@bongos/core 1.19.484 → 1.19.486

package/docs/file-map.md

@@ -130,7 +130,7 @@
 │   ├── sessions/                ← CORE-DOMAIN carve (BV1.R82, default-on): the session_records corpus + data plane (upload, cross-builder search/deep-dive), the BFG read-the-room scorer, session-pulse/stale-claim helpers. Registers no port — reached via HTTP POST to its own /sessions route; resolves the economy `reward` port for the cost-plus token reward. CLAUDE.md, module.json, routes/sessions.js, bfg.js, pulse.js.
 │   ├── autonomy/                ← CORE-DOMAIN carve (BV1.R83, default-on): the MAS autonomy surfaces — the $0 deterministic autonomy gate (System 3, inert until armed), the conductor/architect CLIs, and the in-process routine timers (incl. the weekly peer-vote-tally poller). Registers no port; resolves the lifecycle `tallyPeerVotes` doorway. CLAUDE.md, module.json, routes/autonomy.js, autonomy.js.
 │   ├── status-ui/              ← CORE-DOMAIN WEB-SURFACE carve (BV1.R84, default-on): the public status dashboard at status.<apex>, moved from public-status/. NO routes/db/port — declares contributes.webSurfaces:[{host:"status.",dir:"public"}], served by the loader web-surface seam (moduleWebSurfaces → serve-internal). CLAUDE.md, module.json, public/{index.html,status.js,style.css,cursors/,snapshots/}.
-│   ├── hall-ui/                ← CORE-DOMAIN WEB-SURFACE carve (BV1.R85, default-on): the authenticated builders' hall at builders.<apex>, moved from public-builders/ (~13k LOC, the largest). NO routes/db/port — declares contributes.webSurfaces:[{host:"builders.",dir:"public"}] for discovery, but UNLIKE status-ui keeps its DEDICATED serving block in serve-internal (the /builders shim + canonical redirects + citizen/Archon page gates + asset-stamping + hall-widget injection), partitioned out of the generic web-surface loop and served from BUILDERS_DIR. CLAUDE.md, module.json, public/{index.html,builders.js,style.css,work,watch,harbor,gate,pair,settings,ranks,sessions,primer,diagrams,atlas,...}.{html,js},cursors/,chime.wav. Three ARCHETYPE sheets sit beside the per-page ones: `record.css` (the task + idea records, task 1003305), `room.css` (the READING ROOMS — the primer + the diagrams index, task 1003306: the reading measure and rhythm, the table of contents, the progress hairline and the framed figure diagram-viewer.js upgrades on both pages) and `oversight.css` (the OVERSIGHT family — government, watch, harbor, gate, task 1003469: the row, the figure band inside a panel, the group head, the inline form, the grant toggle and the shared confirm modal; named oversight because the vocabulary wall bans "governance" on the government surface). A page sheet then holds only what one page has and the others do not — `primer.css` the acknowledge gate, `diagrams.css` the legend strip, `gate.css` the hold reasons and file chips, `watch.css` the severities, the report reader and the grade trend, `people.css` the directory's identity cell (task 1003470 made the legacy door `/scouting` ship the same body and script as `/people`; task 1003440 then deleted the door — `scouting.html` and `scouting.states.json` are gone and the URL 301s to `/people`).
+│   ├── hall-ui/                ← CORE-DOMAIN WEB-SURFACE carve (BV1.R85, default-on): the authenticated builders' hall at builders.<apex>, moved from public-builders/ (~13k LOC, the largest). NO routes/db/port — declares contributes.webSurfaces:[{host:"builders.",dir:"public"}] for discovery, but UNLIKE status-ui keeps its DEDICATED serving block in serve-internal (the /builders shim + canonical redirects + citizen/Archon page gates + asset-stamping + hall-widget injection), partitioned out of the generic web-surface loop and served from BUILDERS_DIR. CLAUDE.md, module.json, public/{index.html,builders.js,style.css,work,watch,harbor,gate,pair,settings,ranks,sessions,primer,diagrams,atlas,...}.{html,js},cursors/,chime.wav. Four ARCHETYPE sheets sit beside the per-page ones: `record.css` (the task + idea records, task 1003305), `room.css` (the READING ROOMS — the primer + the diagrams index, task 1003306: the reading measure and rhythm, the table of contents, the progress hairline and the framed figure diagram-viewer.js upgrades on both pages), `oversight.css` (the OVERSIGHT family — government, watch, harbor, gate, task 1003469: the row, the figure band inside a panel, the group head, the inline form, the grant toggle and the shared confirm modal; named oversight because the vocabulary wall bans "governance" on the government surface) and `panel.css` (the PANEL family — settings, profile, pair, not-ready, task 1003308: the row, the switch, the field with its label above, the chip control, the four voices and the sign-in gate; the hall's my-projects page was DELETED in the same task — "my projects" is the hub's user-level page, and the hall keeps no link or redirect). A page sheet then holds only what one page has and the others do not — `primer.css` the acknowledge gate, `diagrams.css` the legend strip, `gate.css` the hold reasons and file chips, `watch.css` the severities, the report reader and the grade trend, `settings.css` the rail layout, the group head, the token ladder and the voices grid, `profile.css` the identity band and the shelf, `pair.css` the device row, `people.css` the directory's identity cell (task 1003470 made the legacy door `/scouting` ship the same body and script as `/people`; task 1003440 then deleted the door — `scouting.html` and `scouting.states.json` are gone and the URL 301s to `/people`).
