@bongos/core 1.19.485 → 1.19.486

package/modules/hall-ui/public/goal-inbox.js

@@ -167,6 +167,19 @@
   }
 
   function onClick(e) {
+    // task 1003279: a rot verb. Handled FIRST because its rows carry no data-goal —
+    // the path is server-declared and already tier-correct, so this branch needs to
+    // know nothing about which of the four verbs was pressed beyond what to say
+    // afterwards. Refreshes the ROT slice only: repainting the goals list would
+    // leave the acted-on row sitting there (the task-1003066 lesson).
+    const rotBtn = e.target.closest('[data-rot-path]');
+    if (rotBtn) {
+      const verb = rotBtn.dataset.rotVerb;
+      act(() => postJSON(`${API}${rotBtn.dataset.rotPath}`, {}),
+        ROT_TOASTS[verb] || 'Done.', loadRot);
+      return;
+    }
+
     // task 1003066 (BV1.R05): the nod. It reuses the EXISTING promote route —
     // POST /tasks/:id/promote, already Metic+ via task.promote — so giving a nod
     // adds no endpoint and no permission. Handled before the membership branches
@@ -262,6 +275,104 @@
       .catch(() => { /* a non-triager's 403, or a hiccup: never break the hall */ });
   }
 
+  // ---- the rot queue (task 1003279, goal 1000072) ---------------------------
+  //
+  // "Untouched-for-X triggers a configured action rather than a silent decay."
+  // The owner's decision (2026-08-25): the action is a LINE IN THIS CARD, not an
+  // automatic status change and not a nightly digest. Auto-demoting mutates real
+  // work with no human in the loop, and a wrong timer then silently freezes it; a
+  // digest is a notification, not an action, and gets scrolled past.
+  //
+  // THE BUTTONS ARE SERVER-DECLARED. Each row arrives carrying its own `verbs`
+  // array — label, method and path — and this renders exactly those. It is not
+  // decoration: three of the four verbs reuse EXISTING routes (promote, demote,
+  // abandon, archive) whose permissions differ by tier, and a hardcoded button list
+  // here would be a second copy of that mapping, free to drift into offering a
+  // button the server will refuse. A goal legitimately gets two verbs where a task
+  // gets four; this file does not need to know why.
+  //
+  // No client-side rank gate, for the same reason the nod slice has none: the read
+  // is scoped server-side, so a builder is only ever handed rows that are theirs to
+  // act on and the button list is already narrowed to what they can press.
+  const MAX_ROT_ROWS = 5;
+
+  function untouchedFor(iso) {
+    const t = iso ? Date.parse(iso) : NaN;
+    if (Number.isNaN(t)) return 'untouched';
+    const days = Math.floor((Date.now() - t) / 86400000);
+    if (days < 1) return 'untouched today';
+    return `untouched ${days} day${days === 1 ? '' : 's'}`;
+  }
+
+  function rotRowHtml(r) {
+    const href = r.tier === 'goal'
+      ? goalHref(r.id)
+      : `/task/${encodeURIComponent(r.id)}`;
+    const where = r.tier === 'goal'
+      ? 'goal'
+      : (r.goal_title ? escapeHtml(r.goal_title) : `goal ${escapeHtml(String(r.goal_id || '—'))}`);
+    // `watered` is worth showing: a row that is back DESPITE having been watered is
+    // a different message from one nobody has ever looked at, and hiding that would
+    // make the second watering feel like the first one did nothing.
+    const again = r.ever_watered ? ' · watered before' : '';
+    const buttons = (Array.isArray(r.verbs) ? r.verbs : []).map((v) => {
+      const path = String(v.path || '').replace(':id', encodeURIComponent(r.id));
+      return `<button class="btn-ghost" type="button" data-rot-path="${escapeHtml(path)}"`
+        + ` data-rot-verb="${escapeHtml(String(v.verb || ''))}"`
+        + ` title="${escapeHtml(String(v.hint || ''))}">${escapeHtml(String(v.label || v.verb || '?'))}</button>`;
+    }).join('');
+    return `<li class="ginbox__item" data-rot-tier="${escapeHtml(String(r.tier))}">
+        <div class="ginbox__main">
+          <a class="ginbox__goal" href="${href}">${escapeHtml(r.title || `${r.tier} #${r.id}`)}</a>
+          <span class="ginbox__sub">${escapeHtml(String(r.status || ''))} · ${where} · ${escapeHtml(untouchedFor(r.last_touched_at))}${again}</span>
+        </div>
+        <div class="ginbox__acts">${buttons}</div>
+      </li>`;
+  }
+
+  // What each verb says when it lands. Keyed by the SERVER's verb name so a new verb
+  // degrades to a neutral confirmation instead of a blank toast.
