@bongos/core 1.19.484 → 1.19.486

package/modules/hall-ui/public/settings.js

@@ -134,6 +134,15 @@
 
   // Render one row per sound from `effective`. Each row: label + description and
   // an On/Off toggle button whose data-on reflects the effective enabled-state.
+  // The family switch (panel.css `.sw`): a role=switch button whose state is
+  // aria-checked, drawn as a track and a knob. Keeps the `.sound-toggle` class
+  // and `data-on`, which every delegated click handler on this page reads.
+  function switchHtml(on, label, extraAttrs = '') {
+    return `<button type="button" class="sound-toggle sw" role="switch" aria-checked="${on ? 'true' : 'false'}" ` +
+      `aria-label="${escapeHtml(label)}" data-on="${on ? '1' : '0'}"${extraAttrs}>` +
+      '<span class="sw__track"></span><span class="sw__knob"></span></button>';
+  }
+
   function renderSounds(data) {
     const wrap = $('#sound-rows');
     if (!wrap) return;
@@ -150,9 +159,7 @@
         `<div class="sound-row__label">${escapeHtml(row.label || row.sound)}</div>` +
         `<div class="sound-row__desc">${escapeHtml(row.desc || '')}</div>` +
         '</div>' +
-        `<button type="button" class="sound-toggle" data-sound="${escapeHtml(row.sound)}" ` +
-        `data-on="${on ? '1' : '0'}" aria-pressed="${on ? 'true' : 'false'}">` +
-        `${on ? 'On' : 'Off'}</button>` +
+        switchHtml(on, `Sound: ${row.label || row.sound}`, ` data-sound="${escapeHtml(row.sound)}"`) +
         '</div>'
       );
     }).join('');
@@ -405,25 +412,23 @@
       wrap.innerHTML = window.OTBKit.emptyStateHtml('No levels registered.');
       return;
     }
+    // One pick among four: a radio row per level (panel.css `.prow--pick`), the
+    // whole row its label. A level above the rank ceiling is a disabled radio
+    // that says so in the label voice rather than a dead "Rank-locked" button.
     wrap.innerHTML = levels.map((lv) => {
       const chosen = lv.n === eff;
-      const tag = lv.n === def ? ' <span class="voices__default">· default for your rank</span>' : '';
-      let btn;
-      if (!lv.allowed) {
-        btn = `<button type="button" class="sound-toggle" disabled data-level="${lv.n}" data-on="0">Rank-locked</button>`;
-      } else if (chosen) {
-        btn = `<button type="button" class="sound-toggle" data-level="${lv.n}" data-on="1" aria-pressed="true">Chosen</button>`;
-      } else {
-        btn = `<button type="button" class="sound-toggle" data-level="${lv.n}" data-on="0" aria-pressed="false">Choose</button>`;
-      }
+      const locked = !lv.allowed;
+      const id = `wander-${lv.n}`;
+      const tags = (lv.n === def ? '<span class="prow__tag">default for your rank</span>' : '') +
+        (locked ? '<span class="prow__tag">rank-locked</span>' : '');
       return (
-        `<div class="sound-row" data-level="${lv.n}">` +
-        '<div class="sound-row__text">' +
-        `<div class="sound-row__label">${escapeHtml(lv.label)}${tag}</div>` +
-        `<div class="sound-row__desc">${escapeHtml(lv.blurb || '')}</div>` +
-        '</div>' +
-        btn +
-        '</div>'
+        `<label class="prow prow--pick" for="${id}" data-level="${lv.n}"${locked ? ' aria-disabled="true"' : ''}>` +
+        `<input class="pradio" type="radio" name="wandering" id="${id}" value="${lv.n}"` +
+        `${chosen ? ' checked' : ''}${locked ? ' disabled' : ''}>` +
+        '<span class="prow__main">' +
+        `<span class="prow__label">${escapeHtml(lv.label)}${tags}</span>` +
+        `<span class="prow__desc">${escapeHtml(lv.blurb || '')}</span>` +
+        '</span></label>'
       );
     }).join('');
     const note = $('#wandering-note');
@@ -466,13 +471,13 @@
       const data = res.data;
       renderWandering(data);
       $('#wandering-scroll').hidden = false;
-      // Delegate clicks so post-render buttons stay wired (single-select).
+      // Delegate the change so post-render radios stay wired (single-select).
       const wrap = $('#wander-rows');
-      wrap.addEventListener('click', (e) => {
-        const b = e.target.closest('.sound-toggle');
-        if (!b || b.disabled || b.dataset.on === '1') return; // ignore locked + already-chosen
-        const level = Number(b.dataset.level);
-        if (Number.isInteger(level)) saveWandering(level, b);
+      wrap.addEventListener('change', (e) => {
+        const r = e.target.closest('.pradio');
+        if (!r || r.disabled || !r.checked) return; // ignore locked; a radio only fires on becoming checked
+        const level = Number(r.value);
+        if (Number.isInteger(level)) saveWandering(level, r);
       });
     } catch (err) {
       console.error('[settings] failed to load wandering', err);
@@ -497,11 +502,11 @@
       '<div class="sound-row" data-render="widgets">' +
       '<div class="sound-row__text">' +
       '<div class="sound-row__label">Rich in-feed cards' +
-      (isDefault ? ' <span class="voices__default">· default (on)</span>' : '') +
+      (isDefault ? '<span class="prow__tag">default (on)</span>' : '') +
       '</div>' +
       '<div class="sound-row__desc">Render session cards as widgets (prettier, costs tokens) instead of plain text (cheaper, identical info).</div>' +
       '</div>' +
-      `<button type="button" class="sound-toggle" data-on="${on ? '1' : '0'}" aria-pressed="${on ? 'true' : 'false'}">${on ? 'On' : 'Off'}</button>` +
+      switchHtml(on, 'Rich in-feed cards') +
       '</div>';
   }
 
