@bongos/core 1.19.650 → 1.19.652

package/.bongos-core.json

@@ -2,22 +2,22 @@
   "artifact": "bongos-core",
   "manifest_schema": 1,
   "generator": "scripts/gds/package-core.js",
-  "core_version": "1.19.650",
-  "core_contract": "1.19.650",
-  "source_commit": "5616186b29fea16f71cec70846cda88fe124c8c7",
+  "core_version": "1.19.652",
+  "core_contract": "1.19.652",
+  "source_commit": "addabb3fbae5b20acb74b0d7ee3cf369d6a4e8f5",
   "source_ref": "HEAD",
-  "built_at": "2026-09-10T20:01:10.390Z",
+  "built_at": "2026-09-10T21:00:32.591Z",
   "redaction": {
     "model": "docs-redacted+functional-verbatim",
-    "docs_redacted": 471,
+    "docs_redacted": 472,
     "agent_docs_stubbed": 24,
-    "functional_verbatim": 2109,
+    "functional_verbatim": 2110,
     "rules": 3,
     "gate_literals": 3,
     "gate": "passed"
   },
-  "file_count": 2604,
-  "tree_sha256": "39e08e82e8577f3b084821c1496216c5420ba3297223ffd477c047ea6f1a8e39",
+  "file_count": 2606,
+  "tree_sha256": "0625f6b55212a6ec7203db50d856c576c15b3eda23ea574a46fb212641dc163c",
   "files": [
     {
       "path": ".claude/skills/backlog-review/SKILL.md",
@@ -382,7 +382,7 @@
     {
       "path": "clients/bongos-client/index.d.ts",
       "mode": "0000644",
-      "sha256": "5ef1befd1a1b30e8ef9e8b8ca08f768361d2422f6ddba2160a5395d46a84d443"
+      "sha256": "a82dc5f2fdcf44a1abff4bd8ba0aec70cc49004ad5feae72c362e8b45c5f04e5"
     },
     {
       "path": "clients/bongos-client/index.mjs",
@@ -1889,20 +1889,25 @@
       "mode": "0000644",
       "sha256": "2830a09a2d0520e7992c8e7d1545304092857267a9060f5127bd2ffcff237ebc"
     },
+    {
+      "path": "docs/adr/0277-a-box-is-in-use-only-while-a-human-is-attached.md",
+      "mode": "0000644",
+      "sha256": "e5e99f19152b5a98c21f70fc0e54a09e9ae59beeb81fea8d26df2de4ef196b90"
+    },
     {
       "path": "docs/adr/README.md",
       "mode": "0000644",
-      "sha256": "0c6981591a439c22775b596f69e602ba7801f8d8549d4244ca8fefc5dc48ac3b"
+      "sha256": "5ee80f0739cfbe9543f746ed13efbfeeaa56c350fb4e9570c7c122723b86a34a"
     },
     {
       "path": "docs/api-reference.md",
       "mode": "0000644",
-      "sha256": "6c5f26c9c00387ecc84ed80726a4d62eca0f017f1d75c304d758961749fe616f"
+      "sha256": "fe08952e837f4e79243823d66876f2413ca1d743c22bc2a287c18275616692d4"
     },
     {
       "path": "docs/api/openapi.json",
       "mode": "0000644",
-      "sha256": "d63a4ab6e92a24d339a632360fb92246512e09eabbc5bff632881bda6d4abf50"
+      "sha256": "db8be14055cc32b31376585ad954e1e91a8b1cbe77401bad3d5215c1d3b419aa"
     },
     {
       "path": "docs/architecture.md",
@@ -2777,7 +2782,7 @@
     {
       "path": "docs/module-api-changelog.md",
       "mode": "0000644",
-      "sha256": "6d296bf6c8df69fc9ec84f3a6548039ef304b369a93d7ac2c4c80bc2ba86842f"
+      "sha256": "7b9836503b654f29b308db8418484f1f707bfe6edcd32aaae6aa1c1a17216b5b"
     },
     {
       "path": "docs/modules-contract.md",
@@ -3824,6 +3829,11 @@
       "mode": "0000644",
       "sha256": "2cda282b43ea71dd82ddf4e5ece90f11ad4013cbee0820f0a33391f202feff9c"
     },
+    {
+      "path": "migrations/core_238_box_unattended_cap.sql",
+      "mode": "0000644",
+      "sha256": "03df9104a0309011df1b6e96627c62cc6612f34b654134306d13fd5c89b8f038"
+    },
     {
       "path": "modules/agents/lib/validate.js",
       "mode": "0000644",
@@ -4247,7 +4257,7 @@
     {
       "path": "modules/dev-box/boxes.js",
       "mode": "0000644",
-      "sha256": "667993d81db36e1ddd1307013044f3d40b6baca3c6f5271b77332d10fa290063"
+      "sha256": "cd1fe37f04e6a32964fd165045ac6613ce2e1236e1ff388da38d428a769beb4b"
     },
     {
       "path": "modules/dev-box/db.js",
@@ -4262,7 +4272,7 @@
     {
       "path": "modules/dev-box/routes/box.js",
       "mode": "0000644",
-      "sha256": "b61996de3fa3dbdc9b8fb639fd53aba5c1c2567350dc602b39ebbbd3a93164ac"
+      "sha256": "c5cef340b2a5c85202d07709f1b96983eb03ce5a15168684922e2de1ae025d71"
     },
     {
       "path": "modules/discord/CLAUDE.md",
@@ -7732,12 +7742,12 @@
     {
       "path": "package-lock.json",
       "mode": "0000644",
-      "sha256": "8ac99c68b8d148e7e3a53cbcb94d2e2bd10f6d95e87bd173b2fc6b9497e7fe8e"
+      "sha256": "9fcb8bfb10f688b6442649f49bd4cc91454e56a44169414ca8839caab3fc05c7"
     },
     {
       "path": "package.json",
       "mode": "0000644",
-      "sha256": "8dc1331a5f582689d16c699861f729674dfcb8d02485a285ff71c46428a6d010"
+      "sha256": "ed0d91d1a9a16e1f8e97ce2b538de568c297bc281cf15ea99f22f9bb92f1b5f0"
     },
     {
       "path": "public-docs/index.html",
@@ -7922,7 +7932,7 @@
     {
       "path": "scripts/gds/box-infra.js",
       "mode": "0000644",
-      "sha256": "bfbe7348ddc9895d4eed1a23efe9246b44850e1bfe6d6015d63a0b2a4433373d"
