@bongos/core 1.19.920 → 1.19.922

package/.bongos-core.json

@@ -2,22 +2,22 @@
   "artifact": "bongos-core",
   "manifest_schema": 1,
   "generator": "scripts/gds/package-core.js",
-  "core_version": "1.19.920",
-  "core_contract": "1.19.920",
-  "source_commit": "f4047b39eee17385567cbe07c45821af322b8f51",
+  "core_version": "1.19.922",
+  "core_contract": "1.19.922",
+  "source_commit": "b57f79a73cefa42840ff10d77aab958af1fe4ed4",
   "source_ref": "HEAD",
-  "built_at": "2026-09-20T19:16:17.763Z",
+  "built_at": "2026-09-20T20:40:52.111Z",
   "redaction": {
     "model": "docs-redacted+functional-verbatim",
-    "docs_redacted": 508,
+    "docs_redacted": 510,
     "agent_docs_stubbed": 26,
-    "functional_verbatim": 2303,
+    "functional_verbatim": 2309,
     "rules": 3,
     "gate_literals": 3,
     "gate": "passed"
   },
-  "file_count": 2837,
-  "tree_sha256": "0aa0c6f824621e1dd477c005962f961b6c9e71756b59f6bf383b122152964b5b",
+  "file_count": 2845,
+  "tree_sha256": "36516d370c40955c53b7b0b70845d49e03d34aaecf7d5e58a54bf78ed454f694",
   "files": [
     {
       "path": ".claude/skills/ask-for-help/SKILL.md",
@@ -152,7 +152,7 @@
     {
       "path": ".claude/skills/grade-audit/SKILL.md",
       "mode": "0000644",
-      "sha256": "5aa0804e6b4162f0dd0f5608e8a0964890e680e0f7cefe4fe2efdacc7ddbc340"
+      "sha256": "c32df53b87b71a15e6b6e605c0c9698a07ff99a94bc6325fd99648d9c2d38122"
     },
     {
       "path": ".claude/skills/grade-recover/SKILL.md",
@@ -2089,10 +2089,20 @@
       "mode": "0000644",
       "sha256": "2fbb3e040b55162284242f545af76b1254fafbecfe042b8c792dc0dca475c4f8"
     },
+    {
+      "path": "docs/adr/0320-an-empty-diff-is-not-an-ungraded-diff.md",
+      "mode": "0000644",
+      "sha256": "e582b4ece7a5b0acf4392d8b3d4942d55b52dc487d7c6a7c3a159203485ec633"
+    },
+    {
+      "path": "docs/adr/0321-brightness-is-a-weighted-share-and-the-targets-are-a-row.md",
+      "mode": "0000644",
+      "sha256": "3a743808de440eebd5fcdd74a4c88e41acc82cc02ce5632cb392b2aa0c05b48e"
+    },
     {
       "path": "docs/adr/README.md",
       "mode": "0000644",
-      "sha256": "087b5151c182476c1f541e239776099319ad7fa95e6ebc2dc5ccf2b320c84f0c"
+      "sha256": "caece332e048f6ee15517740255c4d715efc025c82756ac095ccde7814b60daa"
     },
     {
       "path": "docs/api-reference.md",
@@ -2662,7 +2672,7 @@
     {
       "path": "docs/module-api-changelog.md",
       "mode": "0000644",
-      "sha256": "760c792a9c7d16c1b9fc1b77eaf915baf0d9e652d04c84571118c521bbde0700"
+      "sha256": "d657d8b2fc7eb2bb4379a22a41d95b835ac655848626120a2218ab7603df5313"
     },
     {
       "path": "docs/modules-contract.md",
@@ -4224,15 +4234,20 @@
       "mode": "0000644",
       "sha256": "736eed2c89863d6eb28072627a40ac4f8945832cfb7b1d1aba10e6cc65483901"
     },
+    {
+      "path": "modules/economy/idea-brightness.js",
+      "mode": "0000644",
+      "sha256": "745da28c27ebcd50b349c3fe027f7e3f14888f9e012e0c9443656de249444ba1"
+    },
     {
       "path": "modules/economy/idea-size-historical.js",
       "mode": "0000644",
-      "sha256": "f99f62eb4eaeda10b32284dbe27f87e64d5b6b82c9eb4aa442057d0de13be761"
+      "sha256": "215eefac80aaf3624a8ff5d5284f29388a2e1b492424dd152b3d9bbe074e3a01"
     },
     {
       "path": "modules/economy/idea-size.js",
       "mode": "0000644",
-      "sha256": "d1fa5fda6b34bd2a8cf8d563c780bc4b12f1cdfb955e13f51799a589609ac1c0"
+      "sha256": "8818bea53d2ce90fe0bc98b53bfed1af11c4eeb541942b96c4cf50a162791634"
     },
     {
       "path": "modules/economy/migrations/economy_001_fix_gds_shipper_description.sql",
