@bongos/core 1.19.921 → 1.19.922

package/.bongos-core.json

@@ -2,22 +2,22 @@
   "artifact": "bongos-core",
   "manifest_schema": 1,
   "generator": "scripts/gds/package-core.js",
-  "core_version": "1.19.921",
-  "core_contract": "1.19.921",
-  "source_commit": "b57a8de976b2d06f0400384b4c8bd5d1f0d69508",
+  "core_version": "1.19.922",
+  "core_contract": "1.19.922",
+  "source_commit": "b57f79a73cefa42840ff10d77aab958af1fe4ed4",
   "source_ref": "HEAD",
-  "built_at": "2026-09-20T20:00:16.702Z",
+  "built_at": "2026-09-20T20:40:52.111Z",
   "redaction": {
     "model": "docs-redacted+functional-verbatim",
-    "docs_redacted": 509,
+    "docs_redacted": 510,
     "agent_docs_stubbed": 26,
-    "functional_verbatim": 2305,
+    "functional_verbatim": 2309,
     "rules": 3,
     "gate_literals": 3,
     "gate": "passed"
   },
-  "file_count": 2840,
-  "tree_sha256": "9ea93825644aa4fadb711161dbfbf72e4a032f44e888e27c23fbf66d1a695b32",
+  "file_count": 2845,
+  "tree_sha256": "36516d370c40955c53b7b0b70845d49e03d34aaecf7d5e58a54bf78ed454f694",
   "files": [
     {
       "path": ".claude/skills/ask-for-help/SKILL.md",
@@ -2094,10 +2094,15 @@
       "mode": "0000644",
       "sha256": "e582b4ece7a5b0acf4392d8b3d4942d55b52dc487d7c6a7c3a159203485ec633"
     },
+    {
+      "path": "docs/adr/0321-brightness-is-a-weighted-share-and-the-targets-are-a-row.md",
+      "mode": "0000644",
+      "sha256": "3a743808de440eebd5fcdd74a4c88e41acc82cc02ce5632cb392b2aa0c05b48e"
+    },
     {
       "path": "docs/adr/README.md",
       "mode": "0000644",
-      "sha256": "7f11cc3e7cf17031aae449f13724fe1c42350516e5294732b6db1eb6e3917673"
+      "sha256": "caece332e048f6ee15517740255c4d715efc025c82756ac095ccde7814b60daa"
     },
     {
       "path": "docs/api-reference.md",
@@ -2667,7 +2672,7 @@
     {
       "path": "docs/module-api-changelog.md",
       "mode": "0000644",
-      "sha256": "5693553f86384a3e66f0e6ba77ba1e6f83130a440d0a1f17179173b98696a026"
+      "sha256": "d657d8b2fc7eb2bb4379a22a41d95b835ac655848626120a2218ab7603df5313"
     },
     {
       "path": "docs/modules-contract.md",
@@ -4229,15 +4234,20 @@
       "mode": "0000644",
       "sha256": "736eed2c89863d6eb28072627a40ac4f8945832cfb7b1d1aba10e6cc65483901"
     },
+    {
+      "path": "modules/economy/idea-brightness.js",
+      "mode": "0000644",
+      "sha256": "745da28c27ebcd50b349c3fe027f7e3f14888f9e012e0c9443656de249444ba1"
+    },
     {
       "path": "modules/economy/idea-size-historical.js",
       "mode": "0000644",
-      "sha256": "f99f62eb4eaeda10b32284dbe27f87e64d5b6b82c9eb4aa442057d0de13be761"
+      "sha256": "215eefac80aaf3624a8ff5d5284f29388a2e1b492424dd152b3d9bbe074e3a01"
     },
     {
       "path": "modules/economy/idea-size.js",
       "mode": "0000644",
-      "sha256": "d1fa5fda6b34bd2a8cf8d563c780bc4b12f1cdfb955e13f51799a589609ac1c0"
+      "sha256": "8818bea53d2ce90fe0bc98b53bfed1af11c4eeb541942b96c4cf50a162791634"
     },
     {
       "path": "modules/economy/migrations/economy_001_fix_gds_shipper_description.sql",
@@ -5522,7 +5532,7 @@
     {
       "path": "modules/lifecycle/cascade.js",
       "mode": "0000644",
-      "sha256": "fd8aeec221eede847aa3b0047c01721ac7e2076e95675a71a117eff3bf3bbc55"
+      "sha256": "176f7463d6f3c7bf2297760d0934f88528ee180dfb0c9e49a4347a449af2820d"
     },
     {
       "path": "modules/lifecycle/check-rollup.js",
@@ -5764,6 +5774,11 @@
       "mode": "0000644",
       "sha256": "e98efbb1537f0d99adb6b6b66c1fdccfd4bbac16b97362d479af903eb9de492c"
     },
+    {
+      "path": "modules/lifecycle/migrations/lifecycle_010_removal_targets.sql",
+      "mode": "0000644",
+      "sha256": "e3e29e791eeb94ab1380ae2e2a13eafaea413faf0d0324a4e2007ab2b3002fca"
+    },
     {
       "path": "modules/lifecycle/mingle.js",
       "mode": "0000644",
@@ -5772,7 +5787,7 @@
     {
       "path": "modules/lifecycle/module.json",
       "mode": "0000644",
-      "sha256": "01f96d398408491bc4f1d9357c23c259f16e52184569849a0caf775f5b38836b"
+      "sha256": "36a03e5d8a4fc1129439356ba6daaf284d2cd2ca3d98d35f990e3215ff11198a"
     },
     {
       "path": "modules/lifecycle/pg-constraint-fail.js",
