@bongos/core 1.21.4 → 1.21.6

package/modules/autonomy/config-idle.js

@@ -0,0 +1,192 @@
+'use strict';
+
+// modules/autonomy/config-idle.js — idle because there is no work, or idle
+// because of a setting the owner can fix? (task 1004539.) Pure: no I/O, no clock
+// of its own; `nowMs` is injected and the one outward call (`post`) is too.
+//
+// THE INCIDENT. From 2026-10-01T23:48Z to 2026-10-02T09:47Z a runner sat fenced
+// with `no_builder_scope` — its builder had picked no goals — while the hall said
+// "alive, waiting for work" and nobody was told. Ten hours of a machine doing
+// exactly what it was configured to do, which was nothing.
+//
+// TWO KINDS OF IDLE, and the whole point is that they must not look alike:
+//   · QUIET — nothing claimable, a capacity hold with a known reset, the owner's
+//     kill switch, the owner's pause on one builder. Either there is no work, or
+//     a person deliberately said stop. Telling the owner about their own decision
+//     is noise, and noise is how a status light gets ignored.
+//   · CONFIGURATION — the runner would work, but a setting stops it and nothing
+//     will change until someone changes the setting. These are the codes below.
+//
+// THE GRACE. A configuration refusal is surfaced only after it has held for its
+// grace. Fifteen minutes for the settings a person changes on purpose (an owner
+// mid-edit on the Gate page is not an incident), an hour for the two that can
+// also be a passing blip (an instance restart, a gauge between sessions).
+//
+// THE SPLIT OF WORK. The RUNNER knows what refused it and for how long, so it
+// tracks that (trackIdle) and, once the grace has passed, says so on its
+// heartbeat as `last_event: 'config_idle:<code>'` (markBeat). The SERVER reads
+// that one string: runner-health.js turns it into a not-ok state with the fix,
+// and the notifier below posts one Discord notice per change. No new column: the
+// heartbeat already carries a free-text last event, and a runner that predates
+// this sends none of these, which reads exactly as before.
+
+const GRACE_S = 15 * 60;
+const LONG_GRACE_S = 60 * 60;
+
+// Every configuration code, the sentence the owner reads, and the fix. A code
+// that is not here is never an alert — that is how kill_switch, builder_paused
+// and not_permitted stay quiet by construction rather than by an exception.
+const CONFIG_IDLE = Object.freeze({
+  no_builder_scope: Object.freeze({
+    graceS: GRACE_S,
+    why: 'no goals are picked for this runner, so it takes no work',
+    remedy: 'Choose which goals your runner works in Settings → Your Autobongos runner (/builders/settings#autobongos).',
+  }),
+  no_allowlist: Object.freeze({
+    graceS: GRACE_S,
+    why: 'no goal is allowed for runners on this project',
+    remedy: 'Allow at least one goal for runners on the Gate page.',
+  }),
+  goal_not_allowlisted: Object.freeze({
+    graceS: GRACE_S,
+    why: 'it was started for goals that are not on the allowlist',
+    remedy: 'Add those goals on the Gate page, or restart the runner without --goal / AUTOBONGOS_GOALS.',
+  }),
+  fence_unreadable: Object.freeze({
+    graceS: LONG_GRACE_S,
+    why: 'it cannot read its fence from this instance, so nothing is permitted',
+    remedy: 'Check the runner PC can reach this instance and that its Bongos CLI session is still valid (re-issue it in Settings if not).',
+  }),
+  gauge_unknown: Object.freeze({
+    graceS: LONG_GRACE_S,
+    why: 'its usage gauge has no fresh reading, so it will not start work',
+    remedy: 'Wire the usage-gauge statusLine on the runner PC (modules/autonomy/CLAUDE.md, "Wiring the gauge"), or open one Claude session there.',
+  }),
+});
+
+const PREFIX = 'config_idle:';
+const PENDING = 'config_pending:';
+
+// configIdleCode — which configuration, if any, one run-log row is idle on.
+function configIdleCode(row) {
+  if (!row || typeof row !== 'object') return null;
+  if (row.event === 'fenced') {
+    const code = row.code;
+    // goal_not_allowlisted counts only at RUN level (every requested goal
+    // refused). The same code on one TASK is the fence doing its job on one pick.
+    if (code === 'goal_not_allowlisted') return row.task_id ? null : code;
+    if (code === 'no_builder_scope' || code === 'no_allowlist' || code === 'fence_unreadable') return code;
+    return null;
+  }
+  // An UNKNOWN gauge, never a capacity hold: a spent window has a reset and ends
+  // by itself, and the usage limit is a hold the owner has ruled acceptable.
+  if (row.event === 'hold' && row.unknown === true && !row.usage_limit) return 'gauge_unknown';
+  return null;
+}
+
+// trackIdle — the runner's memory of how long it has been idle on one code.
+// Any row that is not a configuration refusal ends the stretch; a DIFFERENT code
+// starts a new one, because the fix changed and so did the owner's grace.
+function trackIdle(prev, row, nowMs) {
+  const code = configIdleCode(row);
+  if (!code) return null;
+  if (prev && prev.code === code && Number.isFinite(prev.sinceMs)) return prev;
+  return { code, sinceMs: nowMs };
+}
+
+// idleEvent — the heartbeat word for a stretch that has outlived its grace.