@@ -579,7 +584,7 @@
       '<div class="sound-row__label">Show my cross-project record</div>' +
       `<div class="sound-row__desc">${escapeHtml(totalsLine + consentNote)} You always see your own numbers here.</div>` +
       '</div>' +
-      `<button type="button" class="sound-toggle" data-on="${on ? '1' : '0'}" aria-pressed="${on ? 'true' : 'false'}">${on ? 'Shown' : 'Hidden'}</button>` +
+      switchHtml(on, 'Show my cross-project record') +
       '</div>';
   }
 
@@ -637,10 +642,10 @@
   function privacyRow(key, label, state, on, desc, note) {
     return `<div class="sound-row" data-privacy="${key}">` +
       '<div class="sound-row__text">' +
-      `<div class="sound-row__label">${escapeHtml(label)}${note}</div>` +
+      `<div class="sound-row__label">${escapeHtml(label)}<span class="prow__tag">${escapeHtml(state)}</span>${note}</div>` +
       `<div class="sound-row__desc">${escapeHtml(desc)}</div>` +
       '</div>' +
-      `<button type="button" class="sound-toggle" data-on="${on ? '1' : '0'}" aria-pressed="${on ? 'true' : 'false'}">${state}</button>` +
+      switchHtml(on, `${label}: ${state}`) +
       '</div>';
   }
 
@@ -976,11 +981,14 @@
       const body = (res.data || {});
       if (!res.ok) throw new Error(body.message || `HTTP ${res.status}`);
       const expires = body.expires_at ? new Date(body.expires_at).toLocaleString() : 'unknown';
+      // The secret is QUOTED (settings.css `.quote`): a 64-character token cannot
+      // be a line of prose, so it sits one tonal step down with its own foot.
       result.innerHTML =
-        '<p>Fresh CLI token issued. Paste it in your terminal:</p>' +
-        `<pre>${escapeHtml(body.paste_command || '')}</pre>` +
-        '<p><button type="button" class="settings-btn" id="cli-reissue-copy">Copy</button>' +
-        `<span class="settings-card__hint" style="margin-left:0.6rem;">Expires ${escapeHtml(expires)} · refreshes on use.</span></p>`;
+        '<p class="cli-result__say">Fresh CLI token issued. Paste it in your terminal:</p>' +
+        '<div class="quote"><p class="quote__eyebrow">paste command</p>' +
+        `<pre class="quote__pre">${escapeHtml(body.paste_command || '')}</pre>` +
+        '<div class="quote__foot"><button type="button" class="settings-btn settings-btn--quiet" id="cli-reissue-copy">Copy</button>' +
+        `<span class="settings-card__hint">Expires ${escapeHtml(expires)} · refreshes on use.</span></div></div>`;
       result.hidden = false;
       const copyBtn = $('#cli-reissue-copy');
       if (copyBtn) copyBtn.addEventListener('click', async () => {
@@ -1037,10 +1045,11 @@
 
