@bongos/core 1.23.22 → 1.24.1

package/tests/fixtures/seed-tasks/bv2-ideator-surface.json

@@ -0,0 +1,373 @@
+{
+  "_comment": "Historical seed, already run: goal 1000095 (BONGOS-V2), from seed-bv2-ideator-surface-tasks.js; spec docs/specs/bongos-v2-ideator-surface.md. Kept as the equivalence fixture for tests/seed_tasks.mjs (task 1004979).",
+  "version_id": "BONGOS-V2",
+  "goal_id": 1000095,
+  "source": "planning-session",
+  "source_ref_prefix": "bv2-ideator-surface",
+  "tasks": [
+    {
+      "ref": "R07",
+      "title": "BV2.R01 — Spike: how provenance is recorded without widening the task hierarchy",
+      "description": "Output an ADR naming the edge shape, where it is written, and who writes it when work is split or rewritten.\n\n**The constraint that makes this a spike.** `modules/lifecycle/hierarchy.js` caps task parentage at ONE level (a parent may not itself have a parent; a task with children may not become a child) and refuses cross-version trees. Both are deliberate — ship rollup and claim safety lean on them. A descent of the shape idea → task → rewrite → split → removal is four levels and crosses a version boundary, so it cannot ride on that relation, and **widening it is explicitly out of scope** (spec decision 8).\n\nProvenance is a different relation from work decomposition. The expected home is `ideas_task_lineage`, which is already many-ideas-to-one-task and carries none of those invariants — but confirm that before assuming it.\n\n**Also settle:** who writes the edge. Parentage today is a manual explicit act, so an edge that depends on someone remembering will have holes. Spec: `docs/specs/bongos-v2-ideator-surface.md` (final). Design of record: idea 1001072 + `docs/design/ideator-surface-direction.md`.",
+      "kind": "spike",
+      "discipline": "engineer",
+      "priority": 5,
+      "criterion_ids": [
+        "ideator-tag-survives-the-fork"
+      ]
+    },
+    {
+      "ref": "R14",
+      "title": "BV2.R02 — Spike: what counts as removed, and who says so",
+      "description": "Output an ADR settling the removal signal: its source, and whether it is derived or declared.\n\n**Nothing records this today.** `shipped` is terminal (`modules/lifecycle/rot.js` says so in as many words), there is no reverted status, and `tasks.merged_into_task_id` is CHECK-constrained to abandoned rows so it can only ever describe work that was cut before it landed. This signal is what lets brightness fall at all.\n\n**The owner's decision (spec decision 13) is the shape, not the detail:** the system PROPOSES and a person CONFIRMS. `modules/lifecycle/cascade.js` already implements ship-generates-work and ships with an EMPTY rule set, so the mechanism exists and only the rule is new. A derived-only signal dims the sky for refactors, renames and file moves; a declared-only one rots because nobody remembers.\n\nNearest existing signal to build the derivation on: `modules/economy/credits.js` `netNegativeBonusAmount`, which already reads `lines_removed > lines_added` from a ship's own diff — the only place the system counts deletion. Spec: `docs/specs/bongos-v2-ideator-surface.md` (final). Design of record: idea 1001072 + `docs/design/ideator-surface-direction.md`.",
+      "kind": "spike",
+      "discipline": "engineer",
+      "priority": 5,
+      "criterion_ids": [
+        "ideator-sky-tells-the-truth"
+      ]
+    },
+    {
+      "ref": "R01",
+      "title": "BV2.R03 — The receipt persists",
+      "description": "A filing's outcome is stated and survives the next keystroke; the last several outcomes stay reachable on the surface that filed them.\n\n**This is the bug that started the session.** The hall already prints \"Filed as task N under <goal>\" on a routed capture (`modules/hall-ui/public/ideas.js`, the `#fq-result` line) — and then clears it the moment the composer is touched again. The signal exists; its half-life is about four seconds.\n\nDone-when: a person files a thought, keeps working, and can still see what became of it without navigating anywhere. Spec: `docs/specs/bongos-v2-ideator-surface.md` (final). Design of record: idea 1001072 + `docs/design/ideator-surface-direction.md`.",
+      "kind": "feature",
+      "discipline": "ui",
+      "priority": 4,
+      "criterion_ids": [
+        "ideator-nothing-is-lost"
+      ]
+    },
+    {
+      "ref": "R02",
+      "title": "BV2.R04 — Gravity is visible before release",
+      "description": "The goal that will catch a thought is shown while composing, and letting it float is an explicit choice rather than an empty dropdown.\n\n**No new routing.** `modules/ideas/routing.js` `decideLanding` already decides this at capture time, and `GET /goals/suggestions` already feeds the composer's goal select. This task makes the decision legible at the moment it is made — the invisible dropdown is the direct cause of the confusion this whole scope came from (spec decision 2).\n\nDone-when: before releasing a thought, a person can see which goal will catch it, change it, or deliberately let it float. Spec: `docs/specs/bongos-v2-ideator-surface.md` (final). Design of record: idea 1001072 + `docs/design/ideator-surface-direction.md`.",