@@ -4514,6 +4529,11 @@
       "mode": "0000644",
       "sha256": "597f883d4878a8fb585585331e11dc219e8a57d1459be4039116b60e7fdc556d"
     },
+    {
+      "path": "modules/grading/grader-no-artifact.js",
+      "mode": "0000644",
+      "sha256": "ab20c06268f30d0ed7198774d7435237f63440550235bdc5b926870db56886e7"
+    },
     {
       "path": "modules/grading/grader-prompt.js",
       "mode": "0000644",
@@ -4592,7 +4612,7 @@
     {
       "path": "modules/grading/grader.js",
       "mode": "0000644",
-      "sha256": "1234bb3c9938fd4cf71c39e4660d69c56a27de667ee7ff09b0f865374b6beba4"
+      "sha256": "968363ed43dfd3792462996b061e90cb7af30d9c31a6d6bd39e68ec812b47706"
     },
     {
       "path": "modules/grading/module.json",
@@ -5512,7 +5532,7 @@
     {
       "path": "modules/lifecycle/cascade.js",
       "mode": "0000644",
-      "sha256": "fd8aeec221eede847aa3b0047c01721ac7e2076e95675a71a117eff3bf3bbc55"
+      "sha256": "176f7463d6f3c7bf2297760d0934f88528ee180dfb0c9e49a4347a449af2820d"
     },
     {
       "path": "modules/lifecycle/check-rollup.js",
@@ -5754,6 +5774,11 @@
       "mode": "0000644",
       "sha256": "e98efbb1537f0d99adb6b6b66c1fdccfd4bbac16b97362d479af903eb9de492c"
     },
+    {
+      "path": "modules/lifecycle/migrations/lifecycle_010_removal_targets.sql",
+      "mode": "0000644",
+      "sha256": "e3e29e791eeb94ab1380ae2e2a13eafaea413faf0d0324a4e2007ab2b3002fca"
+    },
     {
       "path": "modules/lifecycle/mingle.js",
       "mode": "0000644",
@@ -5762,7 +5787,7 @@
     {
       "path": "modules/lifecycle/module.json",
       "mode": "0000644",
-      "sha256": "01f96d398408491bc4f1d9357c23c259f16e52184569849a0caf775f5b38836b"
+      "sha256": "36a03e5d8a4fc1129439356ba6daaf284d2cd2ca3d98d35f990e3215ff11198a"
     },
     {
       "path": "modules/lifecycle/pg-constraint-fail.js",
@@ -5794,6 +5819,11 @@
       "mode": "0000644",
       "sha256": "8270ce55255998a4f0bbf574a54df0ba2597013c727b4afb1ce2abad9c9d4d2a"
     },
+    {
+      "path": "modules/lifecycle/removal-targets.js",
+      "mode": "0000644",
+      "sha256": "e80304e7b43fe86852763e2f859bc05c1b88bb50a3eea407342ae6d46b8f9eda"
+    },
     {
       "path": "modules/lifecycle/rot.js",
       "mode": "0000644",
@@ -5862,7 +5892,7 @@
     {
       "path": "modules/lifecycle/routes/lifecycle.js",
       "mode": "0000644",
-      "sha256": "f4b080286870b6cd52cd59c5cb7c5a5127c3b0a90df50b7d87495d684767203b"
+      "sha256": "330e42fad79812a05a90256fe31931df2156093b80a648d7c838ecac136c91e4"
     },
     {
       "path": "modules/lifecycle/routes/mingle.js",
@@ -5882,7 +5912,7 @@
     {
       "path": "modules/lifecycle/routes/removal-proposals.js",
       "mode": "0000644",
-      "sha256": "329f130d3556dc05981ce6b4b6ce4d55984c6ca42fd0f421fd70cba63eb277ac"
+      "sha256": "e0a0e14a8818c011334e8f61a50c8dd7ad11b4387acfd6ab9e18e570f54ec6c4"
     },
     {
       "path": "modules/lifecycle/routes/rot.js",
@@ -7872,12 +7902,12 @@
     {
       "path": "package-lock.json",
       "mode": "0000644",
-      "sha256": "c4064939e0c8b7f6452d0348427109332caa61e8759e40a60ded3dc4f704602a"
+      "sha256": "0169c3fafa67ebf63c9ae35566e8104bcf210ae80973c8e1837874109fe85354"
     },
     {
       "path": "package.json",
       "mode": "0000644",
-      "sha256": "840b50ec98565b70f1550ea34aa8813bf5e8cbb8ae7dece18ed1e45abe6ad608"
+      "sha256": "b62dd828c8e8b167dfc4bca7d54fdec8c76b13f89a44e61365d48962abf77ba9"
     },
     {
       "path": "public-docs/index.html",
@@ -8822,7 +8852,7 @@
