@bongos/core 1.19.469 → 1.19.471

package/tests/hall_catalog_world.mjs

@@ -0,0 +1,181 @@
+// tests/hall_catalog_world.mjs — the catalog pages in the chrome world (task
+// 1003472, goal 1000081): modules and the repo atlas, REDESIGNED rather than
+// re-skinned. Static pins over the shipped source: the module catalog is ONE
+// panel of the oversight family's rows (the card grid, the boxed search and
+// the .mod-chip alias are gone), the description is clamped with a details
+// disclosure under it, the right column is the family's grant toggle or a
+// state pill and never an accent fill, the submit door sits on the row, and
+// the figure band carries the numbers the page head used to say as prose; the
+// atlas keeps its nine semantic colours and puts every piece of chrome around
+// the scene in the shell's dialect — the panel is a .scroll, the view switch
+// the tab strip, the detail card a hairline panel with no shadow — and gains
+// an island index a keyboard or a phone can open.
+import test from 'node:test';
+import assert from 'node:assert/strict';
+import fs from 'node:fs';
+import path from 'node:path';
+import { fileURLToPath } from 'node:url';
+
+const ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
+const PUB = path.join(ROOT, 'modules', 'hall-ui', 'public');
+const read = (f) => fs.readFileSync(path.join(PUB, f), 'utf8').replace(/\r\n/g, '\n');
+// Negative pins read the code, not its comments (a comment that says what left
+// would otherwise fail the pin that says it left).
+const decomment = (src) => src.replace(/\/\*[\s\S]*?\*\//g, '').replace(/<!--[\s\S]*?-->/g, '').replace(/^\s*\/\/.*$/gm, '');
+const STYLE = read('style.css');
+const OVERSIGHT = read('oversight.css');
+const tokensDefined = (css, where) => {
+  for (const t of new Set([...css.matchAll(/var\((--[a-z0-9-]+)\)/g)].map((m) => m[1]))) {
+    const declared = (src) => new RegExp(`(^\\s*|[{;]\\s*)${t}:`, 'm').test(src);
+    assert.ok(declared(STYLE) || declared(OVERSIGHT) || declared(css),
+      `${where} spends ${t}, which neither style.css, oversight.css nor the sheet itself defines`);
+  }
+};
+const noAlias = (rawCss, where) => {
+  const css = decomment(rawCss);
+  const alias = css.match(/--(surface|surface-2|border|border-strong|accent-weak|accent-text)\b/g) || [];
+  assert.deepEqual(alias, [], `${where} spends a compat alias: ${alias.join(', ')}`);
+};
+
+// ---- modules ----------------------------------------------------------------
+
+test('modules: ONE panel of family rows — the filter bar, the figure band and two groups on one .scroll', () => {
+  const html = read('modules.html');
+  assert.match(html, /<link rel="stylesheet" href="\/builders\/oversight\.css">\s*<link rel="stylesheet" href="\/builders\/modules\.css">/, 'the family sheet loads before the page sheet');
+  assert.equal((html.match(/class="scroll[ "]/g) || []).length, 1, 'one panel, not three');
+  assert.match(html, /<div id="mod-filters"><\/div>/, 'the kit filter bar has a mount');
+  assert.match(html, /class="ov-figs" id="mod-figs"/, 'the figure band is the family\'s');
+  assert.match(html, /<ul class="ov-rows" id="core-grid">/, 'the core catalog is a run of rows');
+  assert.match(html, /<ul class="ov-rows" id="own-grid">/, 'the project\'s own modules are a run of rows');
+  assert.equal((html.match(/class="ov-group__head"/g) || []).length, 2, 'two group heads');
+  assert.doesNotMatch(decomment(html), /mod-grid|mod-card|mod-browse|submit-scroll|class="settings-status"/, 'the card grid, the boxed search and the third panel are gone');