   function artKeyEntryHtml() {
     return (
+      '<label class="field-label" for="artkey-input">Your key</label>' +
       '<div class="artkey-entry-row">' +
       '<input type="password" class="artkey-input" id="artkey-input" autocomplete="off" ' +
       'spellcheck="false" placeholder="Paste your Google AI Studio key">' +
-      '<button type="button" class="settings-btn" id="artkey-save">Save key</button>' +
+      '<button type="button" class="settings-btn craft-save" id="artkey-save">Save key</button>' +
       '</div>' +
       `<p class="settings-card__hint">${getOneLink} · Stored encrypted; never shown again after saving.</p>`
     );

package/modules/hall-ui/public/settings.states.json

@@ -0,0 +1,16 @@
+{
+  "_": "The hall's SETTINGS page through modules/ui-design/kit/render.js (task 1003308). Every panel on it is a form the page script fills from a dozen /me/* reads, so the floors run against the hall-preview harness rather than the kit's own stub:\n\n  node scripts/hall-preview/server.js --port 4621 --fixture-me\n  node modules/ui-design/kit/render.js --states modules/hall-ui/public/settings.states.json --base-in http://builders.localhost:4621 --base-out http://builders.localhost:4621\n\nOne group renders at a time behind the section rail, so each rail group is its own state. There is no `out` state on purpose: settings.js answers a 401 by navigating to the sign-in flow, and a state whose page navigates away measures the destination, not this page (the not-signed-in gate panel is the non-401 failure render, pinned statically in tests/hall_settings_world.mjs).",
+  "page": "/settings",
+  "surface": "hall-ui",
+  "stub": { "prefix": "/builders/" },
+  "modeQuery": false,
+  "ignoreRequests": ["/api/(gds|bongos)/", "/downloads/devbox/"],
+  "ignoreConsole": ["/api/(gds|bongos)/", "/downloads/devbox/", "\b401\b", "\b404\b", "Unauthorized", "Not Found", "load failed", "Password field"],
+  "states": {
+    "account": { "auth": true, "actions": [["wait", 900]], "expect": { "visible": ["#settings-h1", "#display-name-input", "#craft-chips", "#privacy-rows"] } },
+    "access": { "auth": true, "url": "/settings#access", "actions": [["wait", 900]], "expect": { "visible": ["#cli-reissue-btn", "#sessions-list", "#artkey-card"] } },
+    "preferences": { "auth": true, "url": "/settings#preferences", "actions": [["wait", 900]], "expect": { "visible": ["#wander-rows", "#render-rows"] } },
+    "sound": { "auth": true, "url": "/settings#sound", "actions": [["wait", 900]], "expect": { "visible": ["#voices-table", "#sound-rows", "#event-sound-rows"] } }
+  },
+  "reducedMotion": { "auth": true, "actions": [["wait", 900]] }
+}

package/modules/hall-ui/public/style.css

@@ -1693,7 +1693,10 @@ main [id] { scroll-margin-top: calc(var(--topbar-h) + 16px); }
   color: var(--ink-soft);
 }
 .profile__disc-label { color: var(--ink-faint); }
-.profile__disc-edit { font-size: 12.5px; }
+/* task 1003308: a link in the Standing card's fact line is a control and owes
+   the 24px floor (it measured 123x19); the prose-link recipe buys the height
+   with padding and hands the width back with the negative margin. */
+.profile__disc-edit { display: inline-block; min-width: 24px; min-height: 24px; padding: 3px 4px; margin: -3px -4px; font-size: 12.5px; }
 .profile__credits {
   display: flex;
   flex-direction: column;
@@ -1731,7 +1734,7 @@ main [id] { scroll-margin-top: calc(var(--topbar-h) + 16px); }
 .profile__budget--over { background: var(--danger-weak); color: var(--danger); border-color: color-mix(in srgb, var(--danger) 25%, transparent); }
 .profile__needs--action { background: var(--warn-weak); color: var(--warn); border-color: color-mix(in srgb, var(--warn) 25%, transparent); }
 .profile__needs--covered { background: var(--ok-weak); color: var(--ok); border-color: color-mix(in srgb, var(--ok) 22%, transparent); }
-.profile__needs-act { font-weight: 600; white-space: nowrap; }
+.profile__needs-act { display: inline-block; min-width: 24px; min-height: 24px; padding: 3px 4px; margin: -3px -4px; font-weight: 600; white-space: nowrap; }
 /* ADR 0120 part 5: owed-rebase gate banner — danger-tinted (it blocks new claims). */
 .profile__rebase { background: var(--danger-weak); color: var(--danger); border-color: color-mix(in srgb, var(--danger) 25%, transparent); }
 