     {
       "path": "scripts/gds/provision-core-upgrade.js",
       "mode": "0000644",
-      "sha256": "5fad0beb0a3d4b322918a99765cb922fcce1de4196c19cb08a0d3bc91c3d149e"
+      "sha256": "1fd6e38184bb0943fdc22e314b9e6cad0b5ebeae7f7370992adbd3b4f2ad5a9e"
     },
     {
       "path": "scripts/gds/provision-disconnect.js",
@@ -8977,7 +9007,7 @@
     {
       "path": "scripts/gds/run-unit-tests.js",
       "mode": "0000644",
-      "sha256": "a40a90ba6255820130aa6a94ddc314b643177e4a153750dc6290550a75e1a4e8"
+      "sha256": "d3567553fb963ad78c0ab36dd283fbf5c46e188dd7538e00fed36442f7ab2515"
     },
     {
       "path": "scripts/gds/runner-drift.js",
@@ -9212,7 +9242,7 @@
     {
       "path": "scripts/gds/ship-flow.js",
       "mode": "0000644",
-      "sha256": "4b8179e5c1aae3fc4845457a4089c57f6cf105c33d03d21d3ade99776371e50f"
+      "sha256": "b6198e134156b755bcffa3c385c9b2ec780dcd7681791c1d3fb938217bd8102b"
     },
     {
       "path": "scripts/gds/ship-git.js",
@@ -9222,12 +9252,12 @@
     {
       "path": "scripts/gds/ship-grade-steps.js",
       "mode": "0000644",
-      "sha256": "158a01214499cd229a51819cd2dfcfee2eae34475f87f23795f81ec83d54f337"
+      "sha256": "204834c41dd184ebc076dcd57d6a5370a910f4fc9c276bb3984b08b43f550012"
     },
     {
       "path": "scripts/gds/ship-grade.js",
       "mode": "0000644",
-      "sha256": "b1fb38635433b579fbb38d65e92b9db226cccb753866ab7a2a15227796be66cd"
+      "sha256": "40c6a9f6aa6a75cdf8a5e41bfa8318766636cba64e47aee870c26a719676713d"
     },
     {
       "path": "scripts/gds/ship-honesty.js",
@@ -9877,7 +9907,7 @@
     {
       "path": "src/module-api.js",
       "mode": "0000644",
-      "sha256": "111908611a709491751fd92695758cca7125efc22bf5e68e908a8c4f45cf6301"
+      "sha256": "86c69951f0059e5374245ef798c5cd24cd82d836a4ccf706e80f186de986b473"
     },
     {
       "path": "src/module-loader/catalog.js",
@@ -10792,7 +10822,7 @@
     {
       "path": "tests/core_upgrade_runner.mjs",
       "mode": "0000644",
-      "sha256": "a8fc77b7a32e4377b4b327bd485cbc17428421ef3fc871770fdaeee3e02e48f4"
+      "sha256": "5d0b4fa1ec48d40ebc801902b5279475533ae2dc8819e587bb95bc17783cba06"
     },
     {
       "path": "tests/cosmos_token_contrast.mjs",
@@ -11217,7 +11247,7 @@
     {
       "path": "tests/git_merge_regen.mjs",
       "mode": "0000644",
-      "sha256": "a55ae255245a53429cc7948e35ea0515bf58307f826d605d6ffd52cc60196ef8"
+      "sha256": "79208b90f1b785af56ab057c858e96cea4e67ebf247858457addedce55e71b06"
     },
     {
       "path": "tests/github_push_ancestry.mjs",
@@ -11649,6 +11679,11 @@
       "mode": "0000644",
       "sha256": "1823c173f811d52d93b63201d0ebb0d85f2b1e42a569e6331580ef097f5c05cc"
     },
+    {
+      "path": "tests/grader_no_artifact.mjs",
+      "mode": "0000644",
+      "sha256": "c8450702a2d805d1cf5e826a3dedf49fff6cd01c6ca540fa9c64444fc874d5d3"
+    },
     {
       "path": "tests/grader_panel.mjs",
       "mode": "0000644",
@@ -11657,7 +11692,7 @@
     {
       "path": "tests/grader_prompt_fencing.mjs",
       "mode": "0000644",
-      "sha256": "fa155f3c5faa3763d1a51d56b7746ad870e826e3249f5e9b08108a3cfbfcbd72"
+      "sha256": "b626e614de000078eef1b305f6322d94326f032bcbeba2808baaa9dcc8ed3103"
     },
     {
       "path": "tests/grader_quality_window_overflow.mjs",
@@ -11879,6 +11914,11 @@
       "mode": "0000644",
       "sha256": "0d8f07c64f4d17c8c894b2d6395281882efd4e186c5714fe9aab61e2808d4314"
     },
+    {
+      "path": "tests/idea_brightness.mjs",
+      "mode": "0000644",