+      "kind": "feature",
+      "discipline": "ui",
+      "priority": 4,
+      "criterion_ids": [
+        "ideator-nothing-is-lost"
+      ]
+    },
+    {
+      "ref": "R05",
+      "title": "BV2.R05 — The per-instance dials: the ignite floor and the decay rate",
+      "description": "Both configured rather than constant, sharing one home. Defaults preserve today's behaviour and halving respectively.\n\n**Two dials, one surface** (spec decisions 3 and 16). The ignite floor — who may convert a quick idea directly into claimable work — is today the `METIC_PLUS` constant in `modules/ideas/routing.js`. The decay rate — how fast an ideator's share falls per hop of the descent — is new in R11. The owner's ruling is that both belong to the project, not to the platform: a project of one wants every thought claimable, a project of fifty wants a nod.\n\nThey are scoped together deliberately so a second dial does not grow its own separate home. Do not widen either default as a side effect. Spec: `docs/specs/bongos-v2-ideator-surface.md` (final). Design of record: idea 1001072 + `docs/design/ideator-surface-direction.md`.",
+      "kind": "feature",
+      "discipline": "engineer",
+      "priority": 3,
+      "criterion_ids": [
+        "ideator-nothing-is-lost"
+      ]
+    },
+    {
+      "ref": "R20",
+      "title": "BV2.R06 — The new five questions as a versioned template",
+      "description": "`base-v2` ships beside `base-v1`; ideas already filed keep scoring against the questions they were actually asked.\n\n**The owner's question set, in order:** what made you have the idea; scope as best as you can here; what should an engineer or artist know prior to building; how is this long term justified in the project; what does a successful implementation of the idea look like.\n\n**This is cheaper than it looks.** `modules/ideas/templates.js` already registers templates by key and every idea stores its `template_key`, so this is a second entry in the registry, NOT a migration. Renaming a label is free; only renaming a key would be a data migration, and this does not need to.\n\nOne field survives outright (what made you have the idea ≈ `why_had`) and one roughly (the long-term justification ≈ `fit`). Three are new and one is dropped. Spec: `docs/specs/bongos-v2-ideator-surface.md` (final). Design of record: idea 1001072 + `docs/design/ideator-surface-direction.md`.",
+      "kind": "feature",
+      "discipline": "engineer",
+      "priority": 4,
+      "criterion_ids": [
+        "ideator-full-idea-shapes-the-space"
+      ]
+    },
+    {
+      "ref": "R08",
+      "title": "BV2.R07 — Provenance edges on the idea lineage ledger",
+      "description": "task→task descent edges recorded, to arbitrary depth and across version boundaries. The task hierarchy's one-level cap and its cross-version refusal are untouched.\n\nBuild to whatever R07's ADR settled. The write side that exists today is `modules/ideas/inbox.js` `linkIdeaTask`, an upsert on `(task_id, idea_id)`; `ideas_task_lineage` has been many-ideas-to-one-task since `ideas_006`.\n\n**The property that matters:** the tag must survive a rewrite, a split and a merge. If it only survives one hop the result is a link, not a story — and, after R11, someone does not get paid. Spec: `docs/specs/bongos-v2-ideator-surface.md` (final). Design of record: idea 1001072 + `docs/design/ideator-surface-direction.md`.",
+      "kind": "feature",
+      "discipline": "engineer",
+      "priority": 5,
+      "criterion_ids": [
+        "ideator-tag-survives-the-fork"
+      ],
+      "deps": [
+        "R07"
+      ]
+    },
+    {
+      "ref": "R04",
+      "title": "BV2.R08 — Fold the Full Idea form and the spark queue into the new surface",
+      "description": "Developing a thought is a step taken AFTER a one-line filing, never a gate before it. No dead links from `/idea/:id`, the command palette, or the nav.\n\n**What the ideas page actually is today:** three stacked sections — the spark queue (\"waiting to be developed\"), the quick composer, and the five-field Full Idea composer with its live completeness meter. All three need a home. The Board Room does NOT — it is reached from the left nav and is not behind this page.\n\n**The risk this task carries** (spec decision 18): a spark's whole value is that it costs nothing to have. Folding a five-question form onto the same surface is the most likely way to slow the one-line path. R06a exists to catch that; do not treat it as someone else's problem. Spec: `docs/specs/bongos-v2-ideator-surface.md` (final). Design of record: idea 1001072 + `docs/design/ideator-surface-direction.md`.",
+      "kind": "refactor",
+      "discipline": "ui",
+      "priority": 3,
+      "criterion_ids": [
+        "ideator-nothing-is-lost"
+      ],
+      "deps": [
+        "R01"
+      ]
+    },
+    {
+      "ref": "R11",
+      "title": "BV2.R09 — The ideator payout follows the descent, decayed by depth",