 │   ├── lifecycle/               ← CORE-DOMAIN carve (BV1.R86, default-on): the build state machine — tasks · claims · versions · done-when · goals · dependencies · claim→ship→grade→credit · github-push + merge-lock + conflict-resolve + publish-reconciler. The LAST, most-coupled carve; registers the `lifecycle` kernel port (createTask, classifyTaskKind, tallyPeerVotes, work-tracking reads). CLAUDE.md, module.json, routes/{tasks,claims,versions,done-when,goals,dependencies,gate-approvals,analytics}.js, lifecycle.js, github-push.js, merge-lock.js, conflict-resolve.js, publish-reconciler.js, task-visuals.js + task-visual-db.js + routes/visuals.js (the optional ship-time visual, task 1003109 — the route file is NOT named task-*.js on purpose; see the module CLAUDE.md).
 │   ├── copy-desk/               ← CORE-DOMAIN module (task 1003113 / R02 of goal 1000074, default-on): the COPY half of the design contract — ADR 0081 gave design TOKENS a repo-owned source of truth, text had none. Owns the FLAG (anyone in any role marks a string or a whole surface as needing an artist's attention, with a reason required in BOTH the route and a CHECK constraint) and the QUEUE an artist reads it from. READS R01's committed registry (docs/copy-registry.json, generated by scripts/gds/copy-inventory.js) and never writes it. NO LIVE CMS is the hard non-goal: no column here could hold replacement text, and copy_no_cms.mjs pins that. Key is `copy-desk`, not `copy` — the branding contract already owns a `copy` block, so the bare word reds the "core carries no module code" fitness check. CLAUDE.md, module.json, registry.js, flags.js, routes/copy-desk.js, migrations/copy_desk_001_flags.sql, tests/{copy_flags,copy_queue,copy_no_cms}.mjs. Its hall surface lives with hall-ui (public/copy-desk.{html,js,css}), per the one-key-per-web-surface precedent.
 │   ├── ui-design/               ← CORE-DOMAIN module (task 1003324 / ADR 0197, default-on): the design capability every builder on every instance gets — ships METHOD, never a world. Absorbs ADR 0081's layer: adapters/{claude-design,figma}/index.js (moved from src/ui/adapters/), scripts/{design-sync,figma-design-sync,validate-design}.js (moved from scripts/gds/, which keeps thin shims), docs/design-contract.md (moved from docs/). Declaration-only: contributes.skills design (the /design playbook, new) + design-sync + figma-design-sync; no routes/port/migrations, so disabling it touches no served surface. CLAUDE.md separates the platform FLOORS (the Fifteen Rule, the dark twins, no page :root, the 24px floor, AA in both modes, the kill switch) from the instance's WORLD (its packs + DESIGN.md). kit/ (task 1003320) is the look-before-you-ship kit: lib.js (the floors, the states/probes contracts, the action + expectation vocabularies, the WCAG maths, the stub spawner), serve.js (any surface through the doorway's real transforms + fixtures/), render.js (states × 1440/390/320 × dark/light, audited), probe.js (PASS/FAIL contracts), check-mock.js (platform rules + the instance's DESIGN.md taste bans, then the detector), tells.js (task 1003329 / ADR 0223: the anti-pattern detector as two tiers — floors FAIL, craft tells WARN, kit-ignore waivers per file; the rendered twins live in lib.js factsInPage), contrast.js + png.js; a page's <page>.states.json / <page>.probes.json sit BESIDE the surface (modules/public-landing/public/, modules/hall-ui/public/). Recipe: docs/recipes/ui-look-before-you-ship.md. skills/ (task 1003321 / ADR 0198) is the vendoring policy: policy.json (licence allowlist, verdicts that may land, sidecar fields, preamble markers), PREAMBLE.md (the platform preamble every vendored SKILL.md opens with), README.md (the roster — both origins scanned dangerous on 2026-08-28, landed as rebuild specs; nothing vendored — and the landing recipe); a landable copy goes under skills/vendor/<name>/ with PROVENANCE.md + LICENSE and is materialised into an instance's .claude/skills/ by claude-materialize.js step 1b. skills/<name>/ (task 1003325 / ADR 0220) are the in-house rebuilds from the specs, first-party and counted: design-taste-frontend (the default taste skill), design-taste-frontend-v1 (the earlier generation, kept distinct), high-end-visual-design (the polish pass), redesign-existing-projects (the in-place upgrade); each opens with the same preamble and carries a "Rebuilt from" section instead of a sidecar. impeccable/ (task 1003326 / ADR 0221) is the design-craft method as ONE skill with sub-commands: SKILL.md (the router, the menu, the craft floor, the bounded finish) + reference/<sub-command>.md (eighteen playbooks, one loaded per request); no hooks, no bypass agent, no telemetry, no live server. minimalist-ui/, industrial-brutalist-ui/, gpt-taste/, stitch-design-taste/ (task 1003327 / ADR 0230) are the four looks, composition grammars with no colours of their own: the palette is the instance's pack and the texture is a named entry in styles/; a substrate is an archetype that still ships both modes, gpt-taste's selection is derived from the route rather than rolled, and stitch-design-taste writes a DESIGN.md-shaped contract document whose thirteen are transcribed from the pack. image-to-code/, imagegen-frontend-web/, imagegen-frontend-mobile/, brandkit/ (task 1003328 / ADR 0222) are the image family under the hero-only rule: plates and hero objects only, the pair (JPEG dark plate + WebP alpha cutout) with a <file>.json sidecar beside each, through the instance's art pipeline key; the grove specimen's styles/grove/assets/ is the worked example. style/ (task 1003475 / ADR 0231) is the module's first FIRST-PARTY skill (no upstream, so a `## First party` section instead of `## Rebuilt from`): the /style session in which an owner authors their own look in four bounded steps, rendering the nearest library entries before asking, drafting inside the contract, retuning by measurement, and handing over the one-step adoption without ever writing config/branding.json. styles/ (task 1003323 / ADR 0219) is the style library: <name>/pack.json (the theme.ui overlay, exactly the fifteen) + DESIGN.md (the look's derived recipes, thirteen in lockstep with the pack) + mock.html (the specimen); chrome-world (pinned to the neutral pack), expedition, grove, blueprint (the first cool look, authored through /style at task 1003475); STYLE=<name> on the kit lays a look over the instance's pack through GDS_BRANDING_FILE; tests/ui_design_styles.mjs runs the world/cosmos/hall token suites once per alternate (UI_DESIGN_PACK). config/design-tokens.* + design-sources.json STAY in config/ as the host boundary; public-landing keeps its own key (first customer, not owner).

