000106 — BONGOS-V2). The piece [ADR 0306](0306-instance-supervision-is-a-seam-with-systemd-as-the-default.md) explicitly deferred: the self-host image ships no proxy, so provisioning step 6's `<slug>.caddy` snippet write and `systemctl reload caddy` cannot work there and a child instance gets no front door. **Two failure shapes, only one visible**: a DOMAINED child already half-refused, because `caddy adapt` fails with no binary and [ADR 0303](0303-provisioning-verifies-the-base-caddyfile-and-never-edits-it.md)'s own catch turns that into a gap — but the message told the operator to add a directive to `/etc/caddy/Caddyfile`, a file the container does not have and that ADR 0303 §1 forbids provisioning from creating; a DOMAINLESS child skipped that preflight entirely (it is gated on `inst.domain`), reached step 6 and died on the `sudo` write, an uncaught throw that bypasses the `{ok:false}` pending-retry path and hard-errors the instance on attempt one — a crash recorded where a refusal was the honest answer. Decision: `ingressPlaneGap(exec)` probes the plane with `caddy version` — one cheap unprivileged read, the same posture as `checkCaddyWiring` — and both standup legs refuse with `Ingress preflight failed: …`, deliberately NOT domain-gated, because the domainless child is the one 0303 could not see. **Only a missing binary proves there is no proxy**: under remote exec `boxExec` is `ssh <host> bash -s`, so an unreachable co-hosting box throws here too, and diagnosing a network blip as 'this plane has no proxy, provision elsewhere' would be a confident wrong answer that burns the intent's retry budget — exit 127 is read as proof, anything else answers 'could not confirm a reverse proxy on this plane' with the real cause leading. The three refusals are ordered **capacity → ingress → wiring**, cheapest and most fundamental first and all before any mutation, which moves 0303's preflight behind the ADR 0285 capacity measurement; both still refuse before anything changes, so only the precedence between two refusals moves. **No ingress seam and no no-op backend**, despite the obvious symmetry with 0306: a `none` implementation whose `writeSite`/`reload` are no-ops lets the standup SUCCEED while leaving the child unreachable — neither half of the task's done-when, and exactly the silently-broken instance it exists to prevent. Does not decide: what a child's front door IS on a container plane (a published port, a bundled proxy, an explicit localhost-only shape) — a future ADR that adds one replaces this refusal rather than extending it. Teardown is left alone on purpose: it already reloads `allowFail`, and refusing there would strand a row instead of cleaning it.](0315-a-plane-with-no-proxy-is-refused-not-given-a-no-op-ingress.md) | provisioning / ingress |

package/docs/module-api-changelog.md

@@ -2302,5 +2302,9 @@ is load-bearing: the script throws rather than guess if it is missing, and
         landed since 1.19.912 with no explicit bump. run 35523207325. (task 1002620)
   1.19.914 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
         landed since 1.19.913 with no explicit bump. run 35523700531. (task 1002620)
+  1.19.915 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+        landed since 1.19.914 with no explicit bump. run 35524223153. (task 1002620)
+  1.19.916 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+        landed since 1.19.915 with no explicit bump. run 35525694524. (task 1002620)
 ---------------------------------------------------------------------------
 ```

package/modules/government/board.js

@@ -171,7 +171,7 @@ async function emitItemClosed(closed, { cause, votes } = {}) {
 const FULL_IDEA_SECTION_KEYS = Object.freeze(['purpose', 'big_picture', 'why_had', 'why_matters', 'fit']);
 
 // Author karma on RATIFICATION: +3, mirroring the criterion-proposal ratify
-// award (modules/ideas/inbox.js KARMA_RATIFY_DELTA — tuned down from +5 in
+// award (modules/ideas/ratify.js KARMA_RATIFY_DELTA — tuned down from +5 in
 // V3.R28; the +5 still printed in planning-session/SKILL.md and openapi.json is
 // STALE, do not copy it). Ratification is the CLOSE outcome, so R10's tally is
 // what fires the payout — this file owns the constant and the payout so the

package/modules/ideas/config.js

@@ -0,0 +1,230 @@
+'use strict';
+
+// modules/ideas/config.js — the two PER-INSTANCE IDEATOR DIALS (BV2.R05, spec
+// decisions 3 and 16).
