@bongos/core 1.19.651 → 1.19.653

package/.bongos-core.json

@@ -2,22 +2,22 @@
   "artifact": "bongos-core",
   "manifest_schema": 1,
   "generator": "scripts/gds/package-core.js",
-  "core_version": "1.19.651",
-  "core_contract": "1.19.651",
-  "source_commit": "c13a88d638588dedd2454579a62cb76e4415656a",
+  "core_version": "1.19.653",
+  "core_contract": "1.19.653",
+  "source_commit": "eff58cdbf33eb107723b56ef2f119c578d628d5e",
   "source_ref": "HEAD",
-  "built_at": "2026-09-10T20:32:32.558Z",
+  "built_at": "2026-09-10T23:48:13.514Z",
   "redaction": {
     "model": "docs-redacted+functional-verbatim",
-    "docs_redacted": 471,
+    "docs_redacted": 472,
     "agent_docs_stubbed": 24,
-    "functional_verbatim": 2109,
+    "functional_verbatim": 2110,
     "rules": 3,
     "gate_literals": 3,
     "gate": "passed"
   },
-  "file_count": 2604,
-  "tree_sha256": "3e626f458ea19a08ab773ec27d6efe07ab6901a906091aa433ac27aa7789173e",
+  "file_count": 2606,
+  "tree_sha256": "f2c83acf6434a7c56482adc7efcd782b2577ba4f4d6092d74e2ea143b5c6f90c",
   "files": [
     {
       "path": ".claude/skills/backlog-review/SKILL.md",
@@ -382,7 +382,7 @@
     {
       "path": "clients/bongos-client/index.d.ts",
       "mode": "0000644",
-      "sha256": "5ef1befd1a1b30e8ef9e8b8ca08f768361d2422f6ddba2160a5395d46a84d443"
+      "sha256": "a82dc5f2fdcf44a1abff4bd8ba0aec70cc49004ad5feae72c362e8b45c5f04e5"
     },
     {
       "path": "clients/bongos-client/index.mjs",
@@ -1889,20 +1889,25 @@
       "mode": "0000644",
       "sha256": "2830a09a2d0520e7992c8e7d1545304092857267a9060f5127bd2ffcff237ebc"
     },
+    {
+      "path": "docs/adr/0277-a-box-is-in-use-only-while-a-human-is-attached.md",
+      "mode": "0000644",
+      "sha256": "e5e99f19152b5a98c21f70fc0e54a09e9ae59beeb81fea8d26df2de4ef196b90"
+    },
     {
       "path": "docs/adr/README.md",
       "mode": "0000644",
-      "sha256": "0c6981591a439c22775b596f69e602ba7801f8d8549d4244ca8fefc5dc48ac3b"
+      "sha256": "5ee80f0739cfbe9543f746ed13efbfeeaa56c350fb4e9570c7c122723b86a34a"
     },
     {
       "path": "docs/api-reference.md",
       "mode": "0000644",
-      "sha256": "6c5f26c9c00387ecc84ed80726a4d62eca0f017f1d75c304d758961749fe616f"
+      "sha256": "fe08952e837f4e79243823d66876f2413ca1d743c22bc2a287c18275616692d4"
     },
     {
       "path": "docs/api/openapi.json",
       "mode": "0000644",
-      "sha256": "d63a4ab6e92a24d339a632360fb92246512e09eabbc5bff632881bda6d4abf50"
+      "sha256": "db8be14055cc32b31376585ad954e1e91a8b1cbe77401bad3d5215c1d3b419aa"
     },
     {
       "path": "docs/architecture.md",
@@ -2777,7 +2782,7 @@
     {
       "path": "docs/module-api-changelog.md",
       "mode": "0000644",
-      "sha256": "b19f014bb424a4974164c08f892cb0103af216bebd411615b1d997f01d6054a7"
+      "sha256": "11da08cbbf3f33e0a95df12baddcfc0bddba2b4bb4cf7c77f2a818c7d1dbfba8"
     },
     {
       "path": "docs/modules-contract.md",
@@ -3824,6 +3829,11 @@
       "mode": "0000644",
       "sha256": "2cda282b43ea71dd82ddf4e5ece90f11ad4013cbee0820f0a33391f202feff9c"
     },
+    {
+      "path": "migrations/core_238_box_unattended_cap.sql",
+      "mode": "0000644",
+      "sha256": "03df9104a0309011df1b6e96627c62cc6612f34b654134306d13fd5c89b8f038"
+    },
     {
       "path": "modules/agents/lib/validate.js",
       "mode": "0000644",
@@ -4247,7 +4257,7 @@
     {
       "path": "modules/dev-box/boxes.js",
       "mode": "0000644",
-      "sha256": "667993d81db36e1ddd1307013044f3d40b6baca3c6f5271b77332d10fa290063"
+      "sha256": "cd1fe37f04e6a32964fd165045ac6613ce2e1236e1ff388da38d428a769beb4b"