+      "sha256": "d67d60b1236ccedd01591356f5a5a9a72e4f1efd895ddf5af00c744219a2b3b6"
+    },
     {
       "path": "tests/idea_capture_grades.mjs",
       "mode": "0000644",
@@ -12507,7 +12547,7 @@
     {
       "path": "tests/no_artifact_escalation.mjs",
       "mode": "0000644",
-      "sha256": "3d2b03a39cbefc02565a190dee0612e14576edbf32ea0fccf798d6ed28fee8f1"
+      "sha256": "f1523ee48247d18c7326b9aa0b442ca2c9fab8bd41dbe9f23a4cb89e1986bee0"
     },
     {
       "path": "tests/oauth_secret.mjs",
@@ -13682,7 +13722,7 @@
     {
       "path": "tests/skip_is_not_pass.mjs",
       "mode": "0000644",
-      "sha256": "6258b4a3ad76a1d9139b053535c173760c5b42aa82510541501b6fef5ddd1fe1"
+      "sha256": "db9e246f1ce7ef6306b938d325c450e31f2e834244f64dd2f0aaea96e760d987"
     },
     {
       "path": "tests/smoke_preflight.mjs",

package/.claude/skills/grade-audit/SKILL.md

@@ -20,6 +20,15 @@ node scripts/gds/api.js GET "/api/bongos/tasks/<id>?include=grade"
 
 Bucket by grade shape: `passed`, failed, `signals.panel_outcome='unavailable'` (outage — no quality signal existed), or no grade row at all.
 
+**Then split off the no-artifact species before any leg reads the bucket** (task 1004011, ADR 0320). A grade with `signals.no_artifact_grade === true` judged the builder's **claim that nothing was needed** — the handoff notes and value summary against the task description — not a diff. There is no diff, no panel, and one generalist shot (`signals.lenses_dropped` names the four lenses that did not run). It is a real grade and a real gate, but it measures a different thing, so:
+
+- **Do not average or count it alongside diff grades.** A 7.5 over three paragraphs of prose and a 7.5 over a 400-line diff are not the same number.
+- **Leg 2 still applies, and matters more here.** A `blocker`/`major` on a no-artifact pass usually means the *evidence* was thin — queue it the same way.
+- **Leg 3 does not apply** — there is no merged diff to re-read for runtime behaviour. The equivalent question, worth asking on any no-artifact pass that shipped on assertion alone, is: *could a reader today re-run or re-read what the notes claim?* If not, queue it.
+- **A no-artifact FAIL is not an override candidate for Leg 1** unless it also landed. The builder's remedy is better evidence, not a permission.
+
+Note `task_grades.grader_kind` is **not** the discriminator: the server records `'subagent'` for everything arriving through `POST /tasks/:id/grade`. `signals.no_artifact_grade` is the durable marker.
+
 ## Leg 1 — the override ledger
 
 For every shipped task whose grade **failed** (or is absent), the land needed an override. Cross-reference the ledger (Archon — `override_request.decide`):

package/docs/adr/0320-an-empty-diff-is-not-an-ungraded-diff.md

@@ -0,0 +1,159 @@
+# ADR 0320 — An empty diff is not an ungraded diff: grade the claim instead
+
+- **Status:** Accepted
+- **Date:** 2026-09-20
+- **Task:** 1004011 · goal 1000118 · scoped out of task 1003950 (shape 2)
+- **Supersedes nothing.** Narrows [ADR 0041](0041-temporary-grader-bypass-killswitch.md)'s reach: the `--allow-empty` close is no longer one of the things `task.confirm.grade_bypass` gates.
+- **Drops** task 1004010, the alternative shape (a new permission atom for the same close). Owner decision, 2026-09-20 — see §5.
+
+## 1. Context
+
+`scripts/gds/ship.js --allow-empty` is how a builder closes a task that produced no
+committed artifact: the premise turned out to be false, the work was a pure
+verification, the change landed directly in the database or on the host.