package/modules/lifecycle/module.json

@@ -22,7 +22,8 @@
       "recommendations",
       "closeness",
       "visuals",
-      "kickoff-seed"
+      "kickoff-seed",
+      "rot"
     ],
     "pollers": [
       "publish-reconciler"

package/modules/lifecycle/rot.js

@@ -0,0 +1,210 @@
+'use strict';
+
+// modules/lifecycle/rot.js — what is quietly rotting, and the one write that says
+// "leave it alone" (task 1003279, goal 1000072, criterion legibility-sort-and-staleness).
+//
+// WHY THIS EXISTS. The goal's rotting half: "Untouched-for-X triggers a configured
+// action rather than a silent decay." The owner's decision (2026-08-25) fixed what
+// the action is — a NEEDS-ATTENTION ITEM, not an automatic status change and not a
+// nightly digest. A goal or task past the timer raises one line in the hall's
+// existing inbox, addressed to whoever created it and to the owner, offering the
+// four verbs the goal's own prose asks for: prune, kill, prioritise, water.
+// Rejected, and why: auto-demoting mutates real work with no human in the loop, and
+// a wrong timer then silently freezes it; a digest is a notification, not an action,
+// and gets scrolled past.
+//
+// THERE IS NO SWEEP, AND THAT IS THE DESIGN. Every line here is DERIVED on read from
+// the rot clock against the timer. Nothing is stored, so "exactly one open item per
+// stale thing, not one per sweep" is true by construction rather than by a
+// deduplicating poller that has to be written correctly and then stay correct. The
+// three consequences the owner's note asks for all fall out of the same fact:
+//   • acting on a line (prune/kill/prioritise) changes status → the row stops matching
+//   • watering pushes attention_watered_at forward → the row stops matching
+//   • a real edit moves updated_at → the row stops matching
+// Nothing to reconcile, nothing to garbage-collect, no way to accrete duplicates,
+// and no window in which the inbox and the database disagree.
+//
+// WHAT CAN ROT, AND WHAT DELIBERATELY CANNOT. Rot is *work nobody has picked up* —
+// not work in flight. Each exclusion below is excluded because some OTHER surface
+// already owns that question, and two surfaces asking the same question with two
+// different timers is the ADR 0226 failure:
+//   'active'                → the CLAIM-silence timer owns it (src/stale-timer.js);
+//                             the sweeper releases it and the Archon roster reports it.
+//   'blocked'               → a blocker owns it; /blocker-review is its cadence.
+//   'completed','confirmed' → the ship pipeline owns it; the publish reconciler and
+//                             the "Stranded ships" line report it.
+//   'shipped','abandoned'   → terminal. Nothing rots after it is done.
+// That leaves the queue nobody is working, which is exactly the pile the four verbs
+// are verbs for.
+
+const api = require('../../src/module-api');
+
+const { pool } = api;
+
+// The statuses that can rot, per tier. Exported so the tests assert against the same
+// set the query reads — a second copy of this list is how the inbox and its tests
+// drift into disagreeing about what rot even is.
+const TASK_ROTTABLE_STATUSES = Object.freeze(['backlog', 'ready']);
+const GOAL_ROTTABLE_STATUSES = Object.freeze(['open']);
+
+// The rot clock, spelled once. Both strings are duplicated VERBATIM in the index
+// expressions in migration core_231 — if you change one, change both, or the query
+// silently stops using the index. See that migration's header for why the first two
+// terms are shaped the way they are (they are task-lib.js's published definition of
+// "touched"; the water mark is the third term this task adds).
+const TASK_ROT_CLOCK = 'GREATEST(t.updated_at, COALESCE(t.shipped_at, t.updated_at), COALESCE(t.attention_watered_at, t.updated_at))';
+const GOAL_ROT_CLOCK = 'GREATEST(g.updated_at, COALESCE(g.attention_watered_at, g.updated_at))';
+
+// The verbs a line offers, per tier — served WITH the rows so the client renders
+// what the server will actually accept, instead of a button list that can drift out
+// of step with the routes behind it.
+//
+// Three of the four are EXISTING routes, on purpose: the nod slice in this same card
+// established the precedent (task 1003066 reused POST /tasks/:id/promote rather than
+// inventing an endpoint), and a verb that reuses a route also reuses its permission,
+// so this feature adds no new authority. Only `water` is new, because nothing in the
+// system could previously say "I looked at this, it is fine, ask me again later".
+//
+// A GOAL gets two verbs, not four, and the omission is honest rather than lazy:
+// promote/demote are task-lifecycle transitions that a goal has no equivalent of
+// (a goal is open, achieved or archived). Rendering a dead "prioritise" button on a
+// goal row would be worse than not offering it.
+const TASK_VERBS = Object.freeze([
+  Object.freeze({ verb: 'prioritise', label: 'Prioritise', method: 'POST', path: '/tasks/:id/promote', hint: 'make it claimable now' }),
+  Object.freeze({ verb: 'prune', label: 'Prune', method: 'POST', path: '/tasks/:id/demote', hint: 'back to the backlog, not dead' }),
+  Object.freeze({ verb: 'kill', label: 'Kill', method: 'POST', path: '/tasks/:id/abandon', hint: 'it is not going to happen' }),
+  Object.freeze({ verb: 'water', label: 'Water', method: 'POST', path: '/tasks/:id/water', hint: 'leave it — reset the clock' }),
+]);
+const GOAL_VERBS = Object.freeze([
+  Object.freeze({ verb: 'kill', label: 'Archive', method: 'POST', path: '/goals/:id/archive', hint: 'close it out' }),
+  Object.freeze({ verb: 'water', label: 'Water', method: 'POST', path: '/goals/:id/water', hint: 'leave it — reset the clock' }),