@@ -5804,6 +5819,11 @@
       "mode": "0000644",
       "sha256": "8270ce55255998a4f0bbf574a54df0ba2597013c727b4afb1ce2abad9c9d4d2a"
     },
+    {
+      "path": "modules/lifecycle/removal-targets.js",
+      "mode": "0000644",
+      "sha256": "e80304e7b43fe86852763e2f859bc05c1b88bb50a3eea407342ae6d46b8f9eda"
+    },
     {
       "path": "modules/lifecycle/rot.js",
       "mode": "0000644",
@@ -5872,7 +5892,7 @@
     {
       "path": "modules/lifecycle/routes/lifecycle.js",
       "mode": "0000644",
-      "sha256": "f4b080286870b6cd52cd59c5cb7c5a5127c3b0a90df50b7d87495d684767203b"
+      "sha256": "330e42fad79812a05a90256fe31931df2156093b80a648d7c838ecac136c91e4"
     },
     {
       "path": "modules/lifecycle/routes/mingle.js",
@@ -5892,7 +5912,7 @@
     {
       "path": "modules/lifecycle/routes/removal-proposals.js",
       "mode": "0000644",
-      "sha256": "329f130d3556dc05981ce6b4b6ce4d55984c6ca42fd0f421fd70cba63eb277ac"
+      "sha256": "e0a0e14a8818c011334e8f61a50c8dd7ad11b4387acfd6ab9e18e570f54ec6c4"
     },
     {
       "path": "modules/lifecycle/routes/rot.js",
@@ -7882,12 +7902,12 @@
     {
       "path": "package-lock.json",
       "mode": "0000644",
-      "sha256": "90c995ff72567f0389795d8aabe1e76d05d0ac47b604081c0f03725a0a66737a"
+      "sha256": "0169c3fafa67ebf63c9ae35566e8104bcf210ae80973c8e1837874109fe85354"
     },
     {
       "path": "package.json",
       "mode": "0000644",
-      "sha256": "f406c6c8801548af676175664eb13a14e0f80ee58a8106eca0ed075baab77136"
+      "sha256": "b62dd828c8e8b167dfc4bca7d54fdec8c76b13f89a44e61365d48962abf77ba9"
     },
     {
       "path": "public-docs/index.html",
@@ -8832,7 +8852,7 @@
     {
       "path": "scripts/gds/provision-core-upgrade.js",
       "mode": "0000644",
-      "sha256": "5fad0beb0a3d4b322918a99765cb922fcce1de4196c19cb08a0d3bc91c3d149e"
+      "sha256": "1fd6e38184bb0943fdc22e314b9e6cad0b5ebeae7f7370992adbd3b4f2ad5a9e"
     },
     {
       "path": "scripts/gds/provision-disconnect.js",
@@ -9887,7 +9907,7 @@
     {
       "path": "src/module-api.js",
       "mode": "0000644",
-      "sha256": "6e48d3680bf84d97e45001deee8c64b2a5a31eed9ce9b68515b13d4a42086203"
+      "sha256": "86c69951f0059e5374245ef798c5cd24cd82d836a4ccf706e80f186de986b473"
     },
     {
       "path": "src/module-loader/catalog.js",
@@ -10802,7 +10822,7 @@
     {
       "path": "tests/core_upgrade_runner.mjs",
       "mode": "0000644",
-      "sha256": "a8fc77b7a32e4377b4b327bd485cbc17428421ef3fc871770fdaeee3e02e48f4"
+      "sha256": "5d0b4fa1ec48d40ebc801902b5279475533ae2dc8819e587bb95bc17783cba06"
     },
     {
       "path": "tests/cosmos_token_contrast.mjs",
@@ -11894,6 +11914,11 @@
       "mode": "0000644",
       "sha256": "0d8f07c64f4d17c8c894b2d6395281882efd4e186c5714fe9aab61e2808d4314"
     },
+    {
+      "path": "tests/idea_brightness.mjs",
+      "mode": "0000644",
+      "sha256": "d67d60b1236ccedd01591356f5a5a9a72e4f1efd895ddf5af00c744219a2b3b6"
+    },
     {
       "path": "tests/idea_capture_grades.mjs",
       "mode": "0000644",

package/docs/adr/0321-brightness-is-a-weighted-share-and-the-targets-are-a-row.md

@@ -0,0 +1,163 @@
+# ADR 0321 — Brightness is a payout-weighted share, and a removal's targets are rows
+
+- **Status:** Accepted
+- **Date:** 2026-09-20
+- **Task:** [task 1004099](https://cloudbongos.com/builders#/task/1004099) (BV2.R16, goal 1000095 — BONGOS-V2)
+- **Spec:** `docs/specs/<redacted>.md` decisions 4 and 20
+- **Under:** [ADR 0313](0313-a-removal-is-proposed-by-the-ship-and-confirmed-by-a-person.md), [ADR 0319](0319-a-removal-verdict-is-a-row-beside-the-question.md)
+
+## Context
+
+An idea's **size** is its total ideator payout from its descent and never falls
+([ADR 0312](0312-provenance-is-a-second-ideas-owned-edge-table.md) and
+`modules/economy/idea-size.js`). **Brightness** is the other channel: how much of that
+work is still alive. The pair is what lets a thought whose version the project later tore
+out draw *large and dark* — visibly different from a thought that never caused anything
+and draws *small and dark*. One number cannot express both, which is why there are two.
