@bongos/core 1.19.470 → 1.19.472

package/.bongos-core.json

@@ -2,22 +2,22 @@
   "artifact": "bongos-core",
   "manifest_schema": 1,
   "generator": "scripts/gds/package-core.js",
-  "core_version": "1.19.470",
-  "core_contract": "1.19.470",
-  "source_commit": "dd9b08fd3b05ca54600d1cd9beaa771be0d8568d",
+  "core_version": "1.19.472",
+  "core_contract": "1.19.472",
+  "source_commit": "6b69181019333048f1fcb17d03f9d04b6b098fb5",
   "source_ref": "HEAD",
-  "built_at": "2026-09-02T14:48:18.482Z",
+  "built_at": "2026-09-02T15:04:57.327Z",
   "redaction": {
     "model": "docs-redacted+functional-verbatim",
-    "docs_redacted": 410,
+    "docs_redacted": 411,
     "agent_docs_stubbed": 24,
-    "functional_verbatim": 1831,
+    "functional_verbatim": 1833,
     "rules": 3,
     "gate_literals": 3,
     "gate": "passed"
   },
-  "file_count": 2265,
-  "tree_sha256": "669cadea9cb3ee85a8d995e4fd24179814f5b8475b753e228d71446493c85800",
+  "file_count": 2268,
+  "tree_sha256": "d824d0535e867ee19410330bc863104779eab940c7a8403f755f98805c928072",
   "files": [
     {
       "path": ".claude/skills/blocker-review/SKILL.md",
@@ -382,7 +382,7 @@
     {
       "path": "clients/bongos-client/index.d.ts",
       "mode": "0000644",
-      "sha256": "2bce52b8070cda294371da71931bc7edde4fe431d99f06221d31c23d083e74d7"
+      "sha256": "6e1ae5c410c8796df7efcdcd9cbd0ccebe1075da8bc18d503c50196d0e7db683"
     },
     {
       "path": "clients/bongos-client/index.mjs",
@@ -1634,6 +1634,11 @@
       "mode": "0000644",
       "sha256": "f9f3a0b8ebe2d161e17e1c632bbbda71842c9476958294330420f28c6301f7db"
     },
+    {
+      "path": "docs/adr/0226-one-stale-timer-reporting-degrades-enforcement-refuses.md",
+      "mode": "0000644",
+      "sha256": "a3a854a3d04095c04abbe31239aa9931a482a6720d4a04077481e08d6deb6845"
+    },
     {
       "path": "docs/adr/0227-a-task-network-map-is-refused-the-goal-graph-is-the-map.md",
       "mode": "0000644",
@@ -1642,7 +1647,7 @@
     {
       "path": "docs/adr/README.md",
       "mode": "0000644",
-      "sha256": "4c6f66d10d34f4c1c1e0ab6376868281b87e28a9f3b16ccfb75fafc004dcf8e2"
+      "sha256": "93a49ca61bb1ea3e3bf9c3325bcae8b174278c8504fb1cc993c03d87bb6ba2f5"
     },
     {
       "path": "docs/api-reference.md",
@@ -1652,7 +1657,7 @@
     {
       "path": "docs/api/openapi.json",
       "mode": "0000644",
-      "sha256": "1e2b837a69669de3f76f189b3b868dbfc67c41cb7a5bbd773b465fa82a4e0cb2"
+      "sha256": "fa675542b54c8bbd96530ecaac630deaf9873cc9091714eb9fde660e5af2ad4e"
     },
     {
       "path": "docs/architecture.md",
@@ -2132,7 +2137,7 @@
     {
       "path": "docs/module-api-changelog.md",
       "mode": "0000644",
-      "sha256": "8149596860cbbf60448d12ec3c229ee62cd7eb63524235a3464f68cb260b3c15"
+      "sha256": "901d3e0044c9b6f0437df6424de404e6d367a0e2dceb7226eb3b1c4df7d906b8"
     },
     {
       "path": "docs/modules-contract.md",
@@ -4557,7 +4562,7 @@
     {
       "path": "modules/hall-ui/public/task-lib.js",
       "mode": "0000644",
-      "sha256": "dde9fe5cc1d80829c45aa6ef4f486697345a122cf0a7054991b7c7ebc390754f"
+      "sha256": "3efb1199b1fc3c979b1c3aaa23d817241b48104dd1dfd40cbc20ed80b1a971cc"
     },
     {
       "path": "modules/hall-ui/public/task.css",
@@ -4782,7 +4787,7 @@
     {
       "path": "modules/lifecycle/db-ship.js",
       "mode": "0000644",
-      "sha256": "0a313d9c20cc0da5952e3a5acbca83cd1fd3df7ecccbbd109701d865b4dd2fe6"
+      "sha256": "d300392b7bf802d00ae79c55ad3b0d9413dc9bb56e7e1105f49656b39abb874a"
     },
     {
       "path": "modules/lifecycle/db-tasks.js",
@@ -6227,7 +6232,7 @@
     {
       "path": "modules/sessions/pulse.js",
       "mode": "0000644",
-      "sha256": "0f9f0a412b4560dd20bc3e15d8160d991b276f5e3a6e2ba3b752a322bef78e4c"
+      "sha256": "50e7009581961fc1c29cfead85f8d4278e948bfc2a43d5c6b3eaf4e7821ca1af"
     },
     {
       "path": "modules/sessions/routes/sessions.js",
@@ -6662,12 +6667,12 @@
     {
       "path": "package-lock.json",
       "mode": "0000644",
-      "sha256": "d31730b3e97acb3c865e52501b03d403acfb927f3107e3f605323e17945e0bf0"
+      "sha256": "9950b1cf51f93769fdfe48d5001b54bb1274cc4359988e0a2ec98865fe551be0"
     },