+function idleEvent(tracker, nowMs) {
+  if (!tracker || !CONFIG_IDLE[tracker.code]) return null;
+  if (!Number.isFinite(nowMs) || nowMs - tracker.sinceMs < CONFIG_IDLE[tracker.code].graceS * 1000) return null;
+  return `${PREFIX}${tracker.code}`;
+}
+
+// markBeat — the beat fields the runner sends. A beat that carries a task, a
+// boot or an exit says something more specific than "idle" and is left alone.
+// Inside the grace the stretch is PENDING (`config_pending:<code>`): the hall
+// reads it as an ordinary fence wait, and the notifier knows it is the same
+// setting still holding — so a runner that restarts mid-stretch does not "clear"
+// and then re-raise its notice, while a real capacity hold or a kill switch
+// (which end the stretch, so are sent as themselves) still clears it.
+function markBeat(fields, tracker, nowMs) {
+  const f = fields || {};
+  if (f.working_task_id || f.last_event === 'boot' || f.last_event === 'upgrade_exit') return f;
+  const ev = idleEvent(tracker, nowMs);
+  if (ev) return { ...f, last_event: ev };
+  if (tracker && CONFIG_IDLE[tracker.code]) return { ...f, last_event: `${PENDING}${tracker.code}` };
+  return f;
+}
+
+// parseIdleEvent — the code a heartbeat's last_event names, or null. Only a KNOWN
+// code is honoured, so a heartbeat cannot make the hall print arbitrary text.
+function parseIdleEvent(lastEvent) {
+  if (typeof lastEvent !== 'string' || !lastEvent.startsWith(PREFIX)) return null;
+  const code = lastEvent.slice(PREFIX.length);
+  return Object.prototype.hasOwnProperty.call(CONFIG_IDLE, code) ? code : null;
+}
+
+// Heartbeat events that say nothing about whether the setting was fixed: the
+// loop's own rhythm and a restart. A pending stretch on the SAME code is neutral
+// too (see markBeat). Anything else — a fence or hold the runner sent as itself,
+// a pick, a worker, "nothing claimable" — means the setting no longer holds it.
+const NEUTRAL = new Set([null, undefined, '', 'boot', 'loop', 'waiting', 'code_refreshed', 'upgrade_exit']);
+
+function pendingCode(lastEvent) {
+  if (typeof lastEvent !== 'string' || !lastEvent.startsWith(PENDING)) return null;
+  const code = lastEvent.slice(PENDING.length);
+  return Object.prototype.hasOwnProperty.call(CONFIG_IDLE, code) ? code : null;
+}
+
+// noticeDecision — post, or stay quiet? `notified` is the code last announced for
+// this runner (null for none). Raise once per code, clear once when it resolves,
+// and say nothing on every other beat.
+function noticeDecision(notified, { lastEvent = null, workingTaskId = null } = {}) {
+  const code = parseIdleEvent(lastEvent);
+  if (code) return code === notified ? { action: null, next: notified } : { action: 'raise', code, next: code };
+  if (!notified) return { action: null, next: null };
+  if (!workingTaskId && (NEUTRAL.has(lastEvent) || pendingCode(lastEvent) === notified)) return { action: null, next: notified };
+  return { action: 'clear', code: notified, next: null };
+}
+
+// A host name is the builder's own text and lands in a shared channel, so it is
+// cut to the characters a host name has and set as code — never a link, never
+// formatting.
+function safeHost(host) {
+  const h = String(host || '').replace(/[^A-Za-z0-9._-]/g, '').slice(0, 64);
+  return h ? ` on \`${h}\`` : '';
+}
+
+function noticeText({ action, code, host }) {
+  const spec = CONFIG_IDLE[code];
+  const pc = safeHost(host);
+  if (action === 'clear') return `Autobongos runner${pc}: no longer held — it was idle because ${spec.why}, and that has changed.`;
+  return `Autobongos runner${pc} is idle because ${spec.why}. Fix: ${spec.remedy}`;
+}
+
+// createNotifier — the de-duplicating Discord line. One remembered code per
+// (builder, host), in memory: an instance restart forgets it and may repeat one
+// notice, which is the cheap end of the trade against a migration for a flag.
+// `post` is the discord.post port ({ channel, text }) or null when the instance
+// has no Discord; then nothing is remembered either, so wiring Discord later
+// still gets the first notice.
+function createNotifier({ post = null, channel = 'ship_news' } = {}) {
+  const notified = new Map();
+  return {
+    notified,
+    async observe({ builderId, host, lastEvent, workingTaskId } = {}) {
+      const key = `${builderId}|${String(host || '').toLowerCase()}`;
+      const d = noticeDecision(notified.get(key) || null, { lastEvent, workingTaskId });
+      if (!d.action) return { posted: false, action: null };
+      if (typeof post !== 'function') return { posted: false, action: d.action, reason: 'no_discord' };
+      const res = await post({ channel, text: noticeText({ action: d.action, code: d.code, host }) });
+      if (res && res.posted === false) return { posted: false, action: d.action, reason: res.reason || 'not_posted' };
+      if (d.next) notified.set(key, d.next); else notified.delete(key);
+      return { posted: true, action: d.action, code: d.code };
+    },
+  };
+}
+
+module.exports = {
+  GRACE_S, LONG_GRACE_S, CONFIG_IDLE,
+  configIdleCode, trackIdle, idleEvent, markBeat, parseIdleEvent, pendingCode, noticeDecision, noticeText, createNotifier,
+};