+]);
+
+const MAX_ROT_ROWS = 200;
+
+// rottingFor({ builderId, canSeeAll, rotDays, limit }) — the rot lines this caller
+// should see, oldest first.
+//
+// SCOPE. The owner's note addresses the item "to its creator, and to the owner", so:
+// a builder sees what they created; a caller with `canSeeAll` (the owner) sees
+// everything. A thing whose creator is NULL — created before attribution existed, or
+// by a system path (the core_227 convention) — is visible ONLY to canSeeAll, because
+// there is no person it could honestly be addressed to. Silently showing orphaned
+// rot to every builder would make the inbox everyone's problem and therefore
+// nobody's.
+//
+// Returns { rows, rotDays, cutoff } — `cutoff` is the timestamp the clock was
+// compared against, echoed so a reader can tell WHY a row is here without redoing
+// the arithmetic.
+async function rottingFor({ builderId, canSeeAll = false, rotDays, limit = 50 } = {}) {
+  const days = Number(rotDays);
+  if (!Number.isInteger(days) || days <= 0) {
+    throw new Error('rottingFor: rotDays must be a positive whole number of days');
+  }
+  const id = Number(builderId);
+  if (!Number.isInteger(id) || id <= 0) return { rows: [], rotDays: days, cutoff: null };
+  const cap = Math.max(1, Math.min(MAX_ROT_ROWS, Number(limit) || 50));
+
+  // One round trip for both tiers. The UNION arms are shaped to the same column list
+  // so the client renders one list of lines, not two lists it has to interleave.
+  const { rows } = await pool.query(
+    `WITH cutoff AS (SELECT now() - make_interval(days => $1::int) AS at)
+     SELECT * FROM (
+       SELECT 'task'::text                AS tier,
+              t.id::text                  AS id,
+              t.title                     AS title,
+              t.status                    AS status,
+              t.goal_id::text             AS goal_id,
+              g.title                     AS goal_title,
+              t.created_by::text          AS created_by,
+              ${TASK_ROT_CLOCK}           AS last_touched_at,
+              (t.attention_watered_at IS NOT NULL) AS ever_watered
+         FROM tasks t
+         LEFT JOIN goals g ON g.id = t.goal_id
+        WHERE t.status = ANY($2::text[])
+          AND ${TASK_ROT_CLOCK} < (SELECT at FROM cutoff)
+          AND ($4::boolean OR t.created_by = $3::bigint)
+       UNION ALL
+       SELECT 'goal'::text                AS tier,
+              g.id::text                  AS id,
+              g.title                     AS title,
+              g.status                    AS status,
+              NULL::text                  AS goal_id,
+              NULL::text                  AS goal_title,
+              g.created_by::text          AS created_by,
+              ${GOAL_ROT_CLOCK}           AS last_touched_at,
+              (g.attention_watered_at IS NOT NULL) AS ever_watered
+         FROM goals g
+        WHERE g.status = ANY($5::text[])
+          AND ${GOAL_ROT_CLOCK} < (SELECT at FROM cutoff)
+          AND ($4::boolean OR g.created_by = $3::bigint)
+     ) rot
+     ORDER BY last_touched_at ASC, tier ASC, id ASC
+     LIMIT $6`,
+    [days, TASK_ROTTABLE_STATUSES, id, canSeeAll, GOAL_ROTTABLE_STATUSES, cap]
+  );
+
+  const cutoffAt = new Date(Date.now() - days * 24 * 60 * 60 * 1000).toISOString();
+  return {
+    rows: rows.map((r) => ({ ...r, verbs: r.tier === 'task' ? TASK_VERBS : GOAL_VERBS })),
+    rotDays: days,
+    cutoff: cutoffAt,
+  };
+}
+
+// water(tier, id, builderId) — the clock reset, and the only write this file makes.
+//
+// IDEMPOTENT BY NATURE: watering an already-watered thing just moves the mark
+// forward again. There is no "already watered" error to handle, because a second
+// watering is a perfectly sensible thing for a human to do.
+//
+// Returns the new mark, or null when no such open row exists — the caller turns that
+// into a 404. Note the status filter: watering something that is already shipped,
+// abandoned or archived is refused, because the clock on a finished thing means
+// nothing and silently succeeding would tell the caller a lie.
+async function water(tier, id, builderId) {
+  const rowId = Number(id);
+  if (!Number.isInteger(rowId) || rowId <= 0) return null;
+  const by = Number.isInteger(Number(builderId)) && Number(builderId) > 0 ? Number(builderId) : null;
+
+  const table = tier === 'goal' ? 'goals' : 'tasks';
+  const statuses = tier === 'goal' ? GOAL_ROTTABLE_STATUSES : TASK_ROTTABLE_STATUSES;
+  const { rows } = await pool.query(
+    `UPDATE ${table}
+        SET attention_watered_at = now(),
+            attention_watered_by = $2
+      WHERE id = $1
+        AND status = ANY($3::text[])
+      RETURNING id::text AS id, attention_watered_at, attention_watered_by::text AS attention_watered_by`,
+    [rowId, by, statuses]
+  );
+  return rows[0] || null;
+}
+
+// createdBy(tier, id) — who a rot line is addressed to, for the authorization check
+// on `water`. Returns { created_by, status } or null. Separate from water() so the
+// route can refuse BEFORE writing, rather than writing and then discovering it
+// should not have.
+async function createdBy(tier, id) {
+  const rowId = Number(id);
+  if (!Number.isInteger(rowId) || rowId <= 0) return null;
+  const table = tier === 'goal' ? 'goals' : 'tasks';
+  const { rows } = await pool.query(
+    `SELECT created_by::text AS created_by, status FROM ${table} WHERE id = $1`,
+    [rowId]
+  );
+  return rows[0] || null;
+}
+
+module.exports = {
+  TASK_ROTTABLE_STATUSES,
+  GOAL_ROTTABLE_STATUSES,
+  TASK_ROT_CLOCK,
+  GOAL_ROT_CLOCK,
+  TASK_VERBS,
+  GOAL_VERBS,
+  MAX_ROT_ROWS,
+  rottingFor,
+  water,
+  createdBy,
+};