+  const ROT_TOASTS = {
+    prioritise: 'Prioritised — it’s claimable now.',
+    prune: 'Pruned — back in the backlog.',
+    kill: 'Killed — it won’t come back.',
+    water: 'Watered — the clock is reset.',
+  };
+
+  function renderRot(data) {
+    const box = host && host.querySelector('#attention-rot');
+    if (!box) return;
+    const rows = (data && Array.isArray(data.rows)) ? data.rows : [];
+    if (!rows.length) {
+      box.innerHTML = '';
+      window.OTBAttention?.refresh();
+      return;
+    }
+    const shown = rows.slice(0, MAX_ROT_ROWS);
+    const more = rows.length > shown.length
+      ? `<p class="ginbox__pending">…${rows.length - shown.length} more going quiet.</p>`
+      : '';
+    // The heading names the TIMER, not just the count. A reader who disagrees with
+    // the line ("30 days is too short for a backlog") needs to know which number
+    // produced it before they can go change it — and when that number came from a
+    // value the server could not use, the receipt says so here, on the screen of
+    // somebody who can fix it.
+    const t = (data && data.timer) || {};
+    const timerNote = t.invalid
+      ? `<span class="ginbox__sub"> — ${escapeHtml(String(t.describe || ''))}</span>`
+      : `<span class="ginbox__sub"> — untouched ${escapeHtml(String(t.rot_days ?? '?'))}+ days</span>`;
+    box.innerHTML = '<h3 class="ginbox__sec-h">Going quiet '
+      + `<span class="count-pill">${rows.length}</span>${timerNote}</h3>`
+      + `<ul class="ginbox__list">${shown.map(rotRowHtml).join('')}</ul>${more}`;
+    window.OTBAttention?.refresh();
+  }
+
+  function loadRot() {
+    return getJSON(`${API}/inbox/rotting`)
+      .then((data) => renderRot(data))
+      .catch(() => { /* signed out, older server, or a hiccup: never break the hall */ });
+  }
+
   // task 2169: this widget IS the "Needs your attention" card — ONE capped
   // summary hosting every actionable item class: goal invitations +
   // join-requests (this file) and ideas awaiting triage (builders.js renders
@@ -294,10 +405,17 @@
       // awaiting a nod inside a goal sits nearer the goals slice than idea
       // triage. Its rows carry the shared .ginbox__item class, so refresh()
       // counts them with no change to the selector below.
-      '<div id="attention-nod"></div>';
+      '<div id="attention-nod"></div>' +
+      // task 1003279 (goal 1000072): work going quiet — a goal or task untouched
+      // past the project's rot timer, with the owner's four verbs on it. LAST in
+      // the card on purpose: every slice above is somebody waiting on YOU right
+      // now, while rot is a standing question that has already waited weeks and
+      // can wait until they are read.
+      '<div id="attention-rot"></div>';
     host.addEventListener('click', onClick);
     load();
     loadNodQueue();
+    loadRot();
     // task 1002802 (P06): the profile slice lives in its own file (builders.js is
     // over the size budget); this card owns its div, so it boots it here.
     window.OTBProfileNudge?.load();

package/modules/lifecycle/module.json

@@ -22,7 +22,8 @@
       "recommendations",
       "closeness",
       "visuals",
-      "kickoff-seed"
+      "kickoff-seed",
+      "rot"
     ],
     "pollers": [
       "publish-reconciler"

package/modules/lifecycle/rot.js

@@ -0,0 +1,210 @@
+'use strict';
+
+// modules/lifecycle/rot.js — what is quietly rotting, and the one write that says
+// "leave it alone" (task 1003279, goal 1000072, criterion legibility-sort-and-staleness).