+  assert.doesNotMatch(html, /\d+ module\(s\)/, 'the page head no longer says the numbers as prose');
+});
+
+test('modules: the row is the oversight row — title with the mono key, clamped description, facts, one control on the right', () => {
+  const js = read('modules.js');
+  assert.match(js, /<li class="ov-row mod-row" data-key=/, 'each module is an .ov-row');
+  assert.match(js, /<span class="ov-row__title">\$\{escapeHtml\(m\.title \|\| m\.key\)\}<span class="ov-mono">\$\{escapeHtml\(m\.key\)\}<\/span>/, 'the key rides inside the title in mono');
+  assert.match(js, /class="ov-row__sub mod-row__desc"/, 'the description is the sub line');
+  assert.match(js, /<details class="mod-more"/, 'a details disclosure opens the rest');
+  assert.match(js, /<div class="ov-row__facts">\$\{provenancePill\(m\)\}\$\{attributionFacts\(m\)\}\$\{upkeepFact\(m\)\}<\/div>/, 'provenance, credit and upkeep are the facts line');
+  assert.match(js, /<div class="ov-row__right mod-row__right">\$\{rightHtml\(m\)\}<\/div>/, 'the right column is one function');
+  const css = read('modules.css');
+  assert.match(css, /\.mod-row__desc \{[^}]*-webkit-line-clamp: 2/, 'the description clamps to two lines');
+  assert.match(css, /\.mod-row:has\(\.mod-more\[open\]\) \.mod-row__desc/, 'and lifts the clamp while the details are open');
+  assert.doesNotMatch(decomment(js), /class="mod-chip|innerHTML = .*style=|<span style=/, 'no .mod-chip, no inline style');
+});
+
+test('modules: the switch is the family grant toggle or a state pill — never an accent fill, never a dead control', () => {
+  const js = read('modules.js');
+  assert.match(js, /class="ov-toggle mod-toggle" aria-pressed=/, 'the toggle is .ov-toggle with aria-pressed');
+  assert.match(js, /: `<span class="fact-pill \$\{on \? 'fact-pill--ok' : ''\}"/, 'a viewer below the floor sees the state as a pill');
+  assert.match(js, /rankLabel\('metic'\)/, 'the floor is written from the pack');
+  assert.doesNotMatch(js, /Metic\+/, 'and never as a hardcoded rank');
+  const css = decomment(read('modules.css'));
+  assert.doesNotMatch(css, /background:\s*var\(--accent\)/, 'no accent fill on a state');
+  assert.doesNotMatch(css, /button\.mod-toggle|\[data-on=/, 'the old accent-filled toggle is gone');
+  assert.match(js, /class="btn-ghost btn--sm mod-submit" data-submit-key=/, 'the submit door is a ghost pill on the row');
+});
+
+test('modules: upkeep colours the exception — undeclared is the warn pill, maintained a plain fact', () => {
+  const js = read('modules.js');
+  assert.match(js, /fact-pill fact-pill--warn"[^>]*>upkeep undeclared</, 'undeclared upkeep is the warn pill');
+  assert.match(js, /<span class="ov-fact">upkeep <b>\$\{escapeHtml\(status\)\}<\/b><\/span>/, 'a maintained module reads as a plain fact');
+  assert.match(js, /fact-pill fact-pill--info">core-loaded</, 'core-loaded is the info pill');
+  assert.match(js, /<span class="fact-chip">\$\{escapeHtml\(m\.license\)\}<\/span>/, 'the licence is a chip');
+});
+
+test('modules: the kit filter bar carries the search and a state lens, and the empty state is the kit\'s', () => {
+  const js = read('modules.js');
+  assert.match(js, /kit\.makeFilterBar\(\{/, 'the bar is the kit\'s');
+  assert.match(js, /search: \{ id: 'mod-search'/, 'the search keeps its id (the states file fills it)');
+  assert.match(js, /\{ id: 'mod-state', label: 'State'/, 'a state lens');
+  assert.match(js, /kit\.emptyStateHtml\(/, 'empties are the kit\'s');