     {
       "path": "package.json",
       "mode": "0000644",
-      "sha256": "533ce05335a427241e42414979e9c01c7c7df1f446959ffe2a70beae4f8089a7"
+      "sha256": "2c9a8851c9bfeaa466c27bc933049734fcde9b77ce276bf2604882a0feff20b7"
     },
     {
       "path": "public-docs/index.html",
@@ -7097,7 +7102,7 @@
     {
       "path": "scripts/gds/fitness.js",
       "mode": "0000644",
-      "sha256": "ec823ee34e55318a1bee8008658fe44c24158e43a3736065312ae931d0bab796"
+      "sha256": "a7322e6d2510bee2780ca76c68a1c46e7d771cd6675b5f4c223adcf8e001a6c5"
     },
     {
       "path": "scripts/gds/gate-review.js",
@@ -7447,7 +7452,7 @@
     {
       "path": "scripts/gds/pulse.js",
       "mode": "0000644",
-      "sha256": "0165d2b4c0f48e59f506e43ea0c8252fed81f2799aa14df0c4624097322dd636"
+      "sha256": "21cf8741c5e046f61fbe94164d348d476f41bd45cac62c72609580032b1244ba"
     },
     {
       "path": "scripts/gds/push-main.js",
@@ -8217,7 +8222,7 @@
     {
       "path": "src/bongos/routes/builders.js",
       "mode": "0000644",
-      "sha256": "dc71324e4a1357f86b7e5a66c64ca5b38a2c79ef58c6d7a6f7337a23cfa1ee60"
+      "sha256": "0d27bd6e4db13e9aae324efab98829480fed43abe615c5c56d8e707c6a3465d3"
     },
     {
       "path": "src/bongos/routes/github.js",
@@ -8322,7 +8327,7 @@
     {
       "path": "src/module-api.js",
       "mode": "0000644",
-      "sha256": "a5108ff620f06bbc05b7db97722319170c3fe6d5ce379524fe53b03ad0a137fb"
+      "sha256": "35edfe1acbfd33316d1bbc681817dc06af19336873acd4abe239af41efbc22f2"
     },
     {
       "path": "src/module-loader/catalog.js",
@@ -8364,6 +8369,11 @@
       "mode": "0000644",
       "sha256": "4ba8c3b2e17c2faa38a872fe679e0dc7d032e79e05eb7277d76736201311dcdd"
     },
+    {
+      "path": "src/stale-timer.js",
+      "mode": "0000644",
+      "sha256": "2e46d071e5c61d302f34507215dd0a5f20a0887841ae0f7b033be865c2cb8af5"
+    },
     {
       "path": "tests/abandon_task.mjs",
       "mode": "0000644",
@@ -10192,7 +10202,7 @@
     {
       "path": "tests/module_api.mjs",
       "mode": "0000644",
-      "sha256": "9b2394ce72e74a96460c6d9ef1cc2ee280dded85523fae2979d56a49fb514b85"
+      "sha256": "a4980667646d3a3dda1a67906d0735d8acf462989de937e3d342461b275e74eb"
     },
     {
       "path": "tests/module_catalog.mjs",
@@ -10302,7 +10312,7 @@
     {
       "path": "tests/onboarding_observability.mjs",
       "mode": "0000644",
-      "sha256": "2423b4de9df54cfe2d127d8b3983b05f8e5ec7c15f7b325b6e81931d31a51061"
+      "sha256": "973847bd475916e1418a8c70ff9c0f2a1186d55c31e0e8ba4f8b24fabb4c35dc"
     },
     {
       "path": "tests/onboarding_route_signals.mjs",
@@ -11079,6 +11089,11 @@
       "mode": "0000644",
       "sha256": "27bd2a87e001eec2bc58e13cfa58e53f88c73ebe7504b944c718182247d98ca7"
     },
+    {
+      "path": "tests/stale_timer.mjs",
+      "mode": "0000644",
+      "sha256": "770fb94ecdb37da2f7cf74b95d734b789cbbbd5414a97ae5275089302064a71d"
+    },
     {
       "path": "tests/stale_worktrees.mjs",
       "mode": "0000644",

package/clients/bongos-client/index.d.ts

@@ -31,12 +31,12 @@ export interface GetBoxSshKeyResponse { keys: unknown }
 export interface GetBoxTerminalResponse { state: unknown; url: unknown; credential: unknown; hint: unknown; warming_up?: boolean; terminal_at?: unknown }
 export interface GetBoxesResponse { boxes: unknown }
 export interface GetBuildersDirectoryResponse { builders: unknown }
-export interface GetBuildersIdActiveClaimsResponse { builder_id: unknown; claims: unknown; stale_hours: unknown }
+export interface GetBuildersIdActiveClaimsResponse { builder_id: unknown; claims: unknown; stale_hours: unknown; stale_hours_source: unknown }
 export interface GetBuildersIdActivityResponse { builder_id: unknown; section: unknown; role: unknown; rows: unknown; total: unknown }
 export interface GetBuildersIdOnboardingResponse { builder_id: unknown; onboarding: unknown }
 export interface GetBuildersIdProfileResponse { builder: unknown; shipped_count: unknown; recent_ships: unknown; achievements: unknown; cross_project?: unknown; handle?: unknown }
 export interface GetBuildersMePendingRankChangeResponse { change: unknown; greeting?: unknown }