+//
+// WHY THIS EXISTS. The goal's rotting half: "Untouched-for-X triggers a configured
+// action rather than a silent decay." The owner's decision (2026-08-25) fixed what
+// the action is — a NEEDS-ATTENTION ITEM, not an automatic status change and not a
+// nightly digest. A goal or task past the timer raises one line in the hall's
+// existing inbox, addressed to whoever created it and to the owner, offering the
+// four verbs the goal's own prose asks for: prune, kill, prioritise, water.
+// Rejected, and why: auto-demoting mutates real work with no human in the loop, and
+// a wrong timer then silently freezes it; a digest is a notification, not an action,
+// and gets scrolled past.
+//
+// THERE IS NO SWEEP, AND THAT IS THE DESIGN. Every line here is DERIVED on read from
+// the rot clock against the timer. Nothing is stored, so "exactly one open item per
+// stale thing, not one per sweep" is true by construction rather than by a
+// deduplicating poller that has to be written correctly and then stay correct. The
+// three consequences the owner's note asks for all fall out of the same fact:
+//   • acting on a line (prune/kill/prioritise) changes status → the row stops matching
+//   • watering pushes attention_watered_at forward → the row stops matching
+//   • a real edit moves updated_at → the row stops matching
+// Nothing to reconcile, nothing to garbage-collect, no way to accrete duplicates,
+// and no window in which the inbox and the database disagree.
+//
+// WHAT CAN ROT, AND WHAT DELIBERATELY CANNOT. Rot is *work nobody has picked up* —
+// not work in flight. Each exclusion below is excluded because some OTHER surface
+// already owns that question, and two surfaces asking the same question with two
+// different timers is the ADR 0226 failure:
+//   'active'                → the CLAIM-silence timer owns it (src/stale-timer.js);
+//                             the sweeper releases it and the Archon roster reports it.
+//   'blocked'               → a blocker owns it; /blocker-review is its cadence.
+//   'completed','confirmed' → the ship pipeline owns it; the publish reconciler and
+//                             the "Stranded ships" line report it.
+//   'shipped','abandoned'   → terminal. Nothing rots after it is done.
+// That leaves the queue nobody is working, which is exactly the pile the four verbs
+// are verbs for.
+
+const api = require('../../src/module-api');
+
+const { pool } = api;
+
+// The statuses that can rot, per tier. Exported so the tests assert against the same
+// set the query reads — a second copy of this list is how the inbox and its tests
+// drift into disagreeing about what rot even is.
+const TASK_ROTTABLE_STATUSES = Object.freeze(['backlog', 'ready']);
+const GOAL_ROTTABLE_STATUSES = Object.freeze(['open']);
+
+// The rot clock, spelled once. Both strings are duplicated VERBATIM in the index
+// expressions in migration core_231 — if you change one, change both, or the query
+// silently stops using the index. See that migration's header for why the first two
+// terms are shaped the way they are (they are task-lib.js's published definition of
+// "touched"; the water mark is the third term this task adds).
+const TASK_ROT_CLOCK = 'GREATEST(t.updated_at, COALESCE(t.shipped_at, t.updated_at), COALESCE(t.attention_watered_at, t.updated_at))';
+const GOAL_ROT_CLOCK = 'GREATEST(g.updated_at, COALESCE(g.attention_watered_at, g.updated_at))';
+
+// The verbs a line offers, per tier — served WITH the rows so the client renders
+// what the server will actually accept, instead of a button list that can drift out
+// of step with the routes behind it.
+//
+// Three of the four are EXISTING routes, on purpose: the nod slice in this same card
+// established the precedent (task 1003066 reused POST /tasks/:id/promote rather than
+// inventing an endpoint), and a verb that reuses a route also reuses its permission,
+// so this feature adds no new authority. Only `water` is new, because nothing in the
+// system could previously say "I looked at this, it is fine, ask me again later".