package/modules/lifecycle/routes/rot.js

@@ -0,0 +1,160 @@
+'use strict';
+
+// modules/lifecycle/routes/rot.js — GET /inbox/rotting + the two water writes
+// (task 1003279, goal 1000072, criterion legibility-sort-and-staleness).
+//
+// WHY. Goal 1000072's rotting half: work must not decay in silence. This is the read
+// the hall's needs-attention inbox calls to find out what is rotting, plus the one
+// write the owner's fourth verb needs — "water": leave it alone and reset its clock.
+//
+// The other three verbs (prune, kill, prioritise) are NOT here, and their absence is
+// the design. They reuse the routes that already do those jobs — promote, demote,
+// abandon, archive — which is the precedent the nod slice set in this same card
+// (task 1003066). A verb that reuses a route reuses its permission, so three
+// quarters of this feature adds no new authority to the system at all.
+//
+// The route is only the doorway; ../rot.js owns the SQL and the definition of rot.
+// Keep it that way — this file must never grow a query.
+//
+// MODULE BOUNDARY: reaches core only through the published doorway
+// `../../../src/module-api`; `../rot` is an intra-module sibling.
+
+const express = require('express');
+const api = require('../../../src/module-api');
+const rot = require('../rot');
+
+// The module's namespaced pino child (task 1003208) rather than console.* — a
+// structured line is attributable and rides ADR 0022's redaction; a bare console
+// call is neither, which is why the quality ratchet counts them.
+const log = api.logger('lifecycle');
+
+// Who may see rot that is addressed to someone else.
+//
+// The owner's note addresses each item "to its creator, and to the owner". The
+// creator half is an ownership fact the query already applies. This atom is the
+// other half — `builder.roster.read` is "may read another builder's record off the
+// roster", which is exactly what seeing someone else's rot is, and it is the atom
+// /builders/:id/active-claims and /builders/:id/credits already carry for the same
+// act. ADR 0157 delegated it archon→metic; the owner holds it a fortiori, so
+// "addressed to the owner" is satisfied without hardcoding an Archon identity
+// anywhere (the rule audit-authorship.sh enforces).
+const SEE_ALL_ROT = 'builder.roster.read';
+
+// Programmatic permission check — the middleware form cannot be used here because a
+// CREATOR with no atom at all must still be allowed through, and a gate mounted in
+// front of the handler would refuse them before the ownership fact is known.
+// Returns false when the governance port is absent or throws: authority that cannot
+// be established is a denial, never a pass (ADR 0016 fail-closed).
+async function holdsSeeAll(builderId) {
+  try {
+    const governance = api.resolveOptional('government');
+    if (!governance || typeof governance.builderHasPermissions !== 'function') return false;
+    return await governance.builderHasPermissions(Number(builderId), [SEE_ALL_ROT]);
+  } catch (err) {
+    log.error(`rot: permission resolve failed — denying fail-closed: ${err && err.message}`);
+    return false;
+  }
+}
+
+module.exports = function buildRotRouter() {
+  const router = express.Router();
+
+  // GET /inbox/rotting — what is quietly rotting, for this caller.
+  //
+  // rank: any-builder — own-scoped by default. The builder id comes from the
+  // authenticated session and is never read off the request, so a caller can only
+  // ever widen the result by HOLDING an atom, never by naming a different builder.
+  // A Xenos sees exactly the things they created and nothing else.
+  //
+  // ?rot_days= is a LENS, not a setting: it answers "what would 7 days show me?"
+  // without reconfiguring the project, and is never written back. The response
+  // reports the timer and where the number came from, so a reader can always tell a
+  // lens apart from the project's real answer (the src/stale-timer.js receipt
+  // convention — a number with no provenance is what let 6h and 24h coexist).
+  router.get('/inbox/rotting', api.requireBuilder, async (req, res) => {
+    try {