     },
     {
       "path": "modules/dev-box/db.js",
@@ -4262,7 +4272,7 @@
     {
       "path": "modules/dev-box/routes/box.js",
       "mode": "0000644",
-      "sha256": "b61996de3fa3dbdc9b8fb639fd53aba5c1c2567350dc602b39ebbbd3a93164ac"
+      "sha256": "c5cef340b2a5c85202d07709f1b96983eb03ce5a15168684922e2de1ae025d71"
     },
     {
       "path": "modules/discord/CLAUDE.md",
@@ -7732,12 +7742,12 @@
     {
       "path": "package-lock.json",
       "mode": "0000644",
-      "sha256": "e70fe3cda6fcf43f7416f03c0232be6be8ff84fca2aaac504dac9268b33d8f69"
+      "sha256": "42dddf576e9fb7f8d33e39dff4244f6105bd4bf78b150cf700d819f763ab6b8d"
     },
     {
       "path": "package.json",
       "mode": "0000644",
-      "sha256": "17a361e96b81d29aaddc6b2f73d2d3cdf007914df8e14d6f3fcd0ea7c12378c8"
+      "sha256": "12d491b531085f6ed22cbda1b8f7485401c186fd10b1cb4170e8af6bed174d95"
     },
     {
       "path": "public-docs/index.html",
@@ -7922,7 +7932,7 @@
     {
       "path": "scripts/gds/box-infra.js",
       "mode": "0000644",
-      "sha256": "bfbe7348ddc9895d4eed1a23efe9246b44850e1bfe6d6015d63a0b2a4433373d"
+      "sha256": "811545b6769947c5399f4be52782e90c1a6c2e628e72d7751266d2c7dafb62c3"
     },
     {
       "path": "scripts/gds/box-sync.js",
@@ -7932,7 +7942,7 @@
     {
       "path": "scripts/gds/box.js",
       "mode": "0000644",
-      "sha256": "afcebfb8e8e8f7041ee9cbfce1e9b8a46a299feb5e6e89ce4e00273135b268db"
+      "sha256": "e7d82101c8212d1c46da944bb52f2d18a7fc87293f66f18e6856844f8766666b"
     },
     {
       "path": "scripts/gds/bug-triage.js",
@@ -8177,7 +8187,7 @@
     {
       "path": "scripts/gds/fitness-checks-vocabulary.js",
       "mode": "0000644",
-      "sha256": "5ea954ec0bf26e5192a369d0f94dcb3b8bf2e263c9e927c66a01791962a46995"
+      "sha256": "f64905f88718e5617ee97584dada757367497eed350bfb41814d257c9d2ec680"
     },
     {
       "path": "scripts/gds/fitness-checks-write-validation.js",
@@ -8197,7 +8207,7 @@
     {
       "path": "scripts/gds/fitness.js",
       "mode": "0000644",
-      "sha256": "3593c992b397333ee85f11dc2ea6325c3c96a2d1e5b813204da32c34c493b236"
+      "sha256": "b30c5c2b3bf6465a63a7124327ad40f94987088d1d87fcc110fec9281539a0a1"
     },
     {
       "path": "scripts/gds/gate-review.js",
@@ -9492,7 +9502,7 @@
     {
       "path": "src/module-api.js",
       "mode": "0000644",
-      "sha256": "de52ed5ea35350aff9ade88ecc06393252ef5294ea7b76aca8222f956367472a"
+      "sha256": "03201e0e94d7ba4d755c8d0efae051208913faa2a7f654b231d3cb9ded49bd9b"
     },
     {
       "path": "src/module-loader/catalog.js",
@@ -9962,7 +9972,7 @@
     {
       "path": "tests/boxes.mjs",
       "mode": "0000644",
-      "sha256": "5a8d2ca5709f2c4ae5089b53883a5a892beeb6920bacbddbd352b106c4ec0e34"
+      "sha256": "30a553024c9fe50076efd447c7f50ddca8e6d20bb91392f20ec30ab3b414aab6"
     },
     {
       "path": "tests/branding.mjs",
@@ -10947,7 +10957,7 @@
     {
       "path": "tests/government_vocabulary.mjs",
       "mode": "0000644",
-      "sha256": "71bd23242e53b1acd15fddedcb093790a847471c8c55485614d379d29e3065f3"
+      "sha256": "444f0638dccebc42e5a371820ed565c665d4373c198e1581389ab222bf267c5e"
     },
     {
       "path": "tests/grade_aggregates_unavailable.mjs",

package/clients/bongos-client/index.d.ts

@@ -213,7 +213,7 @@ export interface PostBlockersRequest { title: string; body_md?: string; source?:
 export interface PostBlockersResponse { skipped?: boolean; reason?: unknown; blocker?: unknown }
 export interface PostBoxCloseResponse { ok: boolean; queued: unknown; action: unknown; message: unknown }