+
+Two things had to be settled before it could be computed.
+
+**First, what a share is a share OF.** The spec says graded, not binary (decision 20): a
+descent of five things with three alive is partly lit, and goes out only when nothing
+survives.
+
+**Second, and the real blocker: the removal facts are stored in the wrong direction.**
+ADR 0319 gave a confirmed removal a row — `lifecycle_removal_verdicts`, keyed on the
+proposal, carrying the verdict and `ship_task_id`. It also said, in the migration and in
+its own text, that the list of tasks whose work was removed was deliberately absent, and
+that *"brightness designs its own storage for targets when it needs one."* That deferral
+is now due.
+
+The gap is not cosmetic. `ship_task_id` is the task whose merge **deleted** the files.
+Brightness needs the previously-shipped tasks that **stopped counting**. Those are
+different rows, almost always under different ideas — a later, unrelated piece of work
+tears out an earlier one. Reading the ship as the removed task dims the wrong star, and
+dims it for the wrong idea, while looking like a working query.
+
+The attribution itself already exists. `modules/lifecycle/removal-derivation.js` blames
+each deleted path back to the task that introduced it, and the cascade renders the result
+as prose in the proposal's body. `removal-proposals.js` refuses to parse that prose back
+and is right to: *"a body is written for a person to read, and a reader that silently
+depends on its line shape breaks the day somebody improves the wording."*
+
+## Decision
+
+### D1 — The targets are rows, written at proposal time
+
+`modules/lifecycle/migrations/lifecycle_010_removal_targets.sql` adds
+`lifecycle_removal_targets (proposal_task_id, removed_task_id, paths)`, written by
+`recordRemovalTargets` from the same `ctx.removals` objects the proposal body renders.
+**One derivation, two renderings** — the prose and the rows cannot disagree, and
+`removal-proposals.js` keeps its refusal intact because something else now carries the
+fact.
+
+It must be written at **proposal** time rather than at verdict time. The attribution comes
+from GitHub commit-history reads, capped at eight paths per ship
+(`MAX_ATTRIBUTED_PATHS`) and running on the server's shared push credential — the same
+credential the publish path depends on. Re-deriving when a person clicks Confirm, days
+later, would spend that budget again against a history that has moved on.
+
+This is **not** the cascade runner fanning out, which [ADR 0242](0242-a-cascade-is-a-declaration-table-on-the-event-that-already-exists.md)
+forbids: the removal rule still files exactly one task. This records a side fact *about*
+that one task — the same shape as the verdict row its answer writes.
+
+`ON CONFLICT DO NOTHING`, never `DO UPDATE`. A second walk can legitimately find *fewer*
+paths, because the cap and the rate limit make an exhausted page yield no attribution at
+all; overwriting would let a degraded re-read erase a good first one. For the same
+reason the writer runs on the cascade's `skipped` row as well as its `created` one, so a
+re-ship **repairs** an attribution that a derivation outage missed.
+
+### D2 — Brightness is weighted by payout, not by task count
+
+The share is `live / credits`, where each descent task is weighted by what it actually
+earned the idea.
+
+Counting tasks instead would make deleting a one-line fix dim a star as hard as deleting
+the feature it belongs to. Weighting by payout makes brightness fall in proportion to how
+much of the idea's *worth* died — and since size is drawn from the same quantity, the two
+channels become a share of one number rather than two unrelated measurements sitting side
+by side. It also makes "large and dead" exact: full size, zero brightness.
+
+The basis is **paid + estimated**, matching size. A historical idea's descent was never
+paid for (`idea-size-historical.js` prices those hops); counting only banked credits would
+mean removing an estimated hop dims nothing while the size drawn beside it still counts
+that hop. To support this, `priceDescentForIdea` and `ideaSizes` now return a per-task
+`byTask` breakdown that **sums exactly to `credits`** — assembled from the priced descent
+plus any ledger payment for a task the descent no longer reaches, because `idea-size.js`
+deliberately keeps those in `credits` so size cannot fall, and dropping them here would
+make the parts sum to less than the whole and silently overstate brightness.
+
+### D3 — An idea that earned nothing is LIT, not dark
+
+Zero over zero is not zero. A freshly-filed thought has had nothing removed from it, so
+`share: 1` with `hasWork: false`. Returning 0 would make it pixel-identical to the thought
+whose version was torn out — which is precisely the distinction BV2.R19's proof exists to
+check, and would quietly defeat the reason size and brightness are two channels.
+`hasWork` is what lets the five states (BV2.R17) tell a protostar from a remnant without
+re-deriving it.
+
+### D4 — "Could not look" is not "nothing was removed"
+
+When the removal facts cannot be read — the lifecycle module is off, the port is
+unregistered — `share` is `null` and `attributable` is `false`, never a confident 1. Same
+posture `idea-size.js` already takes with `historical: null` when the descent walk is
+unavailable: an established absence and an unreadable one are different answers, and only
+one of them may be drawn as a plain full-brightness star.
+
+A **confirmed removal that names no target** is the residual case D1 cannot close: it is
+genuinely gone, and brightness does not know which idea to dim. It happens for proposals
+filed before `lifecycle_010`, for attributions where every deletion predates
+`claims.published_head_sha`, and for a derivation outage. Guessing in either direction is
+worse than not dimming — so nothing dims, and `countUnattributedConfirmed()` exists so a
+surface can say *"the sky may read brighter than the truth by up to N confirmed
+removals"* instead of being silently optimistic.