+      "description": "A descendant's ship pays the origin at the decayed rate. Idempotent. Existing first-hop behaviour preserved exactly.\n\n**The seam exists.** `modules/economy/credits.js` `awardIdeaTaskShipCredit` already resolves a shipped task back to its source idea and splits the payout — but only via the EARLIEST lineage link, one hop. A task split off later, or a child of a child, pays nobody.\n\n**Decay** (spec decision 16): full share at the direct task, halving at each hop, so an infinite descent is worth at most twice the direct task. The rate is a dial (R05), not a constant.\n\n**The boundary that stops farming** (spec decision 7): descendant WORK pays the origin; a separate idea that merely cites the origin does not. The descent displays more than the payout counts. Spec: `docs/specs/bongos-v2-ideator-surface.md` (final). Design of record: idea 1001072 + `docs/design/ideator-surface-direction.md`.",
+      "kind": "feature",
+      "discipline": "engineer",
+      "priority": 5,
+      "criterion_ids": [
+        "ideator-tag-survives-the-fork"
+      ],
+      "deps": [
+        "R08"
+      ]
+    },
+    {
+      "ref": "R09",
+      "title": "BV2.R10 — The descent reads to arbitrary depth and across versions",
+      "description": "One query, not per-hop round trips.\n\n**Three findings inherited from abandoned task 1004054**, whose predecessor was built, graded and lost. They are free design requirements, not someone else's mess:\n\n1. **Test at the RENDERED layer, not just the data layer.** The prior attempt tested only the server-side trail builder, which is exactly why finding 2 went uncaught.\n2. **A merged idea's triage note lives on the MERGED row, not the target row.** The prior attempt read it from the target, so the headline scenario was the broken one.\n3. **Collapse the hops into one query or a CTE.** The prior attempt ran 4–6 serial round trips per read.\n\nToday's reader is `modules/ideas/inbox.js` `listIdeaTrailForBuilder`, which returns `lineage_tasks[]` — one hop only. Spec: `docs/specs/bongos-v2-ideator-surface.md` (final). Design of record: idea 1001072 + `docs/design/ideator-surface-direction.md`.",
+      "kind": "feature",
+      "discipline": "engineer",
+      "priority": 4,
+      "criterion_ids": [
+        "ideator-tag-survives-the-fork"
+      ],
+      "deps": [
+        "R08"
+      ]
+    },
+    {
+      "ref": "R15",
+      "title": "BV2.R11 — The cascade rule that proposes a removal",
+      "description": "A ship that deletes an earlier shipped task's work files a QUESTION, not a verdict. `shipped` stays terminal and no credit is ever clawed back.\n\nBuild to R14's ADR. `modules/lifecycle/cascade.js` already implements ship-generates-work and declares an EMPTY rule set — this is the first rule, so expect the mechanism to be sound and unexercised.\n\n**Do not make this a verdict.** The owner chose propose-then-confirm precisely because refactors, renames and file moves all look like deletions to a diff. A rule that marks work removed on its own evidence will dim the sky for reasons that are not real. Spec: `docs/specs/bongos-v2-ideator-surface.md` (final). Design of record: idea 1001072 + `docs/design/ideator-surface-direction.md`.",
+      "kind": "feature",
+      "discipline": "engineer",
+      "priority": 4,
+      "criterion_ids": [
+        "ideator-sky-tells-the-truth"
+      ],
+      "deps": [
+        "R14"
+      ]
+    },
+    {
+      "ref": "R21",
+      "title": "BV2.R12 — Substance floors for the new Full Idea fields",
+      "description": "Floors chosen deliberately for each new field, because the completeness score feeds credits.\n\n`modules/ideas/completeness.js` scores against the per-field `substanceMin` declared in the template; `base-v1` used a flat 40 characters for all five. The new fields are not interchangeable — \"scope as best as you can here\" and \"what made you have the idea\" do not deserve the same floor.\n\n**The never-invent-a-field rule gets stronger here, not weaker** (the Ideator pack). The new set is deliberately resistant to ghost-writing: nobody but the filer can answer what made them have the idea. A floor that pushes an agent to pad a thin answer destroys exactly that property. A short answer scores short — that is the scorer working. Spec: `docs/specs/bongos-v2-ideator-surface.md` (final). Design of record: idea 1001072 + `docs/design/ideator-surface-direction.md`.",
+      "kind": "feature",
+      "discipline": "engineer",
+      "priority": 3,
+      "criterion_ids": [
+        "ideator-full-idea-shapes-the-space"
+      ],
+      "deps": [
+        "R20"
+      ]
+    },
+    {
+      "ref": "R22",
+      "title": "BV2.R13 — A Full Idea carries a recommendation: goal or criterion",
+      "description": "The recommendation is carried from filing through to the board item and shown to voters.\n\n**The ideator does not decide** (spec decision 9). They recommend; the board decides. The reasoning the owner accepted is that scope is the thing you learn last — the person who had the thought writes it, the people reading it judge how big it turned out to be.\n\nThe board item payload is `boardWindowPayload` in `modules/ideas/routes/inbox.js`; the section labels the Board Room renders are a hand-mirror of the template's field keys (`modules/hall-ui/public/board-room.js`, test-pinned) — so a template change and a board change move together. **The Board Room's own flow is unchanged.** Spec: `docs/specs/bongos-v2-ideator-surface.md` (final). Design of record: idea 1001072 + `docs/design/ideator-surface-direction.md`.",