+//
+// A GOAL gets two verbs, not four, and the omission is honest rather than lazy:
+// promote/demote are task-lifecycle transitions that a goal has no equivalent of
+// (a goal is open, achieved or archived). Rendering a dead "prioritise" button on a
+// goal row would be worse than not offering it.
+const TASK_VERBS = Object.freeze([
+  Object.freeze({ verb: 'prioritise', label: 'Prioritise', method: 'POST', path: '/tasks/:id/promote', hint: 'make it claimable now' }),
+  Object.freeze({ verb: 'prune', label: 'Prune', method: 'POST', path: '/tasks/:id/demote', hint: 'back to the backlog, not dead' }),
+  Object.freeze({ verb: 'kill', label: 'Kill', method: 'POST', path: '/tasks/:id/abandon', hint: 'it is not going to happen' }),
+  Object.freeze({ verb: 'water', label: 'Water', method: 'POST', path: '/tasks/:id/water', hint: 'leave it — reset the clock' }),
+]);
+const GOAL_VERBS = Object.freeze([
+  Object.freeze({ verb: 'kill', label: 'Archive', method: 'POST', path: '/goals/:id/archive', hint: 'close it out' }),
+  Object.freeze({ verb: 'water', label: 'Water', method: 'POST', path: '/goals/:id/water', hint: 'leave it — reset the clock' }),
+]);
+
+const MAX_ROT_ROWS = 200;
+
+// rottingFor({ builderId, canSeeAll, rotDays, limit }) — the rot lines this caller
+// should see, oldest first.
+//
+// SCOPE. The owner's note addresses the item "to its creator, and to the owner", so:
+// a builder sees what they created; a caller with `canSeeAll` (the owner) sees
+// everything. A thing whose creator is NULL — created before attribution existed, or
+// by a system path (the core_227 convention) — is visible ONLY to canSeeAll, because
+// there is no person it could honestly be addressed to. Silently showing orphaned
+// rot to every builder would make the inbox everyone's problem and therefore
+// nobody's.
+//
+// Returns { rows, rotDays, cutoff } — `cutoff` is the timestamp the clock was
+// compared against, echoed so a reader can tell WHY a row is here without redoing
+// the arithmetic.
+async function rottingFor({ builderId, canSeeAll = false, rotDays, limit = 50 } = {}) {
+  const days = Number(rotDays);
+  if (!Number.isInteger(days) || days <= 0) {
+    throw new Error('rottingFor: rotDays must be a positive whole number of days');
+  }
+  const id = Number(builderId);
+  if (!Number.isInteger(id) || id <= 0) return { rows: [], rotDays: days, cutoff: null };
+  const cap = Math.max(1, Math.min(MAX_ROT_ROWS, Number(limit) || 50));
+
+  // One round trip for both tiers. The UNION arms are shaped to the same column list
+  // so the client renders one list of lines, not two lists it has to interleave.
+  const { rows } = await pool.query(
+    `WITH cutoff AS (SELECT now() - make_interval(days => $1::int) AS at)
+     SELECT * FROM (
+       SELECT 'task'::text                AS tier,
+              t.id::text                  AS id,
+              t.title                     AS title,
+              t.status                    AS status,
+              t.goal_id::text             AS goal_id,
+              g.title                     AS goal_title,
+              t.created_by::text          AS created_by,
+              ${TASK_ROT_CLOCK}           AS last_touched_at,
+              (t.attention_watered_at IS NOT NULL) AS ever_watered
+         FROM tasks t
+         LEFT JOIN goals g ON g.id = t.goal_id
+        WHERE t.status = ANY($2::text[])
+          AND ${TASK_ROT_CLOCK} < (SELECT at FROM cutoff)
+          AND ($4::boolean OR t.created_by = $3::bigint)
+       UNION ALL
+       SELECT 'goal'::text                AS tier,
+              g.id::text                  AS id,
+              g.title                     AS title,
+              g.status                    AS status,
+              NULL::text                  AS goal_id,
+              NULL::text                  AS goal_title,
+              g.created_by::text          AS created_by,
+              ${GOAL_ROT_CLOCK}           AS last_touched_at,
+              (g.attention_watered_at IS NOT NULL) AS ever_watered
+         FROM goals g
+        WHERE g.status = ANY($5::text[])
+          AND ${GOAL_ROT_CLOCK} < (SELECT at FROM cutoff)
+          AND ($4::boolean OR g.created_by = $3::bigint)
+     ) rot
+     ORDER BY last_touched_at ASC, tier ASC, id ASC
+     LIMIT $6`,
+    [days, TASK_ROTTABLE_STATUSES, id, canSeeAll, GOAL_ROTTABLE_STATUSES, cap]
+  );
+
+  const cutoffAt = new Date(Date.now() - days * 24 * 60 * 60 * 1000).toISOString();
+  return {
+    rows: rows.map((r) => ({ ...r, verbs: r.tier === 'task' ? TASK_VERBS : GOAL_VERBS })),
+    rotDays: days,
+    cutoff: cutoffAt,
+  };
+}
+
+// water(tier, id, builderId) — the clock reset, and the only write this file makes.