-export interface GetBuildersRosterResponse { builders: unknown; stale_hours: unknown }
+export interface GetBuildersRosterResponse { builders: unknown; stale_hours: unknown; stale_hours_source: unknown }
 export interface GetClosenessForMeResponse { closeness: unknown; count: unknown }
 export interface GetClosenessWeightsResponse { weights: unknown; window_days: unknown; note: unknown }
 export interface GetClosenessWithBuilderIdResponse { closeness: unknown; why: unknown }

package/docs/adr/0226-one-stale-timer-reporting-degrades-enforcement-refuses.md

@@ -0,0 +1,121 @@
+# 0226 — One stale-claim timer; reporting degrades where enforcement refuses
+
+- **Status:** Accepted
+- **Date:** 2026-08-28
+- **Tasks:** [#1003476](https://cloudbongos.com/builders#/task/1003476)
+- **Goal:** [#1000072](https://cloudbongos.com/builders#/goal/1000072) — Human legibility, criterion `legibility-sort-and-staleness`.
+- **Builds on:** [#1003278](https://cloudbongos.com/builders#/task/1003278), which gave both work boards a shared *task* staleness vocabulary and left this one — the *claim* timer — named in a comment as the thing still to wire.
+- **Split out of:** [#1003279](https://cloudbongos.com/builders#/task/1003279) on 2026-09-02. This work was authored under that task’s claim, but it answers a different question than that task’s DONE WHEN: 1003279 is the needs-attention **inbox item** a stale *goal or task* raises (with the verbs prune / kill / prioritise / water), and §4 below records that the *task* staleness buckets and a settings knob were deliberately **rejected** as out of scope here. It ships under its own task so the ledger says what the diff does; 1003279 stays open for its inbox half.
+
+## 1. The problem: one question, four answers, none of them the project's
+
+"How long may a claim go silent before this project calls it abandoned" was
+answered independently in four places:
+
+| Surface | Number | Where it came from | What it does |
+|---|---|---|---|
+| `scripts/gds/pulse.js --release-stale` | **6h** | `GDS_STALE_CLAIM_HOURS`, else a literal `6` | **acts** — releases the claim, stamps the session log `[auto-released:stale]`, returns the task to `ready`, pings the builder |
+| `GET /builders/roster` → `getBuildersRoster` | **24h** | a literal, twice (route and db helper) | **reports** — the `stale_claim` flag on the Archon roster |
+| `GET /builders/:id/active-claims` → `<redacted>` | **24h** | a second, byte-identical literal | **reports** — which claim to target for release |
+| `sweepStaleClaims` / `getStaleClaimsForBuilder` | **30 min** | a default parameter | whatever an argument-less caller wanted |
+
+The 6-vs-24 pair is the one that hurt. The roster is the screen an Archon opens
+to decide whether to intervene, and for **eighteen hours** after the sweeper had
+already released a claim, tagged it and handed the task back to the queue, that
+screen still showed it healthy. Neither file is wrong when read alone — the
+roster's own comment even says it "mirrors the threshold the stale-claim-release
+sweeper uses", which was true of the *definition* and false of the *number*. A
+mirror that copies the shape and not the value is worse than no mirror: it reads
+as a guarantee.
+
+This is the shape goal 1000072 exists to close. A person steering an AI-run
+project is steering by what the surfaces tell them, so a surface that reports a
+different rule from the one the machine enforces is not a cosmetic defect.
+
+## 2. Decision
+
+**One resolver owns the timer, and every surface that reports or enforces
+staleness reads it.** `src/stale-timer.js` — a KERNEL file, in the same category
+as `instance-config.js` and `branding.js`: host configuration a module reads
+rather than hardcodes. Exposed to modules through the doorway
+(`api.resolveStaleClaimHours`), required directly by core routes and by the CLI.
+
+Precedence, widest scope last:
+
+1. **An explicit override** — `--threshold-hours`, `?stale_hours=N`. A *lens*, not
+   a reconfiguration: an Archon asking "what would 48h show me?" must not change
+   what the project does, and the response labels the answer `query` so the
+   distinction survives into the payload.