+//
+// The owner's ruling is that both of these belong to the PROJECT, not to the
+// platform: a project of one wants every thought claimable, a project of fifty
+// wants a nod. They live in ONE home, deliberately, so that the second dial did
+// not grow a separate one — which is the whole point of R05 scoping them
+// together rather than as two tasks.
+//
+// Precedence mirrors modules/government/config.js, which mirrors src/branding.js:
+//
+//   env override  ->  instance config (config/ideas.json)  ->  neutral starter
+//   (config/ideas.neutral.json)
+//
+// A fresh instance with NO config resolves to the neutral starter, and the
+// neutral starter is chosen so that resolving it changes NOTHING about today's
+// behaviour. That is the fail-to-vanilla posture branding and government already
+// take, and it is what lets this land ahead of its consumers.
+//
+// ── WHAT THIS FILE IS NOT ────────────────────────────────────────────────────
+//
+// It is NOT an authority surface, and the ignite floor is NOT the trusted tier.
+//
+// modules/ideas/routing.js spells `METIC_PLUS` once but READS it for four
+// semantically different gates:
+//
+//   1. decideLanding, homeless-bug branch  — ready vs backlog
+//   2. decideLanding, goal-carrying branch — ready vs backlog
+//   3. mayProposeCriterion                 — who may FILE a criterion-proposal
+//   4. the protected-scope wall            — who may route into the
+//                                            permission / ship / deploy core
+//
+// ONLY (1) and (2) are the ignite floor, and only they read this dial. Gates (3)
+// and (4) stay pinned to the fixed Metic+ constant, because an instance lowering
+// its ignite floor to `xenos` — exactly the "project of one" case the owner
+// asked for — must not thereby gain the ability to file criterion-proposals or
+// to put rows into the protected core's queue. routing.js says this itself at
+// the constant's definition ("It grants nothing — the server-side rank floor and
+// the goal's scope wall are separate, load-bearing gates"), the protected-scope
+// branch says "the two are layers, not alternatives", and
+// tests/filing_abuse_matrix.mjs models the widening as an ATTACK: its header
+// records "METIC_PLUS widened to include xenos ... 4 of 23 fail".
+//
+// So the dial below decides one thing only: whether a filed bug lands CLAIMABLE
+// or lands AWAITING A NOD. Both landings create the same row, in the same goal,
+// with the same rank floor derived by createTask; the difference is a status a
+// human can flip either way. That is a scheduling preference, which is why it is
+// safe to configure — and it is why nothing else in this module reads it.
+//
+// ── THE DECAY DIAL'S SLICE BOUNDARY ──────────────────────────────────────────
+//
+// `descentDecayRate` has NO production consumer in this commit. R11 (the ideator
+// payout following the descent) is its intended reader and has not landed — it
+// depends on R08, which is not built. Shipping the contract ahead of the caller
+// is the same deliberate slice boundary modules/government/config.js documents
+// for itself ("deliberately has no production caller yet ... the tests pin the
+// contract until they land"), and it is what decision 16 asked for when it said
+// the two dials should share one home "rather than growing separately".
+//
+// Landing it now is the cheap half. Landing it with R11 would mean R11 either
+// inventing a second home or retrofitting this one mid-build.
+
+const fs = require('node:fs');
+const path = require('node:path');
+const api = require('../../src/module-api');
+
+// THE TWO FILES COME FROM TWO DIFFERENT ROOTS (ADR 0268, task 1003739). Under a
+// PINNED core, __dirname is inside node_modules/@cloudbongos/core, so resolving
+// both from one root reads the INSTANCE pack out of node_modules — a path no
+// host authors and every `npm ci` erases. Core content from resolveCoreRoot(),
+// host content from resolveInstanceRoot(), reached through the module doorway.