package/modules/autonomy/governor-docket.js

@@ -0,0 +1,101 @@
+'use strict';
+
+// modules/autonomy/governor-docket.js — the autonomy module's part of the
+// governor's docket (task 1004523, goal 1000125; collector:
+// modules/government/docket.js, decision: ADR 0362).
+//
+// WHY. Two things the Governor City shows live here. The Autobongos FENCE stands
+// at Automation, and it is a state rather than a queue, so it becomes a matter
+// only when it needs a governor: the switch is off, or it is on with no goal
+// allowed (nothing can build either way). And the "money" reading: the one
+// budget this project actually records is the unattended-spend ceiling the
+// autonomy gate brakes on (scripts/gds/autonomy-gate.js `ceilingUsd`), against
+// the month's unattended spend (economy's `autonomousApiSpendMtd`, through the
+// `reward` port). So "money left" is honestly "what unattended building may still
+// spend this month" — the project has no wider budget to count down from, and the
+// line says so rather than inventing one.
+//
+// Contributed to the `governor.docket` point from the autonomy route factory (a
+// module never requires a sibling, ADR 0083). Pure mappers exported for tests.
+
+const api = require('../../src/module-api');
+const db = require('./db');
+const autonomyGate = require('../../scripts/gds/autonomy-gate');
+
+const POINT = 'governor.docket';
+
+// The fence as matters for one viewer. Pure. Only a holder of
+// `autonomy.fence.manage` (the switch's own atom) is told it needs them.
+function fenceDocketMatters(project, mayManage) {
+  const goals = Array.isArray(project.goals) ? project.goals : [];
+  let title = null;
+  let where = null;
+  if (project.enabled === false) {
+    title = 'Unattended building is switched off';
+    where = project.paused_reason ? `automation · the switch · ${project.paused_reason}` : 'automation · the switch';
+  } else if (!goals.length) {
+    title = 'Unattended building is on, but no goal is allowed';
+    where = 'automation · allowed goals';
+  }
+  if (!title) return [];
+  return [{
+    id: 'fence',
+    rule: 'decide',
+    state: mayManage ? 'needs' : 'settled',
+    title,
+    short: 'the switch',
+    where,
+    opened_at: project.updated_at || null,
+    deadline: null,
+    proposer: project.updated_by == null ? null : { id: project.updated_by },
+    tally: null,
+    href: '/watch',
+    ref: { type: 'autonomy_fence', id: 'project' },
+  }];
+}
+
+// Money left under the unattended-spend ceiling. Pure. Hot when under a fifth left.
+function moneyReading({ ceilingUsd, spentUsd }) {
+  const ceiling = Number(ceilingUsd) || 0;
+  const spent = Math.max(0, Number(spentUsd) || 0);
+  const left = Math.max(0, ceiling - spent);
+  const usd = (n) => `$${n.toFixed(2).replace(/\.00$/, '')}`;
+  return {
+    value: { left_usd: left, spent_usd: spent, ceiling_usd: ceiling, scope: 'unattended building, this month' },
+    figure: `${usd(left)} left`,
+    line: `unattended building this month · ${usd(spent)} of ${usd(ceiling)} spent`,
+    hot: ceiling > 0 && left / ceiling < 0.2,
+  };
+}
+
+function contributeAutonomyToDocket() {
+  // GET /autonomy/fence is any builder's read; the read itself fails on a missing
+  // fence row rather than fabricating "off" (that route's rule).
+  api.contribute(POINT, {
+    source: 'autobongos_fence',
+    building: 'automation',
+    gate: { anyBuilder: true },
+    read: async (ctx) => {
+      const project = await db.readFence();
+      if (!project) throw new Error('fence_uninitialised');
+      return fenceDocketMatters(project, ctx.has('autonomy.fence.manage'));
+    },
+  });
+  // The ceiling and the month's unattended spend are what GET /autonomy/precheck
+  // answers, so the reading carries that route's atom.
+  api.contribute(POINT, {
+    reading: 'money',
+    gate: { permission: 'autonomy.precheck' },
+    read: async () => {
+      const reward = api.resolveOptional('reward');
+      if (!reward || typeof reward.autonomousApiSpendMtd !== 'function') throw new Error('economy_off');
+      return moneyReading({ ceilingUsd: autonomyGate.ceilingUsd(), spentUsd: await reward.autonomousApiSpendMtd() });
+    },
+  });
+}
+
+module.exports = {
+  contributeAutonomyToDocket,
+  fenceDocketMatters,
+  moneyReading,
+};