+
+Until now that flag did two things at once. It set `skipGrade = true` — the subagent
+grader never ran — and it therefore routed the close through
+`POST /tasks/:id/confirm`, whose gate is `task.confirm.grade_bypass`, one of the four
+trust-boundary keys [ADR 0157](0157-archon-is-rank-and-identity-only.md) names. In
+practice a Metic could not close an artifact-free task at all without asking an Archon.
+
+Task 1003950 shipped a terminating escalation on that refusal so the builder at least
+stopped looping. It deliberately left the underlying shape alone and filed two
+alternatives: give the close its own lower-floored permission atom (1004010), or remove
+the need for a permission by grading something real (1004011, this one).
+
+## 2. The two things that were wrong
+
+**The permission was the wrong question.** `task.confirm.grade_bypass` means *ratify
+this past a grade that FAILED*. That is a genuine trust-boundary act: a verdict exists
+and a human is overriding it. An `--allow-empty` close is not that. No verdict exists,
+because there was nothing for the grader to read. Charging the same key for "it was
+judged and rejected" and "there was nothing to judge" conflates a override with an
+absence, and the cost of the conflation was that the cheapest, least scrutinised ship
+in the system needed the most powerful key to perform.
+
+**Nothing was being checked.** This is the more serious half. On a no-artifact ship the
+grader was skipped *entirely*, so the assertions in the handoff notes — "the premise was
+already fixed", "this was a pure ops verification", "the row was updated directly" —
+went into the ledger unexamined. The ledger is the complete record of what happened to
+the project (CLAUDE.md §8), and on exactly the ships where the record is the *only*
+evidence, nothing read it. A permission gate is not a substitute for scrutiny: an Archon
+clicking confirm is not the same as someone checking whether the claim is true.
+
+## 3. Decision
+
+**On an `--allow-empty` ship, grade the NOTES (and the value summary) against the task
+description, instead of skipping the grade.** The grader's question becomes: *is this
+task genuinely artifact-free, and does the evidence given support that?* A pass is a
+real passing grade that confirms through the ordinary rank-open path and needs no bypass
+permission. A fail is a real fail, and the remedy is better evidence, not a key.
+
+Four sub-decisions carry most of the weight:
+
+**D1 — The rubric axes are re-asked, not replaced.** The gate downstream is
+`functional_fidelity >= THRESHOLD AND code_quality >= THRESHOLD AND confidence >= 0.4`,
+and `/grade-audit`, the aggregates and the cost model all read those columns. Inventing
+a third pair of axis names would have meant teaching every one of them a synonym. So the
+axes keep their names and the prompt re-asks them for this species:
+`functional_fidelity` → *is this genuinely artifact-free?*; `code_quality` → *is the
+evidence specific and checkable, or bare assertion?*. The gate arithmetic is untouched.
+
+**D2 — Two generalist shots, not the four-lens panel.** The panel is Hacker / Quality /
+Efficiency / (Reader) — lenses over code. Over three paragraphs of prose they are four
+readings of the same short text at four times the cost, so the lenses go, recorded in
+`signals.lenses_dropped` rather than left to be inferred from their absence (the
+trivial-diff precedent, #513: lighter, never silent).
+
+The panel's unanimous gate, however, was also the cross-check that makes injection
+hard — an attacker must fool *every* gating worker. This decision's first implementation
+kept a single shot and lost that property; the grader failed the ship on it, correctly
+(see D4). So the species runs **two** independent readings of the same prompt, collapsed
+by **unanimity, not median**: the worst score on each axis, and a pass only if every shot
+passed. Under a median the collapse would be actively harmful — the median of two is
+their mean, so a fooled 10 averages with a suspicious 3 into a passing 6.5 and the second
+reading launders the first. A split verdict is recorded as `signals.shot_dissent`, since
+two readings of the same fenced text disagreeing is itself worth a human's eye.
+
+The collapse covers **all three gate axes, `confidence` included** — a point the second
+round of grading caught, because the first fix collapsed only `functional_fidelity` and
+`code_quality`. Confidence is easy to miss: it is the one gate axis that lives in
+`signals` rather than `rubric_scores`. Leaving it at the median would have reintroduced
+the same laundering on the axis where it matters most, since the server's
+`validateAndScore` derives `lowConfidence` purely from the submitted value and never sees
+the client's `unanimous` boolean — a shot honestly reporting 0.2 ("I cannot judge this
+claim", the value that exists to fall through to a human) would average with a confident
+0.9 and clear the 0.4 gate at 0.55.