+      "sha256": "811545b6769947c5399f4be52782e90c1a6c2e628e72d7751266d2c7dafb62c3"
     },
     {
       "path": "scripts/gds/box-sync.js",
@@ -7932,7 +7942,7 @@
     {
       "path": "scripts/gds/box.js",
       "mode": "0000644",
-      "sha256": "afcebfb8e8e8f7041ee9cbfce1e9b8a46a299feb5e6e89ce4e00273135b268db"
+      "sha256": "e7d82101c8212d1c46da944bb52f2d18a7fc87293f66f18e6856844f8766666b"
     },
     {
       "path": "scripts/gds/bug-triage.js",
@@ -8902,7 +8912,7 @@
     {
       "path": "scripts/gds/ship-land.js",
       "mode": "0000644",
-      "sha256": "72efd4268060fb5ddf8a176d91baf01353dc1e82594d70feef029c45f748d8f9"
+      "sha256": "d8cd184816230b7b246ec7afaa2ea285b7ba0e24bb8f47f79d2bc7fa5b423429"
     },
     {
       "path": "scripts/gds/ship-memory-sync.js",
@@ -8912,7 +8922,7 @@
     {
       "path": "scripts/gds/ship-merge.js",
       "mode": "0000644",
-      "sha256": "7c5751c146bcddc9cbf88c6177925e049413d0d275ddb174d5d92b38e75ecab8"
+      "sha256": "b602b4cf8f0e66610991237e1cb7ade9cd5c14659b155ce3512268d40ae670eb"
     },
     {
       "path": "scripts/gds/ship-preflight-steps.js",
@@ -8952,7 +8962,7 @@
     {
       "path": "scripts/gds/ship.js",
       "mode": "0000644",
-      "sha256": "a612a450145476ea8d6705d7a45b8a84e2dc861ad8cb5be8c6aa69252b5c54c5"
+      "sha256": "6fd0329b8ad7d45fbb93deda02142c2b766c9e01b669d2d94eeafcb1caa225b0"
     },
     {
       "path": "scripts/gds/skill-lint.js",
@@ -9492,7 +9502,7 @@
     {
       "path": "src/module-api.js",
       "mode": "0000644",
-      "sha256": "1d0148cf06b94938cb6f7e6a9e6666ab5393092309530ce5efa6afbd363323b5"
+      "sha256": "d0459d72e42fdd8e712146f10545b27b6f82a310afa7bd0acb1b9290e1ef17b3"
     },
     {
       "path": "src/module-loader/catalog.js",
@@ -9962,7 +9972,7 @@
     {
       "path": "tests/boxes.mjs",
       "mode": "0000644",
-      "sha256": "5a8d2ca5709f2c4ae5089b53883a5a892beeb6920bacbddbd352b106c4ec0e34"
+      "sha256": "30a553024c9fe50076efd447c7f50ddca8e6d20bb91392f20ec30ab3b414aab6"
     },
     {
       "path": "tests/branding.mjs",
@@ -12552,7 +12562,7 @@
     {
       "path": "tests/ship_ci_deploy.mjs",
       "mode": "0000644",
-      "sha256": "e236bc3d6882bc6ddf5d389371a92a96aec62769f14c37bbca31810bcbea0d61"
+      "sha256": "83f8bfb0979b8950a8895eae7710981c19e30878b89fe648eb2dc2e8098c9de1"
     },
     {
       "path": "tests/ship_error_shape.mjs",

package/clients/bongos-client/index.d.ts

@@ -213,7 +213,7 @@ export interface PostBlockersRequest { title: string; body_md?: string; source?:
 export interface PostBlockersResponse { skipped?: boolean; reason?: unknown; blocker?: unknown }
 export interface PostBoxCloseResponse { ok: boolean; queued: unknown; action: unknown; message: unknown }
 export interface PostBoxEnsureResponse { state: unknown; action: unknown; queued: boolean; intent?: unknown }
-export interface PostBoxHeartbeatRequest { claude_active?: boolean }
+export interface PostBoxHeartbeatRequest { claude_active?: boolean; attached?: boolean }
 export interface PostBoxHeartbeatResponse { ok: boolean; state: unknown }
 export interface PostBoxHostKeysRequest { host_keys: string }
 export interface PostBoxHostKeysResponse { ok: boolean; state: unknown; count: unknown }

package/docs/adr/0277-a-box-is-in-use-only-while-a-human-is-attached.md

@@ -0,0 +1,53 @@
+# ADR 0277 — A box is "in use" only while a human is attached, and the claim expires
+
+- **Status:** accepted
+- **Date:** 2026-09-10
+- **Task:** [1003507](https://cloudbongos.com/builders#/task/1003507) (goal 1000095 — *Working area 6*, criterion `wa6-role-experience`)
+- **Supersedes the "never touch a box with a claude process" rule** in [ADR 0031](<redacted>.md) §5(a); the park/preserve guarantee of tasks 1002726/1002727 is unchanged and is what makes this safe.
+
+## Context
+
+`sweep-idle` parks an `active` box whose heartbeat has gone quiet. Which boxes it may touch was decided by `selectIdleBoxes()`, and the rule was: skip any box with `claude_active = true`, at any age, plus skip anything whose `last_activity_at` is recent.
+
+Both halves were satisfiable without a human being anywhere near the box.
+
+1. **`claude_active` is a latch, not a level.** Only a heartbeat ping writes it, and `infra/box-heartbeat.sh` **exits without pinging** when it sees no activity. So silence — the very signal the sweep exists to act on — could never clear the flag. Reproduced against the shipped selector: a row with `claude_active = true` was skipped at `idleMinutes` of 10, 120, 1440 and **5,256,000** (ten years). Not "reaped late": never.
+2. **`load > 0.2` kept the activity clock fresh.** A running devcontainer plus an idle `claude` clears that floor on its own, so `last_activity_at` was bumped every 5 minutes indefinitely.