package/modules/autonomy/routes/autonomy.js

@@ -30,6 +30,7 @@ const autonomyGate = require('../../../scripts/gds/autonomy-gate');
 const db = require('../db');
 const fence = require('../fence');
 const runnerHealth = require('../runner-health');
+const configIdle = require('../config-idle');
 // The doorway's namespaced logger and strict body validator. Raw console.* is
 // ratcheted repo-wide (fitness.js console_call_count) and unstructured besides.
 const log = api.logger('autonomy');
@@ -101,9 +102,26 @@ function commitOrNull(v) {
   return typeof v === 'string' && /^[0-9a-f]{40}$/.test(v) ? v : null;
 }
 
+// The governor's docket (task 1004523): the fence + the money reading,
+// contributed from this factory (see ../governor-docket.js).
+const governorDocket = require('../governor-docket');
+
 module.exports = function buildAutonomyRouter() {
+  governorDocket.contributeAutonomyToDocket();
   const router = express.Router();
 
+  // The one Discord line for a runner idle on a setting (task 1004539). The port
+  // is resolved per post, not here: the discord module registers it at mount and
+  // may mount after this router. No Discord on the instance answers no_discord,
+  // and the hall's runner panel still says it either way.
+  const idleNotifier = configIdle.createNotifier({
+    post: async (msg) => {
+      const port = typeof api.resolveOptional === 'function' ? api.resolveOptional('discord.post', null) : null;
+      if (typeof port !== 'function') return { posted: false, reason: 'no_discord' };
+      return port(msg);
+    },
+  });
+
   router.get('/autonomy/precheck', auth.requireBuilder, auth.requirePermission('autonomy.precheck'), async (req, res) => {
     const routine = String(req.query.routine || '').slice(0, 64);
     if (!routine) return res.fail('routine_required', { status: 400, message: 'pass ?routine=<name>' });
@@ -372,6 +390,15 @@ module.exports = function buildAutonomyRouter() {
         claudeAccount: typeof b.claude_account === 'string' && b.claude_account.trim() ? b.claude_account.trim() : null,
       });
       res.json({ ok: true, heartbeat: row });
+      // AFTER the answer, and never awaited by it: a notice that cannot be posted
+      // must not turn a recorded check-in into a failed one (the fail-soft rule
+      // below). It de-duplicates itself — once per cause, once when it clears.
+      idleNotifier.observe({
+        builderId: req.builder.id,
+        host: b.host,
+        lastEvent: b.last_event || null,
+        workingTaskId: Number.isInteger(b.working_task_id) ? b.working_task_id : null,
+      }).catch((e) => log.warn(`[gds] autonomy: idle notice not posted: ${e && e.message ? e.message : e}`));
     } catch (err) {
       // FAIL SOFT, and deliberately unlike the fence's GET. A heartbeat that
       // cannot be written is a monitoring gap; turning it into an error the runner