+      const builderId = Number(req.builder.id);
+      const timer = await api.resolveRotDays({ override: req.query.rot_days });
+      const canSeeAll = await holdsSeeAll(builderId);
+      const { limit } = api.parsePagination(req, { defaultLimit: 50, maxLimit: rot.MAX_ROT_ROWS });
+      const found = await rot.rottingFor({ builderId, canSeeAll, rotDays: timer.days, limit });
+
+      // A rot read is a clock comparison — a cached one is a wrong one the moment
+      // somebody waters a row.
+      res.set('Cache-Control', 'no-store');
+      res.json({
+        rows: found.rows,
+        count: found.rows.length,
+        scope: canSeeAll ? 'all' : 'mine',
+        timer: {
+          rot_days: timer.days,
+          source: timer.source,
+          // Present ONLY when a configured value could not be used. The inbox shows
+          // it to the person who can fix it rather than 500-ing (the reporting-
+          // degrades half of ADR 0226's asymmetric fail posture).
+          invalid: timer.invalid,
+          describe: api.projectSettings.describeRotTimer(timer),
+        },
+        cutoff: found.cutoff,
+      });
+    } catch (err) {
+      log.error(`GET /inbox/rotting: ${err && err.message}`);
+      res.fail('rot_read_failed', { status: 500, message: 'internal error' });
+    }
+  });
+
+  // The two water writes share everything but their tier, so they share a handler.
+  // Two separate routes rather than one /:tier/ route on purpose: an explicit path
+  // per tier is what lets the route-rank auditor and the generated OpenAPI describe
+  // each one, and it keeps a tier name out of the URL where a typo would 404 into
+  // something confusing.
+  //
+  // rank: any-builder + an ownership-or-atom check in the handler. Watering is the
+  // gentlest of the four verbs — it changes no status and destroys nothing; it says
+  // "I looked, it is fine, ask me later". Gating it any harder than seeing the line
+  // would mean showing a builder a button they are not allowed to press.
+  function waterHandler(tier) {
+    return async (req, res) => {
+      const id = api.parseId(req, res, { code: tier === 'goal' ? 'bad_goal_id' : 'bad_task_id', positiveInt: true });
+      if (id === null) return;
+      try {
+        const row = await rot.createdBy(tier, id);
+        if (!row) return res.fail(tier === 'goal' ? 'goal_not_found' : 'task_not_found', 404);
+
+        // Authorized iff the line was addressed to you: you created the thing, or you
+        // hold the atom that lets you see other people's rot.
+        const mine = row.created_by != null && String(row.created_by) === String(req.builder.id);
+        if (!mine && !(await holdsSeeAll(Number(req.builder.id)))) {
+          return res.fail('permission_forbidden', {
+            status: 403,
+            message: `only the ${tier}'s creator, or a builder holding ${SEE_ALL_ROT}, can water it`,
+          });
+        }
+
+        const watered = await rot.water(tier, id, Number(req.builder.id));
+        if (!watered) {
+          // The row exists but is not in a rottable status — already shipped,
+          // abandoned or archived. Say so rather than succeeding vacuously: a clock
+          // on a finished thing means nothing, and a silent 200 would tell the caller
+          // their click did something it did not.
+          return res.fail('not_rottable', {
+            status: 409,
+            message: `${tier} ${id} is '${row.status}' — a finished ${tier} has no rot clock to reset`,
+          });
+        }
+        res.json({ ok: true, tier, id: watered.id, watered_at: watered.attention_watered_at });
+      } catch (err) {
+        log.error(`POST /${tier}s/:id/water: ${err && err.message}`);
+        res.fail('water_failed', { status: 500, message: 'internal error' });
+      }
+    };
+  }
+
+  // POST /tasks/:id/water — reset a rotting task's clock.
+  router.post('/tasks/:id/water', api.requireBuilder, waterHandler('task'));
+
+  // POST /goals/:id/water — reset a rotting goal's clock.
+  router.post('/goals/:id/water', api.requireBuilder, waterHandler('goal'));
+
+  return router;
+};