+      "kind": "feature",
+      "discipline": "engineer",
+      "priority": 4,
+      "criterion_ids": [
+        "ideator-full-idea-shapes-the-space"
+      ],
+      "deps": [
+        "R20"
+      ]
+    },
+    {
+      "ref": "R12",
+      "title": "BV2.R14 — Size is the sum of those payouts",
+      "description": "Computable from the ledger for any idea. Compressed for drawing, with the true figure available.\n\n**Size is credits, not karma** (spec decision 5). `karma_log` carries no task key and no idea key — `migrations/040_builder_karma.sql` states that this is deliberate — so \"the karma a thought caused\" is not a quantity that can be computed. Credits are already idea-attributed at ship, so they can.\n\nSize never falls. That is what makes it independent of brightness, and what lets a thought whose work was torn out still render large. Sums are long-tailed, so compress for drawing and show the real number in the panel. Spec: `docs/specs/bongos-v2-ideator-surface.md` (final). Design of record: idea 1001072 + `docs/design/ideator-surface-direction.md`.",
+      "kind": "feature",
+      "discipline": "engineer",
+      "priority": 4,
+      "criterion_ids": [
+        "ideator-tag-survives-the-fork"
+      ],
+      "deps": [
+        "R11"
+      ]
+    },
+    {
+      "ref": "R10",
+      "title": "BV2.R15 — The descent surface on the idea detail page",
+      "description": "One thought at the top, everything it caused falling away below — including the branches that went out.\n\n`/idea/:id` (`modules/hall-ui/public/idea.js`) is the canonical per-idea record and stays; this is its new section. It already renders a one-line \"became task N\" outcome, which this replaces with the full story.\n\nDone-when: a person can trace a thing shipped months later back to the line that caused it, through rewrites, splits and merges. See `docs/design/mocks/ideator-surface/Descent.dc.html` for the agreed shape — it is a shape, not a pixel contract. Spec: `docs/specs/bongos-v2-ideator-surface.md` (final). Design of record: idea 1001072 + `docs/design/ideator-surface-direction.md`.",
+      "kind": "feature",
+      "discipline": "ui",
+      "priority": 4,
+      "criterion_ids": [
+        "ideator-tag-survives-the-fork"
+      ],
+      "deps": [
+        "R09"
+      ]
+    },
+    {
+      "ref": "R15a",
+      "title": "BV2.R16 — Confirming or dismissing a removal proposal",
+      "description": "On the existing awaiting-nod surface, at the same floor as the nod (Metic+, `task.promote`). No new permission and no new page.\n\nAn unanswered proposal **rots on the normal clock** (spec decision 14) rather than accumulating — `modules/lifecycle/rot.js` and the `GET /inbox/rotting` feed already exist and this rides them.\n\nThe surface is `modules/hall-ui/public/goal-inbox.js`, which already renders the awaiting-nod queue and the rot feed side by side. Confirming is what makes brightness fall; dismissing is what stops a refactor from dimming the sky. Spec: `docs/specs/bongos-v2-ideator-surface.md` (final). Design of record: idea 1001072 + `docs/design/ideator-surface-direction.md`.",
+      "kind": "feature",
+      "discipline": "engineer",
+      "priority": 4,
+      "criterion_ids": [
+        "ideator-sky-tells-the-truth"
+      ],
+      "deps": [
+        "R15"
+      ]
+    },
+    {
+      "ref": "R23",
+      "title": "BV2.R17 — Ratify a Full Idea into a goal",
+      "description": "The goal half beside the existing criterion half. One transaction. The five answers land on the goal.\n\n**The criterion half already exists** and is the model to follow: `modules/ideas/inbox.js` `ratifyCriterionProposal` writes `done_when_criteria` + the idea status + karma + the audit row in a single transaction, and `POST /inbox/:id/ratify` fronts it.\n\n**Nothing today turns a filed thought into a goal** — goals come from a separate planning act — so this is the genuinely new path of the four in this criterion. `POST /goals` validates `scope_modules` against the live roster and escalates to Archon for a protected scope; a ratification path has to respect both. Spec: `docs/specs/bongos-v2-ideator-surface.md` (final). Design of record: idea 1001072 + `docs/design/ideator-surface-direction.md`.",
+      "kind": "feature",
+      "discipline": "engineer",
+      "priority": 3,
+      "criterion_ids": [
+        "ideator-full-idea-shapes-the-space"
+      ],
+      "deps": [
+        "R22"
+      ]
+    },
+    {
+      "ref": "R12a",
+      "title": "BV2.R18 — Backfill lineage for existing ideas, without backfilling money",