+2. **`<PREFIX>_STALE_CLAIM_HOURS`** — the project's configured timer, resolved
+   through `instance-config.resolveEnv`, whose legacy prefix chain still honours
+   the `GDS_STALE_CLAIM_HOURS` the live sweeper has always read. **Nothing in a
+   running deployment has to change for this to resolve to what it resolves to
+   today.** This is also the channel a platform-managed project already has: the
+   provisioning runner patches `web.env` in place and restarts ([ADR 0190](<redacted>.md)).
+3. **`6`** — the default. Deliberately the *sweeper's* historical number and not
+   the roster's 24: the sweeper is the surface that acts, and adopting 24 would
+   have quietly made every project three times more patient with a dead claim
+   while looking like a tidy-up.
+
+The bound is **1..720 hours** — not taste: `GET /builders/roster` has published
+`1..720` as its `stale_hours` contract since V3.R14, and one timer means one
+bound. (Sub-hour values were previously accepted by that route despite the
+published range; they are now rejected, consistent with what it always claimed.)
+
+**Every surface that prints the timer prints where it came from.** The sweep
+header and the auto-release note carry the source; both roster reads return
+`stale_hours_source`. A number with no provenance is precisely what let 6 and 24
+sit side by side in the ops log for a year.
+
+## 3. The part that is not obvious: the fail posture is asymmetric
+
+A misconfigured timer must not silently become a different policy. But the two
+kinds of caller cannot want the same thing from a bad value, so the resolver
+**reports** rather than throws, and each caller states its own posture:
+
+- **Reporting degrades.** A read-only surface takes the default and labels the
+  source `default (invalid <VAR>="…": …)`. A 500 here would take down the roster
+  an Archon opened *to find the problem*, and hide the typo behind an error page;
+  answering with the default and naming the bad value puts it on the screen of
+  the one person who can fix it.
+- **Enforcement refuses.** The sweep declines to run at all. It releases other
+  people's claims and stamps their session logs, and no reload undoes that — so
+  "probably 6" is not an answer it is allowed to give. An explicit
+  `--threshold-hours` that is unusable is likewise a usage error, as before.
+
+Stated as a rule: **a surface that only reads may guess and say so; a surface
+that acts may not guess.**
+
+## 4. What was rejected
+
+- **A new `config/stale.json` pair.** The env route already *is* the per-project
+  channel (the runner writes `web.env`), and a config file would have added a
+  fourth tier to a precedence whose whole point is that there is one place to
+  look.
+- **Making the roster's 24 the shared default.** It is the number nothing acted
+  on. Unifying on it changes real behaviour under cover of a refactor.
+- **Throwing from the resolver.** It would have forced the roster to either 500
+  or re-implement the fallback, which is a second reader — the original bug.
+- **Folding in the boards' 14/30/60-day task buckets.** A different question:
+  those are *days*, about a *task* going untouched, and they are a browsing lens
+  with no enforcement behind them. Two questions may have two vocabularies; only
+  one of them may be a number typed twice.
+- **A DB row + settings UI for the timer.** A reasonable next step, and out of
+  scope here: the defect was four numbers, not the absence of a knob. Adding a
+  row before the readers agreed would have produced a fifth.
+
+## 5. Consequences
+
+- `GET /builders/roster` and `GET /builders/:id/active-claims` gain
+  `stale_hours_source`; their default `stale_hours` changes from `24` to the
+  project timer (`6` unless configured). Additive to the payload; the default is
+  a **deliberate** behaviour change — it is the fix.
+- Both routes now share one `staleHoursFor(req, res)` helper. Two copies of a
+  literal is how the drift happened twice in one file.
+- `sweepStaleClaims` / `getStaleClaimsForBuilder` no longer have a number of
+  their own; an argument-less call means the project's timer, resolved per call
+  so an env change lands on the next sweep and not the next restart.
+- Pinned by `tests/stale_timer.mjs` (the resolver executed, the sameness of every
+  surface asserted, and both fail postures) plus the updated roster assertions in
+  `tests/onboarding_observability.mjs` — whose old `stale_hours === 24` line *was*
+  the eighteen-hour lie, written down as an expectation.

package/docs/adr/README.md

@@ -313,5 +313,6 @@ This keeps the decision history honest and traceable.