+//
+// IDEMPOTENT BY NATURE: watering an already-watered thing just moves the mark
+// forward again. There is no "already watered" error to handle, because a second
+// watering is a perfectly sensible thing for a human to do.
+//
+// Returns the new mark, or null when no such open row exists — the caller turns that
+// into a 404. Note the status filter: watering something that is already shipped,
+// abandoned or archived is refused, because the clock on a finished thing means
+// nothing and silently succeeding would tell the caller a lie.
+async function water(tier, id, builderId) {
+  const rowId = Number(id);
+  if (!Number.isInteger(rowId) || rowId <= 0) return null;
+  const by = Number.isInteger(Number(builderId)) && Number(builderId) > 0 ? Number(builderId) : null;
+
+  const table = tier === 'goal' ? 'goals' : 'tasks';
+  const statuses = tier === 'goal' ? GOAL_ROTTABLE_STATUSES : TASK_ROTTABLE_STATUSES;
+  const { rows } = await pool.query(
+    `UPDATE ${table}
+        SET attention_watered_at = now(),
+            attention_watered_by = $2
+      WHERE id = $1
+        AND status = ANY($3::text[])
+      RETURNING id::text AS id, attention_watered_at, attention_watered_by::text AS attention_watered_by`,
+    [rowId, by, statuses]
+  );
+  return rows[0] || null;
+}
+
+// createdBy(tier, id) — who a rot line is addressed to, for the authorization check
+// on `water`. Returns { created_by, status } or null. Separate from water() so the
+// route can refuse BEFORE writing, rather than writing and then discovering it
+// should not have.
+async function createdBy(tier, id) {
+  const rowId = Number(id);
+  if (!Number.isInteger(rowId) || rowId <= 0) return null;
+  const table = tier === 'goal' ? 'goals' : 'tasks';
+  const { rows } = await pool.query(
+    `SELECT created_by::text AS created_by, status FROM ${table} WHERE id = $1`,
+    [rowId]
+  );
+  return rows[0] || null;
+}
+
+module.exports = {
+  TASK_ROTTABLE_STATUSES,
+  GOAL_ROTTABLE_STATUSES,
+  TASK_ROT_CLOCK,
+  GOAL_ROT_CLOCK,
+  TASK_VERBS,
+  GOAL_VERBS,
+  MAX_ROT_ROWS,
+  rottingFor,
+  water,
+  createdBy,
+};

package/modules/lifecycle/routes/rot.js

@@ -0,0 +1,160 @@
+'use strict';
+
+// modules/lifecycle/routes/rot.js — GET /inbox/rotting + the two water writes
+// (task 1003279, goal 1000072, criterion legibility-sort-and-staleness).
+//
+// WHY. Goal 1000072's rotting half: work must not decay in silence. This is the read
+// the hall's needs-attention inbox calls to find out what is rotting, plus the one
+// write the owner's fourth verb needs — "water": leave it alone and reset its clock.
+//
+// The other three verbs (prune, kill, prioritise) are NOT here, and their absence is
+// the design. They reuse the routes that already do those jobs — promote, demote,
+// abandon, archive — which is the precedent the nod slice set in this same card
+// (task 1003066). A verb that reuses a route reuses its permission, so three
+// quarters of this feature adds no new authority to the system at all.