 export interface PostBoxEnsureResponse { state: unknown; action: unknown; queued: boolean; intent?: unknown }
-export interface PostBoxHeartbeatRequest { claude_active?: boolean }
+export interface PostBoxHeartbeatRequest { claude_active?: boolean; attached?: boolean }
 export interface PostBoxHeartbeatResponse { ok: boolean; state: unknown }
 export interface PostBoxHostKeysRequest { host_keys: string }
 export interface PostBoxHostKeysResponse { ok: boolean; state: unknown; count: unknown }

package/docs/adr/0277-a-box-is-in-use-only-while-a-human-is-attached.md

@@ -0,0 +1,53 @@
+# ADR 0277 — A box is "in use" only while a human is attached, and the claim expires
+
+- **Status:** accepted
+- **Date:** 2026-09-10
+- **Task:** [1003507](https://cloudbongos.com/builders#/task/1003507) (goal 1000095 — *Working area 6*, criterion `wa6-role-experience`)
+- **Supersedes the "never touch a box with a claude process" rule** in [ADR 0031](<redacted>.md) §5(a); the park/preserve guarantee of tasks 1002726/1002727 is unchanged and is what makes this safe.
+
+## Context
+
+`sweep-idle` parks an `active` box whose heartbeat has gone quiet. Which boxes it may touch was decided by `selectIdleBoxes()`, and the rule was: skip any box with `claude_active = true`, at any age, plus skip anything whose `last_activity_at` is recent.
+
+Both halves were satisfiable without a human being anywhere near the box.
+
+1. **`claude_active` is a latch, not a level.** Only a heartbeat ping writes it, and `infra/box-heartbeat.sh` **exits without pinging** when it sees no activity. So silence — the very signal the sweep exists to act on — could never clear the flag. Reproduced against the shipped selector: a row with `claude_active = true` was skipped at `idleMinutes` of 10, 120, 1440 and **5,256,000** (ten years). Not "reaped late": never.
+2. **`load > 0.2` kept the activity clock fresh.** A running devcontainer plus an idle `claude` clears that floor on its own, so `last_activity_at` was bumped every 5 minutes indefinitely.
+
+Either leg alone kept a box alive, which is why the incident looked inexplicable: `example-owner`'s box had been up since 2026-08-12 with a heartbeat every 5 minutes, while tmux session `otb` had been **unattached since 2026-08-15 18:01 UTC** and the `claude` inside it had burned 16 minutes of CPU across 25 hours of wall clock. An abandoned interactive `claude` sitting at its prompt is byte-for-byte indistinguishable from a working one. Cost: **$20.21** on one box, almost all of it unattended.
+
+**A third defect made the whole sweep inert**, found while testing this fix and confirmed on clean `origin/main`: `loadDeps()` in `scripts/gds/box.js` opened with `if (_deps) return _deps;` and **`_deps` was never declared**. The assignment further down would have created a global in sloppy mode, but the read comes first, and reading an undeclared identifier is a `ReferenceError`. So `loadDeps()` threw on its first call, every time, and every command that resolves a DigitalOcean client died with it — including `sweep-idle --apply`, which builds that client *before* the park loop. **The idle sweep could not park any box at all.** No test caught it because the only `apply: true` test in the suite relied on the `claude_active` veto emptying the idle set before `makeDo()` was reached: the bug was hidden behind the other bug.
+
+## Decision
+
+**A box may not stay active longer than `BOX_UNATTENDED_MAX_HOURS` (default 12) without evidence that a human was actually attached to it.** One number bounds both proxies.