 | 0224 | [**Module-owned skills reach the core checkout as untracked, self-ignored copies with a manifest: the self-copy guard stays, the dev path is a flag, and the file map skips what the module documents** ([task 1003330](https://cloudbongos.com/builders#/task/1003330) · goal 1000083). `materializeClaude`'s self-copy guard is right (a core copying itself is a no-op at best), but Claude Code discovers only `.claude/skills/` at the project root, so a builder IN the core checkout could not invoke any of the nine ui-design skills written there. Decisions: **D1** `node scripts/gds/claude-materialize.js --module-skills-only [--dry-run] [--clean]` calls `materializeModuleSkillsIntoCore`: the same roster, gate and slug rule as step 1b, verbatim copies (no bongosify: the checkout runs `node scripts/gds/…`), a core-owned name kept, a disabled module's excluded; the guard untouched. **D2** untracked and self-ignored: a generated `.claude/skills/.module-skills.json` manifest and a `.gitignore` that ignores itself, the manifest and every materialised dir; each run removes what the last manifest named then lands the current set (byte-identical on repeat; a dropped declaration disappears); `--clean` stops after the removal. **D3** `gen-file-map.js` and `tests/file_map.mjs` skip materialised names by the manifest (a module skill is documented by its module's README, not by the notes sidecar). **D4** init from a checkout that carries the copies still lands them through step 1b, transformed, and never the dotfiles. **D5** pinned end to end in `tests/claude_materialize.mjs`. Rejected: dropping the guard; committing the copies; symlinks or junctions; notes for dirs not in the repository.](<redacted>.md) | materialiser / skills |
 | 0225 | [**Privacy suppresses cross-project surfaces only: a private builder still appears on their own project's roster** ([task 1003443](https://cloudbongos.com/builders#/task/1003443) · goal 1000075). The accepted privacy spec defined its two flags inconsistently for one case: `hide_stats` suppresses "everything derived from the CROSS-PROJECT rollup" (qualified, so an in-project leaderboard is out of scope) while `account_visibility: private` said "absent from search, LEADERBOARDS, sitemap" (unqualified, so it read as covering the in-project one too) — and PV2 demands "ONE shared predicate used by every public read: … leaderboards …" while `modules/economy/credits.js`'s `leaderboard()` is a bare `SELECT … FROM builders` with no join and no predicate. Read one way that is an unshipped PV2 violation in main; read the other it is correct, and nothing settled which. **Owner decision (2026-08-30): privacy suppresses CROSS-PROJECT surfaces only.** A `private` builder is absent from `/u/<handle>`, platform search, the sitemap, Explore and the recruiting reach, and still appears on the roster of a project they build on — a project's record of its own work is the project's business. Two consequences are the point of recording it: `credits.leaderboard()` is **correct as written** (adding a predicate there would be a regression, not a fix — exactly what a literal PV2 reading would have done), and PV2's "leaderboards" means the cross-project ones. The spec was amended rather than annotated: the D1 row and both `active · public` matrix rows now say *cross-project*, the two `active · private` rows drop "absent everywhere" (the file's most misreadable phrase) for "absent from every cross-project surface", PV2's ship-table row is qualified, and the boundary lands as the **third rule** under D2 beside "`hide_stats` beats everything". Rejected: making `private` hide a builder from projects they build on (it reads as more protective and breaks the ledger — a roster that omits contributors cannot show who built the thing, and credits would accrue to someone invisible on the surface explaining them); and leaving it as a dated spec note (it pins shipped code as deliberately predicate-free, which is an ADR's job).](<redacted>.md) | privacy / spec |
 | 0227 | [**A task network map is refused; the goal graph is the map, and search answers findability** ([task 1003282](https://cloudbongos.com/builders#/task/1003282) · goal 1000072, criterion `legibility-project-map`, which gates itself on this spike). Measured across a swept density range (p=2%–40% of tasks carrying a dependency): a node-link view of ~1,357 tasks is confetti, not structure, and densifying it draws forty goals badly while claiming to show a thousand tasks — a confident picture of nothing is the opposite of the legibility this goal serves. Decision: NO whole-corpus task map at any density; the readable surface is the ~40-node GOAL graph as the entry point with a per-goal DEPENDENCY FOREST as the drill-down, queried when a goal is opened rather than zoomed out of a global map. Every edge a map could draw already exists in the DB and none needs a new table — `task_dependencies` (020), `tasks.parent_task_id`, `tasks.goal_id`, `task_criteria`→`done_when_criteria`, `idea_inbox.promoted_to_task_id`, `idea_inbox.merged_into_idea_id` (`core_195`), `tasks.version_id` (membership, never an edge). **Findability (goal 1000027) answers the owner’s question more cheaply than a map**: the ask splits into “find what I was brainstorming”, which `/recall` (ADR 0060) plus the two lineage columns already answers end to end and which wants a text LINEAGE