+//
+// The route is only the doorway; ../rot.js owns the SQL and the definition of rot.
+// Keep it that way — this file must never grow a query.
+//
+// MODULE BOUNDARY: reaches core only through the published doorway
+// `../../../src/module-api`; `../rot` is an intra-module sibling.
+
+const express = require('express');
+const api = require('../../../src/module-api');
+const rot = require('../rot');
+
+// The module's namespaced pino child (task 1003208) rather than console.* — a
+// structured line is attributable and rides ADR 0022's redaction; a bare console
+// call is neither, which is why the quality ratchet counts them.
+const log = api.logger('lifecycle');
+
+// Who may see rot that is addressed to someone else.
+//
+// The owner's note addresses each item "to its creator, and to the owner". The
+// creator half is an ownership fact the query already applies. This atom is the
+// other half — `builder.roster.read` is "may read another builder's record off the
+// roster", which is exactly what seeing someone else's rot is, and it is the atom
+// /builders/:id/active-claims and /builders/:id/credits already carry for the same
+// act. ADR 0157 delegated it archon→metic; the owner holds it a fortiori, so
+// "addressed to the owner" is satisfied without hardcoding an Archon identity
+// anywhere (the rule audit-authorship.sh enforces).
+const SEE_ALL_ROT = 'builder.roster.read';
+
+// Programmatic permission check — the middleware form cannot be used here because a
+// CREATOR with no atom at all must still be allowed through, and a gate mounted in
+// front of the handler would refuse them before the ownership fact is known.
+// Returns false when the governance port is absent or throws: authority that cannot
+// be established is a denial, never a pass (ADR 0016 fail-closed).
+async function holdsSeeAll(builderId) {
+  try {
+    const governance = api.resolveOptional('government');
+    if (!governance || typeof governance.builderHasPermissions !== 'function') return false;
+    return await governance.builderHasPermissions(Number(builderId), [SEE_ALL_ROT]);
+  } catch (err) {
+    log.error(`rot: permission resolve failed — denying fail-closed: ${err && err.message}`);
+    return false;
+  }
+}
+
+module.exports = function buildRotRouter() {
+  const router = express.Router();
+
+  // GET /inbox/rotting — what is quietly rotting, for this caller.
+  //
+  // rank: any-builder — own-scoped by default. The builder id comes from the
+  // authenticated session and is never read off the request, so a caller can only
+  // ever widen the result by HOLDING an atom, never by naming a different builder.
+  // A Xenos sees exactly the things they created and nothing else.
+  //
+  // ?rot_days= is a LENS, not a setting: it answers "what would 7 days show me?"
+  // without reconfiguring the project, and is never written back. The response
+  // reports the timer and where the number came from, so a reader can always tell a
+  // lens apart from the project's real answer (the src/stale-timer.js receipt
+  // convention — a number with no provenance is what let 6h and 24h coexist).
+  router.get('/inbox/rotting', api.requireBuilder, async (req, res) => {
+    try {
+      const builderId = Number(req.builder.id);
+      const timer = await api.resolveRotDays({ override: req.query.rot_days });
+      const canSeeAll = await holdsSeeAll(builderId);
+      const { limit } = api.parsePagination(req, { defaultLimit: 50, maxLimit: rot.MAX_ROT_ROWS });
+      const found = await rot.rottingFor({ builderId, canSeeAll, rotDays: timer.days, limit });
+
+      // A rot read is a clock comparison — a cached one is a wrong one the moment
+      // somebody waters a row.
+      res.set('Cache-Control', 'no-store');
+      res.json({
+        rows: found.rows,
+        count: found.rows.length,
+        scope: canSeeAll ? 'all' : 'mine',
+        timer: {
+          rot_days: timer.days,
+          source: timer.source,
+          // Present ONLY when a configured value could not be used. The inbox shows
+          // it to the person who can fix it rather than 500-ing (the reporting-
+          // degrades half of ADR 0226's asymmetric fail posture).
