@bongos/core 1.19.921 → 1.19.923

package/.bongos-core.json

@@ -2,22 +2,22 @@
   "artifact": "bongos-core",
   "manifest_schema": 1,
   "generator": "scripts/gds/package-core.js",
-  "core_version": "1.19.921",
-  "core_contract": "1.19.921",
-  "source_commit": "b57a8de976b2d06f0400384b4c8bd5d1f0d69508",
+  "core_version": "1.19.923",
+  "core_contract": "1.19.923",
+  "source_commit": "f854693589aaf4e6736cbe02c05c3fd5eb2f2ca1",
   "source_ref": "HEAD",
-  "built_at": "2026-09-20T20:00:16.702Z",
+  "built_at": "2026-09-20T22:19:24.521Z",
   "redaction": {
     "model": "docs-redacted+functional-verbatim",
-    "docs_redacted": 509,
+    "docs_redacted": 511,
     "agent_docs_stubbed": 26,
-    "functional_verbatim": 2305,
+    "functional_verbatim": 2311,
     "rules": 3,
     "gate_literals": 3,
     "gate": "passed"
   },
-  "file_count": 2840,
-  "tree_sha256": "9ea93825644aa4fadb711161dbfbf72e4a032f44e888e27c23fbf66d1a695b32",
+  "file_count": 2848,
+  "tree_sha256": "c600fca8af8dd65a3567fe7851b2ead8bc6c08f43dcb3b1b4964957c5c734e1a",
   "files": [
     {
       "path": ".claude/skills/ask-for-help/SKILL.md",
@@ -2094,10 +2094,20 @@
       "mode": "0000644",
       "sha256": "e582b4ece7a5b0acf4392d8b3d4942d55b52dc487d7c6a7c3a159203485ec633"
     },
+    {
+      "path": "docs/adr/0321-brightness-is-a-weighted-share-and-the-targets-are-a-row.md",
+      "mode": "0000644",
+      "sha256": "3a743808de440eebd5fcdd74a4c88e41acc82cc02ce5632cb392b2aa0c05b48e"
+    },
+    {
+      "path": "docs/adr/0322-a-remnant-needs-evidence-and-merged-wins.md",
+      "mode": "0000644",
+      "sha256": "6a4ad58720701e760068d5ce1761733790beef0a142aa31a08782d029cc7a390"
+    },
     {
       "path": "docs/adr/README.md",
       "mode": "0000644",
-      "sha256": "7f11cc3e7cf17031aae449f13724fe1c42350516e5294732b6db1eb6e3917673"
+      "sha256": "7c66ecbd1940f3cdd830f0fb4acf65c41178807a431bb8fab382e4b8a0dbc8ae"
     },
     {
       "path": "docs/api-reference.md",
@@ -2667,7 +2677,7 @@
     {
       "path": "docs/module-api-changelog.md",
       "mode": "0000644",
-      "sha256": "5693553f86384a3e66f0e6ba77ba1e6f83130a440d0a1f17179173b98696a026"
+      "sha256": "2dc422992b2c8e66db2eb3e7492abb35d061caf0ea2e3cc1ad492d0b4b8083b4"
     },
     {
       "path": "docs/modules-contract.md",
@@ -4229,15 +4239,20 @@
       "mode": "0000644",
       "sha256": "736eed2c89863d6eb28072627a40ac4f8945832cfb7b1d1aba10e6cc65483901"
     },
+    {
+      "path": "modules/economy/idea-brightness.js",
+      "mode": "0000644",
+      "sha256": "745da28c27ebcd50b349c3fe027f7e3f14888f9e012e0c9443656de249444ba1"
+    },
     {
       "path": "modules/economy/idea-size-historical.js",
       "mode": "0000644",
-      "sha256": "f99f62eb4eaeda10b32284dbe27f87e64d5b6b82c9eb4aa442057d0de13be761"
+      "sha256": "215eefac80aaf3624a8ff5d5284f29388a2e1b492424dd152b3d9bbe074e3a01"
     },
     {
       "path": "modules/economy/idea-size.js",
       "mode": "0000644",
-      "sha256": "d1fa5fda6b34bd2a8cf8d563c780bc4b12f1cdfb955e13f51799a589609ac1c0"
+      "sha256": "8818bea53d2ce90fe0bc98b53bfed1af11c4eeb541942b96c4cf50a162791634"
     },
     {
       "path": "modules/economy/migrations/economy_001_fix_gds_shipper_description.sql",
@@ -4262,7 +4277,7 @@
     {
       "path": "modules/economy/reward.js",
       "mode": "0000644",
-      "sha256": "ef4b939d83324c927dd1b1c8e3200212d0b5da973a87db6f9810c9c7edb942ad"
+      "sha256": "79f225665dfc84fce1c50d01a25bbf81986c91047732d04113f24a68f766d29a"
     },
     {
       "path": "modules/economy/routes/cost.js",
@@ -5389,6 +5404,11 @@
       "mode": "0000644",
       "sha256": "363598b5905c850967b407f20110a1d9e9d5b1090a958700cb6a4ed5cea70d80"
     },
+    {
+      "path": "modules/ideas/idea-state.js",
+      "mode": "0000644",
+      "sha256": "e516f7951b91234c1f9dc6e327dc7365b6f6c9aad69bb3a85835061e2d072253"
+    },
     {
       "path": "modules/ideas/inbox.js",
       "mode": "0000644",
@@ -5467,7 +5487,7 @@
     {
       "path": "modules/ideas/routes/inbox.js",
       "mode": "0000644",
-      "sha256": "5ec576c26e46c8a27cd3b40d400abd177f4bdf1f2124e286a294fa58a809489a"
+      "sha256": "c302e5cd180ce9a6253ab30fad24b970d06f33f0916ac5d922323e536da7b213"
     },
     {
       "path": "modules/ideas/routing.js",
@@ -5497,7 +5517,7 @@
     {
       "path": "modules/ideas/trail.js",
       "mode": "0000644",
-      "sha256": "35dfa6abb78efdac695b89805d660ff4bb0e0d2bc2587f0d1945310dcffb2980"
+      "sha256": "5ea6bad2296406f56bcf3a00f040ce78a789f24fc0d7d5b933e1526cbbb97cd2"
     },
     {
       "path": "modules/lifecycle/CLAUDE.md",
@@ -5522,7 +5542,7 @@
     {
       "path": "modules/lifecycle/cascade.js",
       "mode": "0000644",
-      "sha256": "fd8aeec221eede847aa3b0047c01721ac7e2076e95675a71a117eff3bf3bbc55"
+      "sha256": "176f7463d6f3c7bf2297760d0934f88528ee180dfb0c9e49a4347a449af2820d"
     },
     {