package/docs/module-api-changelog.md

@@ -1405,5 +1405,9 @@ is load-bearing: the script throws rather than guess if it is missing, and
         landed since 1.19.482 with no explicit bump. run 33674657478. (task 1002620)
   1.19.484 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
         landed since 1.19.483 with no explicit bump. run 33675143968. (task 1002620)
+  1.19.485 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+        landed since 1.19.484 with no explicit bump. run 33681828446. (task 1002620)
+  1.19.486 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+        landed since 1.19.485 with no explicit bump. run 33682949187. (task 1002620)
 ---------------------------------------------------------------------------
 ```

package/migrations/core_231_project_settings_and_attention_water.sql

@@ -0,0 +1,163 @@
+-- core_231_project_settings_and_attention_water.sql — the rot clock and the knob
+-- that sets it (task 1003279, goal 1000072, criterion legibility-sort-and-staleness).
+--
+-- THE GAP. Goal 1000072's rotting half asks that "untouched-for-X triggers a
+-- configured action rather than a silent decay". Two things were missing to make
+-- that sentence true, and this migration adds exactly those two:
+--
+--   1. X had nowhere to live. src/stale-timer.js (task 1003476, ADR 0226) owns the
+--      CLAIM-silence timer — hours, env-configured, and the sweep that ACTS on it
+--      releases someone's claim. The rot timer is a different measurement with a
+--      different unit and a different consequence (days; it asks a human a
+--      question), and task 1003280 requires it be "live, DB-backed" and warns
+--      "do not fork a second store". So: one generic project_settings table, with
+--      the rot timer as its first key.
+--
+--   2. "Water" had nothing to write. The owner's four verbs are prune, kill,
+--      prioritise and WATER — leave the thing alone and reset its clock. Without
+--      somewhere to record that, watering would have to fake a real edit, and the
+--      same line would come back on the next read; the inbox teaches people to
+--      ignore it within a week. attention_watered_at IS the reset.
+--
+-- WHY A COLUMN AND NOT AN ITEMS TABLE. There is deliberately no `attention_items`
+-- row anywhere in this design. The inbox line is DERIVED on read from the rot clock
+-- (below) vs the timer, which makes "exactly one open item per stale thing, not one
+-- per sweep" true by construction rather than by a de-duplicating sweep that has to
+-- be got right.
+-- Acting on the line (prune/kill/prioritise) changes status and the row stops
+-- matching; watering pushes the clock forward and it stops matching. Nothing to
+-- reconcile, nothing to garbage-collect, and no way to accrete duplicates.
+--
+-- Additive + forward-safe: every column is nullable with no backfill, nothing is
+-- renamed, and no existing reader changes meaning (tests/migrations_forward_safe.mjs).
+
+BEGIN;
+
+-- ---------------------------------------------------------------------------
+-- 1. project_settings — the instance's live, DB-backed knobs.
+-- ---------------------------------------------------------------------------
+--
+-- Deliberately a generic key/value table rather than one column per knob: task
+-- 1003280 puts five project fundamentals on one page, and a table that grows a
+-- migration per knob would make that page a schema change every time. Values are
+-- stored as TEXT and parsed by a typed accessor at the read edge
+-- (src/bongos/project-settings.js), the same shape src/stale-timer.js already uses
+-- for env values — one parser, one range check, one documented default.
+--
+-- A key that has never been set has NO ROW. Absence means "use the code default",
+-- which is what lets a fresh instance boot correctly with an empty table, and what
+-- lets a settings page distinguish "never configured" from "deliberately set to
+-- the same value the default happens to be".
