docs(backlog): record idea-promotion (f107ff5); mark plan-comparison blocked

f107ff5 (idea-board -> profile promotion) moves to RETRO. Plan-comparison view marked
BLOCKED: no plan-candidate event exists server-side (only workflow.proposed), so there
is no wire shape to render or unit-verify until a multi-candidate planner lands.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

BACKLOG.md

@@ -40,7 +40,7 @@ matching bullets below are superseded; only the noted follow-ups remain live:
 
 - **B §2** plan-derived diff manifest — `641051b`
 
-**Remaining (deeper / lower-verifiability):** H freestyle follow-ups (graph re-route, child-session runner); the dormant follow-up activations (A1 planner prompt, A3 producer, B§4 decision hook, B§5 static_check stage); §E plan-comparison view + idea-board→profile.
+**Remaining (deeper / lower-verifiability):** B§4 decision hook (next); H freestyle follow-ups (graph re-route, child-session runner — deep session-lifecycle, want live testing); the dormant model-dependent activations (A1 planner prompt, A3 producer, B§5 static_check stage — live-QA-gated). §E plan-comparison view is BLOCKED (no plan-candidate event; see §E).
 **§E tui-go remaining (UNBLOCKED — Go via `GOTOOLCHAIN=auto` go1.24.2):** plan comparison view; idea-board→profile promotion.
 **Still blocked in this sandbox:** F live-QA gates + D §6 web approval client (need local model / SearXNG / GPU).
 
@@ -121,16 +121,20 @@ card (65df3f4) are shipped — RETRO candidates. Remaining:
 
 - [ ] **§2 full Go↔Kotlin per-event-type render matrix** — golden-fixture tests asserting a
       defined render for every event type (last §2 bullet; partially covered today).
-- [ ] **§3/§4 plan comparison view** — top-2 candidates side-by-side, compact stage graphs,
+- 🚫 **§3/§4 plan comparison view** — **BLOCKED (no data source).** Top-2 candidates side-by-side,
-      diff-highlighted, lint/critique findings inline. Lands with the planning pipeline;
+      compact stage graphs, diff-highlighted, lint/critique findings inline. The server emits no
-      load-bearing for the future preference ranker.
+      plan-candidate event — only `workflow.proposed` (candidate *workflows*, not *plans*). Per the
+      spec this "lands with the planning pipeline" (a multi-candidate planner), which is unbuilt, so
+      there is no wire shape to render against and nothing to unit-verify. Do NOT build a blind TUI
+      view; revisit only once a `PlanCandidate`-bearing event exists. (Checked 2026-06-21.)
 - [ ] **§3 approval ergonomics audit** — single-key y/n/e for T0–T2, mandatory confirm T3+,
       queued-approval navigable list (never modal-stacked). Verify against current band impl.
 - [ ] **Render markdown in chat turns** (QA feature note b) — TUI currently ignores md.
 - [ ] **Session list / resume view** (QA feature note c) — after server restart + TUI reopen
       there's no way to see a prior session or its state; `GET /sessions` data exists server-side.
-- [ ] **Idea board → profile promotion** — deferred hook; auto-captured ideas promote into the
+- [x] **Idea board → profile promotion** — `f107ff5`. `PromoteIdea` WS message → append idea as a
-      curated `.correx/project.toml` profile. (Board itself shipped 3ac0a14..02e963d.)
+      `conventions` entry in `.correx/project.toml` (`ProjectProfileWriter`), `IdeaPromotedEvent`
+      tombstones it off the board. → RETRO.
 - ⏸ **§5.2 command-card LLM annotation layer** — deferred by spec ("ship layer 1, live with it,
       then decide whether layer 2 earns its place"). Build only after using layer 1.
 

RETRO.md

@@ -33,6 +33,7 @@ Nine tracks, each compiled + unit-tested green before commit.
 | `641051b` | Plan-derived diff manifest: `PlanStage.writes` + `PlanDerivedManifest.deriveAllowedWrites`/`combine`, unioned into `StageConfig.writeManifest` at compile, enforced by the existing containment matcher | B §2 |
 | `ab7e4be` | Egress allowlist **activation**: `resolveSessionEgressHosts` threads the session's `EgressAllowlistProjection` state into `ToolCallAssessmentInput` at `runPlane2Assessment`, so `NetworkHostRule` now consults the live per-session union (was fed `emptySet()`) | D (activation) |
 | `4b0024f` | Batch source-list fetch-approval: `POST /sessions/{id}/approve-sources` → `SourceListHosts.extract` (java.net.URI, lower-cased, ports stripped, dossier-line tolerant) → one `EgressHostsGrantedEvent`; live allowlist then auto-clears those web_fetches (no per-URL T2) | D |
+| `f107ff5` | Idea-board → project-profile promotion: `IdeaPromotedEvent` (board tombstone, like discard) + `ProjectProfileWriter` (escape-aware TOML serialize/write) + `ProjectProfile.withConvention` (deduped) + server `PromoteIdea` handler (loads profile, appends idea text, writes `.correx/project.toml`); also made `SimpleToml`'s reader unescape `\\`/`\"` symmetrically with the writers (fixes pre-existing read/write asymmetry) | E |
 
 ### Follow-ups created this pass (refiled into BACKLOG)
 - **C-A1 activation** — `planner.md` must emit a `brief_echo` block and `role_pipeline.toml` must set `briefEcho="true"` / `briefEchoSource` for the gate to fire live (model-dependent → live-QA).