       "path": "modules/lifecycle/check-rollup.js",
@@ -5764,6 +5784,11 @@
       "mode": "0000644",
       "sha256": "e98efbb1537f0d99adb6b6b66c1fdccfd4bbac16b97362d479af903eb9de492c"
     },
+    {
+      "path": "modules/lifecycle/migrations/lifecycle_010_removal_targets.sql",
+      "mode": "0000644",
+      "sha256": "e3e29e791eeb94ab1380ae2e2a13eafaea413faf0d0324a4e2007ab2b3002fca"
+    },
     {
       "path": "modules/lifecycle/mingle.js",
       "mode": "0000644",
@@ -5772,7 +5797,7 @@
     {
       "path": "modules/lifecycle/module.json",
       "mode": "0000644",
-      "sha256": "01f96d398408491bc4f1d9357c23c259f16e52184569849a0caf775f5b38836b"
+      "sha256": "36a03e5d8a4fc1129439356ba6daaf284d2cd2ca3d98d35f990e3215ff11198a"
     },
     {
       "path": "modules/lifecycle/pg-constraint-fail.js",
@@ -5804,6 +5829,11 @@
       "mode": "0000644",
       "sha256": "8270ce55255998a4f0bbf574a54df0ba2597013c727b4afb1ce2abad9c9d4d2a"
     },
+    {
+      "path": "modules/lifecycle/removal-targets.js",
+      "mode": "0000644",
+      "sha256": "e80304e7b43fe86852763e2f859bc05c1b88bb50a3eea407342ae6d46b8f9eda"
+    },
     {
       "path": "modules/lifecycle/rot.js",
       "mode": "0000644",
@@ -5872,7 +5902,7 @@
     {
       "path": "modules/lifecycle/routes/lifecycle.js",
       "mode": "0000644",
-      "sha256": "f4b080286870b6cd52cd59c5cb7c5a5127c3b0a90df50b7d87495d684767203b"
+      "sha256": "330e42fad79812a05a90256fe31931df2156093b80a648d7c838ecac136c91e4"
     },
     {
       "path": "modules/lifecycle/routes/mingle.js",
@@ -5892,7 +5922,7 @@
     {
       "path": "modules/lifecycle/routes/removal-proposals.js",
       "mode": "0000644",
-      "sha256": "329f130d3556dc05981ce6b4b6ce4d55984c6ca42fd0f421fd70cba63eb277ac"
+      "sha256": "e0a0e14a8818c011334e8f61a50c8dd7ad11b4387acfd6ab9e18e570f54ec6c4"
     },
     {
       "path": "modules/lifecycle/routes/rot.js",
@@ -7882,12 +7912,12 @@
     {
       "path": "package-lock.json",
       "mode": "0000644",
-      "sha256": "90c995ff72567f0389795d8aabe1e76d05d0ac47b604081c0f03725a0a66737a"
+      "sha256": "baab771a63f97afcbcfa72e466c8e3bcdb220724bf1a0fd2046e078c88c31cc4"
     },
     {
       "path": "package.json",
       "mode": "0000644",
-      "sha256": "f406c6c8801548af676175664eb13a14e0f80ee58a8106eca0ed075baab77136"
+      "sha256": "ff37869714eeb7c99b2120171573cee5a434667baa4eb7bc76a87755f4a67214"
     },
     {
       "path": "public-docs/index.html",
@@ -8832,7 +8862,7 @@
     {
       "path": "scripts/gds/provision-core-upgrade.js",
       "mode": "0000644",
-      "sha256": "5fad0beb0a3d4b322918a99765cb922fcce1de4196c19cb08a0d3bc91c3d149e"
+      "sha256": "1fd6e38184bb0943fdc22e314b9e6cad0b5ebeae7f7370992adbd3b4f2ad5a9e"
     },
     {
       "path": "scripts/gds/provision-disconnect.js",
@@ -9887,7 +9917,7 @@
     {
       "path": "src/module-api.js",
       "mode": "0000644",
-      "sha256": "6e48d3680bf84d97e45001deee8c64b2a5a31eed9ce9b68515b13d4a42086203"
+      "sha256": "7c96d3ff9b319a6e4b6e640b01d8e8d3d61a341efb292359c35c495a938eacd5"
     },
     {
       "path": "src/module-loader/catalog.js",
@@ -10802,7 +10832,7 @@
     {
       "path": "tests/core_upgrade_runner.mjs",
       "mode": "0000644",
-      "sha256": "a8fc77b7a32e4377b4b327bd485cbc17428421ef3fc871770fdaeee3e02e48f4"
+      "sha256": "5d0b4fa1ec48d40ebc801902b5279475533ae2dc8819e587bb95bc17783cba06"
     },
     {
       "path": "tests/cosmos_token_contrast.mjs",
@@ -11894,6 +11924,11 @@
       "mode": "0000644",
       "sha256": "0d8f07c64f4d17c8c894b2d6395281882efd4e186c5714fe9aab61e2808d4314"
     },
+    {
+      "path": "tests/idea_brightness.mjs",
+      "mode": "0000644",
+      "sha256": "d67d60b1236ccedd01591356f5a5a9a72e4f1efd895ddf5af00c744219a2b3b6"
+    },
     {
       "path": "tests/idea_capture_grades.mjs",
       "mode": "0000644",
@@ -12009,6 +12044,11 @@
       "mode": "0000644",
       "sha256": "8bfc36537ffccae702e74e8763534fa535486a2eb8bbf9ee546a2c7368d1dc6b"
     },
+    {
+      "path": "tests/idea_state.mjs",
+      "mode": "0000644",
+      "sha256": "f71f7007d72689e865b1945feac66012398b38557affdc776d0a6abdc2140e65"
+    },
     {
       "path": "tests/idea_task_descent.mjs",
       "mode": "0000644",

package/docs/adr/0321-brightness-is-a-weighted-share-and-the-targets-are-a-row.md

@@ -0,0 +1,163 @@
+# ADR 0321 — Brightness is a payout-weighted share, and a removal's targets are rows
+
+- **Status:** Accepted
+- **Date:** 2026-09-20
+- **Task:** [task 1004099](https://cloudbongos.com/builders#/task/1004099) (BV2.R16, goal 1000095 — BONGOS-V2)
+- **Spec:** `docs/specs/<redacted>.md` decisions 4 and 20
+- **Under:** [ADR 0313](0313-a-removal-is-proposed-by-the-ship-and-confirmed-by-a-person.md), [ADR 0319](0319-a-removal-verdict-is-a-row-beside-the-question.md)
+
+## Context
+
+An idea's **size** is its total ideator payout from its descent and never falls