+  assert.doesNotMatch(decomment(js), /mod-empty/, '.mod-empty is gone');
+  const html = read('modules.html');
+  assert.match(html, /<script src="\/builders\/hall-kit\.js"><\/script>/, 'and the page loads the kit');
+});
+
+test('modules: the figure band carries modules, enabled, built here and undeclared upkeep', () => {
+  const js = read('modules.js');
+  for (const label of ['modules', 'enabled', 'built here', 'no upkeep']) {
+    assert.match(js, new RegExp(`fig\\('${label}'`), `figure: ${label}`);
+  }
+});
+
+test('modules.css spends only the fifteen, and every token it names exists', () => {
+  const css = read('modules.css');
+  noAlias(css, 'modules.css');
+  tokensDefined(css, 'modules.css');
+  assert.doesNotMatch(decomment(css), /#[0-9a-f]{3,8}\b/i, 'no literal colours');
+});
+
+test('the shell no longer aliases .mod-chip onto the pill', () => {
+  const alias = STYLE.slice(STYLE.indexOf('.fact-pill,\n'), STYLE.indexOf('{', STYLE.indexOf('.fact-pill,\n')));
+  assert.doesNotMatch(alias, /mod-chip/, 'modules takes .fact-pill by name');
+});
+
+// ---- atlas ------------------------------------------------------------------
+
+test('atlas: the nine semantic colours stay fixed literals, and nothing else in the sheet is one', () => {
+  const css = read('atlas.css');
+  for (const t of ['--ab-sun', '--ab-sky', '--ab-coral', '--ab-paper', '--ab-good', '--ab-core', '--ab-db', '--ab-ghost', '--ab-danger']) {
+    assert.match(css, new RegExp(`${t}:#[0-9a-f]{6}`), `${t} is a fixed literal (ADR 0094)`);
+  }
+  const rest = decomment(css).replace(/--ab-(sun|sky|coral|paper|good|core|db|ghost|danger):#[0-9a-f]{6}/g, '');
+  assert.deepEqual(rest.match(/#[0-9a-f]{3,8}\b/gi) || [], [], 'no other literal colour');
+  noAlias(css, 'atlas.css');
+  tokensDefined(css, 'atlas.css');
+  assert.doesNotMatch(rest, /box-shadow/, 'no box-shadow: the world draws depth with hairlines');
+});
+
+test('atlas: the panel is the shell\'s .scroll and the view switch is the shell\'s tab strip', () => {
+  const html = read('atlas.html');
+  assert.match(html, /<section class="scroll atlas-page"/, 'the map sits on a .scroll');
+  assert.match(html, /<div class="kit-tabs ab-views" role="tablist"/, 'the view switch is .kit-tabs');
+  assert.equal((html.match(/class="setup__tab" role="tab" data-view=/g) || []).length, 2, 'two tabs');
+  assert.doesNotMatch(decomment(html), /ab-modes|ab-chip"|class="card"/, 'the segmented box, the live chip and the empty card are gone');
+  const css = decomment(read('atlas.css'));
+  assert.doesNotMatch(css, /\.ab-modes|\.ab-chip\b|radial-gradient|\.ab-empty \.card/, 'and their rules with them');
+  const js = read('atlas.js');
+  assert.match(js, /setAttribute\('aria-selected'/, 'the script switches the tabs by aria-selected');
+  assert.doesNotMatch(decomment(js), /classList\.toggle\('active'/, 'not by an .active class');
+});
+
+test('atlas: the detail card is a hairline panel whose facts are the shell\'s pills and chips, and a neighbour is a door', () => {
+  const css = read('atlas.css');
+  assert.match(css, /\.ab-popup\{[^}]*border:var\(--line\) solid var\(--rule\)/, 'the card closes on one rule hairline');
+  const js = read('atlas.js');
+  assert.match(js, /fact-pill fact-pill--' \+ \(PILL\[n\.badge\.k\]/, 'the badge is a status pill');
+  assert.match(js, /<span class="fact-chip">' \+ esc\(n\.metric\)/, 'the metric is a chip');
+  assert.match(js, /<button type="button" class="fact-chip ab-jump" data-node=/, 'a connected island is a button');