+CREATE TABLE IF NOT EXISTS project_settings (
+  key         text PRIMARY KEY,
+  value       text NOT NULL,
+  updated_at  timestamptz NOT NULL DEFAULT now(),
+  updated_by  bigint REFERENCES builders(id)
+);
+
+COMMENT ON TABLE project_settings IS
+  'Live, DB-backed per-project knobs (task 1003279). Key/value so task 1003280''s settings page can grow a row without a migration. No row = never configured = use the code default; that absence is meaningful, so do not seed defaults here.';
+COMMENT ON COLUMN project_settings.value IS
+  'Stored as text and parsed by a typed accessor at the read edge (src/bongos/project-settings.js). A value that fails its range check is IGNORED with a receipt, never coerced silently — the ADR 0226 posture.';
+COMMENT ON COLUMN project_settings.updated_by IS
+  'The builder who last set this knob. NULL = set by a system path with no builder in the request (the goals.created_by convention, migration 160).';
+
+-- ---------------------------------------------------------------------------
+-- 2. The water mark, on both tiers that can rot.
+-- ---------------------------------------------------------------------------
+--
+-- NULL = never watered, and the thing's own activity timestamp is the whole clock.
+-- This is why the read expression is a GREATEST and not a bare COALESCE: a real edit
+-- after a watering must move the clock forward again, and a watering must never make
+-- a thing look OLDER than its last genuine touch.
+--
+-- THE ROT CLOCK, AND WHY IT IS SHAPED LIKE THIS:
+--
+--   tasks:  GREATEST(updated_at, COALESCE(shipped_at, updated_at),
+--                    COALESCE(attention_watered_at, updated_at))
+--   goals:  GREATEST(updated_at, COALESCE(attention_watered_at, updated_at))
+--
+-- The first two terms are NOT a new definition of "touched" — they are exactly the
+-- one modules/hall-ui/public/task-lib.js already publishes for the Tasks board and
+-- the Goals page (`taskActivityMs = max(updated_at, shipped_at)`, task 1003278, this
+-- same criterion), which folds in shipped_at because a ship path can stamp it
+-- without touching updated_at. This migration adds a THIRD term to that definition
+-- and nothing else. Had the server invented its own two-term clock, the board and
+-- the inbox would disagree about which rows are stale — which is the 6h-vs-24h
+-- failure of ADR 0226 reappearing one tier up, and the reason the indexes below
+-- spell the expression out in full rather than approximating it.
+-- (Goals carry no shipped_at column, so their clock has two terms, not three.)
+ALTER TABLE tasks
+  ADD COLUMN IF NOT EXISTS attention_watered_at timestamptz,
+  ADD COLUMN IF NOT EXISTS attention_watered_by bigint REFERENCES builders(id);
+
+ALTER TABLE goals
+  ADD COLUMN IF NOT EXISTS attention_watered_at timestamptz,
+  ADD COLUMN IF NOT EXISTS attention_watered_by bigint REFERENCES builders(id);
+
+COMMENT ON COLUMN tasks.attention_watered_at IS
+  'When a human last said "leave it, it is fine" about this task rotting (task 1003279). Resets the rot clock without touching the work. NULL = never watered.';
+COMMENT ON COLUMN goals.attention_watered_at IS
+  'When a human last said "leave it, it is fine" about this goal rotting (task 1003279). Resets the rot clock without touching the work. NULL = never watered.';
+
+-- The rot read is "open things whose clock is older than N days", so the index is
+-- on (status, clock) — status first because it is the equality predicate and it
+-- cuts the table to the open rows before the range scan ever runs.
+CREATE INDEX IF NOT EXISTS idx_tasks_attention_rot
+  ON tasks (status, (GREATEST(updated_at,
+                              COALESCE(shipped_at, updated_at),
+                              COALESCE(attention_watered_at, updated_at))));
+CREATE INDEX IF NOT EXISTS idx_goals_attention_rot
+  ON goals (status, (GREATEST(updated_at, COALESCE(attention_watered_at, updated_at))));
+
+-- ---------------------------------------------------------------------------
+-- 3. Rebuild the two `t.*` views so the new columns are projected.
+-- ---------------------------------------------------------------------------
+--
+-- A Postgres view created with `SELECT t.*` pins its column list at CREATE VIEW
+-- time. core_227's header records six columns that silently never reached the claim
+-- feed exactly this way; bodies below are identical to core_227's (the wildcard
+-- re-expands to every current column).