+([ADR 0312](0312-provenance-is-a-second-ideas-owned-edge-table.md) and
+`modules/economy/idea-size.js`). **Brightness** is the other channel: how much of that
+work is still alive. The pair is what lets a thought whose version the project later tore
+out draw *large and dark* — visibly different from a thought that never caused anything
+and draws *small and dark*. One number cannot express both, which is why there are two.
+
+Two things had to be settled before it could be computed.
+
+**First, what a share is a share OF.** The spec says graded, not binary (decision 20): a
+descent of five things with three alive is partly lit, and goes out only when nothing
+survives.
+
+**Second, and the real blocker: the removal facts are stored in the wrong direction.**
+ADR 0319 gave a confirmed removal a row — `lifecycle_removal_verdicts`, keyed on the
+proposal, carrying the verdict and `ship_task_id`. It also said, in the migration and in
+its own text, that the list of tasks whose work was removed was deliberately absent, and
+that *"brightness designs its own storage for targets when it needs one."* That deferral
+is now due.
+
+The gap is not cosmetic. `ship_task_id` is the task whose merge **deleted** the files.
+Brightness needs the previously-shipped tasks that **stopped counting**. Those are
+different rows, almost always under different ideas — a later, unrelated piece of work
+tears out an earlier one. Reading the ship as the removed task dims the wrong star, and
+dims it for the wrong idea, while looking like a working query.
+
+The attribution itself already exists. `modules/lifecycle/removal-derivation.js` blames
+each deleted path back to the task that introduced it, and the cascade renders the result
+as prose in the proposal's body. `removal-proposals.js` refuses to parse that prose back
+and is right to: *"a body is written for a person to read, and a reader that silently
+depends on its line shape breaks the day somebody improves the wording."*
+
+## Decision
+
+### D1 — The targets are rows, written at proposal time
+
+`modules/lifecycle/migrations/lifecycle_010_removal_targets.sql` adds
+`lifecycle_removal_targets (proposal_task_id, removed_task_id, paths)`, written by
+`recordRemovalTargets` from the same `ctx.removals` objects the proposal body renders.
+**One derivation, two renderings** — the prose and the rows cannot disagree, and
+`removal-proposals.js` keeps its refusal intact because something else now carries the
+fact.
+
+It must be written at **proposal** time rather than at verdict time. The attribution comes
+from GitHub commit-history reads, capped at eight paths per ship
+(`MAX_ATTRIBUTED_PATHS`) and running on the server's shared push credential — the same
+credential the publish path depends on. Re-deriving when a person clicks Confirm, days
+later, would spend that budget again against a history that has moved on.
+
+This is **not** the cascade runner fanning out, which [ADR 0242](0242-a-cascade-is-a-declaration-table-on-the-event-that-already-exists.md)
+forbids: the removal rule still files exactly one task. This records a side fact *about*
+that one task — the same shape as the verdict row its answer writes.
+
+`ON CONFLICT DO NOTHING`, never `DO UPDATE`. A second walk can legitimately find *fewer*
+paths, because the cap and the rate limit make an exhausted page yield no attribution at
+all; overwriting would let a degraded re-read erase a good first one. For the same
+reason the writer runs on the cascade's `skipped` row as well as its `created` one, so a
+re-ship **repairs** an attribution that a derivation outage missed.
+
+### D2 — Brightness is weighted by payout, not by task count
+
+The share is `live / credits`, where each descent task is weighted by what it actually
+earned the idea.
+
+Counting tasks instead would make deleting a one-line fix dim a star as hard as deleting
+the feature it belongs to. Weighting by payout makes brightness fall in proportion to how
+much of the idea's *worth* died — and since size is drawn from the same quantity, the two
+channels become a share of one number rather than two unrelated measurements sitting side
+by side. It also makes "large and dead" exact: full size, zero brightness.
+
+The basis is **paid + estimated**, matching size. A historical idea's descent was never
+paid for (`idea-size-historical.js` prices those hops); counting only banked credits would
+mean removing an estimated hop dims nothing while the size drawn beside it still counts
+that hop. To support this, `priceDescentForIdea` and `ideaSizes` now return a per-task
+`byTask` breakdown that **sums exactly to `credits`** — assembled from the priced descent
+plus any ledger payment for a task the descent no longer reaches, because `idea-size.js`
+deliberately keeps those in `credits` so size cannot fall, and dropping them here would
+make the parts sum to less than the whole and silently overstate brightness.