+      "description": "Pre-existing ideas carry a size computed from the descent they actually have. No credits are paid retroactively.\n\n**And the consequence is surfaced, not hidden** (spec decision 17). For those ideas size is NOT a sum of payouts actually made, so it needs a historical marker or the number quietly lies about what it means. The owner chose this deliberately: it makes the sky meaningful on day one without spending credits again on work already paid for once.\n\nDone-when: every idea filed before this shipped has a size, and anywhere that size is shown makes clear which kind of number it is. Spec: `docs/specs/bongos-v2-ideator-surface.md` (final). Design of record: idea 1001072 + `docs/design/ideator-surface-direction.md`.",
+      "kind": "feature",
+      "discipline": "engineer",
+      "priority": 4,
+      "criterion_ids": [
+        "ideator-tag-survives-the-fork"
+      ],
+      "deps": [
+        "R12"
+      ]
+    },
+    {
+      "ref": "R03",
+      "title": "BV2.R19 — The room",
+      "description": "A plain overview of one's own thinking: what was filed, what it became, its size, and whether it still burns.\n\n**This is the page a person opens daily**, and it does the real work — the sky is ambient, the room is useful. It is deliberately unglamorous: rows, a size, a state.\n\n**It is the author's own view. The profile keeps a compact public trail** (spec decision 19) — the two are not the same surface. `modules/hall-ui/public/profile.js` already renders an idea trail from `GET /inbox/by-builder/:id`; that stays as what someone else sees on you.\n\nSee `docs/design/mocks/ideator-surface/Room.dc.html` for the agreed shape. Spec: `docs/specs/bongos-v2-ideator-surface.md` (final). Design of record: idea 1001072 + `docs/design/ideator-surface-direction.md`.",
+      "kind": "feature",
+      "discipline": "ui",
+      "priority": 3,
+      "criterion_ids": [
+        "ideator-nothing-is-lost"
+      ],
+      "deps": [
+        "R12"
+      ]
+    },
+    {
+      "ref": "R16",
+      "title": "BV2.R20 — Brightness — the live share of a descent",
+      "description": "Computable per idea, and it falls when a removal is confirmed.\n\n**Graded, not binary** (spec decision 20): a thought whose descent is five things with three still alive is partly lit, and goes out only when nothing survives. That is what makes a star visibly dim as the project removes pieces of what it caused.\n\n**Brightness never claws back credits.** The ledger is not rewritten when the project changes its mind — only the picture changes. Size, which R12 owns, does not move. Spec: `docs/specs/bongos-v2-ideator-surface.md` (final). Design of record: idea 1001072 + `docs/design/ideator-surface-direction.md`.",
+      "kind": "feature",
+      "discipline": "engineer",
+      "priority": 4,
+      "criterion_ids": [
+        "ideator-sky-tells-the-truth"
+      ],
+      "deps": [
+        "R15a",
+        "R12"
+      ]
+    },
+    {
+      "ref": "R06",
+      "title": "BV2.R21 — Proof: a thought filed from the hall is traceable an hour later without asking anyone",
+      "description": "**The live demonstration that `ideator-nothing-is-lost` is met.**\n\nA person files a thought, leaves, comes back later, and finds what became of it unaided — no asking, no database, no one else's help. If they filed it aimed, they can see which goal caught it; if they let it float, they can see that nothing has claimed it yet.\n\nThis is the exact scenario that failed on 2026-09-19 and produced this whole scope: a thought was filed, it silently became a task under a goal, and the person who filed it could not find it five minutes later. The proof is that this can no longer happen. Spec: `docs/specs/bongos-v2-ideator-surface.md` (final). Design of record: idea 1001072 + `docs/design/ideator-surface-direction.md`.",
+      "kind": "verify",
+      "discipline": "engineer",
+      "priority": 3,
+      "criterion_ids": [
+        "ideator-nothing-is-lost"
+      ],
+      "deps": [
+        "R01",
+        "R03"
+      ]
+    },
+    {
+      "ref": "R06a",
+      "title": "BV2.R22 — Proof: the one-line path did not get slower",
+      "description": "**The guard on spec decision 18**, which is the decision in this scope carrying the most risk.\n\nFiling a spark takes the same gestures and the same time it does today, with the Full Idea form present on the same surface. Measure it against today's path, not against an impression.\n\nA spark's whole value is that it costs nothing to have. If the fast path picks up an extra step, a scroll, or a decision, this scope will have built something beautiful that people stop using — and they will go back to firing one-liners into Discord. A green build is not the evidence here; a timed comparison is. Spec: `docs/specs/bongos-v2-ideator-surface.md` (final). Design of record: idea 1001072 + `docs/design/ideator-surface-direction.md`.",
+      "kind": "verify",
+      "discipline": "engineer",
+      "priority": 3,
+      "criterion_ids": [
+        "ideator-nothing-is-lost"
+      ],
+      "deps": [
+        "R04"
+      ]
+    },
+    {
+      "ref": "R13",
+      "title": "BV2.R23 — Proof: a task split twice pays its origin at the decayed rate and appears in the descent",