package/modules/autonomy/runner-health.js

@@ -24,6 +24,12 @@
 //     relaunches, which takes a minute or two, and the owner ruled that a restart
 //     must read as a restart, never as a death (task 1004407). Past RESTART_S the
 //     relaunch has failed and it is dead again — with a detail that says so.
+//   · idle_config — alive, but idle on a setting the owner can fix (no goals
+//     picked, an empty allowlist, a fence it cannot read, a gauge with no
+//     reading), for longer than that setting's grace (task 1004539). NOT ok, and
+//     it carries the fix as `remedy`. The runner decides the grace and says
+//     `config_idle:<code>` on its heartbeat; only a code config-idle.js knows is
+//     honoured, so the owner's kill switch and pause can never read as an alarm.
 
 // Reasoned from the runner's own numbers, not picked. The loop beats at the top of
 // every pass and again on each poll inside a wait (every 60s), so a healthy runner
@@ -38,6 +44,8 @@ const LATE_S = 2 * 60 * 60;
 // relaunch which never happened is noticed the same evening.
 const RESTART_S = 10 * 60;
 
+const configIdle = require('./config-idle.js');
+
 const SHA_RE = /^[0-9a-f]{40}$/;
 const sha = (v) => (typeof v === 'string' && SHA_RE.test(v) ? v : null);
 
@@ -129,8 +137,21 @@ function describeRunner(heartbeat, { nowMs = Date.now(), aliveS = ALIVE_S, lateS
     };
   }
 
+  // Idle on configuration — but only while the runner is still talking. Past the
+  // dead line silence wins: a dead runner cannot vouch for its settings.
+  const idleCode = configIdle.parseIdleEvent(heartbeat.last_event);
+  if (idleCode && age <= lateS) {
+    const spec = configIdle.CONFIG_IDLE[idleCode];
+    return {
+      state: 'idle_config', ok: false, ageS: age, age: humanAge(age), ...ident,
+      idleCode, why: spec.why, remedy: spec.remedy,
+      detail: `idle${where} because ${spec.why}`,
+    };
+  }
+
   if (age <= aliveS) {
-    const doing = ACTIVITY[heartbeat.last_event];
+    // A setting still inside its grace reads as the fence wait it is, not "running".
+    const doing = ACTIVITY[heartbeat.last_event] || (configIdle.pendingCode(heartbeat.last_event) ? ACTIVITY.fenced : null);
     return {
       state: 'alive', ok: true, ageS: age, age: humanAge(age), ...ident,
       detail: working

package/modules/discord/board-broadcast.js

@@ -244,4 +244,6 @@ async function postBoardOutcome(payload, deps = {}) {
   return result;
 }
 
-module.exports = { postBoardAnnouncement, postBoardOutcome, composeOutcomeLine };
+// plainName is shared with craft-broadcast.js (task 1004439): one sanitizer for
+// every builder name this module puts on a channel.
+module.exports = { postBoardAnnouncement, postBoardOutcome, composeOutcomeLine, plainName };