+
+### D3 — An idea that earned nothing is LIT, not dark
+
+Zero over zero is not zero. A freshly-filed thought has had nothing removed from it, so
+`share: 1` with `hasWork: false`. Returning 0 would make it pixel-identical to the thought
+whose version was torn out — which is precisely the distinction BV2.R19's proof exists to
+check, and would quietly defeat the reason size and brightness are two channels.
+`hasWork` is what lets the five states (BV2.R17) tell a protostar from a remnant without
+re-deriving it.
+
+### D4 — "Could not look" is not "nothing was removed"
+
+When the removal facts cannot be read — the lifecycle module is off, the port is
+unregistered — `share` is `null` and `attributable` is `false`, never a confident 1. Same
+posture `idea-size.js` already takes with `historical: null` when the descent walk is
+unavailable: an established absence and an unreadable one are different answers, and only
+one of them may be drawn as a plain full-brightness star.
+
+A **confirmed removal that names no target** is the residual case D1 cannot close: it is
+genuinely gone, and brightness does not know which idea to dim. It happens for proposals
+filed before `lifecycle_010`, for attributions where every deletion predates
+`claims.published_head_sha`, and for a derivation outage. Guessing in either direction is
+worse than not dimming — so nothing dims, and `countUnattributedConfirmed()` exists so a
+surface can say *"the sky may read brighter than the truth by up to N confirmed
+removals"* instead of being silently optimistic.
+
+### D5 — Brightness lives in `economy`, behind a port
+
+It is a share of the same payouts size is built from, so it sits beside size in
+`modules/economy/idea-brightness.js`; putting it in `lifecycle` would mean that module
+doing money arithmetic. That makes the removal facts a cross-module read, so they come
+through a kernel-mediated port — `lifecycle.removals` — and never a `require`
+([ADR 0083](<redacted>.md) rule 1), exactly as economy already
+reaches `ideas.descent`.
+
+Economy resolves it with `resolveOptional` and **does not declare it in `consumes`**.
+`consumes` means *required*, and `verifyEnabledPorts` refuses to boot when an enabled
+module consumes an unprovided port — declaring it would turn "lifecycle off" into
+"instance will not start". The same non-declaration, for the same reason, as
+`ideas.descent`.
+
+## Consequences
+
+- Brightness is computable per idea and falls only when a **person** confirms a removal.
+  A dismissed or unanswered proposal dims nothing, which is what stops refactors, renames
+  and moves from dimming the sky continuously — ADR 0313's central finding.
+- **No credit is ever clawed back.** `modules/economy/idea-brightness.js` contains no
+  writer and is unreachable from any ship path. `shipped` stays terminal, the ledger is
+  never rewritten, and size does not move. Only the picture changes.
+- `ideaSizes` grew a field. Callers that spread its result now carry a `Map`; nothing
+  serialises it to JSON today, and a surface that wants to must project it rather than
+  pass it through.
+- BV2.R17 (the five states) can resolve protostar-vs-remnant from `hasWork` and `share`
+  without re-deriving either, and BV2.R18 (the sky) has `removedTasks` to explain *why* a
+  star dimmed rather than only that it did.
+
+## Rejected
+
+- **Parsing the proposal body.** The attribution is right there as
+  `  - task <id> — <title>`. It is also documentation prose that a copy edit may reword at
+  any time, and ADR 0319 already refused this for that reason. A reader that depends on a
+  human-facing line shape fails silently and dims nothing.
+- **Re-deriving targets at verdict time.** Spends the capped GitHub budget a second time,
+  against a history that has moved, on the interactive path where a person is waiting.
+- **Treating `ship_task_id` as the removed task.** The wrong direction; dims the ship's
+  own idea instead of the one whose work died. Named here because the column is right
+  there on the verdict row and is the obvious thing to reach for.
+- **Counting tasks rather than payouts.** Simpler, and makes a one-line fix weigh the same
+  as a feature.
+- **Clamping the share at both ends.** The bottom is clamped so an anomaly renders as a
+  legible "nothing survives" rather than a negative; the top is not, and `live` / `removed`
+  are reported unclamped, so an impossible figure stays visible instead of being hidden by
+  the thing that claims to prevent it — `idea-size.js`'s argument against clamping size.
+- **Storing the removed task's title beside the row.** It lives on `tasks` and can be
+  joined for; a copy goes stale the first time a title is edited.

package/docs/adr/0322-a-remnant-needs-evidence-and-merged-wins.md

@@ -0,0 +1,110 @@
+# ADR 0322 — The five states are derived once, and a remnant needs evidence
+
+- **Status:** Accepted
+- **Date:** 2026-09-20
+- **Task:** [task 1004103](https://cloudbongos.com/builders#/task/1004103) (BV2.R17, goal 1000095 — BONGOS-V2)
+- **Spec:** `docs/specs/<redacted>.md` decisions 4, 19 and 20; criterion `ideator-sky-tells-the-truth`
+- **Design of record:** `docs/design/ideator-surface-direction.md` §"The five objects"
+- **Under:** [ADR 0321](0321-brightness-is-a-weighted-share-and-the-targets-are-a-row.md), [ADR 0313](0313-a-removal-is-proposed-by-the-ship-and-confirmed-by-a-person.md), [ADR 0312](0312-provenance-is-a-second-ideas-owned-edge-table.md)
+
+## Context
+
+The ideator surface draws a thought as one of five objects: **star** (it caused work that
+is still alive), **protostar** (filed, not yet ignited), **satellite** (folded into another
+thought), **remnant** (it burned, then the project removed it) and **cold body** (declined
+at triage, so it never ignited and has no size at all). Dim and dark are different states
+and must be different objects, not one dot at two opacities.