+  assert.doesNotMatch(decomment(js), /ab-chip2|ab-badge ab-b-|↔/, 'the glass chips, the private badges and the arrow glyph are gone');
+  assert.match(js, /ev\.key === 'Escape'/, 'Escape closes the card');
+});
+
+test('atlas: the island index renders every node of the view as a row a keyboard can open', () => {
+  const html = read('atlas.html');
+  assert.match(html, /<details class="kit-collapse ab-index" id="ab-index">/, 'the index is a collapsible under the map');
+  assert.match(html, /<ul class="ov-rows" id="ab-index-rows"><\/ul>/, 'its rows are the family\'s');
+  const js = read('atlas.js');
+  assert.match(js, /function drawIndex\(d\)/, 'the index is drawn per view');
+  assert.match(js, /<li class="ov-row ov-row--dense ab-ix" data-node=/, 'each island is a dense row');
+  assert.match(js, /class="ov-row__title ab-ix__t" aria-expanded="false" aria-controls=/, 'the title is a disclosure button');
+  assert.match(js, /body\.innerHTML = detailHTML\(nodeById\(id\)\)/, 'and opens the same detail the map\'s card shows');
+  assert.match(js, /matchMedia\('\(max-width: 640px\)'\)\.matches\) indexEl\.open = true/, 'open by default on a phone, where the index is the read');
+  assert.match(js, /drawIndex\(d\);/, 'drawn on every render');
+});
+
+test('atlas: the hub breathes at the world\'s ambient floor, not as a pulse', () => {
+  const css = read('atlas.css');
+  const m = css.match(/animation:abbreathe (\d+)s/);
+  assert.ok(m && Number(m[1]) >= 20, 'the loop is 20s or slower');
+});
+
+test('the states files exercise the redesign\'s new states', () => {
+  const mod = JSON.parse(read('modules.states.json'));
+  for (const s of ['browse', 'search-empty', 'lens', 'details', 'out']) assert.ok(mod.states[s], `modules: ${s}`);
+  const atlas = JSON.parse(read('atlas.states.json'));
+  for (const s of ['map', 'truth', 'detail', 'index', 'out']) assert.ok(atlas.states[s], `atlas: ${s}`);
+});

package/tests/module_api.mjs

@@ -33,6 +33,7 @@ const PUBLISHED_SURFACE = [
   'llmCache', // BV1.R73: shared LLM-cost cache (1.6.0; tracked domain leak)
   'llmPricing', // BV1.R77: shared token→USD pricing (1.7.0; tracked domain leak — economy carve)
   'branding', 'clientBranding', 'userAgent', 'resolveEnv', 'readConfigFileSync', 'configHome', 'configPath', // userAgent added 1.12.0 (BV1.R86; github-push UA)
+  'resolveStaleClaimHours', 'staleClaimMinutes', // added by task 1003476 (ADR 0226; goal 1000072): the PROJECT's stale-claim timer — the sweep that releases a silent claim and the Archon roster that reports one read the same number through here, after eighteen hours of disagreeing (6 vs 24)
   'joinabilityMode', // added by task 1003044 (ADR 0194; the carrier after 1.19.374): the project's membership door, one reader for the sign-in gate AND the onboarding module's public POST
   'enabledDisciplines', // BV1.R81: instance offered-disciplines (1.9.0; onboarding restock backstop)
   'registerProvider', 'hasProvider', 'resolve', 'resolveOptional', 'listPorts', 'verifyPortsSatisfied',

package/tests/onboarding_observability.mjs

@@ -248,7 +248,46 @@ await t('GET /builders/roster as archon → 200', async () => {
   });
   assert.equal(r.status, 200);
   assert.ok(Array.isArray(r.json?.builders));
-  assert.equal(r.json?.stale_hours, 24);
+  // The default is the PROJECT's stale-claim timer, not a number this route owns
+  // (task 1003476, goal 1000072). It used to assert a hardcoded 24 while the sweeper
+  // released at 6 — this assertion WAS the eighteen-hour lie, written down.