+
+The heartbeat already computed the human signal and threw it away by folding it into one boolean. It now reports **`attached`** separately — a login session (`who`), an established inbound SSH connection, an open browser terminal (ttyd), or an **attached tmux client** (`#{session_attached}`, the signal that distinguishes this incident's box from a working one). The server stamps `last_attached_at` from it. `claude_active` keeps its meaning and its veto, but the veto now expires: `claude_active_since` records the `false→true` edge (`COALESCE`d across a run of true beats, so it measures the session and not the last 5 minutes), and past the cap the flag stops counting.
+
+`pgrep -x claude` and the load floor stay as reasons the box **pings**; they are no longer accepted as evidence anyone is **there**. That distinction is the whole decision — a running process is not a person.
+
+Both new clocks are cleared with `claude_active` at park, wake and deprovision, or a woken box would inherit an expired latch and be parked instantly — the fix reintroducing the bug from the far side.
+
+### `NULL` means "no data", never "unattended"
+
+A box still running the pre-1003507 heartbeat never sends `attached`, so its `last_attached_at` stays `NULL` forever. Treating that as unattended would park **every un-upgraded box mid-work**, and box source sync is not reliably prompt (idea 1000745 records a spell where a box sat 257 commits behind for three days). So `NULL` is read as unknown and the box keeps the old behaviour, and migration `core_238` deliberately **does not backfill** the column — a backfilled `now()` would start a clock nothing could ever advance and park the box one cap later.
+
+`claude_active_since` takes the opposite default and **is** backfilled, because an unknown latch age *is* the forever-latch being fixed; after the migration a `true` flag with no stamp is unreachable, so refusing it costs nothing and closes the hole.
+
+### Why 12 hours
+
+Longer than any interactive session and long enough for a real overnight autonomous run. The asymmetry justifies the generosity: since task 1002726 the idle sweep **parks** — snapshot kept, filesystem preserved — so a false positive costs one wake, while no cap at all cost $20.21 on a single box. Tunable per instance via the env var.
+
+## Consequences
+
+- `sweep-idle` can park a box that claims `claude_active`. Its log names the clock that selected it (`unattended 21h (cap 12h) — abandoned session`) through a shared `idleReason()`, so the log cannot drift from the selection.
+- **`sweep-idle --apply` works for the first time.** Fixing `_deps` was not optional scope: the selection fix is inert without it, since the sweep crashes before parking anything. A regression test now reaches dep resolution through the same `apply: true` path that hid it.
+- A box nobody ever attaches to (a pure autonomous run on an upgraded heartbeat, `last_attached_at` still `NULL`) is bounded by the `claude_active_since` cap rather than by attachment. That is the intended fallback and the reason the claude clock kept its own bound rather than deferring entirely to attachment.
+
+## Rejected
+
+- **Tracking attachment *instead of* bounding `claude_active`** (the task's option (b), and the more honest-looking fix): it does not close the reported hole. A box that stops pinging keeps its last `claude_active = true` forever, because only a ping can clear it — so the forever-latch survives untouched, and the fix would have shipped against a stale-heartbeat fixture looking green.
+- **Bounding `claude_active` alone** (options (a)/(c)): this is what was built first, and the verification probe caught it — the incident's heartbeat was *fresh*, so lifting the veto changed nothing and the box was still never idle. Recorded because it is the plausible-looking half-fix, and the task's own framing offered the three options as alternatives when the reported cost needs two of them.
+- **Deleting the `load > 0.2` floor** so an abandoned box simply stops pinging: it is what makes an autonomous run count as use, and removing it would park legitimate unattended runs after `idleMinutes`.
+- **Measuring the cap from `active_since`**: that is uptime. A box worked on continuously for days has an old `active_since` and would be parked mid-work.
+- **Raising `BOX_IDLE_MINUTES`**: the reproduction shows no threshold reaches these boxes. The veto was unbounded, so the threshold was never the variable.