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.484",
+  "version": "1.19.486",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.19.484",
+      "version": "1.19.486",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.484",
+  "version": "1.19.486",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/scripts/gds/fitness-checks-vocabulary.js

@@ -118,7 +118,6 @@ const GOAL_VOCAB_SURFACE = [
   // The FIFTH use (task 1003090): the hub's coarse project membership.
   'modules/platform-identity/platform-identity.js',
   'modules/platform-identity/routes/my-projects.js',
-  'modules/hall-ui/public/my-projects.js',
 ];
 // modules/lifecycle/db.js is 5k+ lines and legitimately says "role" about ranks
 // (the rank-sync port, builders.system_role). Scanning it whole would need an

package/scripts/gds/fitness.js

@@ -515,6 +515,15 @@ const KERNEL_FILES = [
   // this roster would read as a kernel->non-kernel leak; it imports only
   // instance-config + node built-ins, so joining costs nothing.
   'src/stale-timer.js',
+  // task 1003279 (goal 1000072, ADR 0232): the project's live knob store and the ROT
+  // timer resolver over it — the same category as stale-timer.js directly above (host
+  // configuration a module reads rather than hardcodes), differing only in living in
+  // the DB instead of the env, because task 1003280 requires that knob be changeable
+  // from a page without a redeploy. The doorway re-exports it, so leaving it off this
+  // roster reads as a kernel->non-kernel leak; it imports only pool.js (itself on this
+  // roster) + node built-ins, so joining costs nothing and buys the import-direction
+  // guarantee on the file every future project knob will be read through.
+  'src/bongos/project-settings.js',
   // BV1.R86: the git-remote/slug + publish-target identity the doorway exposes
   // (api.repoInfo) for the carved lifecycle github-push/conflict-resolve. It is
   // KERNEL (already in the module-scope-map kernel key) and imports only the