+
+DROP VIEW IF EXISTS claimable_tasks;
+CREATE VIEW claimable_tasks AS
+SELECT t.*,
+       pms_calibrated_minutes(t.est_minutes, t.kind) AS est_minutes_calibrated
+  FROM tasks t
+ WHERE t.status = 'ready'
+   AND t.title NOT LIKE '\_\_smoke\_\_%' ESCAPE '\'
+   AND NOT EXISTS (
+     SELECT 1 FROM task_blockers tb WHERE tb.task_id = t.id
+   )
+   AND NOT EXISTS (
+     SELECT 1 FROM claims c
+       JOIN tasks t2 ON t2.id = c.task_id
+      WHERE c.released_at IS NULL
+        AND t2.touches && t.touches
+   );
+
+DROP VIEW IF EXISTS tasks_session_fit;
+CREATE VIEW tasks_session_fit AS
+SELECT t.*,
+  CASE
+    WHEN t.automation_tag = 'overnight-safe' AND COALESCE(t.manual_degree, 5) <= 2
+         AND NOT EXISTS (SELECT 1 FROM task_blockers tb WHERE tb.task_id = t.id)
+      THEN ARRAY['autonomous','check-in','active']
+    WHEN t.automation_tag = 'live-only' OR COALESCE(t.manual_degree, 5) >= 4
+      THEN ARRAY['active']
+    ELSE ARRAY['check-in','active']
+  END AS fits_session_modes,
+  pms_calibrated_minutes(t.est_minutes, t.kind) AS est_minutes_calibrated,
+  CASE
+    WHEN t.credits_reward > 0
+     AND pms_calibrated_minutes(t.est_minutes, t.kind) IS NOT NULL
+     AND pms_calibrated_minutes(t.est_minutes, t.kind) > 0
+    THEN ROUND(t.credits_reward::numeric / pms_calibrated_minutes(t.est_minutes, t.kind), 3)
+    ELSE NULL
+  END AS credits_per_minute
+FROM tasks t;
+
+COMMIT;
+
+INSERT INTO schema_migrations (version) VALUES ('core_231_project_settings_and_attention_water')
+ON CONFLICT (version) DO NOTHING;

package/modules/dev-box/app/src/vendor/bongos-client.cjs

@@ -386,6 +386,8 @@ function createClient(opts = {}) {
       postGoalsIdTransfer: (args) => request("POST", "/goals/{id}/transfer", { hasBody: true }, args),
       // PATCH /goals/{id}/visibility — rank: any-builder — PATCH /goals/:id/visibility
       patchGoalsIdVisibility: (args) => request("PATCH", "/goals/{id}/visibility", { hasBody: true }, args),
+      // POST /goals/{id}/water — rank: any-builder — POST /goals/:id/water
+      postGoalsIdWater: (args) => request("POST", "/goals/{id}/water", { hasBody: true }, args),
       // GET /goals/inbox — rank: any-builder — GET /goals/inbox
       getGoalsInbox: (args) => request("GET", "/goals/inbox", { hasBody: false }, args),
       // POST /goals/reorder — rank: metic+archon — POST /goals/reorder
@@ -466,6 +468,8 @@ function createClient(opts = {}) {
       getInboxAwaitingNod: (args) => request("GET", "/inbox/awaiting-nod", { hasBody: false }, args),
       // GET /inbox/by-builder/{id} — rank: any-builder — GET /inbox/by-builder/:id
       getInboxByBuilderId: (args) => request("GET", "/inbox/by-builder/{id}", { hasBody: false }, args),
+      // GET /inbox/rotting — rank: any-builder — GET /inbox/rotting
+      getInboxRotting: (args) => request("GET", "/inbox/rotting", { hasBody: false }, args),
       // POST /inbox/score — rank: any-builder — POST /inbox/score
       postInboxScore: (args) => request("POST", "/inbox/score", { hasBody: true }, args),
       // GET /inbox/sparks — rank: any-builder — GET /inbox/sparks
@@ -838,6 +842,8 @@ function createClient(opts = {}) {
       postTasksIdVisual: (args) => request("POST", "/tasks/{id}/visual", { hasBody: true }, args),
       // POST /tasks/{id}/vote — rank: metic+archon — POST /tasks/:id/vote
       postTasksIdVote: (args) => request("POST", "/tasks/{id}/vote", { hasBody: true }, args),
+      // POST /tasks/{id}/water — rank: any-builder — POST /tasks/:id/water
+      postTasksIdWater: (args) => request("POST", "/tasks/{id}/water", { hasBody: true }, args),
       // GET /tasks/claimable — rank: any-builder — GET /tasks/claimable
       getTasksClaimable: (args) => request("GET", "/tasks/claimable", { hasBody: false }, args),
       // GET /tasks/newcomer-floor — rank: any-builder — GET /tasks/newcomer-floor

package/modules/hall-ui/public/goal-inbox.js

@@ -167,6 +167,19 @@
   }
 
   function onClick(e) {
+    // task 1003279: a rot verb. Handled FIRST because its rows carry no data-goal —
+    // the path is server-declared and already tier-correct, so this branch needs to
+    // know nothing about which of the four verbs was pressed beyond what to say
+    // afterwards. Refreshes the ROT slice only: repainting the goals list would
+    // leave the acted-on row sitting there (the task-1003066 lesson).
+    const rotBtn = e.target.closest('[data-rot-path]');
+    if (rotBtn) {
+      const verb = rotBtn.dataset.rotVerb;
+      act(() => postJSON(`${API}${rotBtn.dataset.rotPath}`, {}),
+        ROT_TOASTS[verb] || 'Done.', loadRot);
+      return;
+    }
+
     // task 1003066 (BV1.R05): the nod. It reuses the EXISTING promote route —
     // POST /tasks/:id/promote, already Metic+ via task.promote — so giving a nod
     // adds no endpoint and no permission. Handled before the membership branches
@@ -262,6 +275,104 @@
       .catch(() => { /* a non-triager's 403, or a hiccup: never break the hall */ });
   }
 
+  // ---- the rot queue (task 1003279, goal 1000072) ---------------------------
+  //
+  // "Untouched-for-X triggers a configured action rather than a silent decay."
+  // The owner's decision (2026-08-25): the action is a LINE IN THIS CARD, not an
+  // automatic status change and not a nightly digest. Auto-demoting mutates real
+  // work with no human in the loop, and a wrong timer then silently freezes it; a
+  // digest is a notification, not an action, and gets scrolled past.