+
+**D4 — Every builder-controlled field is scrubbed and fenced (SR-15 / #995).** The panel
+workers have wrapped the diff, title, description and value summary in
+`grader-workers/fence.js` since #995, because a builder can embed steering text in their
+own artifact. This species carries the same inputs and is the worse case on both sides of
+the ledger: the notes are not context around an artifact the model can independently
+check, they *are* the evidence; and a successful injection does not merely flip one of
+four workers, it closes a task past the scrutiny this ADR introduced to replace the
+Archon-only gate. So fencing here is not defence in depth, it is the boundary. The
+no-follow rule is also restated *after* the artifact, because the notes may run to 24,000
+characters and a rule stated once at the top is a long way behind by the end of an
+adversarial payload.
+
+**D3 — The species marker lives in `signals`, not in `grader_kind`.** The server's
+`validateAndScore` hardcodes `task_grades.grader_kind` to `'subagent'` for everything
+arriving through `POST /tasks/:id/grade`, so the column cannot carry the distinction
+without teaching every consumer of that enum a new member. `signals.no_artifact_grade`
+is submitted verbatim and stored, so it is the durable discriminator.
+`signals.graded_subject = 'notes'` says what was read.
+
+## 4. Consequences
+
+- A Metic can now close a genuinely artifact-free task on the strength of a graded
+  claim. `task.confirm.grade_bypass` keeps exactly the meaning ADR 0041 gave it and
+  loses a use it never should have had.
+- **A second grade species exists in `task_grades`.** Every consumer that averages,
+  counts or spot-checks grades must split on `signals.no_artifact_grade` first: a score
+  over prose and a score over a 400-line diff are not the same measurement.
+  `/grade-audit` is updated with that rule in this change.
+- **No-artifact closes get harder, not easier, for the dishonest.** The permission wall
+  was indiscriminate — it stopped the honest Metic and waved through any Archon. The
+  grade is discriminating: it reads the claim. "Confirmed working" with nothing a reader
+  could re-run now fails an axis that previously did not exist.
+- **The diff-hash reuse key is deliberately not set** for this species. Hashing the empty
+  diff would let the *next* empty-diff ship of the same task reuse this grade — a
+  different claim, different notes, silently inheriting a pass it never earned.
+- **Below the protected-path floor, nothing changes.** The server's Guard 1b (task
+  1002646) fails a passing grade closed when a below-floor builder submits no
+  `committed_files`, and a no-artifact grade submits none by definition. That guard is
+  correct and untouched: for a sub-floor builder the permission-path check is genuinely
+  unprovable. This decision moves the Metic-and-above case, which is the case that was
+  filed.
+- `--skip-grade` is unchanged and still reaches the Archon gate. The escalation split
+  task 1003950 added still decides which refusal prints there.
+
+## 5. Alternatives considered
+
+**Task 1004010 — a new permission atom for the no-artifact close.** The sibling shape,
+and the one this drops. It would have added a lower-floored relative of a trust-boundary
+key, plus a governance migration and a `system: true` decision of its own. Rejected on
+two grounds: it answers "who may skip the check" when the better question is "why is
+there no check", and it permanently widens the permission surface — the same class of
+change the owner declined three days earlier for `version.create` (task 1003853,
+[ADR 0250](0250-strict-versioning-the-version-boundary-is-the-scope-gate.md) §6a).
+Solving the problem without a new atom is the consistent call. The row is closed, with
+its problem statement kept should this fail to land.
+
+**Keep skipping the grade, lower the floor on the existing key.** Cheapest, and wrong
+for the same reason as 1004010: it treats the gate as the point. Nothing would read the
+notes.
+
+**Grade the notes with the full panel.** Rejected under D2 — four code lenses over prose
+is cost without signal. Note what the rejection had to preserve separately: the panel's
+value here was never its lenses, it was the unanimity of its gate, and D2 keeps that with
+two shots rather than four lenses.
+
+**A single generalist shot.** This decision's first implementation, and wrong for a
+reason that only became visible once the prompt was written: it leaves one reading
+between a crafted set of handoff notes and a closed task. Corrected before landing.
+
+**A new pair of rubric axes for prose.** Rejected under D1 — honest about the
+measurement, but it moves the gate arithmetic and every consumer of it, for a naming
+gain.