+
+Either leg alone kept a box alive, which is why the incident looked inexplicable: `example-owner`'s box had been up since 2026-08-12 with a heartbeat every 5 minutes, while tmux session `otb` had been **unattached since 2026-08-15 18:01 UTC** and the `claude` inside it had burned 16 minutes of CPU across 25 hours of wall clock. An abandoned interactive `claude` sitting at its prompt is byte-for-byte indistinguishable from a working one. Cost: **$20.21** on one box, almost all of it unattended.
+
+**A third defect made the whole sweep inert**, found while testing this fix and confirmed on clean `origin/main`: `loadDeps()` in `scripts/gds/box.js` opened with `if (_deps) return _deps;` and **`_deps` was never declared**. The assignment further down would have created a global in sloppy mode, but the read comes first, and reading an undeclared identifier is a `ReferenceError`. So `loadDeps()` threw on its first call, every time, and every command that resolves a DigitalOcean client died with it — including `sweep-idle --apply`, which builds that client *before* the park loop. **The idle sweep could not park any box at all.** No test caught it because the only `apply: true` test in the suite relied on the `claude_active` veto emptying the idle set before `makeDo()` was reached: the bug was hidden behind the other bug.
+
+## Decision
+
+**A box may not stay active longer than `BOX_UNATTENDED_MAX_HOURS` (default 12) without evidence that a human was actually attached to it.** One number bounds both proxies.
+
+The heartbeat already computed the human signal and threw it away by folding it into one boolean. It now reports **`attached`** separately — a login session (`who`), an established inbound SSH connection, an open browser terminal (ttyd), or an **attached tmux client** (`#{session_attached}`, the signal that distinguishes this incident's box from a working one). The server stamps `last_attached_at` from it. `claude_active` keeps its meaning and its veto, but the veto now expires: `claude_active_since` records the `false→true` edge (`COALESCE`d across a run of true beats, so it measures the session and not the last 5 minutes), and past the cap the flag stops counting.
+
+`pgrep -x claude` and the load floor stay as reasons the box **pings**; they are no longer accepted as evidence anyone is **there**. That distinction is the whole decision — a running process is not a person.
+
+Both new clocks are cleared with `claude_active` at park, wake and deprovision, or a woken box would inherit an expired latch and be parked instantly — the fix reintroducing the bug from the far side.
+
+### `NULL` means "no data", never "unattended"
+
+A box still running the pre-1003507 heartbeat never sends `attached`, so its `last_attached_at` stays `NULL` forever. Treating that as unattended would park **every un-upgraded box mid-work**, and box source sync is not reliably prompt (idea 1000745 records a spell where a box sat 257 commits behind for three days). So `NULL` is read as unknown and the box keeps the old behaviour, and migration `core_238` deliberately **does not backfill** the column — a backfilled `now()` would start a clock nothing could ever advance and park the box one cap later.
+
+`claude_active_since` takes the opposite default and **is** backfilled, because an unknown latch age *is* the forever-latch being fixed; after the migration a `true` flag with no stamp is unreachable, so refusing it costs nothing and closes the hole.
+
+### Why 12 hours
+
+Longer than any interactive session and long enough for a real overnight autonomous run. The asymmetry justifies the generosity: since task 1002726 the idle sweep **parks** — snapshot kept, filesystem preserved — so a false positive costs one wake, while no cap at all cost $20.21 on a single box. Tunable per instance via the env var.
+
+## Consequences
+
+- `sweep-idle` can park a box that claims `claude_active`. Its log names the clock that selected it (`unattended 21h (cap 12h) — abandoned session`) through a shared `idleReason()`, so the log cannot drift from the selection.
+- **`sweep-idle --apply` works for the first time.** Fixing `_deps` was not optional scope: the selection fix is inert without it, since the sweep crashes before parking anything. A regression test now reaches dep resolution through the same `apply: true` path that hid it.
+- A box nobody ever attaches to (a pure autonomous run on an upgraded heartbeat, `last_attached_at` still `NULL`) is bounded by the `claude_active_since` cap rather than by attachment. That is the intended fallback and the reason the claude clock kept its own bound rather than deferring entirely to attachment.
+
+## Rejected
+
+- **Tracking attachment *instead of* bounding `claude_active`** (the task's option (b), and the more honest-looking fix): it does not close the reported hole. A box that stops pinging keeps its last `claude_active = true` forever, because only a ping can clear it — so the forever-latch survives untouched, and the fix would have shipped against a stale-heartbeat fixture looking green.
+- **Bounding `claude_active` alone** (options (a)/(c)): this is what was built first, and the verification probe caught it — the incident's heartbeat was *fresh*, so lifting the veto changed nothing and the box was still never idle. Recorded because it is the plausible-looking half-fix, and the task's own framing offered the three options as alternatives when the reported cost needs two of them.
+- **Deleting the `load > 0.2` floor** so an abandoned box simply stops pinging: it is what makes an autonomous run count as use, and removing it would park legitimate unattended runs after `idleMinutes`.
+- **Measuring the cap from `active_since`**: that is uptime. A box worked on continuously for days has an old `active_since` and would be parked mid-work.
+- **Raising `BOX_IDLE_MINUTES`**: the reproduction shows no threshold reaches these boxes. The veto was unbounded, so the threshold was never the variable.

package/docs/adr/README.md

@@ -368,3 +368,4 @@ This keeps the decision history honest and traceable.