package/modules/discord/craft-broadcast.js

@@ -0,0 +1,107 @@
+// modules/discord/craft-broadcast.js — the feed hears an artist's and an
+// ideator's moments, not only shipped tasks (task 1004439 / WA6.RP09, goal
+// 1000095, criterion wa6-roles-read-true-in-public).
+//
+// WHY. #ship-feed posts one line per shipped task, and nothing when the board
+// ratifies an idea or a Full Idea passes its completeness bar. An ideator's best
+// moments happened in silence while an engineer's every ship was announced. (A
+// page approved in Tweak Mode DOES ship as a task; ship-broadcast.js names its
+// artist on that line, task 1004432's author of record.)
+//
+// THE LINES, owner audience, no jargon:
+//   board.item.passed (a full_idea)   🏛️ The board ratified an idea by <name>. <link>
+//   idea.graded.full (at the bar)     📜 <name>'s Full Idea passed its completeness check. <link>
+//
+// PRIVACY, the existing feed's rules: #ship-feed is the BUILDERS' channel (not
+// #ship-news), so naming a builder by their display name is what it already does
+// for the Board Room's members. The idea's TITLE is never posted — an idea may sit
+// in a private goal, and the hall link is gated where the idea is; the line says
+// THAT it happened and who, and the link carries the rest to whoever may see it.
+// A line never starts with `#<id>`, so the applause bot does not read it as a ship.
+//
+// BEST-EFFORT, like every broadcast in this module: it never throws, so a Discord
+// hiccup can never fail a ratification or a grade — both are durable rows already
+// written when their events fire.
+
+'use strict';
+
+const api = require('../../src/module-api');
+const webhook = require('./webhook');
+const { plainName } = require('./board-broadcast');
+
+const CHANNEL = 'ship_feed';
+
+function ideaLink(ideaId) {
+  const origin = ((api.branding && api.branding().domains) || {}).buildersOrigin || '';
+  return `${origin ? origin.replace(/\/$/, '') : ''}/#/idea/${encodeURIComponent(ideaId)}`;
+}
+
+// PURE. The two lines, from what the caller already resolved.
+function composeRatifiedLine({ ideaId, author }) {
+  const by = author ? ` by ${plainName(author)}` : '';
+  return `\u{1F3DB}\u{FE0F} The board ratified an idea${by}. ${ideaLink(ideaId)}`;
+}
+function composeFullIdeaLine({ ideaId, author }) {
+  const who = author ? `${plainName(author)}'s Full Idea` : 'A Full Idea';
+  return `\u{1F4DC} ${who} passed its completeness check. ${ideaLink(ideaId)}`;
+}
+
+// The display name for a builder id, or null: a missing or unreadable builder
+// leaves the line unnamed rather than failing it.
+async function nameOf(builderId, deps) {
+  if (builderId == null) return null;
+  try {
+    const getBuilder = deps.getBuilder || ((id) => api.getBuilderById(id));
+    const b = await getBuilder(builderId);
+    return b ? (b.display_name || b.github_login || null) : null;
+  } catch (_) {
+    return null;
+  }
+}
+
+async function post(line, deps, result, what) {
+  const log = deps.log || console.log;
+  const hasChannel = deps.hasChannel || webhook.hasWebhook;
+  try {
+    if (!hasChannel(CHANNEL)) { result.skipped = 'channel_not_configured'; return result; }
+    const send = deps.post || webhook.postWebhook;
+    await send(CHANNEL, line);
+    result.posted = true;
+  } catch (e) {
+    result.skipped = 'post_failed';
+    log(`[discord] ${what}: #ship-feed post failed (non-blocking): ${e && e.message ? e.message : e}`);
+  }
+  return result;
+}
+
+// board.item.passed — the pass contract's seven fields. Only a Full Idea is an
+// ideator's moment: an amendment or a genesis stage is the project's decision,
+// and posts nothing here (the Board Room's own channel already carries it).
+async function postIdeaRatified(payload, deps = {}) {
+  const result = { posted: false, skipped: null };
+  if (!payload || payload.subject_type !== 'full_idea' || payload.idea_id == null) {
+    result.skipped = 'not_an_idea';
+    return result;
+  }
+  const author = await nameOf(payload.author_id, deps);
+  return post(composeRatifiedLine({ ideaId: payload.idea_id, author }), deps, result, 'idea ratified');
+}
+
+// idea.graded.full — fired once per real spark→full transition. It is a pass
+// only at or above economy's bar (the same bar the full-pass credit pays at,
+// read through the reward port; without economy there is no bar to pass, so
+// nothing is announced). The author is the developer when someone else developed
+// the spark, as the credit split names them.
+async function postFullIdeaPassed(graded, deps = {}) {
+  const result = { posted: false, skipped: null };
+  const ideaId = graded && (graded.idea_id != null ? graded.idea_id : graded.id);
+  if (ideaId == null) { result.skipped = 'no_idea'; return result; }
+  const reward = deps.reward || api.resolveOptional('reward');
+  const bar = reward && Number(reward.IDEA_FULL_PASS_BAR);
+  const score = graded.completeness_score == null ? NaN : Number(graded.completeness_score);
+  if (!Number.isFinite(bar) || !Number.isFinite(score) || score < bar) { result.skipped = 'below_bar'; return result; }
+  const author = await nameOf(graded.developed_by != null ? graded.developed_by : graded.captured_by, deps);
+  return post(composeFullIdeaLine({ ideaId, author }), deps, result, 'full idea passed');
+}
+
+module.exports = { postIdeaRatified, postFullIdeaPassed, composeRatifiedLine, composeFullIdeaLine };

package/modules/discord/routes/discord.js

@@ -21,6 +21,7 @@ const auth = require('../auth');
 const db = require('../db');
 const shipBroadcast = require('../ship-broadcast');
 const boardBroadcast = require('../board-broadcast');
+const craftBroadcast = require('../craft-broadcast');
 const roleSync = require('../discord-role-sync');
 const webhook = require('../webhook');
 