+
+### D5 — Brightness lives in `economy`, behind a port
+
+It is a share of the same payouts size is built from, so it sits beside size in
+`modules/economy/idea-brightness.js`; putting it in `lifecycle` would mean that module
+doing money arithmetic. That makes the removal facts a cross-module read, so they come
+through a kernel-mediated port — `lifecycle.removals` — and never a `require`
+([ADR 0083](<redacted>.md) rule 1), exactly as economy already
+reaches `ideas.descent`.
+
+Economy resolves it with `resolveOptional` and **does not declare it in `consumes`**.
+`consumes` means *required*, and `verifyEnabledPorts` refuses to boot when an enabled
+module consumes an unprovided port — declaring it would turn "lifecycle off" into
+"instance will not start". The same non-declaration, for the same reason, as
+`ideas.descent`.
+
+## Consequences
+
+- Brightness is computable per idea and falls only when a **person** confirms a removal.
+  A dismissed or unanswered proposal dims nothing, which is what stops refactors, renames
+  and moves from dimming the sky continuously — ADR 0313's central finding.
+- **No credit is ever clawed back.** `modules/economy/idea-brightness.js` contains no
+  writer and is unreachable from any ship path. `shipped` stays terminal, the ledger is
+  never rewritten, and size does not move. Only the picture changes.
+- `ideaSizes` grew a field. Callers that spread its result now carry a `Map`; nothing
+  serialises it to JSON today, and a surface that wants to must project it rather than
+  pass it through.
+- BV2.R17 (the five states) can resolve protostar-vs-remnant from `hasWork` and `share`
+  without re-deriving either, and BV2.R18 (the sky) has `removedTasks` to explain *why* a
+  star dimmed rather than only that it did.
+
+## Rejected
+
+- **Parsing the proposal body.** The attribution is right there as
+  `  - task <id> — <title>`. It is also documentation prose that a copy edit may reword at
+  any time, and ADR 0319 already refused this for that reason. A reader that depends on a
+  human-facing line shape fails silently and dims nothing.
+- **Re-deriving targets at verdict time.** Spends the capped GitHub budget a second time,
+  against a history that has moved, on the interactive path where a person is waiting.
+- **Treating `ship_task_id` as the removed task.** The wrong direction; dims the ship's
+  own idea instead of the one whose work died. Named here because the column is right
+  there on the verdict row and is the obvious thing to reach for.
+- **Counting tasks rather than payouts.** Simpler, and makes a one-line fix weigh the same
+  as a feature.
+- **Clamping the share at both ends.** The bottom is clamped so an anomaly renders as a
+  legible "nothing survives" rather than a negative; the top is not, and `live` / `removed`
+  are reported unclamped, so an impossible figure stays visible instead of being hidden by
+  the thing that claims to prevent it — `idea-size.js`'s argument against clamping size.
+- **Storing the removed task's title beside the row.** It lives on `tasks` and can be
+  joined for; a copy goes stale the first time a title is edited.

package/docs/adr/README.md

@@ -412,3 +412,4 @@ This keeps the decision history honest and traceable.
 | 0320 | [**An empty diff is not an ungraded diff: grade the claim instead** ([task 1004011](https://cloudbongos.com/builders#/task/1004011), goal 1000118 — BONGOS-V2; scoped out of task 1003950 shape 2). `ship.js --allow-empty` closes a task that produced no committed artifact, and it used to do two things at once: set `skipGrade`, so the subagent grader never ran, and therefore route the close through `POST /tasks/:id/confirm`, gated on `task.confirm.grade_bypass` — one of [ADR 0157](0157-archon-is-rank-and-identity-only.md)'s four trust-boundary keys, so a Metic could not close an artifact-free task at all. **Both halves were wrong.** The permission was the wrong question: `grade_bypass` means *ratify past a grade that FAILED*, a genuine override of an existing verdict, and a no-artifact close has no verdict to override — charging the same key for "it was judged and rejected" and "there was nothing to judge" conflates an override with an absence. And nothing was being checked, which is the more serious half: the assertions in the handoff notes ("the premise was already fixed", "this was a pure ops verification", "the row was updated directly") went into the ledger unread, on exactly the ships where the record is the ONLY evidence that exists. A permission gate is not scrutiny — an Archon clicking confirm is not someone checking whether the claim is true. **Decision:** on `--allow-empty` the grader is not skipped, it is RE-POINTED — it grades the notes + value summary against the task description, asking whether the task is genuinely artifact-free and whether the evidence supports that. A pass is a real passing grade confirming through the ordinary rank-open path; a fail is answered with better evidence, not a key. Three sub-decisions carry it: the rubric axes are **re-asked, not replaced** (`functional_fidelity` → is this genuinely artifact-free, `code_quality` → is the evidence specific and checkable), because the gate arithmetic and `/grade-audit`, the aggregates and the cost model all read those columns and a third pair of names would mean teaching every one of them a synonym; **two generalist shots, not the four-lens panel** (Hacker/Quality/Efficiency are lenses over code — over three paragraphs of prose they are four readings of the same short text at four times the cost — so the lenses go, recorded in `signals.lenses_dropped` per the #513 trivial-diff precedent; but the panel's UNANIMOUS gate was also the cross-check that makes injection hard, and the first cut kept a single shot and lost it, so the species asks the same question twice and collapses by **unanimity, not median** — under a median the mean of a fooled 10 and a suspicious 3 is a passing 6.5 and the second reading launders the first; a split is recorded as `signals.shot_dissent`; the collapse covers ALL THREE gate axes including `confidence`, which the second grading round caught missing — it is the one axis living in `signals` rather than `rubric_scores`, and the server derives `lowConfidence` purely from the submitted value, so an honest 0.2 "I cannot judge this" averaged with a confident 0.9 would have cleared the 0.4 gate at 0.55); and the species marker lives in **`signals.no_artifact_grade`, not `grader_kind`**, because the server's `validateAndScore` hardcodes `task_grades.grader_kind` to `'subagent'` for everything on that route. **D4: every builder-controlled field is scrubbed and fenced** (`grader-workers/fence.js`, SR-15 / #995) — the panel workers have fenced the diff, title, description and value summary since #995, and this species is the worse case on both sides: the notes are not context around an artifact the model can independently check, they ARE the evidence, and a successful injection does not flip one of four workers, it closes a task past the very scrutiny this ADR added to replace the Archon-only gate. The first implementation shipped it unfenced and the grader caught it as a blocker. The no-follow rule is restated AFTER the artifact too, since the notes may run to 24,000 characters and a rule stated once at the top is a long way behind by the end of an adversarial payload. The prompt renders no changed-files or diff section at all, so the absence cannot read as the finding. No diff hash is stored — hashing the empty diff makes it a reuse key shared by every empty-diff ship of the task, handing the next close a pass this one earned. Unchanged: `--skip-grade` still reaches the Archon gate (the task 1003950 escalation split still chooses the refusal), and below the protected-path floor the server's Guard 1b (task 1002646) still fails a zero-`committed_files` pass closed, correctly — this moves the Metic-and-above case, which is the case that was filed. **Drops task 1004010**, the alternative shape — a new lower-floored permission atom for the same close — by owner decision of 2026-09-20: it answers "who may skip the check" when the better question is "why is there no check", and it permanently widens the permission surface, the same class of change the owner declined three days earlier for `version.create` ([task 1003853](https://cloudbongos.com/builders#/task/1003853), [ADR 0250](0250-strict-versioning-the-version-boundary-is-the-scope-gate.md) §6a). Also rejected: lowering the floor on the existing key (treats the gate as the point; nothing would read the notes); grading the notes with the full panel; a new pair of rubric axes for prose (honest about the measurement, but moves the gate arithmetic and every consumer of it for a naming gain).](0320-an-empty-diff-is-not-an-ungraded-diff.md) | grading / permissions |
 | 0319 | [**A removal verdict is a row beside the question, because both answers close it the same way** ([task 1004095](https://cloudbongos.com/builders#/task/1004095), goal 1000095 — BONGOS-V2). [ADR 0313](0313-a-removal-is-proposed-by-the-ship-and-confirmed-by-a-person.md) settled that a ship deleting an earlier shipped task’s files files a QUESTION and a person answers it; task 1004090 built the question and nothing could answer it. Building the answer surfaced the property that decides the design: a proposal is a question, not work, so CONFIRMING and DISMISSING both leave nothing to build and both end the task at `abandoned` — meaning a status alone records neither, and brightness could not tell the star it must dim from the one it must not. ADR 0313 had already rejected the obvious alternative (a `removed` status; `shipped` is terminal and much of the ledger leans on it — a removal is a fact recorded BESIDE work, not a new terminal state). Decision: `lifecycle_removal_verdicts` (migration `lifecycle_009`), PRIMARY KEY on `proposal_task_id` so one proposal holds one answer ever — a second decide is REFUSED (409), never upserted and never an idempotent 200, because overwriting destroys the record that a person answered differently; the row is locked `FOR UPDATE` first, so simultaneous Confirm and Dismiss cannot both read “undecided”, and `ALREADY_DECIDED` is checked BEFORE `PROPOSAL_CLOSED` because an answered proposal is also abandoned and the useful message is the one naming the earlier verdict. The verdict and the status change commit in ONE transaction. What this does NOT ship is the target list: the affected tasks and paths stay PROSE in the proposal body (the owner’s 2026-09-20 decision, since [ADR 0242](0242-a-cascade-is-a-declaration-table-on-the-event-that-already-exists.md) forbids widening the runner to fan out), and nothing here parses it — brightness designs that storage. What brightness does get is structured: the verdict plus `ship_task_id`, denormalised out of the `source_ref` that encodes it as a string nothing can join on. Surface: spec decision 15’s “existing awaiting-nod surface” is the CARD, not the QUEUE — [ADR 0299](0299-the-nod-queue-stays-scoped-to-routed-filings.md) keeps that queue scoped to routed filings and a removal proposal has no idea lineage at all, so it gets its own slice on the same card at the same floor. The PERMISSION is reused (`task.promote`, Metic+, read and write both) and the VERB is not: no existing route means “that work is genuinely gone”, and `/tasks/:id/abandon` would close the question without recording which answer was given. Top-level `/removal-proposals` rather than `/tasks/removal-proposals`, because the manifest mounts `tasks` first and its `/tasks/:id` swallows a later file’s literal segment. Rot is INHERITED: `backlog` is rottable and `abandoned` is not, so an unanswered proposal rots and an answered one leaves the feed with no code written for either — pinned against the rot module’s own exported vocabulary. Rejected: the status as the record; parsing the body at confirm time; widening the nod queue; separate `/confirm` and `/dismiss` routes; upserting a second verdict; a `LIKE ‘prefix%’` match (a rule key may contain an underscore, which is a LIKE wildcard).](0319-a-removal-verdict-is-a-row-beside-the-question.md) | ideas / lifecycle |