package/docs/adr/0321-brightness-is-a-weighted-share-and-the-targets-are-a-row.md

@@ -0,0 +1,163 @@
+# ADR 0321 — Brightness is a payout-weighted share, and a removal's targets are rows
+
+- **Status:** Accepted
+- **Date:** 2026-09-20
+- **Task:** [task 1004099](https://cloudbongos.com/builders#/task/1004099) (BV2.R16, goal 1000095 — BONGOS-V2)
+- **Spec:** `docs/specs/<redacted>.md` decisions 4 and 20
+- **Under:** [ADR 0313](0313-a-removal-is-proposed-by-the-ship-and-confirmed-by-a-person.md), [ADR 0319](0319-a-removal-verdict-is-a-row-beside-the-question.md)
+
+## Context
+
+An idea's **size** is its total ideator payout from its descent and never falls
+([ADR 0312](0312-provenance-is-a-second-ideas-owned-edge-table.md) and
+`modules/economy/idea-size.js`). **Brightness** is the other channel: how much of that
+work is still alive. The pair is what lets a thought whose version the project later tore
+out draw *large and dark* — visibly different from a thought that never caused anything
+and draws *small and dark*. One number cannot express both, which is why there are two.
+
+Two things had to be settled before it could be computed.
+
+**First, what a share is a share OF.** The spec says graded, not binary (decision 20): a
+descent of five things with three alive is partly lit, and goes out only when nothing
+survives.
+
+**Second, and the real blocker: the removal facts are stored in the wrong direction.**
+ADR 0319 gave a confirmed removal a row — `lifecycle_removal_verdicts`, keyed on the
+proposal, carrying the verdict and `ship_task_id`. It also said, in the migration and in
+its own text, that the list of tasks whose work was removed was deliberately absent, and
+that *"brightness designs its own storage for targets when it needs one."* That deferral
+is now due.
+
+The gap is not cosmetic. `ship_task_id` is the task whose merge **deleted** the files.
+Brightness needs the previously-shipped tasks that **stopped counting**. Those are
+different rows, almost always under different ideas — a later, unrelated piece of work
+tears out an earlier one. Reading the ship as the removed task dims the wrong star, and
+dims it for the wrong idea, while looking like a working query.
+
+The attribution itself already exists. `modules/lifecycle/removal-derivation.js` blames
+each deleted path back to the task that introduced it, and the cascade renders the result
+as prose in the proposal's body. `removal-proposals.js` refuses to parse that prose back
+and is right to: *"a body is written for a person to read, and a reader that silently
+depends on its line shape breaks the day somebody improves the wording."*
+
+## Decision
+
+### D1 — The targets are rows, written at proposal time
+
+`modules/lifecycle/migrations/lifecycle_010_removal_targets.sql` adds
+`lifecycle_removal_targets (proposal_task_id, removed_task_id, paths)`, written by
+`recordRemovalTargets` from the same `ctx.removals` objects the proposal body renders.
+**One derivation, two renderings** — the prose and the rows cannot disagree, and
+`removal-proposals.js` keeps its refusal intact because something else now carries the
+fact.
+
+It must be written at **proposal** time rather than at verdict time. The attribution comes
+from GitHub commit-history reads, capped at eight paths per ship
+(`MAX_ATTRIBUTED_PATHS`) and running on the server's shared push credential — the same
+credential the publish path depends on. Re-deriving when a person clicks Confirm, days
+later, would spend that budget again against a history that has moved on.
+
+This is **not** the cascade runner fanning out, which [ADR 0242](0242-a-cascade-is-a-declaration-table-on-the-event-that-already-exists.md)
+forbids: the removal rule still files exactly one task. This records a side fact *about*
+that one task — the same shape as the verdict row its answer writes.
+
+`ON CONFLICT DO NOTHING`, never `DO UPDATE`. A second walk can legitimately find *fewer*
+paths, because the cap and the rate limit make an exhausted page yield no attribution at
+all; overwriting would let a degraded re-read erase a good first one. For the same
+reason the writer runs on the cascade's `skipped` row as well as its `created` one, so a
+re-ship **repairs** an attribution that a derivation outage missed.
+
+### D2 — Brightness is weighted by payout, not by task count
+
+The share is `live / credits`, where each descent task is weighted by what it actually
+earned the idea.
+
+Counting tasks instead would make deleting a one-line fix dim a star as hard as deleting
+the feature it belongs to. Weighting by payout makes brightness fall in proportion to how
+much of the idea's *worth* died — and since size is drawn from the same quantity, the two
+channels become a share of one number rather than two unrelated measurements sitting side
+by side. It also makes "large and dead" exact: full size, zero brightness.
+
+The basis is **paid + estimated**, matching size. A historical idea's descent was never
+paid for (`idea-size-historical.js` prices those hops); counting only banked credits would
+mean removing an estimated hop dims nothing while the size drawn beside it still counts
+that hop. To support this, `priceDescentForIdea` and `ideaSizes` now return a per-task
+`byTask` breakdown that **sums exactly to `credits`** — assembled from the priced descent
+plus any ledger payment for a task the descent no longer reaches, because `idea-size.js`
+deliberately keeps those in `credits` so size cannot fall, and dropping them here would
+make the parts sum to less than the whole and silently overstate brightness.