@@ -50,6 +51,8 @@ let _strandListenerOff = null;
 let _roleSyncListenerOff = null;
 let _boardListenerOff = null;
 let _boardCloseListenerOff = null;
+let _ideaRatifiedListenerOff = null;
+let _fullIdeaListenerOff = null;
 function registerSeams() {
   if (!api.hasProvider('discord.isLinked')) {
     api.registerProvider('discord.isLinked', async (builderId) => !!(await db.getDiscordLink(builderId)));
@@ -98,6 +101,13 @@ function registerSeams() {
   // well as a pass; still outbound only, still nothing cast from Discord.
   if (_boardCloseListenerOff) _boardCloseListenerOff();
   _boardCloseListenerOff = api.on('board.item.closed', (payload) => boardBroadcast.postBoardOutcome(payload));
+  // task 1004439: the ideator's moments reach #ship-feed beside the ships — a
+  // ratified idea (the pass contract's event; a mirror reads it, nothing here
+  // pays) and a Full Idea at the bar. Outbound only, best-effort.
+  if (_ideaRatifiedListenerOff) _ideaRatifiedListenerOff();
+  _ideaRatifiedListenerOff = api.on('board.item.passed', (payload) => craftBroadcast.postIdeaRatified(payload));
+  if (_fullIdeaListenerOff) _fullIdeaListenerOff();
+  _fullIdeaListenerOff = api.on('idea.graded.full', (graded) => craftBroadcast.postFullIdeaPassed(graded));
   if (_roleSyncListenerOff) _roleSyncListenerOff();
   _roleSyncListenerOff = api.on('builder.role-sync-needed', ({ builderId }) =>
     roleSync.syncBuilderRole(builderId).catch((e) =>

package/modules/discord/ship-broadcast.js

@@ -30,17 +30,43 @@
 // For now #ship-news gets nothing so exactly one #ship-feed message fires per
 // ship. The broader "make the two channels genuinely different + filter by task
 // type" work is idea 458 — un-pause by restoring the ship_news entry below.
-function chooseBroadcastTargets({ securitySensitive, taskId, summary }) {
+//
+// A PAGE TWEAK (task 1004439): an approved Tweak Mode round ships as a task, and
+// its line says what it is — a page approved, rewritten by its ARTIST (the round's
+// author of record, task 1004432's shipped_by), never the session that applied it.
+// `pageArtist` is the artist's name already resolved, or null when it could not be
+// read; the line then says "page approved" and names nobody rather than the
+// applier. Still `#<id>`-prefixed, so applause on it reaches the round.
+function chooseBroadcastTargets({ securitySensitive, taskId, summary, pageTweak = false, pageArtist = null }) {
   if (!summary) return [];
   if (securitySensitive) {
     return [{ channel: 'security_ship_feed', line: `#${taskId} shipped (security) — ${summary}` }];
   }
+  if (pageTweak) {
+    const by = pageArtist ? ` — rewritten by ${plainName(pageArtist)}` : '';
+    return [{ channel: 'ship_feed', line: `#${taskId} page approved${by}: ${summary}` }];
+  }
   return [
     // { channel: 'ship_news', line: summary },  // PAUSED — task 1749 / idea 458
     { channel: 'ship_feed', line: `#${taskId} shipped — ${summary}` },
   ];
 }
 
+// The page-tweak source string, and the artist's display name for a shipped
+// round, or null — an unreadable builder leaves the line unnamed, never fails it.
+const PAGE_TWEAK_SOURCE = 'page-tweak';
+async function pageArtistName(task, deps) {
+  if (task.shipped_by == null) return null;
+  try {
+    const getBuilder = deps.getBuilder || ((id) => require('../../src/module-api').getBuilderById(id));
+    const b = await getBuilder(task.shipped_by);
+    return b ? (b.display_name || b.github_login || null) : null;
+  } catch (_) {
+    return null;
+  }
+}
+function plainName(name) { return require('./board-broadcast').plainName(name); }
+
 // Best-effort server-side broadcast for a task that just landed via server-
 // mediated publish. `task` is the shipTask() row: { id, value_summary,
 // security_sensitive, ... }. deps.postWebhook (the scripts/discord/lib poster) and
@@ -61,7 +87,9 @@ async function postShipBroadcast(task, deps = {}) {
 