 | 0318 | [**Listing a file for task affinity is not claiming to own it** ([task 1004110](https://cloudbongos.com/builders#/task/1004110), goal 1000095 — BONGOS-V2). The case [ADR 0314](0314-module-protection-is-per-path-not-per-module.md) named and left open, closed by neither of the two routes it predicted. `builder-settings` derived `protected` — Archon-only to scope a goal to — on exactly one glob, `src/bongos/routes/me.js`, caught by the blanket `src/bongos/routes/` prefix. **That glob was never an ownership claim:** `MODULE_GLOBS` listed it for task AFFINITY and said in the same comment that the `GET /me` aggregator stays a thin core facade, and `isProtected()` cannot tell the two apart. **Both predicted routes were measured and rejected.** Narrowing the blanket prefix: all eighteen files under `src/bongos/routes/` are protected by that prefix AND NOTHING ELSE, so narrowing unwalls `auth.js`, `builders.js`, `backup.js` and `core-update.js` together — now pinned as a tripwire test rather than left as a caution. Moving `me.js` into `modules/builder-settings/`: the aggregator resolves TEN module ports (`lifecycle`, `reward`, `onboarding`, `government`, `specialities`, `grade`, `box`, `art` ×2, `discord`) and `builder-settings` is one of them, so hosting it inside one module means resolving nine foreign ports from the inside — the `core -> module` edge [ADR 0083](0083-modular-architecture-strangler-build-plan.md) rule 1 forbids. Decision: **ownership follows what the file is** — `me.js` moves to `kernel`, which already owns `src/bongos/routes/security.js`. This is 0314 one step on: owning the command is not owning the authority, and **being listed next to a module is not owning it either**. **Rejected: a general affinity tier** in `MODULE_GLOBS` mirroring `isCommandPath` — the audit does not support it. Three other modules (`kernel`, `devsecops`, `methodology`) are also protected only by paths outside their own directory, but in each the foreign path genuinely IS the domain; `builder-settings` was the only module protected by a path its own source called core, so a new tier would be a new place for a hole to hide, built for a population of one. `protectedModules()` goes 9 -> 8. **The wall that matters does not move:** a sub-Metic builder touching `/me` is still refused by `checkPermissionPaths`, asserted directly rather than assumed. The sixteen still-unowned route files remain [task 1004116](https://cloudbongos.com/builders#/task/1004116), whose option (a) this de-risks.](0318-listing-a-file-for-task-affinity-is-not-owning-it.md) | permissions / module scope |
+| 0321 | [**Brightness is a payout-weighted share, and a removal's targets are rows** ([task 1004099](https://cloudbongos.com/builders#/task/1004099), goal 1000095 — BONGOS-V2). Size is an idea's total ideator payout and never falls; brightness is how much of that work is still alive, and the pair is what lets a thought whose version was torn out draw LARGE AND DARK rather than merging with one that never mattered. Two things had to be settled. **The removal facts were stored in the wrong direction**: [ADR 0319](0319-a-removal-verdict-is-a-row-beside-the-question.md) gave a confirmed removal a row carrying the verdict and `ship_task_id` — the task whose merge DELETED the files — and deliberately left out the tasks whose work was removed, saying brightness would design its own storage when it needed one. Those are different rows under different ideas, so reading one as the other dims the wrong star while looking like a working query. `<redacted>` stores `(proposal_task_id, removed_task_id, paths)` at PROPOSAL time, from the SAME derivation objects the proposal body renders as prose — one derivation, two renderings, so they cannot disagree and `removal-proposals.js` keeps its refusal to parse a body back. Proposal time and not verdict time because the attribution comes from capped, rate-limited GitHub commit-history reads that only exist while the cascade runs. NOT a runner fan-out ([ADR 0242](0242-a-cascade-is-a-declaration-table-on-the-event-that-already-exists.md)): the rule still files one task; this records a side fact about it. `ON CONFLICT DO NOTHING`, never `DO UPDATE`, since a degraded second walk finds FEWER paths and must not erase a good first read — and the writer runs on the cascade's SKIPPED row too, so a re-ship repairs what a derivation outage missed. **The share is weighted by PAYOUT, not by task count**, or deleting a one-line fix dims a star as hard as deleting the feature; weighting by what each hop earned also makes 'large and dead' exact, and makes the two channels a share of ONE number rather than two unrelated measurements. Basis is paid + estimated to match size, which required `priceDescentForIdea`/`ideaSizes` to return a per-task `byTask` summing EXACTLY to `credits` — including ledger payments for tasks the descent no longer reaches, which `idea-size.js` keeps in `credits` so size cannot fall and which would otherwise make the parts sum to less than the whole. Three edges, each silent: an idea that earned nothing is `share: 1, hasWork: false`, because zero over zero is not zero and a protostar is not a remnant (the BV2.R19 distinction); an unreadable removal port gives `share: null, attributable: false`, because 'could not look' is not 'nothing was removed'; and a CONFIRMED removal naming no target dims nothing at all — brightness cannot know which idea — so `countUnattributedConfirmed()` exists to say the gap out loud instead of quietly brightening the sky. Brightness lives in `economy` beside size and reaches lifecycle through the new `lifecycle.removals` port, resolved OPTIONALLY and NOT declared in `consumes` (declaring it would turn 'lifecycle off' into 'instance will not start' — the `ideas.descent` precedent). **No credit is clawed back and nothing here writes**: ADR 0313 stands, `shipped` is terminal, only the picture changes. Rejected: parsing the proposal body (ADR 0319 already refused it — a human-facing line shape fails silently when reworded); re-deriving at verdict time; treating `ship_task_id` as the removed task; counting tasks rather than payouts; clamping the share at the top, which would hide the anomaly it claims to prevent.](0321-brightness-is-a-weighted-share-and-the-targets-are-a-row.md) | ideas / economy |

package/docs/module-api-changelog.md

@@ -2316,5 +2316,7 @@ is load-bearing: the script throws rather than guess if it is missing, and
         landed since 1.19.919 with no explicit bump. run 35531720944. (task 1002620)
   1.19.921 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
         landed since 1.19.920 with no explicit bump. run 35534076467. (task 1002620)
+  1.19.922 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+        landed since 1.19.921 with no explicit bump. run 35536293721. (task 1002620)
 ---------------------------------------------------------------------------
 ```

package/modules/economy/idea-brightness.js

@@ -0,0 +1,212 @@
+'use strict';
+
+// modules/economy/idea-brightness.js — BRIGHTNESS: the live share of an idea's
+// descent (task 1004099 / BV2.R16, goal 1000095; spec
+// docs/specs/bongos-v2-ideator-surface.md decisions 4 and 20; ADR 0321, under
+// ADR 0313 + 0319).