 | 0274 | [**One kernel, three role packs: the always-loaded instructions stop being an engineer's** ([task 1002990](https://cloudbongos.com/builders#/task/1002990) · goal 1000095 — *Working area 6, Governor / Builder / Artist / Ideator experience*, criterion `wa6-kernel-and-packs`). The root `CLAUDE.md` loads in full every session for every craft, and it was an engineer's document: 250 lines / 32,422 chars of claim-before-working, worktree-per-claim, `DEPS_NOT_SHIPPED`, `touches[]` and `/merge-mode`. An ideator and an artist each paid the full token cost of a pipeline they were not going to run and read it as instructions addressed to them — and it CONTRADICTED the same goal's `wa6-drift-stops-the-session`, which says ideation *"needs no claim"*, while the kernel's hard rule said every change is backed by one. The craft-specific half lived in three SKILLS (`/dev`, `/ideate`, `/paint`), the wrong carrier twice over: a skill's description is resident in every session's listing whatever craft is running (27,022 chars against a ~8,000 budget, three of them over-length), and a skill must be INVOKED — a session that never types the command works from the kernel alone, which is the engineer's document again. **Decision: a role-neutral kernel plus one pack per craft under `docs/packs/`, bound by a registry CI checks.** The kernel keeps what is true for every craft (the lifecycle, the money, the trust boundary, the identity split, the charter, navigation) and drops to 216 lines / 22,572 chars, clearing the character target it had been over; the per-line test gains a second half — *is it true for every craft?* The Engineer pack inherits today's methodology; the Ideator pack absorbs `/ideate` and writes down the two grades the criterion names (a quick idea stays ONE LINE, then Claude ASKS whether to develop it into a Full Idea — five questions drawn out of the conversation, in the ideator's own words, scored on completeness); the Artist pack absorbs `/paint`, generalised off the pixel-art pipeline per [ADR 0272](<redacted>.md) — show-first, as little interpretation as possible, and ARRIVE PRECALCULATED, because a session that opens with intake questions is a form. The three skills are deleted. `scripts/gds/discipline-modes.json` becomes the ROLE REGISTRY: a core craft names a `pack` (a file to read), a module-contributed discipline may still name a `skill` (`ui` → `/design`, unchanged as ADR 0272 requires), and `claim.js` prints whichever with the right verb. **`scripts/gds/role-pack-guard.js` HARD-FAILS CI** on a pack path that resolves to nothing, an entry with neither pointer, fewer than three packs, or a pack over budget (16,000 hard / 13,000 target) — hard precisely BECAUSE `claim.js` fails open: a broken path degrades to silence, the role is hollow, and no error says so, so CI is the only gate ("CI budgets each pack"). `docs/packs/` over `.claude/packs/` because `docs/` is already owned by the `methodology` scope key — a new top-level path resolves to NO key, and the scope map's own comment records the cost (a missing key is an empty wall, and goal-scope-check then denies every member-authored task); it is registered explicitly in the default-deny publish allowlist, in lockstep with the registry, or a released core would print an unresolvable pack path on every claim. `ship-card.js` moved with the claim (it would have shipped an "Open the work" button firing a deleted command — the 1003487 divergence in reverse) and `tests/idea_ideate_full.mjs` moved with its subject, its thirteen Full-Idea assertions passing against the pack unchanged. Governor is deliberately DEFERRED — three packs, not four, until the owner decides; the guard floors at three. Rejected: keeping the skills beside the packs (two homes drift, and the listing cost stays); packs AS skills (the exact failure being fixed); duplicating the safety rules into all three packs (the charter forbids it — three copies drift and the kernel becomes the one nobody trusts); leaving the guard advisory like the doc-comment check (that one gates a judgement, this one gates a resolvable path). **Not done:** the kernel is 216 lines against a ~200 target — still a warning, as it was at 250; the line count is the context-budget cluster's work (tasks 1003620/1003687/1003688), which the goal's audit sequenced behind this one.](<redacted>.md) | methodology / roles / context budget |
 | 0275 | [**A role's written responsibility has one source, and the pack's copy is generated** ([task 1003732](https://cloudbongos.com/builders#/task/1003732) · goal 1000095 — *Working area 6*, criterion `wa6-written-responsibilities`; statements fixed by the area owner 2026-09-08). The criterion is one sentence — *"one source, shown on the profile, injected into the pack, referenced by grading"* — and before this task the three statements existed only in the criterion record, nowhere in the tree. The interesting half is why ONE source and not three good copies: if each consumer holds its own, they drift, and the drift has a specific unfair shape — the project shows a builder one standard on their profile, teaches their session a second, and grades the shipped work against a third, so someone is judged by a rule they were never shown. **Decision: a frozen map at `src/role-responsibilities.js` (verbatim owner text, imports nothing), read by three consumers, with the one copy that CAN drift generated and CI-gated.** The hall reads it through `clientModules()` — already injected into every served page as `window.__MODULES__` and already carrying the discipline roster the statements are keyed by, so the profile renders with no new route, no fetch and no copy. The grader reads `responsibilityFor()` through the module doorway and states the standard in the prompt as the project's, not its own. The PACKS get a generated block: markdown cannot require a JS module, so their copy is the only one that can go stale — and it is the worst to lose, being what a session is actually instructed by. `gen-role-responsibilities.js` writes it from the ROLE REGISTRY (so a renamed pack, or Governor when the owner decides, needs no edit), and `role-pack-guard.js` fails CI on drift. Three consequences worth the record. (1) `fitness.js` needed an EXEMPTION for the owner's own prose: the ideator's statement opens "Make good ideas" and `ideas` is a module key, so the no-module-keys scan flagged an English word — paraphrasing to satisfy a scanner is precisely what the task forbids, so the reason is written down and the file's import DIRECTION is still guarded. (2) Registering the freshness check inside `checkGeneratedArtifactsFresh` pushed `fitness.js` one line past its 1,500-line ratchet; rather than raise the baseline (which the check forbids in its own message) the assertion MOVED into `role-pack-guard.js`, which already owns the packs — one check now answers "are the packs correct". (3) The generator matches each pack's own line ending, because `.md` checks out CRLF on Windows and LF in CI, and a generator that always wrote `\n` would make the gate red on one checkout and green on the other for