   const postWebhook = deps.postWebhook || require('./webhook').postWebhook;
   const log = deps.log || console.log;
-  const targets = chooseBroadcastTargets({ securitySensitive: sec, taskId: task.id, summary });
+  const pageTweak = task.source === PAGE_TWEAK_SOURCE;
+  const pageArtist = pageTweak && sec === false ? await pageArtistName(task, deps) : null;
+  const targets = chooseBroadcastTargets({ securitySensitive: sec, taskId: task.id, summary, pageTweak, pageArtist });
   for (const { channel, line } of targets) {
     try {
       await postWebhook(channel, line);

package/modules/economy/reward.js

@@ -72,6 +72,9 @@ module.exports = {
   get KIND_MULTIPLIERS() { return credits.KIND_MULTIPLIERS; },
   get IDEA_BONUS_FRACTION() { return credits.IDEA_BONUS_FRACTION; },
   get REWARD_MARGIN_PCT() { return credits.REWARD_MARGIN_PCT; },
+  // task 1004439: the completeness a Full Idea must reach to pass, so the Discord
+  // feed announces a pass at exactly the bar the full-pass credit pays at.
+  get IDEA_FULL_PASS_BAR() { return credits.IDEA_FULL_PASS_BAR; },
 
   // --- READ surface the core me/public/builders/sessions routes resolve through
   //     this same port (one economy port; the grading precedent registers the

package/modules/government/board.js

@@ -1349,6 +1349,21 @@ async function boardPassForIdea(ideaId) {
 //   - this builder is not the subject's author (the anti-self-vote line, §3)
 // Fail-closed on an unreadable constitution: parseMembershipPredicate yields
 // nobody, so a malformed snapshot summons no one rather than everyone.
+//
+// THE RULE ITSELF is `awaitsVoter` below, and it is the ONE definition: the
+// governor's docket (docket.js, task 1004523) asks it too, so the city's
+// "needs you" and this summons cannot disagree about who must act.
+// tests/governor_docket.mjs drives both over the same matrix.
+
+// Pure: does this sitting wait on this builder's vote? Open and not past its
+// deadline, a member under the item's OWN snapshot, not already cast, and not
+// the subject's author (null author = nobody to hold back: a genesis stage).
+function awaitsVoter({ builderId, authorId = null, alreadyVoted = false, isMember = false, closed = false, expired = false } = {}) {
+  if (builderId === null || builderId === undefined || builderId === '') return false;
+  if (closed || expired || alreadyVoted || !isMember) return false;
+  return !(authorId != null && String(authorId) === String(builderId));
+}
+
 async function pendingVotesFor(builderId) {
   const empty = Object.freeze({ count: 0, first_item_id: null });
   if (builderId === null || builderId === undefined || builderId === '') return empty;
@@ -1367,16 +1382,15 @@ async function pendingVotesFor(builderId) {
   const membershipCache = new Map();
   const votable = [];
   for (const row of rows) {
-    if (row.already_voted) continue;
-    // The author does not vote on their own item (§3). Null author = nobody to
-    // disqualify, so the item stays votable.
-    if (row.author_id != null && String(row.author_id) === String(builderId)) continue;
+    // Cheap refusals first, so membership is resolved only for a row that could
+    // still be votable (the SQL already dropped closed and past-deadline items).
+    if (!awaitsVoter({ builderId, authorId: row.author_id, alreadyVoted: !!row.already_voted, isMember: true })) continue;
     const constitution = row.constitution || {};
     const key = String(constitution.membership || '');
     if (!membershipCache.has(key)) {
       membershipCache.set(key, await isBoardMember(builderId, constitution).catch(() => false));
     }
-    if (!membershipCache.get(key)) continue;
+    if (!awaitsVoter({ builderId, authorId: row.author_id, alreadyVoted: !!row.already_voted, isMember: membershipCache.get(key) })) continue;
     votable.push(row);
   }
   if (!votable.length) return empty;
@@ -1392,6 +1406,7 @@ module.exports = {
   openGenesisStageClose,
   genesisStageStatus,
   pendingVotesFor,
+  awaitsVoter,
   hasMajority,
   majorityDecided,
   decidingVotes,