+      "description": "**The live demonstration that `ideator-tag-survives-the-fork` is met.**\n\nA real thought becomes a real task; that task is split; one of its children is split again; each ships. The origin is paid at the decayed rate at every hop, and the whole chain reads as one descent.\n\nThis is the criterion everything else stands on. If the tag dies at the first fork, the descent is a link, the size is wrong, and the sky is decoration over a number that does not mean anything. Demonstrate it on real work, not a fixture. Spec: `docs/specs/bongos-v2-ideator-surface.md` (final). Design of record: idea 1001072 + `docs/design/ideator-surface-direction.md`.",
+      "kind": "verify",
+      "discipline": "engineer",
+      "priority": 3,
+      "criterion_ids": [
+        "ideator-tag-survives-the-fork"
+      ],
+      "deps": [
+        "R10",
+        "R12"
+      ]
+    },
+    {
+      "ref": "R17",
+      "title": "BV2.R24 — The five states resolve from ledger facts",
+      "description": "star / protostar / satellite / remnant / cold body — each DERIVED, none a UI guess.\n\n- **star** — caused work that is still alive\n- **protostar** — filed, not yet ignited. Include the well-vs-open-space distinction: caught by a goal and awaiting a nod is a different state from claimed by nothing, and position is what carries it (spec decision, direction doc)\n- **satellite** — folded into another thought; its value counts there\n- **remnant** — it burned, then the project removed it; it keeps its size\n- **cold body** — declined at triage; it never ignited, so it has no size at all\n\nDone-when: every state is computed from the ledger, and no surface has to infer one. Spec: `docs/specs/bongos-v2-ideator-surface.md` (final). Design of record: idea 1001072 + `docs/design/ideator-surface-direction.md`.",
+      "kind": "feature",
+      "discipline": "engineer",
+      "priority": 4,
+      "criterion_ids": [
+        "ideator-sky-tells-the-truth"
+      ],
+      "deps": [
+        "R16"
+      ]
+    },
+    {
+      "ref": "R24",
+      "title": "BV2.R25 — Proof: a Full Idea ratified as a goal produces a goal carrying its five answers",
+      "description": "**The live demonstration that `ideator-full-idea-shapes-the-space` is met.**\n\nA Full Idea is written through the new five questions, carries a recommendation, goes to the Board Room unchanged, is ratified as a GOAL, and the resulting goal carries those five answers natively — scope from \"scope as best as you can here\", done-when from \"what does a successful implementation look like\".\n\nRun it end to end through the real Board Room. The point of this criterion is that an ideator's best work becomes the structure other people's thinking lands in; a goal that arrives without its answers has not demonstrated that. Spec: `docs/specs/bongos-v2-ideator-surface.md` (final). Design of record: idea 1001072 + `docs/design/ideator-surface-direction.md`.",
+      "kind": "verify",
+      "discipline": "engineer",
+      "priority": 3,
+      "criterion_ids": [
+        "ideator-full-idea-shapes-the-space"
+      ],
+      "deps": [
+        "R23"
+      ]
+    },
+    {
+      "ref": "R18",
+      "title": "BV2.R26 — The sky",
+      "description": "The ambient view over the five states: size compressed, brightness live, goals as gravity wells and their criteria as the rings inside them.\n\n**It arrives last on purpose.** By this point it draws numbers and states the rest of the work has already produced, which is what keeps it cheap. A galaxy is not trivial, and this scope only earns it because nothing else depends on it.\n\n**It is never the only path to anything it shows** (spec decision 11). Every fact in the sky is reachable from the room or the descent.\n\nSee `docs/design/mocks/ideator-surface/Sky.dc.html`, and `docs/design/ideator-surface-direction.md` for why the project's own design system — a black void and one accent that lights only what is live — already supplies this. Spec: `docs/specs/bongos-v2-ideator-surface.md` (final). Design of record: idea 1001072 + `docs/design/ideator-surface-direction.md`.",
+      "kind": "feature",
+      "discipline": "ui",
+      "priority": 3,
+      "criterion_ids": [
+        "ideator-sky-tells-the-truth"
+      ],
+      "deps": [
+        "R17",
+        "R03"
+      ]
+    },
+    {
+      "ref": "R19",
+      "title": "BV2.R27 — Proof: a large dead thought renders large and dead",
+      "description": "**The live demonstration that `ideator-sky-tells-the-truth` is met**, and the single scenario this criterion exists for.\n\nA thought that caused substantial work which the project has since removed shows at **full size and zero brightness**, and is distinguishable at a glance from a thought that never caused anything at all.\n\nThat distinction is the whole reason size and brightness are two channels instead of one number. If those two render alike, the criterion is not met however green the build is. Spec: `docs/specs/bongos-v2-ideator-surface.md` (final). Design of record: idea 1001072 + `docs/design/ideator-surface-direction.md`.",
+      "kind": "verify",
+      "discipline": "engineer",
+      "priority": 3,
+      "criterion_ids": [
+        "ideator-sky-tells-the-truth"
+      ],
+      "deps": [
+        "R18"
+      ]
+    }
+  ]
+}