a file nobody touched. A craft with no statement (`ui`, module-contributed per [ADR 0272](<redacted>.md); Governor, deferred per [ADR 0274](<redacted>.md)) renders NOTHING everywhere — no empty quote, no grader line — because a grader told a role has no written standard would supply its own. The profile's avatar was repinned to the top row (the head grid is `align-items:center`, fine for three short lines, wrong once the block made the column tall); verified in both themes in the hall preview. `tests/role_responsibilities.mjs` asserts the criterion's actual content by sweeping `src/`, `scripts/`, `modules/`, `tests/` and `docs/packs/` for any second copy. Rejected: three hand-written paragraphs (the drift would be invisible); a dedicated route for the hall (a fetch and a failure mode for static text already on a rail); storing the statements in the DB (not live state — a row puts the project's written standard outside code review); letting the grader describe a craft from its name (the invented standard this removes); raising `oversized_file_count` to let `fitness.js` grow.](<redacted>.md) | roles / grading / generated artifacts |
 | 0276 | [**The skill-listing budget cannot hold 64 skills and every trigger, so the number is ratcheted and the choice goes to the owner** ([task 1003620](https://cloudbongos.com/builders#/task/1003620) · goal 1000095 — *Working area 6*, criterion `wa6-role-experience`). Every SKILL.md description is resident in EVERY session for every craft, and `skill-lint` budgets the whole listing at 8,000 chars. It has been trimmed twice ([#1003548], [#1003587]) and grown back both times, because the 400-char per-description aim was a WARNING THAT ACCUMULATES. This task rewrote 49 of the 50 `.claude/skills/` descriptions — 17 warnings to 0, listing 25,624 → 19,316 chars, about 1,570 tokens returned to every session — with every trigger phrase preserved and CHECKED MECHANICALLY (a checker diffed the quoted phrases against HEAD and caught five real losses, all restored; four dropped strings were UI labels, not triggers). **8,000 was not reached, and the arithmetic says it cannot be:** across 64 skills the names (880) plus the mandatory quoted triggers (~5,370) are an irreducible ~6,250, leaving ~27 chars per skill to say what the skill DOES. Reaching the budget means trigger-only descriptions — trading truncation for the loss of the semantic signal routing leans on when the user’s words do not literally match a trigger. **Decision: ratchet `skill_listing_chars` at 19,316** in `fitness-ratchets.js` (fails open if the linter cannot load), so it cannot grow while the real question is open; the baseline is deliberately ABOVE skill-lint’s budget and is not a claim the budget is met. **Open and owner-gated:** delist skills (64 is a menu), scale the budget with the roster, or accept trigger-only text — recommendation is delist then rescale, filed as a blocker. `fitness.js`’s over-budget warning STAYS, as the visible trace of that question. Rejected: raising `LISTING_BUDGET_CHARS` to silence the warning (deletes the signal, not the debt); re-cutting the 14 module ui-design descriptions a week after [#1003587] wrote them, for ~2,000 chars toward a target still 9,000 away.](<redacted>.md) | skills / context budget / routing |
+| 0277 | [**A box is "in use" only while a human is attached, and the claim expires** ([task 1003507](https://cloudbongos.com/builders#/task/1003507) · goal 1000095 — *Working area 6*, criterion `wa6-role-experience`). `sweep-idle` skipped any box with `claude_active = true` at ANY age, and `claude_active` is a LATCH, not a level: only a heartbeat ping writes it, and `infra/box-heartbeat.sh` exits WITHOUT pinging when it sees nothing — so silence, the very signal the sweep exists to act on, could never clear it. Reproduced against the shipped selector: skipped at `idleMinutes` of 10, 120, 1440 and **5,256,000** (ten years). Not reaped late; never. The second leg is that `load > 0.2` kept `last_activity_at` bumping every 5 minutes anyway (a devcontainer plus an idle `claude` clears that floor on its own), so EITHER leg alone kept a box alive — which is why bounding only the veto looks like a fix and is not: the incident box's heartbeat was FRESH. Measured: `example-owner`'s box up since 2026-08-12, tmux `otb` UNATTACHED since 2026-08-15 18:01 UTC, `claude` burning 16 min of CPU across 25h of wall clock, **$20.21** of mostly-unattended compute. A THIRD defect, found while testing this and confirmed on clean `origin/main`, made the sweep inert regardless: `loadDeps()` read `_deps` before anything declared it, so it threw `ReferenceError` on first call and every command resolving a DigitalOcean client went with it — including `sweep-idle --apply`, which builds that client before the park loop. **The idle sweep could not park any box at all**, hidden because the suite's only `apply: true` test relied on the veto emptying the idle set before `makeDo()` was reached: one bug shielded by the other. **Decision: a box may not stay active longer than `BOX_UNATTENDED_MAX_HOURS` (12) without evidence a HUMAN was attached.** The heartbeat already computed that signal and folded it into one boolean; it now reports `attached` separately (login session, inbound SSH, open ttyd, or an ATTACHED tmux client via `#{session_attached}` — the signal that separates this box from a working one) and the server stamps `last_attached_at`. `claude_active` keeps its veto but it EXPIRES, bounded by a `claude_active_since` edge stamp. `pgrep -x claude` and the load floor remain reasons the box PINGS, never evidence anyone is THERE — a running process is not a person, and that distinction is the whole decision. The two `NULL` defaults deliberately DISAGREE: `last_attached_at` NULL means "no data" and keeps a pre-1003507 box on the old behaviour (core_238 pointedly does NOT backfill it — a backfilled `now()` starts a clock nothing can advance and parks every un-upgraded box one cap later, and box source sync is not prompt: idea 1000745 records 257 commits behind for three days), while `claude_active_since` NULL is REFUSED because an unknown latch age is the forever-latch itself, and is backfilled so the state is unreachable after deploy. 12h because parking is reversible since task 1002726 (snapshot kept), so a false positive costs one wake against $20.21 for no cap. Both clocks clear at park/wake/deprovision, or a woken box inherits an expired latch and is parked instantly — the fix reintroducing the bug from the far side. Rejected: tracking attachment INSTEAD of bounding the latch (the silent box keeps `true` forever, so the reported hole survives); bounding the latch alone (built first, and the verification probe caught it — the fresh heartbeat meant lifting the veto changed nothing); deleting the load floor (it is what makes an autonomous run count); measuring from `active_since` (that is uptime — parks a box worked on for days); raising `BOX_IDLE_MINUTES` (no threshold reaches an unbounded veto).](<redacted>.md) | dev box / cost / idle sweep |

package/docs/api/openapi.json

@@ -1775,7 +1775,7 @@