TRAIL — one thing and its ancestry — not a picture; and “see the shape of the portfolio”, the only half a graph earns, which is about ~40 goals and not about tasks. So the trail outranks the map and is sequenced first. Accessibility: the TABLE is the primary surface and the graph the enhancement (not an `aria-label` on an SVG blob, not a toggle hiding the accessible path), no sideways scroll on the page (the graph scrolls inside its own container), and category is text as well as colour since the ADR 0192 set is not colour-distinguishable at forty nodes. Ranked list: (1) measure the real density against the live DB — it GATES and may cancel the rest, (2) the lineage trail, (3) the goal graph, (4) the per-goal forest. Rejected: view A (every task); view D (densified); a prototype as the output (the criterion forbade it — `spike-task-map.js` is a measuring instrument under `docs/research/`, wired to no route); and building before measuring. Honest limit: the corpus is SYNTHETIC (the live DB was unreachable), so the verdict is robust across the sweep but the specific numbers are model output — which is why item 1 is a measurement against the real DB.](<redacted>.md) | GDS / legibility + hall |
+| 0226 | [**One stale-claim timer; reporting degrades where enforcement refuses** ([task 1003476](https://cloudbongos.com/builders#/task/1003476), goal 1000072, criterion `legibility-sort-and-staleness`). "How long may a claim go silent" had FOUR answers and none of them was the project's: the sweeper that actually releases a claim read `GDS_STALE_CLAIM_HOURS` (else 6h); `GET /builders/roster` and `GET /builders/:id/active-claims` each hardcoded 24h in byte-identical blocks; and the two `session_pulses` helpers defaulted to 30 minutes. The 6-vs-24 pair is the harm: the roster is the screen an Archon opens to decide whether to intervene, and for **eighteen hours** after the sweeper had released a claim, stamped its session log `[auto-released:stale]` and returned the task to `ready`, that screen still showed it healthy — while the roster's own comment claimed to "mirror" the sweeper, true of the definition and false of the number. Decision: ONE resolver, `src/stale-timer.js` (a KERNEL file, the `instance-config.js`/`branding.js` category — host config a module reads, never hardcodes), reached by modules through the doorway and by core routes and the CLI directly. Precedence: explicit override (`--threshold-hours`, `?stale_hours=` — a LENS, labelled `query`, never a reconfiguration) → `<PREFIX>_STALE_CLAIM_HOURS` via `instance-config.resolveEnv`, whose legacy prefix chain still honours the live `GDS_STALE_CLAIM_HOURS` so **nothing in a running deployment has to change** (and which is the channel ADR 0190's runner already patches into `web.env`) → **6**, the SWEEP's historical number and deliberately not the roster's 24, because the sweep is the surface that acts and unifying on 24 would have made every project three times more patient with a dead claim under cover of a refactor. Bound 1..720h — the range `/builders/roster` has published since V3.R14; one timer, one bound. Every surface that prints the timer prints its PROVENANCE (`stale_hours_source`, the sweep header, the auto-release note): a number without it is exactly what let 6 and 24 coexist unnoticed. **The fail posture is asymmetric and that is the decision**: the resolver reports an unusable value rather than throwing, then a surface that only READS degrades to the default and names the bad var (500-ing the roster an Archon opened to find the problem would hide the problem), while the SWEEP refuses to run at all (it releases other people's claims and stamps their logs; no reload undoes that) — a surface that only reads may guess and say so, a surface that acts may not guess. Both routes now share one `staleHoursFor(req, res)`; two copies of a literal is how the drift happened twice inside one file. Rejected: a new `config/stale.json` tier (the env route already IS the per-project channel); making 24 the shared default; throwing from the resolver (forces a second reader — the original bug); folding in the boards' 14/30/60-DAY task buckets (a different question — days, about a task, a browsing lens with no enforcement behind it); a DB row + settings UI (a reasonable next step, but the defect was four numbers, not a missing knob — a row added before the readers agreed would have been a fifth).](<redacted>.md) | GDS / claims + ops |
 
 > ⚠️ **Numbering collisions are now machine-enforced, not narrated.** Twenty numbers are shared by two ADRs each — assigned in parallel sessions before anything checked. The files keep their filenames (renumbering would break every existing citation, and a number once assigned is never reused), and this table disambiguates each pair as `NNNN-a` / `NNNN-b`. The authoritative list is `LEGACY_DUPLICATE_ADRS` in [`scripts/gds/adr-namespace.js`](../../scripts/gds/adr-namespace.js), frozen by exact filename: a **new** collision — or a third file joining a legacy number, or a rename of either half — hard-fails the `unit` CI gate, as does an index row that points at no file or an ADR with no row. The list may only shrink. This paragraph used to narrate the collisions one by one and had fallen eight behind reality; see [ADR 0195](<redacted>.md) for why the check exists and why the pairs are grandfathered rather than renumbered.