+//
+// Resolved at load rather than per call, matching government/config.js: a lazy
+// resolveInstanceRoot() falls back to process.cwd(), so a chdir mid-process
+// would move the config file underneath a running server.
+const CORE_ROOT = api.resolveCoreRoot();
+const INSTANCE_ROOT = api.resolveInstanceRoot();
+const NEUTRAL_PATH = path.join(CORE_ROOT, 'config', 'ideas.neutral.json');
+const INSTANCE_PATH = path.join(INSTANCE_ROOT, 'config', 'ideas.json');
+
+// The rank ladder, lowest authority first, DERIVED from the doorway rather than
+// restated. `api.LIVE_RANK_LADDER` is the single source of truth, and
+// tests/rank_tier_single_source.mjs enforces that: a literal ladder array in any
+// tracked src/modules/scripts file fails CI unless it is allowlisted with a
+// pinning assertion beside it. Deriving is better than restating here anyway —
+// it removes the drift risk instead of merely detecting it, and adding a rank
+// widens this floor's vocabulary automatically.
+//
+// It is a lazy getter on the doorway, so reading it at load costs a require of
+// the kernel this module's callers already load; it opens no connection.
+const RANK_ORDER = Object.freeze([...api.LIVE_RANK_LADDER]);
+
+// The defaults, as code. They are ALSO in config/ideas.neutral.json, and that is
+// not duplication for its own sake: the neutral file is what a host copies and
+// edits, and these are what the resolver falls back to when the neutral file is
+// missing, unreadable or malformed. A core whose config/ directory did not ship
+// must still boot to today's behaviour rather than to zero.
+const DEFAULT_IGNITE_FLOOR = 'metic';
+const DEFAULT_DECAY_RATE = 0.5;
+
+// Read a JSON pack off disk. A MISSING file is not an error — it is the ordinary
+// case for config/ideas.json, which most instances never author. A file that
+// exists but does not parse returns null and is skipped, so a typo in an
+// instance pack falls back to the neutral defaults rather than bricking boot.
+// That is the same "fail to vanilla, do not fail to dead" posture as the rest of
+// the config layer.
+function readPack(file) {
+  let raw;
+  try {
+    raw = fs.readFileSync(file, 'utf8');
+  } catch {
+    return null;
+  }
+  try {
+    const parsed = JSON.parse(raw);
+    return parsed && typeof parsed === 'object' && !Array.isArray(parsed) ? parsed : null;
+  } catch {
+    return null;
+  }
+}
+
+// A floor is valid only if it NAMES A RANK. Case is normalised but whitespace is
+// NOT trimmed — 'METIC ' is a hostile shape, not a rank, the same judgment
+// mayProposeCriterion already records. A non-string, an unknown rank or an empty
+// value falls back to the default rather than being coerced, because a floor
+// that silently became `xenos` through a typo is precisely the widening this
+// whole file exists to prevent.
+function normaliseFloor(value) {
+  if (typeof value !== 'string') return null;
+  const lower = value.toLowerCase();
+  return RANK_ORDER.includes(lower) ? lower : null;
+}
+
+// The decay rate is a SHARE, so it lives in [0, 1]. 0 means a descendant's ship
+// pays its origin nothing beyond the first hop; 1 means no decay at all, every
+// hop paying in full. Both ends are legitimate project choices, so both are
+// admitted — what is refused is a value outside the band, a non-finite number
+// (NaN, Infinity) or a non-number, each of which falls back to the default.
+// Refusing rather than clamping is deliberate: a config that asked for 1.5 has
+// asked for something incoherent, and silently paying 100% would be a payout bug
+// wearing a config file's clothes.