+
+### D3 — An idea that earned nothing is LIT, not dark
+
+Zero over zero is not zero. A freshly-filed thought has had nothing removed from it, so
+`share: 1` with `hasWork: false`. Returning 0 would make it pixel-identical to the thought
+whose version was torn out — which is precisely the distinction BV2.R19's proof exists to
+check, and would quietly defeat the reason size and brightness are two channels.
+`hasWork` is what lets the five states (BV2.R17) tell a protostar from a remnant without
+re-deriving it.
+
+### D4 — "Could not look" is not "nothing was removed"
+
+When the removal facts cannot be read — the lifecycle module is off, the port is
+unregistered — `share` is `null` and `attributable` is `false`, never a confident 1. Same
+posture `idea-size.js` already takes with `historical: null` when the descent walk is
+unavailable: an established absence and an unreadable one are different answers, and only
+one of them may be drawn as a plain full-brightness star.
+
+A **confirmed removal that names no target** is the residual case D1 cannot close: it is
+genuinely gone, and brightness does not know which idea to dim. It happens for proposals
+filed before `lifecycle_010`, for attributions where every deletion predates
+`claims.published_head_sha`, and for a derivation outage. Guessing in either direction is
+worse than not dimming — so nothing dims, and `countUnattributedConfirmed()` exists so a
+surface can say *"the sky may read brighter than the truth by up to N confirmed
+removals"* instead of being silently optimistic.
+
+### D5 — Brightness lives in `economy`, behind a port
+
+It is a share of the same payouts size is built from, so it sits beside size in
+`modules/economy/idea-brightness.js`; putting it in `lifecycle` would mean that module
+doing money arithmetic. That makes the removal facts a cross-module read, so they come
+through a kernel-mediated port — `lifecycle.removals` — and never a `require`
+([ADR 0083](<redacted>.md) rule 1), exactly as economy already
+reaches `ideas.descent`.
+
+Economy resolves it with `resolveOptional` and **does not declare it in `consumes`**.
+`consumes` means *required*, and `verifyEnabledPorts` refuses to boot when an enabled
+module consumes an unprovided port — declaring it would turn "lifecycle off" into
+"instance will not start". The same non-declaration, for the same reason, as
+`ideas.descent`.
+
+## Consequences
+
+- Brightness is computable per idea and falls only when a **person** confirms a removal.
+  A dismissed or unanswered proposal dims nothing, which is what stops refactors, renames
+  and moves from dimming the sky continuously — ADR 0313's central finding.
+- **No credit is ever clawed back.** `modules/economy/idea-brightness.js` contains no
+  writer and is unreachable from any ship path. `shipped` stays terminal, the ledger is
+  never rewritten, and size does not move. Only the picture changes.
+- `ideaSizes` grew a field. Callers that spread its result now carry a `Map`; nothing
+  serialises it to JSON today, and a surface that wants to must project it rather than
+  pass it through.
+- BV2.R17 (the five states) can resolve protostar-vs-remnant from `hasWork` and `share`
+  without re-deriving either, and BV2.R18 (the sky) has `removedTasks` to explain *why* a
+  star dimmed rather than only that it did.
+
+## Rejected
+
+- **Parsing the proposal body.** The attribution is right there as
+  `  - task <id> — <title>`. It is also documentation prose that a copy edit may reword at
+  any time, and ADR 0319 already refused this for that reason. A reader that depends on a
+  human-facing line shape fails silently and dims nothing.
+- **Re-deriving targets at verdict time.** Spends the capped GitHub budget a second time,
+  against a history that has moved, on the interactive path where a person is waiting.
+- **Treating `ship_task_id` as the removed task.** The wrong direction; dims the ship's
+  own idea instead of the one whose work died. Named here because the column is right
+  there on the verdict row and is the obvious thing to reach for.
+- **Counting tasks rather than payouts.** Simpler, and makes a one-line fix weigh the same
+  as a feature.
+- **Clamping the share at both ends.** The bottom is clamped so an anomaly renders as a
+  legible "nothing survives" rather than a negative; the top is not, and `live` / `removed`
+  are reported unclamped, so an impossible figure stays visible instead of being hidden by
+  the thing that claims to prevent it — `idea-size.js`'s argument against clamping size.
+- **Storing the removed task's title beside the row.** It lives on `tasks` and can be
+  joined for; a copy goes stale the first time a title is edited.