+
+Three surfaces are about to draw them — the room (BV2.R03), the descent (R10) and the sky
+(R20) — and the spec's own phrasing is that every state must be *computed from the ledger,
+and no surface has to infer one*.
+
+The facts already exist. `idea_inbox.status` carries the triage verdict (`open`,
+`promoted`, `discarded`, `merged`; `core_195`). ADR 0321 gave economy `ideaBrightnesses()`,
+returning `hasWork`, `share` and `attributable` per idea. `tasks.goal_id` and `tasks.status`
+say where a thought's work sits and whether it awaits a nod. Nothing was missing; what was
+missing was one place that reads them.
+
+## Decision
+
+**One resolver, `modules/ideas/idea-state.js`, and no surface decides a state.** A state
+inferred in three renderers is three states: the sky can say a thought went out while the
+room beside it still calls it alive, with nothing erroring and no way to tell which is
+right. The resolver is pure — facts in, object out — the way `routing.js` is pure about a
+landing. `attachStateToTrail` is the one async wrapper, composed on the trail route after
+`attachSizeToTrail`.
+
+**Brightness goes on the `reward` port.** `ideas` may not reach `credit_log` any other way
+(ADR 0083 rule 1), and it already declares `reward` in `consumes`, so no new dependency
+edge. Shipping size without brightness had left the module able to draw how big a thought
+was and unable to say whether it was still alive.
+
+**The order of the tests is the decision**, and each step could have gone the other way:
+
+1. **Merged wins over everything.** A folded thought is a satellite even when it earned
+   money of its own — and it *keeps* that money; `trail-size.js` is emphatic that stream 1
+   books against the idea whose lineage row named the shipping task. This changes what the
+   thought **is**, not what it earned. Letting work win here draws a satellite as an
+   independent star beside the thought that absorbed it: one idea, twice in the sky.
+2. **Work beats a discard.** The design defines a cold body as one that *"never ignited, so
+   it has no size at all"* — a stated property, and testing work before status is what
+   makes it true by construction rather than by hope. It is reachable: triage can discard a
+   duplicate whose twin already routed and paid, and `updateIdea` never touches the ledger.
+3. **A remnant needs evidence, never the absence of an answer.** `share === 0` means the
+   project confirmed every piece of the descent gone. `share === null` means the removal
+   facts could not be read at all — ADR 0321 is explicit that those are different answers.
+   An idea with work and no readable facts is a **star** carrying `attributable: false`, so
+   a surface says "unknown" rather than "full". Reading a falsy share as death turns one
+   unmounted module into a sky of hollow rings.
+4. **A protostar is the absence of work, not the presence of a status.** Ignition is being
+   *paid* for something, not being converted into a row, so a promoted-but-unshipped idea is
+   still unignited — which is exactly the state the nod queue exists for.
+
+**Position is a second axis**, because the design says the object alone cannot carry it: a
+protostar **in a well** has a home and awaits a nod; one in **open space** has nothing
+holding it. The resolver returns `position`, `wellGoalId` and `awaitingNod` for every state
+(a star has a position too), and the nod is asked of *every* task rather than only the one
+that named the well — an idea that became two tasks, one promoted and one still at
+`backlog`, still has something waiting on a person.
+
+**`suggested_goal_id` is deliberately not a well.** It sits on the row, it names a goal, and
+it is the wrong fact: `projection.js` records it as strictly advisory — the routing hint on
+a filing that did **not** convert, with `tasks.goal_id` as the binding home. Reading it here
+would draw a protostar inside a well that never caught it and put it in a nod queue nobody
+can act on, because no task exists to promote. The binding fact is now selected on both of
+the trail's task joins (`trail.js`), which costs no extra round trip.
+
+**The page reads the ledger once.** `attachSizeToTrail` leaves economy's own `byTask`
+breakdown on each row and brightness takes its share of exactly that, so the state attach
+hands it straight back. All of the sizes or none: a partial map reads a missing entry as
+"no work", which would draw a paid star as a protostar.
+
+**An absent `reward` port does not empty the sky.** The states still resolve on status
+alone, carrying `attributable: false` — the same posture `trail-size.js` takes with
+`size: null`.
+
+## Consequences
+
+- `GET /inbox/by-builder/:id` now returns `state` per idea beside `size` and
+  `descent_tasks`. Additive; no existing consumer reads it yet, and R03/R10/R20 will.
+- The five objects are spelled once (`IDEA_STATES`), so a renderer switching on hand-copied
+  strings cannot drift by a hyphen and silently draw nothing.
+- Nothing here writes, and no credit moves. ADR 0313 stands: `shipped` is terminal, and
+  only the picture changes.
+- `tests/idea_state.mjs` (31 cases, DB-free). The ordering, the zero-over-zero edge, the
+  well and the trail SQL are each mutation-probed.
+
+## Rejected
+
+- **Resolving the state in each renderer.** The cheapest thing to write and the reason the
+  done-when says "no surface has to infer one".
+- **Deriving the state from `share` alone.** It merges a protostar with a remnant — the
+  precise distinction the two channels exist to draw, and the one BV2.R19's proof checks.
+- **Treating an unreadable `share` as zero.** "We could not look" is not "everything was
+  removed"; ADR 0321 pays for that distinction upstream and discarding it here wastes it.
+- **Status-first ordering** (a discarded idea is always a cold body). It contradicts the
+  object's own stated property the moment triage discards something that already paid.
+- **Reading `suggested_goal_id` as a well.** Advisory by construction; it would populate a
+  nod queue with entries nothing can act on.
+- **A sixth object for "unknown brightness".** The vocabulary is the owner's and is five;
+  the uncertainty is carried as a flag on the answer, not as a new thing in the sky.