+  const timer = require('../src/stale-timer.js');
+  assert.equal(r.json?.stale_hours, timer.resolveStaleClaimHours().hours);
+  assert.equal(r.json?.stale_hours_source, 'default');
+});
+
+await t('GET /builders/roster → the timer follows the project env', async () => {
+  const prev = process.env.GDS_STALE_CLAIM_HOURS;
+  process.env.GDS_STALE_CLAIM_HOURS = '9';
+  try {
+    const r = await send({
+      port, method: 'GET', path: '/api/gds/builders/roster',
+      headers: { 'x-stub-builder-id': '1', 'x-stub-builder-rank': 'archon' },
+    });
+    assert.equal(r.json?.stale_hours, 9, 'resolved per request, not frozen at boot');
+    assert.equal(r.json?.stale_hours_source, 'env:GDS_STALE_CLAIM_HOURS');
+  } finally {
+    if (prev === undefined) delete process.env.GDS_STALE_CLAIM_HOURS;
+    else process.env.GDS_STALE_CLAIM_HOURS = prev;
+  }
+});
+
+await t('GET /builders/roster → a bad project timer degrades, it does not 500', async () => {
+  // The Archon opened this page to find the problem; 500-ing it hides the problem.
+  const prev = process.env.GDS_STALE_CLAIM_HOURS;
+  process.env.GDS_STALE_CLAIM_HOURS = 'six-ish';
+  try {
+    const r = await send({
+      port, method: 'GET', path: '/api/gds/builders/roster',
+      headers: { 'x-stub-builder-id': '1', 'x-stub-builder-rank': 'archon' },
+    });
+    assert.equal(r.status, 200);
+    assert.equal(r.json?.stale_hours, 6);
+    assert.match(String(r.json?.stale_hours_source), /^default \(invalid GDS_STALE_CLAIM_HOURS="six-ish"/);
+  } finally {
+    if (prev === undefined) delete process.env.GDS_STALE_CLAIM_HOURS;
+    else process.env.GDS_STALE_CLAIM_HOURS = prev;
+  }
 });
 
 await t('GET /builders/roster?stale_hours=48 → echoes 48', async () => {
@@ -258,6 +297,7 @@ await t('GET /builders/roster?stale_hours=48 → echoes 48', async () => {
   });
   assert.equal(r.status, 200);
   assert.equal(r.json?.stale_hours, 48);
+  assert.equal(r.json?.stale_hours_source, 'query', 'a lens is labelled as a lens');
 });
 
 await t('GET /builders/roster?stale_hours=0 → 400', async () => {

package/tests/stale_timer.mjs

@@ -0,0 +1,230 @@
+// tests/stale_timer.mjs — one project, one stale-claim timer
+// (task 1003476, goal 1000072, criterion legibility-sort-and-staleness).
+//
+// THE BUG THIS PINS. "How long may a claim go silent" had three answers living in
+// three files, and nothing made them meet: the sweeper that actually releases claims
+// read GDS_STALE_CLAIM_HOURS (default 6h), the Archon roster that REPORTS staleness
+// hardcoded 24h, and the two session-pulse SQL helpers defaulted to 30 minutes. The
+// visible failure was the eighteen-hour lie: for most of a day after a claim had been
+// auto-released, tagged [auto-released:stale] and handed back to the queue, the roster
+// an Archon opens to decide whether to intervene still showed it healthy.
+//
+// So these assertions are mostly about SAMENESS — that no surface carries its own
+// number — plus the one place the two kinds of caller must legitimately differ: a
+// misconfigured timer makes the READ-ONLY roster degrade and say so, and makes the
+// DESTRUCTIVE sweeper refuse to run at all.
+//
+// Run:  node tests/stale_timer.mjs
+import assert from 'node:assert/strict';
+import fs from 'node:fs';
+import path from 'node:path';
+import { fileURLToPath } from 'node:url';
+import { createRequire } from 'node:module';
+import { makeRunner } from './helpers.mjs';
+
+const require = createRequire(import.meta.url);
+const ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
+const read = (rel) => fs.readFileSync(path.join(ROOT, rel), 'utf8');
+const st = require(path.join(ROOT, 'src/stale-timer.js'));
+
+const PULSE_CLI = read('scripts/gds/pulse.js');
+const PULSE_LIB = read('modules/sessions/pulse.js');
+const DB_SHIP = read('modules/lifecycle/db-ship.js');
+const ROSTER_ROUTE = read('src/bongos/routes/builders.js');
+const FITNESS = read('scripts/gds/fitness.js');
+const DOORWAY = read('src/module-api.js');
+
+const { test, summary } = makeRunner();
+
+// ---------------------------------------------------------------------------
+// 1. The resolver itself — executed, not described.