+//
+// WHAT BRIGHTNESS IS. Size is an idea's total ideator payout from its descent and
+// NEVER falls (./idea-size.js). Brightness is how much of that payout is still
+// alive: the same sum, restricted to the descent tasks the project has not since
+// confirmed as removed, over the whole. Two channels, two facts — and the pair is
+// the entire point. A thought that caused a version the project later tore out
+// draws LARGE AND DARK, which is visibly different from a thought that never
+// caused anything and draws small and dark. One number could not say that.
+//
+// GRADED, NOT BINARY (spec decision 20). A descent of five things with three
+// still alive is partly lit. It goes out only when nothing survives. So this is a
+// share in [0, 1] and not a flag — an idea dims progressively as pieces of its
+// work are removed.
+//
+// WEIGHTED BY PAYOUT, NOT BY COUNT, and that is the decision in this file.
+// Counting tasks would make removing a one-line fix dim a star as much as
+// removing the feature it belongs to. Weighting by what each hop actually earned
+// means brightness falls in proportion to how much of the idea's WORTH died,
+// which is the same quantity size is drawn from — so the two channels are a
+// share of one number rather than two unrelated measurements that happen to sit
+// side by side. It also makes "large and dead" exact: full size, zero brightness.
+//
+// THE BASIS IS PAID + ESTIMATED, the same as size. A historical idea's descent
+// was never paid for (./idea-size-historical.js prices those hops), and if
+// brightness counted only banked credits, removing an estimated hop would dim
+// nothing while the size drawn beside it still counted that hop. The share would
+// then be a fraction of a different number than the one on screen.
+//
+// BRIGHTNESS NEVER CLAWS BACK CREDITS, and nothing here could. This module only
+// READS — no writer, no ledger row, no status change. ADR 0313 settles that
+// `shipped` is terminal and the ledger is never rewritten when the project
+// changes its mind: only the picture changes. Size is computed from credit_log
+// and is untouched by anything in this file.
+//
+// WHAT COUNTS AS REMOVED IS A PERSON'S ANSWER, never a derived one. A ship that
+// deletes an earlier shipped task's files files a QUESTION (the
+// `removal-proposed-on-ship` cascade), someone confirms or dismisses it, and only
+// 'confirmed' reaches this read. Refactors, renames and file moves all look like
+// deletions to a diff, so a derived-only signal would dim the sky continuously —
+// ADR 0313's central finding, and the reason `dismissed` exists at all.
+//
+// MODULE BOUNDARY: the removal facts live in the LIFECYCLE module and are reached
+// through the kernel-mediated `lifecycle.removals` port, never a cross-module
+// require (ADR 0083 rule 1) — the same way ./idea-size.js reaches `ideas.descent`.
+
+const api = require('../../src/module-api');
+const { resolveOptional } = api;
+const { ideaSizes } = require('./idea-size');
+
+// A positive integer id as it arrives off a row or a caller, where it may be a
+// bigint serialised to a string. Never coerced with Number(); the guard
+// ./idea-size.js uses, for the same precision reason.
+function idOf(v) {
+  return /^[1-9]\d*$/.test(String(v)) ? String(v) : null;
+}
+
+// ideaBrightnesses — brightness for MANY ideas, keyed by idea id (string).
+//
+// Returns Map<ideaIdString, {
+//   share       number in [0,1] — the live fraction of the descent's payout,
+//               or null when it could not be established (see below)
+//   live        credits still alive
+//   removed     credits whose work is confirmed gone
+//   credits     the total the two divide (equals size's `credits`)
+//   removedTasks  [{ taskId, credits, proposalTaskId, paths }] — WHAT went out,
+//               so a surface can say why a star dimmed instead of only that it
+//               did
+//   hasWork     false when the idea has earned nothing at all
+//   attributable  false when the removal facts could not be read
+// }>
+//
+// EVERY ID ASKED FOR IS PRESENT. Absent and dark are different answers, and an
+// idea that caused nothing yet is a real state the sky has to draw.
+//
+// AN IDEA THAT EARNED NOTHING IS `share: 1`, `hasWork: false` — LIT, NOT DARK,
+// and this is the sharpest edge in the file. Zero over zero is not zero. A
+// freshly-filed thought has had nothing removed from it; it is a protostar, not a
+// remnant. Returning 0 would light-for-light merge it with the thought whose
+// version was torn out, which is exactly the distinction BV2.R19's proof exists
+// to check. `hasWork` is what lets the five states (BV2.R17) tell the two apart
+// without re-deriving it.