package/docs/adr/README.md

@@ -412,3 +412,5 @@ This keeps the decision history honest and traceable.
 | 0320 | [**An empty diff is not an ungraded diff: grade the claim instead** ([task 1004011](https://cloudbongos.com/builders#/task/1004011), goal 1000118 — BONGOS-V2; scoped out of task 1003950 shape 2). `ship.js --allow-empty` closes a task that produced no committed artifact, and it used to do two things at once: set `skipGrade`, so the subagent grader never ran, and therefore route the close through `POST /tasks/:id/confirm`, gated on `task.confirm.grade_bypass` — one of [ADR 0157](0157-archon-is-rank-and-identity-only.md)'s four trust-boundary keys, so a Metic could not close an artifact-free task at all. **Both halves were wrong.** The permission was the wrong question: `grade_bypass` means *ratify past a grade that FAILED*, a genuine override of an existing verdict, and a no-artifact close has no verdict to override — charging the same key for "it was judged and rejected" and "there was nothing to judge" conflates an override with an absence. And nothing was being checked, which is the more serious half: the assertions in the handoff notes ("the premise was already fixed", "this was a pure ops verification", "the row was updated directly") went into the ledger unread, on exactly the ships where the record is the ONLY evidence that exists. A permission gate is not scrutiny — an Archon clicking confirm is not someone checking whether the claim is true. **Decision:** on `--allow-empty` the grader is not skipped, it is RE-POINTED — it grades the notes + value summary against the task description, asking whether the task is genuinely artifact-free and whether the evidence supports that. A pass is a real passing grade confirming through the ordinary rank-open path; a fail is answered with better evidence, not a key. Three sub-decisions carry it: the rubric axes are **re-asked, not replaced** (`functional_fidelity` → is this genuinely artifact-free, `code_quality` → is the evidence specific and checkable), because the gate arithmetic and `/grade-audit`, the aggregates and the cost model all read those columns and a third pair of names would mean teaching every one of them a synonym; **two generalist shots, not the four-lens panel** (Hacker/Quality/Efficiency are lenses over code — over three paragraphs of prose they are four readings of the same short text at four times the cost — so the lenses go, recorded in `signals.lenses_dropped` per the #513 trivial-diff precedent; but the panel's UNANIMOUS gate was also the cross-check that makes injection hard, and the first cut kept a single shot and lost it, so the species asks the same question twice and collapses by **unanimity, not median** — under a median the mean of a fooled 10 and a suspicious 3 is a passing 6.5 and the second reading launders the first; a split is recorded as `signals.shot_dissent`; the collapse covers ALL THREE gate axes including `confidence`, which the second grading round caught missing — it is the one axis living in `signals` rather than `rubric_scores`, and the server derives `lowConfidence` purely from the submitted value, so an honest 0.2 "I cannot judge this" averaged with a confident 0.9 would have cleared the 0.4 gate at 0.55); and the species marker lives in **`signals.no_artifact_grade`, not `grader_kind`**, because the server's `validateAndScore` hardcodes `task_grades.grader_kind` to `'subagent'` for everything on that route. **D4: every builder-controlled field is scrubbed and fenced** (`grader-workers/fence.js`, SR-15 / #995) — the panel workers have fenced the diff, title, description and value summary since #995, and this species is the worse case on both sides: the notes are not context around an artifact the model can independently check, they ARE the evidence, and a successful injection does not flip one of four workers, it closes a task past the very scrutiny this ADR added to replace the Archon-only gate. The first implementation shipped it unfenced and the grader caught it as a blocker. The no-follow rule is restated AFTER the artifact too, since the notes may run to 24,000 characters and a rule stated once at the top is a long way behind by the end of an adversarial payload. The prompt renders no changed-files or diff section at all, so the absence cannot read as the finding. No diff hash is stored — hashing the empty diff makes it a reuse key shared by every empty-diff ship of the task, handing the next close a pass this one earned. Unchanged: `--skip-grade` still reaches the Archon gate (the task 1003950 escalation split still chooses the refusal), and below the protected-path floor the server's Guard 1b (task 1002646) still fails a zero-`committed_files` pass closed, correctly — this moves the Metic-and-above case, which is the case that was filed. **Drops task 1004010**, the alternative shape — a new lower-floored permission atom for the same close — by owner decision of 2026-09-20: it answers "who may skip the check" when the better question is "why is there no check", and it permanently widens the permission surface, the same class of change the owner declined three days earlier for `version.create` ([task 1003853](https://cloudbongos.com/builders#/task/1003853), [ADR 0250](0250-strict-versioning-the-version-boundary-is-the-scope-gate.md) §6a). Also rejected: lowering the floor on the existing key (treats the gate as the point; nothing would read the notes); grading the notes with the full panel; a new pair of rubric axes for prose (honest about the measurement, but moves the gate arithmetic and every consumer of it for a naming gain).](0320-an-empty-diff-is-not-an-ungraded-diff.md) | grading / permissions |