+// ---------------------------------------------------------------------------
+
+await test('no env, no override → the sweep default, labelled', () => {
+  const r = st.resolveStaleClaimHours({ env: {} });
+  assert.equal(r.hours, st.DEFAULT_STALE_CLAIM_HOURS);
+  assert.equal(r.hours, 6, 'the default is the SWEEP\'s historical 6h — the surface that acts');
+  assert.equal(r.source, 'default');
+  assert.equal(r.invalid, null);
+});
+
+await test('the live prod env var still resolves — legacy GDS_ prefix honoured', () => {
+  // Nothing in the running deployment may have to change for this to keep working:
+  // instance-config's legacy prefix chain is what carries GDS_STALE_CLAIM_HOURS.
+  const r = st.resolveStaleClaimHours({ env: { GDS_STALE_CLAIM_HOURS: '12' } });
+  assert.equal(r.hours, 12);
+  assert.equal(r.source, 'env:GDS_STALE_CLAIM_HOURS');
+  assert.equal(r.invalid, null);
+});
+
+await test('the branded prefix wins over the legacy one', () => {
+  const r = st.resolveStaleClaimHours({
+    env: { CLOUDBONGOS_STALE_CLAIM_HOURS: '3', GDS_STALE_CLAIM_HOURS: '12' },
+  });
+  assert.equal(r.hours, 3);
+  assert.equal(r.source, 'env:CLOUDBONGOS_STALE_CLAIM_HOURS');
+});
+
+await test('an override is a LENS — it never becomes the project answer', () => {
+  const env = { GDS_STALE_CLAIM_HOURS: '12' };
+  assert.equal(st.resolveStaleClaimHours({ override: '48', env }).hours, 48);
+  assert.equal(st.resolveStaleClaimHours({ override: '48', env }).source, 'override');
+  // asking again without the lens gives the project's number back, unchanged
+  assert.equal(st.resolveStaleClaimHours({ env }).hours, 12);
+});
+
+await test('an empty override falls through rather than resolving to 0', () => {
+  for (const override of ['', null, undefined]) {
+    const r = st.resolveStaleClaimHours({ override, env: { GDS_STALE_CLAIM_HOURS: '12' } });
+    assert.equal(r.hours, 12, `override=${JSON.stringify(override)} must not shadow the env`);
+  }
+});
+
+await test('an unusable value REPORTS instead of throwing, and never returns a bad number', () => {
+  for (const [raw, reason] of [['nope', 'not a number'], ['0', 'must be positive'], ['-4', 'must be positive'], ['9999', 'out of range (1..720)']]) {
+    const r = st.resolveStaleClaimHours({ env: { GDS_STALE_CLAIM_HOURS: raw } });
+    assert.equal(r.hours, st.DEFAULT_STALE_CLAIM_HOURS, `${raw} must fall back`);
+    assert.equal(r.source, 'default');
+    assert.ok(r.invalid, `${raw} must be reported as invalid`);
+    assert.equal(r.invalid.where, 'env');
+    assert.equal(r.invalid.varName, 'GDS_STALE_CLAIM_HOURS');
+    assert.equal(r.invalid.raw, raw);
+    assert.equal(r.invalid.reason, reason);
+  }
+});
+
+await test('the bound is the one GET /builders/roster already published (1..720)', () => {
+  assert.equal(st.MIN_STALE_CLAIM_HOURS, 1);
+  assert.equal(st.MAX_STALE_CLAIM_HOURS, 720);
+  assert.equal(st.resolveStaleClaimHours({ env: { GDS_STALE_CLAIM_HOURS: '720' } }).hours, 720);
+  assert.ok(st.resolveStaleClaimHours({ env: { GDS_STALE_CLAIM_HOURS: '721' } }).invalid);
+});
+
+await test('describeStaleTimer names the number AND its provenance', () => {
+  assert.equal(st.describeStaleTimer(st.resolveStaleClaimHours({ env: {} })), '6h (default)');