           "box"
         ],
         "summary": "POST /box/heartbeat",
-        "description": "POST /box/heartbeat — the box reports it is alive, resetting the idle clock. rank: any authenticated builder (own resource write). Optional body: { claude_active: bool } — when provided, records whether a `claude` process is running. The idle sweep skips boxes with claude_active=true, so an active Claude session keeps the box alive indefinitely. Heartbeats without a body behave as before (last_activity_at bumped, claude_active unchanged). task 919: allowBoxScope — box-heartbeat.sh (cron */5) runs with the box-scoped session.\n\n**Rank:** `any-builder` — Any authenticated builder (row-level ownership enforced in-handler).",
+        "description": "POST /box/heartbeat — the box reports it is alive, resetting the idle clock. rank: any authenticated builder (own resource write). Optional body: { claude_active: bool, attached: bool }. `claude_active` records whether a `claude` process is running; the idle sweep honours it as a veto, but since task 1003507 only for BOX_UNATTENDED_MAX_HOURS (a running process is not a person, and an unbounded veto pinned boxes active forever). `attached` is the human signal — a login session, an inbound SSH connection, an open browser terminal, or an attached tmux client — and stamps last_attached_at, the clock that cap is measured against. A heartbeat that omits `attached` (any box still running the pre-1003507 script) leaves the column NULL, which the sweep reads as \"no data\" and not as \"unattended\". Heartbeats without a body behave as before (last_activity_at bumped only). task 919: allowBoxScope — box-heartbeat.sh (cron */5) runs with the box-scoped session.\n\n**Rank:** `any-builder` — Any authenticated builder (row-level ownership enforced in-handler).",
         "x-rank": "any-builder",
         "x-source": "modules/dev-box/routes/box.js",
         "requestBody": {
@@ -19399,6 +19399,9 @@
         "properties": {
           "claude_active": {
             "type": "boolean"
+          },
+          "attached": {
+            "type": "boolean"
           }
         },
         "additionalProperties": true

package/docs/api-reference.md

@@ -91,7 +91,7 @@ Base path: `/api/bongos`. Ranks (enforced server-side, [ADR 0016](adr/<redacted>
 | GET | `/api/bongos/box/connect.ps1` | `public` | — | GET /box/connect.ps1 — the Windows (PowerShell) bootstrap script. |
 | GET | `/api/bongos/box/connect.sh` | `public` | — | GET /box/connect.sh — the macOS/Linux bootstrap script. |
 | POST | `/api/bongos/box/ensure` | `any-builder` | — | POST /box/ensure — "make my box ready". |
-| POST | `/api/bongos/box/heartbeat` | `any-builder` | `claude_active` | POST /box/heartbeat — the box reports it is alive, resetting the idle clock. |
+| POST | `/api/bongos/box/heartbeat` | `any-builder` | `claude_active`, `attached` | POST /box/heartbeat — the box reports it is alive, resetting the idle clock. |
 | POST | `/api/bongos/box/host-keys` | `any-builder` | `host_keys` | POST /box/host-keys — the box publishes its own PUBLIC SSH host keys (task 1187 / idea 235). |
 | GET | `/api/bongos/box/managed-settings` | `any-builder` | — | GET /box/managed-settings — the caller's Claude Desktop managed-settings.json. |
 | GET | `/api/bongos/box/me` | `any-builder` | — | GET /box/me — the caller's own box. |

package/docs/module-api-changelog.md

@@ -1749,5 +1749,9 @@ is load-bearing: the script throws rather than guess if it is missing, and
         landed since 1.19.648 with no explicit bump. run 34523111338. (task 1002620)
   1.19.650 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
         landed since 1.19.649 with no explicit bump. run 34523753119. (task 1002620)
+  1.19.651 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+        landed since 1.19.650 with no explicit bump. run 34526936330. (task 1002620)
+  1.19.652 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+        landed since 1.19.651 with no explicit bump. run 34529655648. (task 1002620)
 ---------------------------------------------------------------------------
 ```

package/migrations/core_238_box_unattended_cap.sql

@@ -0,0 +1,57 @@
+-- migration core_238: bound how long a dev box may claim to be in use
+-- (task 1003507).
+--
+-- WHY: a box could assert "in use" forever from two proxies, neither of which
+-- implies a human is present.
+--
+--   1. claude_active is a LATCH, not a level. Only a heartbeat ping writes it,
+--      and infra/box-heartbeat.sh exits WITHOUT pinging when it sees no
+--      activity - so silence, the very signal the idle sweep exists to act on,
+--      could never clear it. selectIdleBoxes() skipped claude_active=true rows
+--      with no time bound, so such a box was unreapable at EVERY threshold.
+--   2. `load > 0.2` kept last_activity_at bumping, so the activity clock never
+--      went stale either. A running devcontainer plus an idle `claude` clears
+--      that floor on its own.
+--
+-- Together they made an abandoned interactive `claude` at its prompt in an
+-- UNATTACHED tmux session indistinguishable from a working one. Measured: one
+-- box unattended since 2026-08-15 burned 20.21 USD of compute the sweep could
+-- not reach.
+--
+-- Two columns, because the fix needs two clocks:
+--   claude_active_since - when claude_active last went false->true, so the veto
+--                         can be bounded by how long it has been claimed.
+--   last_attached_at    - when a HUMAN was last actually attached (a login
+--                         session, an inbound SSH connection, an open browser
+--                         terminal, or an attached tmux client). The heartbeat
+--                         already computed this and folded it into one boolean;
+--                         it now reports it separately.
+--
+-- Idempotent: ADD COLUMN IF NOT EXISTS, and the backfill is guarded on IS NULL
+-- so a fresh restore + replay never moves a stamp later beats have written.
+
+BEGIN;
+
+ALTER TABLE builder_boxes
+  ADD COLUMN IF NOT EXISTS claude_active_since timestamptz;
+
+ALTER TABLE builder_boxes
+  ADD COLUMN IF NOT EXISTS last_attached_at timestamptz;
+
+-- Backfill claude_active_since ONLY. A box that is claude_active right now has
+-- no recorded latch age, and refusing an unknown age would park boxes that are
+-- genuinely in use the moment this deploys. Stamp now() so every live box gets
+-- one full grace window; the next heartbeat keeps it honest from there.
+UPDATE builder_boxes
+   SET claude_active_since = now()
+ WHERE claude_active = true
+   AND claude_active_since IS NULL;
+
+-- last_attached_at is deliberately NOT backfilled. A box still running a
+-- heartbeat from before this change never reports attachment, so its column
+-- stays NULL forever - and selectIdleBoxes reads NULL as "no attachment data"
+-- rather than "unattended", which is what keeps such a box on the old behaviour
+-- instead of parking it mid-work. Backfilling now() would instead start a clock
+-- that nothing can ever advance, and park every un-upgraded box after the cap.