package/tests/fixtures/seed-tasks/fake-api.mjs

@@ -0,0 +1,80 @@
+// tests/fixtures/seed-tasks/fake-api.mjs — an in-memory stand-in for the four Bongos routes a
+// task seeder writes to (task 1004979). It records every request so tests/seed_tasks.mjs can
+// compare what two seeders SENT, and models just enough of the server to answer them the way
+// production does: string task ids, POST /tasks idempotent on (source, source_ref) with
+// `idempotent: true` on a replay, and GET /goals/:id criteria rows carrying linked_tasks.
+
+import http from 'node:http';
+
+export async function startFakeApi({ firstId = 2000001, goalCriteria = {} } = {}) {
+  const requests = [];
+  const tasks = [];          // rows in creation order
+  const links = new Map();   // goalId -> Map(criterion -> count)
+  for (const [gid, crits] of Object.entries(goalCriteria)) links.set(String(gid), new Map(Object.entries(crits)));
+  let nextId = firstId;
+
+  const server = http.createServer((req, res) => {
+    let raw = '';
+    req.on('data', (c) => { raw += c; });
+    req.on('end', () => {
+      const body = raw ? JSON.parse(raw) : null;
+      const url = req.url.replace(/\?.*$/, '');
+      requests.push({ method: req.method, path: url, body });
+      const send = (status, obj) => { res.writeHead(status, { 'Content-Type': 'application/json' }); res.end(JSON.stringify(obj)); };
+      let m;
+      if (req.method === 'POST' && url === '/api/bongos/tasks') {
+        const prior = tasks.find((t) => t.source === body.source && t.source_ref === body.source_ref);
+        if (prior) return send(200, { task: { id: prior.id }, idempotent: true });
+        const row = { ...body, id: String(nextId++), deps: [], promoted: false };
+        tasks.push(row);
+        const g = links.get(String(body.goal_id)) || new Map();
+        for (const c of body.criterion_ids || []) g.set(c, (g.get(c) || 0) + 1);
+        links.set(String(body.goal_id), g);
+        return send(201, { task: { id: row.id, status: 'backlog' } });
+      }
+      if (req.method === 'POST' && (m = url.match(/^\/api\/bongos\/tasks\/(\d+)\/dependencies$/))) {
+        const row = tasks.find((t) => t.id === m[1]);
+        if (!row) return send(404, { error: { code: 'not_found' } });
+        row.deps.push(...body.depends_on_task_ids.map(String));
+        return send(200, { added: body.depends_on_task_ids.length });
+      }
+      if (req.method === 'POST' && (m = url.match(/^\/api\/bongos\/tasks\/(\d+)\/promote$/))) {
+        const row = tasks.find((t) => t.id === m[1]);
+        if (!row) return send(404, { error: { code: 'not_found' } });
+        row.promoted = true;
+        return send(200, { task: { id: row.id, status: 'ready' } });
+      }
+      if (req.method === 'PATCH' && /^\/api\/bongos\/(tasks|inbox)\/\d+$/.test(url)) return send(200, { ok: true });
+      if (req.method === 'GET' && (m = url.match(/^\/api\/bongos\/goals\/(\d+)$/))) {
+        const g = links.get(m[1]) || new Map();
+        return send(200, { goal: { id: m[1] }, criteria: [...g].map(([criterion_id, linked_tasks]) => ({ criterion_id, linked_tasks })) });
+      }
+      return send(404, { error: { code: 'no_route', path: url } });
+    });
+  });
+  await new Promise((r) => server.listen(0, '127.0.0.1', r));
+  const base = `http://127.0.0.1:${server.address().port}`;
+  return {
+    base, requests, tasks,
+    writes: () => requests.filter((r) => r.method !== 'GET'),
+    close: () => new Promise((r) => server.close(r)),
+  };
+}
+
+// The transport seed-tasks.js's seedTasks() takes, pointed at a fake server.
+export function fetchApi(base) {
+  return async (method, p, body) => {
+    const res = await fetch(`${base}/api/bongos${p}`, {
+      method, headers: { 'Content-Type': 'application/json' }, body: body ? JSON.stringify(body) : undefined,
+    });
+    const text = await res.text();
+    return { status: res.status, ok: res.ok, json: text ? JSON.parse(text) : {} };
+  };
+}
+
+// Order-insensitive object keys, order-sensitive arrays: the canonical text of a write log.
+export function canonical(v) {
+  if (Array.isArray(v)) return `[${v.map(canonical).join(',')}]`;
+  if (v && typeof v === 'object') return `{${Object.keys(v).sort().map((k) => `${JSON.stringify(k)}:${canonical(v[k])}`).join(',')}}`;
+  return JSON.stringify(v);
+}

package/tests/github_one_trip.mjs

@@ -106,6 +106,40 @@ test('the app creds come back out of the web.env the runner itself writes', () =
   assert.equal(c.clientId, 'Iv23liABCDEF123456');
   assert.equal(c.pem.trim(), PEM.trim(), 'the one-line pem is restored to real newlines');
   assert.deepEqual(RUN.appCredsFromEnv(''), { appId: null, pem: null, clientId: null });
+  const unquoted = ENV.replace(/^GITHUB_APP_PRIVATE_KEY="(.*)"$/m, 'GITHUB_APP_PRIVATE_KEY=$1');
+  assert.notEqual(unquoted, ENV);
+  assert.equal(RUN.appCredsFromEnv(unquoted).pem.trim(), PEM.trim(), 'a web.env written before task 1005009 still reads');
+});
+
+// One KEY=VALUE line as systemd's EnvironmentFile hands it to the process (env-file.c):
+// unquoted, a backslash escapes the next character and is dropped; inside double quotes
+// it survives unless it escapes one of " \ ` $. The runner's own parser above is not the
+// reader that matters — the SERVER gets the key from systemd (task 1005009).
+function systemdEnvValue(body, key) {
+  const line = body.split('\n').find((l) => l.startsWith(`${key}=`));
+  const raw = line.slice(key.length + 1);
+  let out = '';
+  if (raw.startsWith('"')) {
+    for (let i = 1; i < raw.length && raw[i] !== '"'; i++) {
+      if (raw[i] === '\\' && i + 1 < raw.length) out += '"\\`$'.includes(raw[++i]) ? raw[i] : `\\${raw[i]}`;
+      else out += raw[i];
+    }
+    return out;
+  }
+  for (let i = 0; i < raw.length; i++) out += raw[i] === '\\' && i + 1 < raw.length ? raw[++i] : raw[i];
+  return out;
+}
+
+test('the SERVER can sign with the key systemd hands it from the web.env we write (task 1005009)', () => {
+  const GH = require(path.join(ROOT, 'modules', 'lifecycle', 'github-push.js'));
+  const sign = (pem) => GH.mintAppJwt({ appId: 5189633, privateKeyPem: pem, nowSec: 1_800_000_000 });
+  const jwt = sign(systemdEnvValue(ENV, 'GITHUB_APP_PRIVATE_KEY'));
+  const [h, b, s] = jwt.split('.');
+  assert.equal(crypto.createVerify('RSA-SHA256').update(`${h}.${b}`).verify(publicKey, Buffer.from(s, 'base64url')), true);
+  // The shape every hosted project carried until this task: systemd turns each \n into n.
+  const unquoted = ENV.replace(/^GITHUB_APP_PRIVATE_KEY="(.*)"$/m, 'GITHUB_APP_PRIVATE_KEY=$1');
+  assert.match(systemdEnvValue(unquoted, 'GITHUB_APP_PRIVATE_KEY'), /^-----BEGIN RSA PRIVATE KEY-----nM/);
+  assert.throws(() => sign(systemdEnvValue(unquoted, 'GITHUB_APP_PRIVATE_KEY')), 'the unquoted line is the bug this pins');
 });
 
 test('the app JWT is RS256, signed by the app key, issued by the app id, under ten minutes', () => {

package/tests/github_repo_visibility.mjs

@@ -27,6 +27,9 @@ import { fileURLToPath } from 'node:url';
 