+  assert.equal(
+    st.describeStaleTimer(st.resolveStaleClaimHours({ env: { GDS_STALE_CLAIM_HOURS: '12' } })),
+    '12h (env:GDS_STALE_CLAIM_HOURS)'
+  );
+  const bad = st.describeStaleTimer(st.resolveStaleClaimHours({ env: { GDS_STALE_CLAIM_HOURS: 'nope' } }));
+  assert.match(bad, /^6h \(default\)/);
+  assert.match(bad, /ignoring GDS_STALE_CLAIM_HOURS="nope" \(not a number\)/);
+});
+
+await test('hours→minutes happens in ONE place and never rounds to zero', () => {
+  assert.equal(st.staleClaimMinutes(6), 360);
+  assert.equal(st.staleClaimMinutes(1), 60);
+  assert.equal(st.staleClaimMinutes(0.001), 1, 'a sub-minute timer must still be a minute, not 0');
+  assert.throws(() => st.staleClaimMinutes(0), /positive/);
+  assert.throws(() => st.staleClaimMinutes('x'), /positive/);
+});
+
+// ---------------------------------------------------------------------------
+// 2. Sameness — no surface carries its own number any more.
+// ---------------------------------------------------------------------------
+
+await test('the three old hardcoded defaults are gone from their files', () => {
+  assert.ok(!/thresholdMin = 30\b/.test(PULSE_LIB),
+    'modules/sessions/pulse.js must not default to a third number (30 min)');
+  assert.ok(!/staleHours = 24\b/.test(DB_SHIP),
+    'getBuildersRoster must not default to its own 24h');
+  assert.ok(!/let staleHours = 24\b/.test(ROSTER_ROUTE),
+    'GET /builders/roster must not default to its own 24h');
+});
+
+await test('every staleness surface resolves through the one timer', () => {
+  assert.match(PULSE_CLI, /require\('\.\.\/\.\.\/src\/stale-timer'\)/,
+    'the sweeper CLI must read the shared timer');
+  assert.match(PULSE_LIB, /resolveStaleClaimHours/,
+    'the session-pulse SQL helpers must default to the shared timer');
+  assert.match(DB_SHIP, /api\.resolveStaleClaimHours\(\)/,
+    'getBuildersRoster must default to the shared timer');
+  assert.match(ROSTER_ROUTE, /require\('\.\.\/\.\.\/stale-timer'\)/,
+    'the roster route must read the shared timer');
+});
+
+await test('the sweeper no longer reads the env var itself', () => {
+  // The precedence has ONE home. A second reader is how 6-vs-24 happened.
+  assert.ok(!/process\.env\.GDS_STALE_CLAIM_HOURS/.test(PULSE_CLI),
+    'scripts/gds/pulse.js must not re-read GDS_STALE_CLAIM_HOURS directly');
+});
+
+await test('an explicit argument still overrides at every layer', () => {
+  // The lens must survive: an Archon asking "what would 48h show me?" and an
+  // operator sweeping at a one-off threshold both depend on it.
+  assert.match(PULSE_LIB, /thresholdMin \?\? projectThresholdMin\(\)/);
+  assert.match(DB_SHIP, /staleHours \?\? api\.resolveStaleClaimHours\(\)/);
+  assert.match(ROSTER_ROUTE, /stale_hours != null/);
+});
+
+// ---------------------------------------------------------------------------
+// 3. The asymmetric fail posture: reporting degrades, enforcement refuses.
+// ---------------------------------------------------------------------------
+
+await test('the SWEEP refuses to run on a timer it cannot read', () => {
+  // It releases other people's claims and stamps their session logs. A reload does
+  // not undo that, so guessing is not an option available to it.