+
+COMMIT;

package/modules/dev-box/boxes.js

@@ -164,22 +164,100 @@ function effectiveActivityMs(row) {
   return toMs(row.last_activity_at) ?? toMs(row.active_since) ?? toMs(row.provisioned_at);
 }
 
-// Idle = active boxes whose effective activity is older than idleMinutes AND
-// that don't have an active Claude process. A box with claude_active=true is
-// kept alive regardless of last_activity_at — the session ends when Claude stops.
-// Pure: caller passes the candidate rows and nowMs; returns the subset to deprovision.
-function selectIdleBoxes(rows, { idleMinutes, nowMs } = {}) {
+// ---- the unattended cap (task 1003507) ------------------------------------
+//
+// A box used to be able to assert "in use" forever from two proxies, neither of
+// which implies a human is present:
+//
+//   1. `pgrep -x claude` -> claude_active=true, which selectIdleBoxes skipped
+//      with NO time bound. claude_active is a LATCH, not a level: only a
+//      heartbeat ping writes it, and box-heartbeat.sh exits WITHOUT pinging when
+//      it sees nothing — so silence, the very signal the sweep exists to act on,
+//      could never clear it. Unreapable at EVERY threshold, forever.
+//   2. `load > 0.2` -> ACTIVE=1, which keeps bumping last_activity_at. A running
+//      devcontainer plus an idle `claude` clears that floor on its own, so the
+//      activity clock never went stale either.
+//
+// Together they made an abandoned interactive `claude` at its prompt in an
+// UNATTACHED tmux session indistinguishable from a working one, and one such box
+// burned $20.21 of unattended compute the sweep could not reach. Bounding only
+// (1) does not stop the bleeding, because (2) keeps the box out of the idle set
+// on its own — so both proxies are bounded by the same policy:
+//
+//   A box may not stay active for longer than `unattendedMaxHours` without
+//   evidence that a human was actually attached to it.
+//
+// "Attached" is what the heartbeat already knew and used to throw away by
+// folding it into one boolean: a login session (`who`), an established inbound
+// SSH connection, an open browser terminal (ttyd), or an ATTACHED tmux client.
+// It now reports that separately and the server stamps `last_attached_at`.
+const HOUR_MS = 3_600_000;
+
+// Has a human been attached recently enough for this box's claims to stand?
+//   - no cap configured        -> yes (the pre-1003507 unbounded behaviour;
+//                                 the policy lives in the caller's CONFIG)
+//   - last_attached_at unset   -> yes. A box whose heartbeat predates this change
+//                                 never reports attachment, so its column stays
+//                                 NULL forever — treating unknown as unattended
+//                                 would park every such box mid-work. NULL is
+//                                 deliberately NOT backfilled for that reason.
+//   - within the cap           -> yes
+//   - older than the cap       -> no; the box is unattended
+function attendedRecently(row, { nowMs, unattendedMaxHours } = {}) {
+  if (!Number.isFinite(unattendedMaxHours) || unattendedMaxHours <= 0) return true;
+  const at = toMs(row.last_attached_at);
+  if (at == null) return true;
+  return at > nowMs - unattendedMaxHours * HOUR_MS;
+}
+
+// Does claude_active still earn this box a pass from the idle sweep? Bounded by
+// how long it has been claimed, read off `claude_active_since` (migration
+// core_238, stamped on the false->true edge so it measures the whole session
+// rather than the last beat). An unknown age is refused: core_238 backfills every
+// box that is claude_active at deploy, so a NULL stamp under a true flag is the
+// forever-latch this fixes, not a live session.
+function claudeVetoHolds(row, { nowMs, unattendedMaxHours } = {}) {
+  if (!row.claude_active) return false;
+  if (!Number.isFinite(unattendedMaxHours) || unattendedMaxHours <= 0) return true;
+  const since = toMs(row.claude_active_since);
+  if (since == null) return false;
+  return since > nowMs - unattendedMaxHours * HOUR_MS;
+}
+
+// Idle = active boxes that are either (a) quiet past idleMinutes with no live
+// claude_active veto, or (b) still chattering but unattended past the cap. (b) is
+// the abandoned-session case: the heartbeat is fresh, so (a) can never fire.
+// Pure: caller passes the candidate rows and nowMs; returns the subset to park.
+function selectIdleBoxes(rows, { idleMinutes, nowMs, unattendedMaxHours } = {}) {
   if (!Number.isFinite(idleMinutes) || idleMinutes <= 0) return [];
   if (!Number.isFinite(nowMs)) return [];
   const cutoff = nowMs - idleMinutes * 60_000;
   return (rows || []).filter((r) => {
     if (r.state !== 'active') return false;
-    if (r.claude_active) return false;
+    if (!attendedRecently(r, { nowMs, unattendedMaxHours })) return true;
+    if (claudeVetoHolds(r, { nowMs, unattendedMaxHours })) return false;
     const a = effectiveActivityMs(r);
     return a != null && a <= cutoff;
   });
 }
 
+// Why the sweep picked a box, for the operator log. Mirrors selectIdleBoxes'
+// branches exactly — if these two ever disagree the log is lying, so they are
+// read together.
+function idleReason(row, { nowMs, idleMinutes, unattendedMaxHours } = {}) {
+  if (!attendedRecently(row, { nowMs, unattendedMaxHours })) {
+    const h = Math.round((nowMs - toMs(row.last_attached_at)) / HOUR_MS);
+    return `unattended ${h}h (cap ${unattendedMaxHours}h) — abandoned session`;
+  }
+  const mins = Math.round((nowMs - (effectiveActivityMs(row) || nowMs)) / 60_000);
+  if (row.claude_active) {
+    const since = toMs(row.claude_active_since);
+    const held = since == null ? 'no claude_active_since recorded' : `claude_active ${Math.round((nowMs - since) / HOUR_MS)}h`;
+    return `idle ${mins}m, ${held} past the ${unattendedMaxHours}h cap`;
+  }
+  return `idle ${mins}m`;
+}
+
 // Dormant = parked boxes that have been parked longer than dormantDays. These
 // get fully de-provisioned (snapshot deleted too) to reclaim the last cents.
 // Since task 1002726 this is the ONLY automated path that destroys a snapshot —
@@ -469,7 +547,7 @@ async function recordEvent(db, { boxId, builderId, event, detail, costUsd, actor
 // active box, so logging one per beat would grow the ledger unbounded
 // (~100K rows/builder/year). last_activity_at IS the heartbeat record; box_events
 // is reserved for the rare lifecycle transitions (provision/park/wake/deprovision/cost).