package/docs/api/openapi.json

@@ -2591,7 +2591,7 @@
           "builders"
         ],
         "summary": "GET /builders/roster",
-        "description": "GET /builders/roster — V3.R14 (task 238) onboarding observability. Archon-only roster of every builder with their identity + onboarding signals + active-claim posture. Powers the management panel in the /builders hall so the Archon can promote / demote / release-stale-claim without dropping into psql. Optional query param: ?stale_hours=N (default 24). Defines what counts as \"stale\" for the per-row stale_claim flag — mirrors the threshold the stale-claim-release sweeper uses but exposed as a roster knob so the Archon can dial it in if needed. rank: archon — surfaces every builder's onboarding state. Gate: requirePermission('builder.roster.read') — BV1.R104; the same atom /grades/by-builder and /builders/:id/active-claims already gate on (ADR 0151).\n\n**Rank:** `metic+archon` — Metic or Archon rank (review/triage powers).\n\n**Permissions:** `builder.roster.read` (all required).",
+        "description": "GET /builders/roster — V3.R14 (task 238) onboarding observability. Archon-only roster of every builder with their identity + onboarding signals + active-claim posture. Powers the management panel in the /builders hall so the Archon can promote / demote / release-stale-claim without dropping into psql. Optional query param: ?stale_hours=N. Defines what counts as \"stale\" for the per-row stale_claim flag. The DEFAULT is the project's configured stale-claim timer (task 1003476, goal 1000072) — literally the number the sweeper releases on, not a lookalike: this route defaulted to a hardcoded 24 while the sweeper acted at 6, so the Archon's screen called a claim healthy for eighteen hours after the machine had already taken it away. The param stays as a LENS (\"what would 48h show me?\"), and the response reports both the number and where it came from so the two can never quietly diverge again. rank: archon — surfaces every builder's onboarding state. Gate: requirePermission('builder.roster.read') — BV1.R104; the same atom /grades/by-builder and /builders/:id/active-claims already gate on (ADR 0151).\n\n**Rank:** `metic+archon` — Metic or Archon rank (review/triage powers).\n\n**Permissions:** `builder.roster.read` (all required).",
         "x-rank": "metic+archon",
         "x-source": "src/bongos/routes/builders.js",
         "x-permissions": [
@@ -15830,12 +15830,14 @@
         "properties": {
           "builder_id": {},
           "claims": {},
-          "stale_hours": {}
+          "stale_hours": {},
+          "stale_hours_source": {}
         },
         "required": [
           "builder_id",
           "claims",
-          "stale_hours"
+          "stale_hours",
+          "stale_hours_source"
         ]
       },
       "GetBuildersIdActivityResponse": {
@@ -15897,11 +15899,13 @@
         "type": "object",
         "properties": {
           "builders": {},
-          "stale_hours": {}
+          "stale_hours": {},
+          "stale_hours_source": {}
         },
         "required": [
           "builders",
-          "stale_hours"
+          "stale_hours",
+          "stale_hours_source"
         ]
       },
       "GetClosenessForMeResponse": {

package/docs/module-api-changelog.md

@@ -1377,5 +1377,9 @@ is load-bearing: the script throws rather than guess if it is missing, and
         landed since 1.19.468 with no explicit bump. run 33643388774. (task 1002620)
   1.19.470 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
         landed since 1.19.469 with no explicit bump. run 33644371734. (task 1002620)
+  1.19.471 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+        landed since 1.19.470 with no explicit bump. run 33645344292. (task 1002620)
+  1.19.472 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+        landed since 1.19.471 with no explicit bump. run 33646171957. (task 1002620)
 ---------------------------------------------------------------------------
 ```

package/modules/hall-ui/public/task-lib.js

@@ -117,9 +117,13 @@
   const msOf = (iso) => { const t = iso ? Date.parse(iso) : NaN; return Number.isNaN(t) ? 0 : t; };
   const taskActivityMs = (t) => Math.max(msOf(t.updated_at), msOf(t.shipped_at));
 
-  // The staleness buckets both boards offer. A CLIENT-side vocabulary, not the
-  // project's configured stale timer (task 1003279 wires that into the sweep);
-  // these are lenses for a person browsing, and the sweep is the enforcement.
+  // The staleness buckets both boards offer. A CLIENT-side vocabulary over TASKS,
+  // deliberately NOT the project's configured stale-claim timer — that one lives in
+  // src/stale-timer.js, counts hours rather than days, is about a CLAIM going silent,
+  // and is what the sweeper enforces and the Archon roster reports (task 1003476).
+  // These are lenses for a person browsing a board; that is the machine's rule. Two
+  // different questions, so two vocabularies — but only one of them may be a number
+  // typed twice, which is the bug 1003476 closed.
   const STALE_CHOICES = [
     { value: '', label: '— any age —' },
     { value: '14', label: 'untouched 14+ days' },

package/modules/lifecycle/db-ship.js

@@ -562,21 +562,29 @@ async function getClaimPublishedSha(taskId) {
 //                  time_to_first_ship_minutes (NULL until they've shipped)
 //   - claims:      active_claim_count, stale_claim
 //
-// "stale_claim" mirrors the stale-claim-release sweeper definition
-// (.claude/scheduled-tasks/stale-claim-release/SKILL.md): a still-open
-// claim where either the last session_pulses row is older than the
-// stale threshold, or there's no pulse row at all AND claimed_at is
-// older than the threshold. Default threshold is 24h to match this
-// task's spec — the sweeper itself uses GDS_STALE_CLAIM_HOURS (default
-// 6h) and is in charge of *acting*. The roster only *surfaces*.
+// "stale_claim" mirrors the stale-claim-release sweeper's definition: a
+// still-open claim where either the last session_pulses row is older than
+// the stale threshold, or there's no pulse row at all AND claimed_at is
+// older than the threshold.
+//
+// THE THRESHOLD IS THE PROJECT'S, NOT THIS ROUTE'S (task 1003476, goal
+// 1000072). It used to default to a hardcoded 24h "to match this task's
+// spec" while the sweeper acted on GDS_STALE_CLAIM_HOURS (6h) — so for
+// eighteen hours after a claim had been auto-released, tagged
+// [auto-released:stale] and handed back to the queue, this roster still
+// showed it healthy. The roster surfaces and the sweeper acts, but they
+// must answer the same question the same way, so both now read
+// src/stale-timer.js. An explicit `staleHours` still overrides, because
+// "what would 48h show me?" is a lens a person points at the roster and
+// not a reconfiguration of the project.