+  //
+  // THE BUTTONS ARE SERVER-DECLARED. Each row arrives carrying its own `verbs`
+  // array — label, method and path — and this renders exactly those. It is not
+  // decoration: three of the four verbs reuse EXISTING routes (promote, demote,
+  // abandon, archive) whose permissions differ by tier, and a hardcoded button list
+  // here would be a second copy of that mapping, free to drift into offering a
+  // button the server will refuse. A goal legitimately gets two verbs where a task
+  // gets four; this file does not need to know why.
+  //
+  // No client-side rank gate, for the same reason the nod slice has none: the read
+  // is scoped server-side, so a builder is only ever handed rows that are theirs to
+  // act on and the button list is already narrowed to what they can press.
+  const MAX_ROT_ROWS = 5;
+
+  function untouchedFor(iso) {
+    const t = iso ? Date.parse(iso) : NaN;
+    if (Number.isNaN(t)) return 'untouched';
+    const days = Math.floor((Date.now() - t) / 86400000);
+    if (days < 1) return 'untouched today';
+    return `untouched ${days} day${days === 1 ? '' : 's'}`;
+  }
+
+  function rotRowHtml(r) {
+    const href = r.tier === 'goal'
+      ? goalHref(r.id)
+      : `/task/${encodeURIComponent(r.id)}`;
+    const where = r.tier === 'goal'
+      ? 'goal'
+      : (r.goal_title ? escapeHtml(r.goal_title) : `goal ${escapeHtml(String(r.goal_id || '—'))}`);
+    // `watered` is worth showing: a row that is back DESPITE having been watered is
+    // a different message from one nobody has ever looked at, and hiding that would
+    // make the second watering feel like the first one did nothing.
+    const again = r.ever_watered ? ' · watered before' : '';
+    const buttons = (Array.isArray(r.verbs) ? r.verbs : []).map((v) => {
+      const path = String(v.path || '').replace(':id', encodeURIComponent(r.id));
+      return `<button class="btn-ghost" type="button" data-rot-path="${escapeHtml(path)}"`
+        + ` data-rot-verb="${escapeHtml(String(v.verb || ''))}"`
+        + ` title="${escapeHtml(String(v.hint || ''))}">${escapeHtml(String(v.label || v.verb || '?'))}</button>`;
+    }).join('');
+    return `<li class="ginbox__item" data-rot-tier="${escapeHtml(String(r.tier))}">
+        <div class="ginbox__main">
+          <a class="ginbox__goal" href="${href}">${escapeHtml(r.title || `${r.tier} #${r.id}`)}</a>
+          <span class="ginbox__sub">${escapeHtml(String(r.status || ''))} · ${where} · ${escapeHtml(untouchedFor(r.last_touched_at))}${again}</span>
+        </div>
+        <div class="ginbox__acts">${buttons}</div>
+      </li>`;
+  }
+
+  // What each verb says when it lands. Keyed by the SERVER's verb name so a new verb
+  // degrades to a neutral confirmation instead of a blank toast.
+  const ROT_TOASTS = {
+    prioritise: 'Prioritised — it’s claimable now.',
+    prune: 'Pruned — back in the backlog.',
+    kill: 'Killed — it won’t come back.',
+    water: 'Watered — the clock is reset.',
+  };
+
+  function renderRot(data) {
+    const box = host && host.querySelector('#attention-rot');
+    if (!box) return;
+    const rows = (data && Array.isArray(data.rows)) ? data.rows : [];
+    if (!rows.length) {
+      box.innerHTML = '';
+      window.OTBAttention?.refresh();
+      return;
+    }
+    const shown = rows.slice(0, MAX_ROT_ROWS);
+    const more = rows.length > shown.length
+      ? `<p class="ginbox__pending">…${rows.length - shown.length} more going quiet.</p>`
+      : '';
+    // The heading names the TIMER, not just the count. A reader who disagrees with
+    // the line ("30 days is too short for a backlog") needs to know which number
+    // produced it before they can go change it — and when that number came from a
+    // value the server could not use, the receipt says so here, on the screen of
+    // somebody who can fix it.
+    const t = (data && data.timer) || {};
+    const timerNote = t.invalid
+      ? `<span class="ginbox__sub"> — ${escapeHtml(String(t.describe || ''))}</span>`
+      : `<span class="ginbox__sub"> — untouched ${escapeHtml(String(t.rot_days ?? '?'))}+ days</span>`;
+    box.innerHTML = '<h3 class="ginbox__sec-h">Going quiet '
+      + `<span class="count-pill">${rows.length}</span>${timerNote}</h3>`
+      + `<ul class="ginbox__list">${shown.map(rotRowHtml).join('')}</ul>${more}`;
+    window.OTBAttention?.refresh();
+  }
+
+  function loadRot() {
+    return getJSON(`${API}/inbox/rotting`)
+      .then((data) => renderRot(data))
+      .catch(() => { /* signed out, older server, or a hiccup: never break the hall */ });
+  }
+
   // task 2169: this widget IS the "Needs your attention" card — ONE capped
   // summary hosting every actionable item class: goal invitations +
   // join-requests (this file) and ideas awaiting triage (builders.js renders
@@ -294,10 +405,17 @@
       // awaiting a nod inside a goal sits nearer the goals slice than idea
       // triage. Its rows carry the shared .ginbox__item class, so refresh()
       // counts them with no change to the selector below.