+//
+// WHEN THE REMOVAL FACTS CANNOT BE READ — the lifecycle module is off, or the
+// port is unregistered — `share` is NULL and `attributable` is false, rather than
+// 1. "Nothing was removed" and "we could not look" are different answers and only
+// one of them may be drawn as a plain full-brightness star. Same posture
+// ./idea-size.js takes with `historical: null` when the descent walk is
+// unavailable.
+//
+//   ideaIds        — array of ids (bigint-safe strings or numbers)
+//   client         — optional tx client; falls back to the pool inside the reads
+//   descentByIdea  — the caller's already-walked descent, passed straight through
+//                    to ideaSizes so a page that has one costs no extra walk
+//   sizes          — an already-computed ideaSizes() result, when the caller has
+//                    one. Brightness needs the same per-task figures size does,
+//                    so a surface drawing both should compute sizes once and hand
+//                    them here rather than paying for the whole read twice.
+async function ideaBrightnesses(ideaIds, { client = null, descentByIdea = null, sizes = null } = {}) {
+  const ids = [...new Set((Array.isArray(ideaIds) ? ideaIds : []).map(idOf).filter(Boolean))];
+  const out = new Map();
+  if (ids.length === 0) return out;
+
+  const sized = sizes || await ideaSizes(ids, { client, descentByIdea });
+
+  // The per-task breakdown. `ideaSizes` carries the totals; `byTask` is what
+  // lets a share be taken of them, and it is absent only when the descent could
+  // not be walked at all — in which case there is nothing to attribute against
+  // and the idea reads unattributable below.
+  const perTask = new Map();
+  for (const id of ids) {
+    const s = sized.get(id);
+    perTask.set(id, (s && s.byTask instanceof Map) ? s.byTask : null);
+  }
+
+  // Every descent task across every idea asked for, in ONE port call. A lookup
+  // per idea would be a round trip per star on a page of them.
+  const allTaskIds = new Set();
+  for (const byTask of perTask.values()) {
+    if (!byTask) continue;
+    for (const taskId of byTask.keys()) allTaskIds.add(taskId);
+  }
+
+  const port = resolveOptional && resolveOptional('lifecycle.removals');
+  let confirmed = null;
+  if (port && typeof port.confirmedRemovalsForTasks === 'function' && allTaskIds.size > 0) {
+    confirmed = await port.confirmedRemovalsForTasks([...allTaskIds], { client });
+  } else if (port && typeof port.confirmedRemovalsForTasks === 'function') {
+    // The port is there and there is simply nothing to ask about. That is an
+    // established answer — no removals — not an unreadable one.
+    confirmed = new Map();
+  }
+
+  for (const id of ids) {
+    const s = sized.get(id) || { credits: 0 };
+    const byTask = perTask.get(id);
+    const credits = Number(s.credits) || 0;
+
+    if (!confirmed || !byTask) {
+      out.set(id, {
+        share: null, live: null, removed: null, credits,
+        removedTasks: [], hasWork: credits > 0, attributable: false,
+      });
+      continue;
+    }
+
+    let removed = 0;
+    const removedTasks = [];
+    for (const [taskId, taskCredits] of byTask) {
+      const hit = confirmed.get(taskId);
+      if (!hit) continue;
+      const c = Number(taskCredits) || 0;
+      removed += c;
+      removedTasks.push({
+        taskId,
+        credits: c,
+        proposalTaskId: hit.proposalTaskId,
+        paths: hit.paths,
+      });
+    }
+
+    // The live half comes off the TOTAL minus what died, not off a second sum
+    // over the surviving tasks. The two differ: `credits` includes payouts for
+    // tasks the descent no longer reaches (a re-parented task, a deleted edge),
+    // which ./idea-size.js keeps on purpose so size cannot fall. Summing the
+    // survivors would quietly drop those and make a re-parenting dim a star.
+    const live = credits - removed;
+    // Clamped at the bottom only, and never at the top. `removed` is a subset of
+    // the same figures `credits` was built from so it cannot exceed it — but if
+    // it ever did, a negative brightness is a rendering bug where a zero is a
+    // legible "nothing survives". The anomaly is still visible in `live` and
+    // `removed`, which are reported unclamped.
+    const share = credits > 0 ? Math.max(0, live) / credits : 1;
+
+    out.set(id, {
+      share,
+      live,
+      removed,
+      credits,
+      // Largest loss first: a surface explaining why a star dimmed wants the
+      // piece that mattered, not the first one the descent happened to yield.
+      removedTasks: removedTasks.sort((a, b) => b.credits - a.credits),
+      hasWork: credits > 0,
+      attributable: true,
+    });
+  }
+  return out;
+}
+
+// ideaBrightness — the same answer for one idea. A thin wrapper on purpose: two
+// implementations of "how lit is this thought" is two answers, and this is the
+// shape a single-idea panel wants. Mirrors ./idea-size.js's ideaSize.
+async function ideaBrightness(ideaId, opts = {}) {
+  const key = idOf(ideaId);
+  const unknown = {
+    share: null, live: null, removed: null, credits: 0,
+    removedTasks: [], hasWork: false, attributable: false,
+  };
+  if (!key) return unknown;
+  const all = await ideaBrightnesses([key], opts);
+  return all.get(key) || unknown;
+}
+
+module.exports = {
+  ideaBrightness,
+  ideaBrightnesses,
+};