-async function bumpActivity(db, builderId, { claudeActive } = {}) {
+async function bumpActivity(db, builderId, { claudeActive, attached } = {}) {
   const hasClaude = typeof claudeActive === 'boolean';
   const claudeCol = hasClaude ? ', claude_active = $2' : '';
   // The FIRST time a box reports a live `claude` process, stamp
@@ -481,10 +559,29 @@ async function bumpActivity(db, builderId, { claudeActive } = {}) {
   const connectedCol = (hasClaude && claudeActive === true)
     ? ', first_connected_at = COALESCE(first_connected_at, now())'
     : '';
+  // task 1003507 — claude_active_since is the EDGE, not the level: stamped when
+  // the flag goes false->true (COALESCE keeps the original edge across a run of
+  // true beats, so the latch measures the whole session, not the last 5 minutes)
+  // and cleared on a false beat so the next session starts a fresh clock. Without
+  // this the flag has no age, and selectIdleBoxes cannot bound its own veto.
+  const sinceCol = hasClaude
+    ? (claudeActive === true
+      ? ', claude_active_since = COALESCE(claude_active_since, now())'
+      : ', claude_active_since = NULL')
+    : '';
+  // task 1003507 — `attached` is the HUMAN signal (a login session, an inbound
+  // SSH connection, an open browser terminal, or an attached tmux client), kept
+  // separate from claude_active because a running process is not a person. Only
+  // a true beat writes it: last_attached_at is a high-water mark, so a beat that
+  // reports nobody attached leaves the last real attachment where it was and the
+  // unattended clock keeps running. A box whose heartbeat predates this change
+  // never sends the field, leaving the column NULL, which selectIdleBoxes reads
+  // as "no data" rather than "unattended".
+  const attachedCol = attached === true ? ', last_attached_at = now()' : '';
   const params = hasClaude ? [builderId, claudeActive] : [builderId];
   const { rows } = await db.query(
     `UPDATE builder_boxes
-        SET last_activity_at = now(), updated_at = now()${claudeCol}${connectedCol}
+        SET last_activity_at = now(), updated_at = now()${claudeCol}${connectedCol}${sinceCol}${attachedCol}
       WHERE builder_id = $1 AND state = 'active'
       RETURNING state`,
     params
@@ -516,6 +613,10 @@ const SETTABLE_BOX_COLUMNS = new Set([
   'scope', 'provisioned_rank', 'region', 'size_slug', 'droplet_id', 'droplet_name',
   'snapshot_id', 'ip', 'hostname', 'last_activity_at', 'provisioned_at',
   'active_since', 'parked_at', 'destroyed_at', 'error_note', 'claude_active',
+  // task 1003507 — park/wake/deprovision clear the claude_active latch and its
+  // clock together. A woken box that kept a stale claude_active_since would be
+  // instantly reapable, which is the fix reintroducing the bug from the far side.
+  'claude_active_since', 'last_attached_at',
   // host_keys/host_keys_at are normally written by setBoxHostKeys(), but
   // deprovisionOne() clears them on teardown so a rebuilt box never serves its
   // predecessor's SSH identity (idea 310) — hence they are settable here too.
@@ -889,7 +990,10 @@ module.exports = {
   storageCostUsd,
   summarizeBoxCost,
   // pure — selection
+  attendedRecently,
+  claudeVetoHolds,
   effectiveActivityMs,
+  idleReason,
   selectIdleBoxes,
   selectDormantBoxes,
   selectDormantWarnBoxes,

package/modules/dev-box/routes/box.js

@@ -633,21 +633,29 @@ module.exports = function buildBoxRouter() {
 
   // POST /box/heartbeat — the box reports it is alive, resetting the idle clock.
   // rank: any authenticated builder (own resource write). Optional body:
-  // { claude_active: bool } — when provided, records whether a `claude` process
-  // is running. The idle sweep skips boxes with claude_active=true, so an active
-  // Claude session keeps the box alive indefinitely. Heartbeats without a body
-  // behave as before (last_activity_at bumped, claude_active unchanged).
+  // { claude_active: bool, attached: bool }.
+  //
+  // `claude_active` records whether a `claude` process is running; the idle sweep
+  // honours it as a veto, but since task 1003507 only for BOX_UNATTENDED_MAX_HOURS
+  // (a running process is not a person, and an unbounded veto pinned boxes active
+  // forever). `attached` is the human signal — a login session, an inbound SSH
+  // connection, an open browser terminal, or an attached tmux client — and stamps
+  // last_attached_at, the clock that cap is measured against. A heartbeat that
+  // omits `attached` (any box still running the pre-1003507 script) leaves the
+  // column NULL, which the sweep reads as "no data" and not as "unattended".
+  // Heartbeats without a body behave as before (last_activity_at bumped only).
   // #919: allowBoxScope — box-heartbeat.sh (cron */5) runs with the box-scoped session.
   router.post('/box/heartbeat', auth.allowBoxScope, auth.requireBuilder, async (req, res) => {
     // strict:false — heartbeat is a machine ping from SHIPPED box clients that
     // can't update in lockstep with the server (the ADR-0117 un-updatable-consumer
     // concern). Validate the known field's type, but tolerate a future/extra field
     // rather than reject a resilience-critical ping (the idle sweep keys off it).
-    if (validateOrRespond(req, res, { claude_active: { type: 'boolean' } }, { strict: false })) return;
+    if (validateOrRespond(req, res, { claude_active: { type: 'boolean' }, attached: { type: 'boolean' } }, { strict: false })) return;
     try {
       const body = req.body || {};
       const claudeActive = typeof body.claude_active === 'boolean' ? body.claude_active : undefined;
-      const state = await boxes.bumpActivity(pool, req.builder.id, { claudeActive });
+      const attached = typeof body.attached === 'boolean' ? body.attached : undefined;
+      const state = await boxes.bumpActivity(pool, req.builder.id, { claudeActive, attached });
       res.json({ ok: true, state: state || 'none' });
     } catch (err) {
       log.error('[gds] POST /box/heartbeat', err);

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.650",
+  "version": "1.19.652",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.19.650",
+      "version": "1.19.652",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.650",
+  "version": "1.19.652",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",