 | 0319 | [**A removal verdict is a row beside the question, because both answers close it the same way** ([task 1004095](https://cloudbongos.com/builders#/task/1004095), goal 1000095 — BONGOS-V2). [ADR 0313](0313-a-removal-is-proposed-by-the-ship-and-confirmed-by-a-person.md) settled that a ship deleting an earlier shipped task’s files files a QUESTION and a person answers it; task 1004090 built the question and nothing could answer it. Building the answer surfaced the property that decides the design: a proposal is a question, not work, so CONFIRMING and DISMISSING both leave nothing to build and both end the task at `abandoned` — meaning a status alone records neither, and brightness could not tell the star it must dim from the one it must not. ADR 0313 had already rejected the obvious alternative (a `removed` status; `shipped` is terminal and much of the ledger leans on it — a removal is a fact recorded BESIDE work, not a new terminal state). Decision: `lifecycle_removal_verdicts` (migration `lifecycle_009`), PRIMARY KEY on `proposal_task_id` so one proposal holds one answer ever — a second decide is REFUSED (409), never upserted and never an idempotent 200, because overwriting destroys the record that a person answered differently; the row is locked `FOR UPDATE` first, so simultaneous Confirm and Dismiss cannot both read “undecided”, and `ALREADY_DECIDED` is checked BEFORE `PROPOSAL_CLOSED` because an answered proposal is also abandoned and the useful message is the one naming the earlier verdict. The verdict and the status change commit in ONE transaction. What this does NOT ship is the target list: the affected tasks and paths stay PROSE in the proposal body (the owner’s 2026-09-20 decision, since [ADR 0242](0242-a-cascade-is-a-declaration-table-on-the-event-that-already-exists.md) forbids widening the runner to fan out), and nothing here parses it — brightness designs that storage. What brightness does get is structured: the verdict plus `ship_task_id`, denormalised out of the `source_ref` that encodes it as a string nothing can join on. Surface: spec decision 15’s “existing awaiting-nod surface” is the CARD, not the QUEUE — [ADR 0299](0299-the-nod-queue-stays-scoped-to-routed-filings.md) keeps that queue scoped to routed filings and a removal proposal has no idea lineage at all, so it gets its own slice on the same card at the same floor. The PERMISSION is reused (`task.promote`, Metic+, read and write both) and the VERB is not: no existing route means “that work is genuinely gone”, and `/tasks/:id/abandon` would close the question without recording which answer was given. Top-level `/removal-proposals` rather than `/tasks/removal-proposals`, because the manifest mounts `tasks` first and its `/tasks/:id` swallows a later file’s literal segment. Rot is INHERITED: `backlog` is rottable and `abandoned` is not, so an unanswered proposal rots and an answered one leaves the feed with no code written for either — pinned against the rot module’s own exported vocabulary. Rejected: the status as the record; parsing the body at confirm time; widening the nod queue; separate `/confirm` and `/dismiss` routes; upserting a second verdict; a `LIKE ‘prefix%’` match (a rule key may contain an underscore, which is a LIKE wildcard).](0319-a-removal-verdict-is-a-row-beside-the-question.md) | ideas / lifecycle |
 | 0318 | [**Listing a file for task affinity is not claiming to own it** ([task 1004110](https://cloudbongos.com/builders#/task/1004110), goal 1000095 — BONGOS-V2). The case [ADR 0314](0314-module-protection-is-per-path-not-per-module.md) named and left open, closed by neither of the two routes it predicted. `builder-settings` derived `protected` — Archon-only to scope a goal to — on exactly one glob, `src/bongos/routes/me.js`, caught by the blanket `src/bongos/routes/` prefix. **That glob was never an ownership claim:** `MODULE_GLOBS` listed it for task AFFINITY and said in the same comment that the `GET /me` aggregator stays a thin core facade, and `isProtected()` cannot tell the two apart. **Both predicted routes were measured and rejected.** Narrowing the blanket prefix: all eighteen files under `src/bongos/routes/` are protected by that prefix AND NOTHING ELSE, so narrowing unwalls `auth.js`, `builders.js`, `backup.js` and `core-update.js` together — now pinned as a tripwire test rather than left as a caution. Moving `me.js` into `modules/builder-settings/`: the aggregator resolves TEN module ports (`lifecycle`, `reward`, `onboarding`, `government`, `specialities`, `grade`, `box`, `art` ×2, `discord`) and `builder-settings` is one of them, so hosting it inside one module means resolving nine foreign ports from the inside — the `core -> module` edge [ADR 0083](0083-modular-architecture-strangler-build-plan.md) rule 1 forbids. Decision: **ownership follows what the file is** — `me.js` moves to `kernel`, which already owns `src/bongos/routes/security.js`. This is 0314 one step on: owning the command is not owning the authority, and **being listed next to a module is not owning it either**. **Rejected: a general affinity tier** in `MODULE_GLOBS` mirroring `isCommandPath` — the audit does not support it. Three other modules (`kernel`, `devsecops`, `methodology`) are also protected only by paths outside their own directory, but in each the foreign path genuinely IS the domain; `builder-settings` was the only module protected by a path its own source called core, so a new tier would be a new place for a hole to hide, built for a population of one. `protectedModules()` goes 9 -> 8. **The wall that matters does not move:** a sub-Metic builder touching `/me` is still refused by `checkPermissionPaths`, asserted directly rather than assumed. The sixteen still-unowned route files remain [task 1004116](https://cloudbongos.com/builders#/task/1004116), whose option (a) this de-risks.](0318-listing-a-file-for-task-affinity-is-not-owning-it.md) | permissions / module scope |
+| 0321 | [**Brightness is a payout-weighted share, and a removal's targets are rows** ([task 1004099](https://cloudbongos.com/builders#/task/1004099), goal 1000095 — BONGOS-V2). Size is an idea's total ideator payout and never falls; brightness is how much of that work is still alive, and the pair is what lets a thought whose version was torn out draw LARGE AND DARK rather than merging with one that never mattered. Two things had to be settled. **The removal facts were stored in the wrong direction**: [ADR 0319](0319-a-removal-verdict-is-a-row-beside-the-question.md) gave a confirmed removal a row carrying the verdict and `ship_task_id` — the task whose merge DELETED the files — and deliberately left out the tasks whose work was removed, saying brightness would design its own storage when it needed one. Those are different rows under different ideas, so reading one as the other dims the wrong star while looking like a working query. `<redacted>` stores `(proposal_task_id, removed_task_id, paths)` at PROPOSAL time, from the SAME derivation objects the proposal body renders as prose — one derivation, two renderings, so they cannot disagree and `removal-proposals.js` keeps its refusal to parse a body back. Proposal time and not verdict time because the attribution comes from capped, rate-limited GitHub commit-history reads that only exist while the cascade runs. NOT a runner fan-out ([ADR 