+          invalid: timer.invalid,
+          describe: api.projectSettings.describeRotTimer(timer),
+        },
+        cutoff: found.cutoff,
+      });
+    } catch (err) {
+      log.error(`GET /inbox/rotting: ${err && err.message}`);
+      res.fail('rot_read_failed', { status: 500, message: 'internal error' });
+    }
+  });
+
+  // The two water writes share everything but their tier, so they share a handler.
+  // Two separate routes rather than one /:tier/ route on purpose: an explicit path
+  // per tier is what lets the route-rank auditor and the generated OpenAPI describe
+  // each one, and it keeps a tier name out of the URL where a typo would 404 into
+  // something confusing.
+  //
+  // rank: any-builder + an ownership-or-atom check in the handler. Watering is the
+  // gentlest of the four verbs — it changes no status and destroys nothing; it says
+  // "I looked, it is fine, ask me later". Gating it any harder than seeing the line
+  // would mean showing a builder a button they are not allowed to press.
+  function waterHandler(tier) {
+    return async (req, res) => {
+      const id = api.parseId(req, res, { code: tier === 'goal' ? 'bad_goal_id' : 'bad_task_id', positiveInt: true });
+      if (id === null) return;
+      try {
+        const row = await rot.createdBy(tier, id);
+        if (!row) return res.fail(tier === 'goal' ? 'goal_not_found' : 'task_not_found', 404);
+
+        // Authorized iff the line was addressed to you: you created the thing, or you
+        // hold the atom that lets you see other people's rot.
+        const mine = row.created_by != null && String(row.created_by) === String(req.builder.id);
+        if (!mine && !(await holdsSeeAll(Number(req.builder.id)))) {
+          return res.fail('permission_forbidden', {
+            status: 403,
+            message: `only the ${tier}'s creator, or a builder holding ${SEE_ALL_ROT}, can water it`,
+          });
+        }
+
+        const watered = await rot.water(tier, id, Number(req.builder.id));
+        if (!watered) {
+          // The row exists but is not in a rottable status — already shipped,
+          // abandoned or archived. Say so rather than succeeding vacuously: a clock
+          // on a finished thing means nothing, and a silent 200 would tell the caller
+          // their click did something it did not.
+          return res.fail('not_rottable', {
+            status: 409,
+            message: `${tier} ${id} is '${row.status}' — a finished ${tier} has no rot clock to reset`,
+          });
+        }
+        res.json({ ok: true, tier, id: watered.id, watered_at: watered.attention_watered_at });
+      } catch (err) {
+        log.error(`POST /${tier}s/:id/water: ${err && err.message}`);
+        res.fail('water_failed', { status: 500, message: 'internal error' });
+      }
+    };
+  }
+
+  // POST /tasks/:id/water — reset a rotting task's clock.
+  router.post('/tasks/:id/water', api.requireBuilder, waterHandler('task'));
+
+  // POST /goals/:id/water — reset a rotting goal's clock.
+  router.post('/goals/:id/water', api.requireBuilder, waterHandler('goal'));
+
+  return router;
+};

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.485",
+  "version": "1.19.486",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.19.485",
+      "version": "1.19.486",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.485",
+  "version": "1.19.486",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/scripts/gds/fitness.js

@@ -515,6 +515,15 @@ const KERNEL_FILES = [
   // this roster would read as a kernel->non-kernel leak; it imports only
   // instance-config + node built-ins, so joining costs nothing.
   'src/stale-timer.js',
+  // task 1003279 (goal 1000072, ADR 0232): the project's live knob store and the ROT
+  // timer resolver over it — the same category as stale-timer.js directly above (host
+  // configuration a module reads rather than hardcodes), differing only in living in
+  // the DB instead of the env, because task 1003280 requires that knob be changeable
+  // from a page without a redeploy. The doorway re-exports it, so leaving it off this
+  // roster reads as a kernel->non-kernel leak; it imports only pool.js (itself on this
+  // roster) + node built-ins, so joining costs nothing and buys the import-direction
+  // guarantee on the file every future project knob will be read through.
+  'src/bongos/project-settings.js',
   // BV1.R86: the git-remote/slug + publish-target identity the doorway exposes
   // (api.repoInfo) for the carved lifecycle github-push/conflict-resolve. It is
   // KERNEL (already in the module-scope-map kernel key) and imports only the