+function normaliseDecayRate(value) {
+  if (typeof value !== 'number' || !Number.isFinite(value)) return null;
+  return value >= 0 && value <= 1 ? value : null;
+}
+
+// The env layer. It exists for the co-tenant case branding's AUTH_IDP override
+// exists for — several hosted instances sharing one neutral pack, differentiated
+// only by env, with no config file of their own. Unlike government's, where the
+// env layer is deliberately labels-only because an env var must never widen
+// authority, BOTH dials are exposed here: neither one grants any authority (see
+// the header), so neither is an authority knob.
+function applyEnvOverrides(resolved, env) {
+  const out = { ...resolved };
+
+  const floorRaw = api.resolveEnv('IDEAS_IGNITE_FLOOR', { env });
+  const floor = normaliseFloor(floorRaw);
+  if (floor) out.igniteFloor = floor;
+
+  const rateRaw = api.resolveEnv('IDEAS_DESCENT_DECAY_RATE', { env });
+  if (rateRaw != null && String(rateRaw).trim() !== '') {
+    const rate = normaliseDecayRate(Number(rateRaw));
+    if (rate != null) out.descentDecayRate = rate;
+  }
+
+  return out;
+}
+
+// loadIdeasConfig — resolve the dials. Never throws: every layer that cannot be
+// read or does not validate is skipped in favour of the one beneath it, and the
+// bottom layer is the in-code defaults. Pass `env` and `roots` to test without
+// touching the real filesystem or process.env.
+function loadIdeasConfig({ env = process.env, roots = null } = {}) {
+  const neutralPath = roots && roots.neutralPath ? roots.neutralPath : NEUTRAL_PATH;
+  const instancePath = roots && roots.instancePath ? roots.instancePath : INSTANCE_PATH;
+
+  const neutral = readPack(neutralPath) || {};
+  const instance = readPack(instancePath) || {};
+
+  const resolved = {
+    igniteFloor:
+      normaliseFloor(instance.igniteFloor)
+      || normaliseFloor(neutral.igniteFloor)
+      || DEFAULT_IGNITE_FLOOR,
+    descentDecayRate:
+      normaliseDecayRate(instance.descentDecayRate)
+      ?? normaliseDecayRate(neutral.descentDecayRate)
+      ?? DEFAULT_DECAY_RATE,
+  };
+
+  return Object.freeze(applyEnvOverrides(resolved, env));
+}
+
+// trustedRanksForFloor — turn a floor into the SET decideLanding actually asks.
+//
+// A floor is a point on the ladder and admits everything at or above it, so
+// 'metic' yields {metic, archon} — byte-for-byte the behaviour of the METIC_PLUS
+// constant, which is what makes `igniteFloor: 'metic'` a true no-op default.
+// An unrecognised floor yields the default's set rather than an empty one:
+// failing closed here would mean NOBODY could ignite, turning a config typo into
+// a silent queue stoppage.
+function trustedRanksForFloor(floor) {
+  const at = RANK_ORDER.indexOf(normaliseFloor(floor) || DEFAULT_IGNITE_FLOOR);
+  const from = at === -1 ? RANK_ORDER.indexOf(DEFAULT_IGNITE_FLOOR) : at;
+  return Object.freeze(new Set(RANK_ORDER.slice(from)));
+}
+
+// The resolved dials, read ONCE at load. Config is a file on disk that does not
+// change under a running process; re-reading it per filing would put a
+// synchronous fs call on the capture path for a value that cannot have moved.
+const CONFIG = loadIdeasConfig();
+
+// The set decideLanding's two landing branches consume, derived once from the
+// resolved floor for the same reason.
+const TRUSTED_FILER_RANKS = trustedRanksForFloor(CONFIG.igniteFloor);
+
+module.exports = {
+  loadIdeasConfig,
+  trustedRanksForFloor,
+  igniteFloor: CONFIG.igniteFloor,
+  descentDecayRate: CONFIG.descentDecayRate,
+  TRUSTED_FILER_RANKS,
+  RANK_ORDER,
+  DEFAULT_IGNITE_FLOOR,
+  DEFAULT_DECAY_RATE,
+  NEUTRAL_PATH,
+  INSTANCE_PATH,
+};