 //
 // Returns: array of builder roster rows, ordered by:
 //   1. inactive builders sink to the bottom (status='inactive' last)
 //   2. still-onboarding (first_ship_at IS NULL) above shipped builders
 //   3. then by created_at DESC inside each group (newest first)
 
-async function getBuildersRoster({ staleHours = 24 } = {}) {
-  const hours = Number(staleHours);
+async function getBuildersRoster({ staleHours } = {}) {
+  const hours = Number(staleHours ?? api.resolveStaleClaimHours().hours);
   if (!Number.isFinite(hours) || hours <= 0) {
     throw new Error('getBuildersRoster: staleHours must be a positive number');
   }
@@ -629,9 +637,12 @@ async function getBuildersRoster({ staleHours = 24 } = {}) {
 // signals, so the Archon can pick the right one to release. Used by
 // the management panel's per-row "release stale claim" action.
 
-async function getActiveClaimsForBuilderWithStale(builderId, { staleHours = 24 } = {}) {
+// The threshold defaults to the PROJECT's stale-claim timer, not to a number of its
+// own (task 1003476) — a claim the roster called stale must still be stale one click
+// later, in the view an Archon opens to release it.
+async function getActiveClaimsForBuilderWithStale(builderId, { staleHours } = {}) {
   const builder = Number(builderId);
-  const hours = Number(staleHours);
+  const hours = Number(staleHours ?? api.resolveStaleClaimHours().hours);
   if (!Number.isFinite(builder)) {
     throw new Error('getActiveClaimsForBuilderWithStale: builderId must be numeric');
   }

package/modules/sessions/pulse.js

@@ -39,7 +39,17 @@
 //      getStaleClaimsForBuilder().
 // -------------------------------------------------------------------------
 
-const { pool } = require('../../src/module-api');
+const api = require('../../src/module-api');
+
+const { pool } = api;
+
+// The project's stale-claim timer, in minutes (task 1003476, goal 1000072). These
+// helpers used to default to a hardcoded 30 minutes, which was neither the sweeper's
+// 6h nor the roster's 24h — a third answer to one question, reachable by any caller
+// that omitted the argument. There is one answer now, and it is the project's.
+// Resolved per call, never at require time: an env change must reach a long-running
+// process on its next sweep, not on its next restart.
+const projectThresholdMin = () => api.staleClaimMinutes(api.resolveStaleClaimHours().hours);
 
 // Record a heartbeat for a claim. Idempotent UPSERT — the PK is
 // claim_id so repeated pulses just bump last_pulse_at.
@@ -77,8 +87,8 @@ async function recordPulse(claimId, builderId) {
 // This function is READ-ONLY by design (see open question #1 above);
 // the write-side marker is deferred to a follow-up task that owns
 // the migration.
-async function sweepStaleClaims({ thresholdMin = 30 } = {}) {
-  const threshold = Number(thresholdMin);
+async function sweepStaleClaims({ thresholdMin } = {}) {
+  const threshold = Number(thresholdMin ?? projectThresholdMin());
   if (!Number.isFinite(threshold) || threshold <= 0) {
     throw new Error('sweepStaleClaims: thresholdMin must be a positive number');
   }
@@ -110,9 +120,9 @@ async function sweepStaleClaims({ thresholdMin = 30 } = {}) {
 // Today, "stale" is computed the same way as sweepStaleClaims() —
 // once a marker column exists (follow-up a), this can pivot to read
 // claims.pulse_lost_at IS NOT NULL instead.
-async function getStaleClaimsForBuilder(builderId, { thresholdMin = 30 } = {}) {
+async function getStaleClaimsForBuilder(builderId, { thresholdMin } = {}) {
   const builder = Number(builderId);
-  const threshold = Number(thresholdMin);
+  const threshold = Number(thresholdMin ?? projectThresholdMin());
   if (!Number.isFinite(builder)) {
     throw new Error('getStaleClaimsForBuilder: builderId must be numeric');
   }

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.470",
+  "version": "1.19.472",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.19.470",
+      "version": "1.19.472",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.470",
+  "version": "1.19.472",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/scripts/gds/fitness.js

@@ -509,6 +509,12 @@ const KERNEL_FILES = [
   'src/instance-config.js',
   'src/branding.js',
   'src/build-info.js',
+  // task 1003476 (goal 1000072): the project's stale-claim timer — host configuration
+  // a module reads rather than hardcodes, exactly the category instance-config.js and
+  // branding.js are in. The doorway (a KERNEL_FILE) re-exports it, so leaving it off
+  // this roster would read as a kernel->non-kernel leak; it imports only
+  // instance-config + node built-ins, so joining costs nothing.
+  'src/stale-timer.js',
   // BV1.R86: the git-remote/slug + publish-target identity the doorway exposes
   // (api.repoInfo) for the carved lifecycle github-push/conflict-resolve. It is
   // KERNEL (already in the module-scope-map kernel key) and imports only the