+  assert.match(PULSE_CLI, /refusing to sweep on a timer this project cannot read/);
+  const fn = PULSE_CLI.slice(PULSE_CLI.indexOf('function parseThresholdHours'));
+  const body = fn.slice(0, fn.indexOf('\n}\n') + 3);
+  assert.match(body, /if \(resolved\.invalid\)/, 'the refusal must key off the resolver verdict');
+  assert.match(body, /throw new Error/);
+});
+
+// The helper both Archon staleness reads go through.
+const HELPER = (() => {
+  const from = ROSTER_ROUTE.indexOf('function staleHoursFor(req, res)');
+  assert.ok(from > 0, 'the shared helper must exist');
+  return ROSTER_ROUTE.slice(from, ROSTER_ROUTE.indexOf('\n}\n', from) + 3);
+})();
+
+await test('the ROSTER degrades to the default and names the bad value', () => {
+  // 500-ing the roster an Archon opened to find the problem would hide the problem.
+  assert.match(HELPER, /default \(invalid \$\{timer\.invalid\.varName\}/);
+  assert.ok(!/throw/.test(HELPER), 'the roster helper must not throw on a bad timer');
+  assert.match(HELPER, /res\.fail\('bad_stale_hours', 400/,
+    'only an explicitly BAD query param is a 400 — never a bad project timer');
+});
+
+await test('BOTH Archon staleness reads report the number and its provenance', () => {
+  // Two routes, one helper. Before this they were two byte-identical copies of a
+  // hardcoded 24, which is exactly how a second copy drifts into a second policy.
+  const calls = [...ROSTER_ROUTE.matchAll(/= staleHoursFor\(req, res\)/g)];
+  assert.equal(calls.length, 2, 'the roster and its expand view both go through the helper');
+  assert.match(ROSTER_ROUTE, /res\.json\(\{ builders, stale_hours: stale\.hours, stale_hours_source: stale\.source \}\)/);
+  assert.match(ROSTER_ROUTE, /res\.json\(\{ builder_id: targetId, claims, stale_hours: stale\.hours, stale_hours_source: stale\.source \}\)/);
+  assert.match(HELPER, /source: 'query'/, 'a lens must be labelled as a lens');
+});
+
+await test('the expand view cannot disagree with the roster it expands from', () => {
+  assert.ok(!/staleHours = 24\b/.test(ROSTER_ROUTE), 'no route may keep its own 24');
+  assert.ok(!/staleHours = 24\b/.test(DB_SHIP), 'no db helper may keep its own 24');
+  assert.match(DB_SHIP, /staleHours \?\? api\.resolveStaleClaimHours\(\)\.hours/);
+  const both = [...DB_SHIP.matchAll(/staleHours \?\? api\.resolveStaleClaimHours\(\)\.hours/g)];
+  assert.equal(both.length, 2, 'getBuildersRoster AND getActiveClaimsForBuilderWithStale');
+});
+
+// ---------------------------------------------------------------------------
+// 4. The boundary the new kernel file has to keep.
+// ---------------------------------------------------------------------------
+
+await test('src/stale-timer.js is on the KERNEL_FILES roster', () => {
+  // The doorway (itself a KERNEL_FILE) re-exports it, so leaving it off would read as
+  // a kernel→non-kernel leak and red the build on Check 12.
+  const roster = FITNESS.slice(FITNESS.indexOf('const KERNEL_FILES = ['));
+  assert.match(roster.slice(0, roster.indexOf('];')), /'src\/stale-timer\.js'/);
+});
+
+await test('the timer imports only the kernel', () => {
+  const src = read('src/stale-timer.js');
+  const specs = [...src.matchAll(/require\('([^']+)'\)/g)].map((m) => m[1]);
+  assert.deepEqual(specs, ['./instance-config'],
+    'a kernel file may depend only on the kernel — keep this list boring');
+});
+
+await test('the doorway hands modules the timer, not the raw env', () => {
+  assert.match(DOORWAY, /resolveStaleClaimHours: staleTimer\.resolveStaleClaimHours/);
+  assert.match(DOORWAY, /staleClaimMinutes: staleTimer\.staleClaimMinutes/);
+});
+
+summary();