-      '<div id="attention-nod"></div>';
+      '<div id="attention-nod"></div>' +
+      // task 1003279 (goal 1000072): work going quiet — a goal or task untouched
+      // past the project's rot timer, with the owner's four verbs on it. LAST in
+      // the card on purpose: every slice above is somebody waiting on YOU right
+      // now, while rot is a standing question that has already waited weeks and
+      // can wait until they are read.
+      '<div id="attention-rot"></div>';
     host.addEventListener('click', onClick);
     load();
     loadNodQueue();
+    loadRot();
     // task 1002802 (P06): the profile slice lives in its own file (builders.js is
     // over the size budget); this card owns its div, so it boots it here.
     window.OTBProfileNudge?.load();

package/modules/hall-ui/public/not-ready.html

@@ -9,6 +9,8 @@
   <link rel="preconnect" href="https://fonts.googleapis.com">
   <link rel="preconnect" href="https://fonts.gstatic.com" crossorigin>
   <link rel="stylesheet" href="/builders/style.css?v=2026-07-02-shell1">
+  <!-- The PANEL archetype (task 1003308): this page is its sign-in gate shape. -->
+  <link rel="stylesheet" href="/builders/panel.css">
 </head>
 <body data-page="not-ready" data-page-title="Locked">
 
@@ -18,21 +20,23 @@
   <div class="app-body">
     <header class="app-topbar" id="app-topbar"></header>
     <div class="app-content">
+      <!-- The page's ONE h1 (one-header-main-h1), in the family's voice. -->
+      <div class="page-head page-head--room page-head--panel">
+        <h1 id="not-ready-h1" class="page-head__h">not yet</h1>
+        <p class="page-head__sub">This page unlocks as you advance.</p>
+      </div>
       <main id="hall-main">
-        <section class="scroll">
-          <h2 class="scroll__h">Not yet available</h2>
-          <p class="scroll__lede">This page unlocks as you advance.</p>
-          <p>
+        <section class="scroll gate" aria-labelledby="not-ready-h">
+          <h2 id="not-ready-h" class="gate__h">Not yet available</h2>
+          <p class="gate__lede">
             Xenos builders start with a focused set of pages — ship your first
             <strong>three tasks</strong> to graduate and open the rest of
             {{worldName}}'s builder hub.
           </p>
-          <p style="margin-top: 18px;">
-            <a href="/ranks">See how ranks work →</a>
-          </p>
-          <p>
-            <a href="/">← Back to Home</a>
-          </p>
+          <div class="row-end">
+            <a class="pbtn pbtn--save" href="/ranks">See how ranks work</a>
+            <a class="pbtn pbtn--quiet" href="/">Back to home</a>
+          </div>
         </section>
       </main>
       <footer class="app-foot" id="app-foot"></footer>

package/modules/hall-ui/public/not-ready.states.json

@@ -0,0 +1,14 @@
+{
+  "_": "The NOT-READY page through modules/ui-design/kit/render.js (task 1003308) — the sign-in gate shape of the panel family, static markup with no feed. Renders under the kit's own stub and under the harness alike.",
+  "page": "/not-ready",
+  "surface": "hall-ui",
+  "stub": { "prefix": "/builders/" },
+  "modeQuery": false,
+  "ignoreRequests": ["/api/(gds|bongos)/"],
+  "ignoreConsole": ["/api/(gds|bongos)/", "\b401\b", "\b404\b", "Unauthorized", "Not Found", "load failed"],
+  "states": {
+    "locked": { "auth": true, "actions": [["wait", 400]], "expect": { "visible": ["#not-ready-h1", "#not-ready-h"] } },
+    "out": { "auth": false, "actions": [["wait", 400]], "expect": { "visible": ["#not-ready-h1"] } }
+  },
+  "reducedMotion": { "auth": true, "actions": [["wait", 400]] }
+}

package/modules/hall-ui/public/pair.css

@@ -1,73 +1,23 @@
-/* pair.css — Page-local styles for the dev-box Pair page.