 // A valid key BEFORE requiring the modules, so secret-box reads as configured.
 process.env.BUILDER_SECRET_KEY = 'ab'.repeat(32);
+// Pre-launch OFF unless a case turns it on (task 1004998): a password in the
+// runner's env must not silently turn every flip case into a refusal.
+delete process.env.PRELAUNCH_PASSWORD; delete process.env.STEALTH_PASSWORD;
 
 const require = createRequire(import.meta.url);
 const ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
@@ -150,6 +153,23 @@ test('POST visibility=public: flips via makeRepoPublic and forwards GitHub\'s an
   } finally { s.restore(); }
 });
 
+test('POST visibility=public in PRE-LAUNCH: refused 409 public_repo_prelaunch, nothing flipped (task 1004998)', async () => {
+  const s = stub({ makePublic: () => ({ private: false }) });
+  const saved = process.env.PRELAUNCH_PASSWORD;
+  process.env.PRELAUNCH_PASSWORD = 'shh';
+  try {
+    const res = fakeRes();
+    await postHandler()({ builder: { id: 1 }, body: { repo: 'jaxri/mercury', visibility: 'public' } }, res);
+    assert.equal(res._status, 409);
+    assert.equal(res._body.error.code, 'public_repo_prelaunch');
+    assert.match(res._body.error.message, /pre-launch/);
+    assert.equal(s.calls.flip.length, 0, 'GitHub is never asked to flip');
+  } finally {
+    if (saved === undefined) delete process.env.PRELAUNCH_PASSWORD; else process.env.PRELAUNCH_PASSWORD = saved;
+    s.restore();
+  }
+});
+
 test('POST visibility=public: GitHub\'s 403 becomes not_repo_admin, said plainly', async () => {
   const s = stub({ makePublic: () => { throw new GithubApiError('no', { status: 403, code: 'not_repo_admin' }); } });
   try {

package/tests/goal_achievement.mjs

@@ -60,6 +60,34 @@ function goalHandler({ goal, counts }) {
 // =========================================================================
 // achieveGoalIfComplete — the happy path: last criterion confirmed → achieved
 // =========================================================================
+// Task 1001693: the manual door books the goal-achievement karma too, but only
+// for the caller whose conditional flip actually moved the row.
+const seams = require('../src/module-seams.js');
+const reward = require('../modules/economy/reward.js');
+if (!seams.hasProvider('reward')) seams.registerProvider('reward', reward);
+async function countingAward(fn) {
+  const original = reward.awardGoalAchievementKarma;
+  const calls = [];
+  reward.awardGoalAchievementKarma = async (_exec, { goalId }) => { calls.push(Number(goalId)); return { awarded: 1 }; };
+  try { await fn(); } finally { reward.awardGoalAchievementKarma = original; }
+  return calls;
+}
+
+await test('achieveGoalIfComplete: the caller that flips the goal books its karma once', async () => {
+  const pool = fakePool(goalHandler({ goal: GOAL(), counts: { total: 1, unsatisfied: 0 } }));
+  const calls = await countingAward(() => achieveGoalIfComplete({ goalId: 7 }, { pool }));
+  assert.deepEqual(calls, [7]);
+});
+
+await test('achieveGoalIfComplete: a caller that loses the flip race books nothing, and still reports achieved', async () => {
+  const base = goalHandler({ goal: GOAL(), counts: { total: 1, unsatisfied: 0 } });
+  const pool = fakePool((s) => (/^UPDATE goals/.test(s) ? { rows: [] } : base(s)));
+  let out;
+  const calls = await countingAward(async () => { out = await achieveGoalIfComplete({ goalId: 7 }, { pool }); });
+  assert.deepEqual(calls, []);
+  assert.equal(out.achieved, true);
+});
+
 await test('achieveGoalIfComplete: open goal, all criteria satisfied → flips to achieved', async () => {
   const pool = fakePool(goalHandler({ goal: GOAL(), counts: { total: 3, unsatisfied: 0 } }));
   const out = await achieveGoalIfComplete({ goalId: 7 }, { pool });
@@ -67,7 +95,8 @@ await test('achieveGoalIfComplete: open goal, all criteria satisfied → flips t
   assert.equal(out.goal.status, 'achieved', 'returns the updated row');
   const upd = find(pool.queries, /^UPDATE goals/);
   assert.ok(upd, 'the status flip must be persisted');
-  assert.deepEqual(upd.params, [7, 'achieved'], 'UPDATE binds (goalId, "achieved")');
+  // Conditional on still reading `open` (task 1001693), so only one caller wins the flip.
+  assert.deepEqual(upd.params, [7, 'achieved', 'open'], 'UPDATE binds (goalId, "achieved", from "open")');
 });
 
 // =========================================================================