0242](0242-a-cascade-is-a-declaration-table-on-the-event-that-already-exists.md)): the rule still files one task; this records a side fact about it. `ON CONFLICT DO NOTHING`, never `DO UPDATE`, since a degraded second walk finds FEWER paths and must not erase a good first read — and the writer runs on the cascade's SKIPPED row too, so a re-ship repairs what a derivation outage missed. **The share is weighted by PAYOUT, not by task count**, or deleting a one-line fix dims a star as hard as deleting the feature; weighting by what each hop earned also makes 'large and dead' exact, and makes the two channels a share of ONE number rather than two unrelated measurements. Basis is paid + estimated to match size, which required `priceDescentForIdea`/`ideaSizes` to return a per-task `byTask` summing EXACTLY to `credits` — including ledger payments for tasks the descent no longer reaches, which `idea-size.js` keeps in `credits` so size cannot fall and which would otherwise make the parts sum to less than the whole. Three edges, each silent: an idea that earned nothing is `share: 1, hasWork: false`, because zero over zero is not zero and a protostar is not a remnant (the BV2.R19 distinction); an unreadable removal port gives `share: null, attributable: false`, because 'could not look' is not 'nothing was removed'; and a CONFIRMED removal naming no target dims nothing at all — brightness cannot know which idea — so `countUnattributedConfirmed()` exists to say the gap out loud instead of quietly brightening the sky. Brightness lives in `economy` beside size and reaches lifecycle through the new `lifecycle.removals` port, resolved OPTIONALLY and NOT declared in `consumes` (declaring it would turn 'lifecycle off' into 'instance will not start' — the `ideas.descent` precedent). **No credit is clawed back and nothing here writes**: ADR 0313 stands, `shipped` is terminal, only the picture changes. Rejected: parsing the proposal body (ADR 0319 already refused it — a human-facing line shape fails silently when reworded); re-deriving at verdict time; treating `ship_task_id` as the removed task; counting tasks rather than payouts; clamping the share at the top, which would hide the anomaly it claims to prevent.](0321-brightness-is-a-weighted-share-and-the-targets-are-a-row.md) | ideas / economy |
+| 0322 | [**The five states are derived once, and a remnant needs evidence** ([task 1004103](https://cloudbongos.com/builders#/task/1004103), goal 1000095 — BONGOS-V2). The ideator surface draws a thought as one of five objects — star, protostar, satellite, remnant, cold body — and three surfaces are about to draw them (the room, the descent, the sky). Every fact already existed: `idea_inbox.status` (`core_195`), [ADR 0321](0321-brightness-is-a-weighted-share-and-the-targets-are-a-row.md)’s `hasWork` / `share` / `attributable`, and `tasks.goal_id` + `tasks.status`. What was missing was ONE place that reads them: a state inferred in three renderers is three states, and the sky can say a thought went out while the room beside it still calls it alive, with nothing erroring. **Decision:** one pure resolver (`modules/ideas/idea-state.js`), brightness exposed on the `reward` port (ideas may not reach `credit_log` any other way — [ADR 0083](0083-modular-architecture-strangler-build-plan.md) rule 1 — and already declares `reward` in `consumes`), and the ORDER of the tests IS the decision. **MERGED wins over everything:** a folded thought keeps its own money (`trail-size.js` is emphatic) but is no longer its own point in the sky, so letting work win draws one idea twice, beside the thought that absorbed it. **WORK beats a DISCARD:** a cold body “never ignited, so it has no size at all” is a stated PROPERTY, and testing work first makes it true by construction — triage really can discard a duplicate whose twin already routed and paid, and `updateIdea` never touches the ledger. **A REMNANT needs EVIDENCE, never the absence of an answer:** `share: 0` is a confirmed removal, `share: null` is an unreadable one, and ADR 0321 pays for that distinction upstream — so an idea with work and no readable facts is a STAR carrying `attributable: false`, because reading a falsy share as death turns one unmounted module into a sky of hollow rings. **A PROTOSTAR is the absence of WORK, not of a status:** ignition is being PAID for something, so a promoted-but-unshipped idea is still unignited, which is exactly what the nod queue exists for. **Position is a second axis** (`well` / `open-space` / `awaitingNod`) because the design says the object alone cannot carry it, and the nod is asked of EVERY task, not only the one that named the well. **`suggested_goal_id` is deliberately NOT a well** — `projection.js` records it as strictly advisory, the routing hint on a filing that did not convert, so reading it would put a thought in a nod queue with no task to promote; the binding `tasks.goal_id` now rides on both of the trail’s task joins at no extra round trip. The page reads the ledger ONCE: the state attach hands economy back the `byTask` breakdown size just computed, all of them or none (a partial map reads a missing entry as “no work” and draws a paid star as a protostar). An absent `reward` port does not empty the sky — states still resolve, flagged unattributable. Nothing writes; ADR 0313 stands. Rejected: resolving in each renderer; deriving from `share` alone (it merges a protostar with a remnant, the exact BV2.R19 distinction); treating an unreadable share as zero; status-first ordering; reading the hint as a home; a sixth object for “unknown brightness” (the vocabulary is the owner’s and is five — the uncertainty is a flag on the answer, not a new thing in the sky).](0322-a-remnant-needs-evidence-and-merged-wins.md) | ideas / economy |

package/docs/module-api-changelog.md

@@ -2316,5 +2316,9 @@ is load-bearing: the script throws rather than guess if it is missing, and
         landed since 1.19.919 with no explicit bump. run 35531720944. (task 1002620)
   1.19.921 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
         landed since 1.19.920 with no explicit bump. run 35534076467. (task 1002620)
+  1.19.922 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+        landed since 1.19.921 with no explicit bump. run 35536293721. (task 1002620)
+  1.19.923 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+        landed since 1.19.922 with no explicit bump. run 35541278656. (task 1002620)
 ---------------------------------------------------------------------------
 ```