-   Lifted verbatim out of the page's inline <style> block (task 1002176);
-   the ?v= cache-bust is stamped automatically from this file's content hash
-   at boot (src/asset-version.js). */
+/* pair.css — what the Dev Box pairing page has and the rest of the panel family
+   does not (task 1003308, goal 1000081; the archetype is panel.css). One panel,
+   one device, one button. The device is a row of the family with the platform
+   glyph as its figure; the approve button is the page's one accent door. */
 
-/* Page-local styles for the pairing approve page (#904) — built on the
-   shared design-system tokens in style.css. */
 #pair-scroll { max-width: 640px; }
 
 .pair-device {
   display: flex;
   align-items: center;
-  gap: 14px;
-  background: var(--surface-2);
-  border: 1px solid var(--border);
-  border-radius: var(--radius-sm);
-  padding: 14px 16px;
-  margin: 14px 0 18px;
-}
-.pair-device__glyph {
-  font-size: 1.7rem;
-  line-height: 1;
-}
-.pair-device__name {
-  font-family: var(--font-display);
-  font-size: 14px;
-  font-weight: 600;
-  color: var(--ink);
-}
-.pair-device__meta {
-  font-family: var(--font-body);
-  font-size: 13px;
-  color: var(--ink-soft);
-}
-.pair-code {
-  font-family: ui-monospace, SFMono-Regular, Menlo, Consolas, monospace;
-  font-size: 12.5px;
-  letter-spacing: 0.08em;
-  color: var(--ink-soft);
-}
-.pair-actions {
-  display: flex;
-  align-items: center;
-  gap: 14px;
-  flex-wrap: wrap;
-}
-.pair-approve {
-  font-family: var(--font-body);
-  font-size: 13.5px;
-  font-weight: 600;
-  padding: 10px 22px;
-  background: var(--accent);
-  color: #fff;
-  border: 1px solid var(--accent);
-  border-radius: var(--radius-sm);
-  cursor: pointer;
-}
-.pair-approve:hover:not(:disabled) { background: var(--accent-deep); border-color: var(--accent-deep); }
-.pair-approve:disabled { opacity: 0.55; cursor: default; }
-.pair-status {
-  font-family: var(--font-body);
-  font-size: 13.5px;
-  color: var(--ink-soft);
-  min-height: 1.2em;
-}
-.pair-status--ok { color: var(--ok); font-weight: 600; }
-.pair-status--err { color: var(--danger); }
-.pair-note {
-  font-family: var(--font-body);
-  font-size: 13px;
-  color: var(--ink-faint);
-  margin-top: 16px;
-}
+  gap: var(--sp-sm);
+  margin: var(--sp-sm) 0 var(--sp-md);
+  padding: var(--sp-sm) 0;
+  border-top: var(--line) solid var(--rule-soft);
+  border-bottom: var(--line) solid var(--rule-soft);
+}
+.pair-device__glyph { width: 40px; font-size: 26px; line-height: 1; text-align: center; color: var(--ink-soft); flex: none; }
+.pair-device__name { font-size: 14.5px; font-weight: 500; color: var(--ink); }
+.pair-device__meta { margin-top: 2px; font-size: 13.5px; color: var(--ink-soft); }
+.pair-code { font-family: var(--font-mono); font-size: 12.5px; letter-spacing: .08em; color: var(--ink); }
+.pair-actions { display: flex; flex-wrap: wrap; align-items: center; gap: var(--sp-xs); }
+.pair-actions .pair-status { margin: 0; }
+.pair-note { margin: var(--sp-sm) 0 0; max-width: var(--measure); font-size: 13px; color: var(--ink-faint); }

package/modules/hall-ui/public/pair.html

@@ -9,6 +9,8 @@
   <link rel="preconnect" href="https://fonts.googleapis.com">
   <link rel="preconnect" href="https://fonts.gstatic.com" crossorigin>
   <link rel="stylesheet" href="/builders/style.css?v=2026-07-02-shell1">
+  <!-- The PANEL archetype (task 1003308) before the page's own sheet. -->
+  <link rel="stylesheet" href="/builders/panel.css">
   <link rel="stylesheet" href="/builders/pair.css">
 </head>
 <body data-page="pair" data-page-title="Device pairing">
@@ -19,7 +21,12 @@
   <div class="app-body">
     <header class="app-topbar" id="app-topbar"></header>
     <div class="app-content">
-      <div class="page-head"><p class="page-head__sub" id="pair-sub">Reading the request…</p></div>
+      <!-- The page's ONE h1 (one-header-main-h1), in the family's voice; the
+           sub-line is pair.js's — the request, the approval, or the error. -->
+      <div class="page-head page-head--room page-head--panel">
+        <h1 id="pair-h1" class="page-head__h">pairing</h1>
+        <p class="page-head__sub" id="pair-sub">Reading the request…</p>
+      </div>
       <main id="hall-main">
         <section class="scroll" id="pair-scroll" aria-labelledby="pair-h">
           <h2 id="pair-h" class="scroll__h">A device is asking to act as you</h2>

package/modules/hall-ui/public/pair.states.json

@@ -0,0 +1,14 @@
+{
+  "_": "The Dev Box PAIRING page through modules/ui-design/kit/render.js (task 1003308). The device row and the approve button only exist once the pairing request has LOADED, so the populated state runs against the hall-preview harness (see settings.states.json for the two commands; the harness serves scripts/hall-preview/fixtures/auth__app-pair__info.json for any code). `nocode` is the page's own error render — the link arrived without its pairing code — and needs nothing served.",
+  "page": "/pair",
+  "surface": "hall-ui",
+  "stub": { "prefix": "/builders/" },
+  "modeQuery": false,
+  "ignoreRequests": ["/api/(gds|bongos)/"],
+  "ignoreConsole": ["/api/(gds|bongos)/", "\b401\b", "\b404\b", "Unauthorized", "Not Found", "load failed"],
+  "states": {
+    "request": { "auth": true, "url": "/pair?code=K7QD-4M2X", "actions": [["wait", 700]], "expect": { "visible": ["#pair-h1", "#pair-approve-btn"] } },
+    "nocode": { "auth": true, "actions": [["wait", 700]], "expect": { "visible": ["#pair-h1", "#pair-scroll .pair-status--err"] } }
+  },
+  "reducedMotion": { "auth": true, "url": "/pair?code=K7QD-4M2X", "actions": [["wait", 700]] }
+}