package/docs/adr/README.md

@@ -368,3 +368,4 @@ This keeps the decision history honest and traceable.
 | 0274 | [**One kernel, three role packs: the always-loaded instructions stop being an engineer's** ([task 1002990](https://cloudbongos.com/builders#/task/1002990) · goal 1000095 — *Working area 6, Governor / Builder / Artist / Ideator experience*, criterion `wa6-kernel-and-packs`). The root `CLAUDE.md` loads in full every session for every craft, and it was an engineer's document: 250 lines / 32,422 chars of claim-before-working, worktree-per-claim, `DEPS_NOT_SHIPPED`, `touches[]` and `/merge-mode`. An ideator and an artist each paid the full token cost of a pipeline they were not going to run and read it as instructions addressed to them — and it CONTRADICTED the same goal's `wa6-drift-stops-the-session`, which says ideation *"needs no claim"*, while the kernel's hard rule said every change is backed by one. The craft-specific half lived in three SKILLS (`/dev`, `/ideate`, `/paint`), the wrong carrier twice over: a skill's description is resident in every session's listing whatever craft is running (27,022 chars against a ~8,000 budget, three of them over-length), and a skill must be INVOKED — a session that never types the command works from the kernel alone, which is the engineer's document again. **Decision: a role-neutral kernel plus one pack per craft under `docs/packs/`, bound by a registry CI checks.** The kernel keeps what is true for every craft (the lifecycle, the money, the trust boundary, the identity split, the charter, navigation) and drops to 216 lines / 22,572 chars, clearing the character target it had been over; the per-line test gains a second half — *is it true for every craft?* The Engineer pack inherits today's methodology; the Ideator pack absorbs `/ideate` and writes down the two grades the criterion names (a quick idea stays ONE LINE, then Claude ASKS whether to develop it into a Full Idea — five questions drawn out of the conversation, in the ideator's own words, scored on completeness); the Artist pack absorbs `/paint`, generalised off the pixel-art pipeline per [ADR 0272](<redacted>.md) — show-first, as little interpretation as possible, and ARRIVE PRECALCULATED, because a session that opens with intake questions is a form. The three skills are deleted. `scripts/gds/discipline-modes.json` becomes the ROLE REGISTRY: a core craft names a `pack` (a file to read), a module-contributed discipline may still name a `skill` (`ui` → `/design`, unchanged as ADR 0272 requires), and `claim.js` prints whichever with the right verb. **`scripts/gds/role-pack-guard.js` HARD-FAILS CI** on a pack path that resolves to nothing, an entry with neither pointer, fewer than three packs, or a pack over budget (16,000 hard / 13,000 target) — hard precisely BECAUSE `claim.js` fails open: a broken path degrades to silence, the role is hollow, and no error says so, so CI is the only gate ("CI budgets each pack"). `docs/packs/` over `.claude/packs/` because `docs/` is already owned by the `methodology` scope key — a new top-level path resolves to NO key, and the scope map's own comment records the cost (a missing key is an empty wall, and goal-scope-check then denies every member-authored task); it is registered explicitly in the default-deny publish allowlist, in lockstep with the registry, or a released core would print an unresolvable pack path on every claim. `ship-card.js` moved with the claim (it would have shipped an "Open the work" button firing a deleted command — the 1003487 divergence in reverse) and `tests/idea_ideate_full.mjs` moved with its subject, its thirteen Full-Idea assertions passing against the pack unchanged. Governor is deliberately DEFERRED — three packs, not four, until the owner decides; the guard floors at three. Rejected: keeping the skills beside the packs (two homes drift, and the listing cost stays); packs AS skills (the exact failure being fixed); duplicating the safety rules into all three packs (the charter forbids it — three copies drift and the kernel becomes the one nobody trusts); leaving the guard advisory like the doc-comment check (that one gates a judgement, this one gates a resolvable path). **Not done:** the kernel is 216 lines against a ~200 target — still a warning, as it was at 250; the line count is the context-budget cluster's work (tasks 1003620/1003687/1003688), which the goal's audit sequenced behind this one.](<redacted>.md) | methodology / roles / context budget |
 | 0275 | [**A role's written responsibility has one source, and the pack's copy is generated** ([task 1003732](https://cloudbongos.com/builders#/task/1003732) · goal 1000095 — *Working area 6*, criterion `wa6-written-responsibilities`; statements fixed by the area owner 2026-09-08). The criterion is one sentence — *"one source, shown on the profile, injected into the pack, referenced by grading"* — and before this task the three statements existed only in the criterion record, nowhere in the tree. The interesting half is why ONE source and not three good copies: if each consumer holds its own, they drift, and the drift has a specific unfair shape — the project shows a builder one standard on their profile, teaches their session a second, and grades the shipped work against a third, so someone is judged by a rule they were never shown. **Decision: a frozen map at `src/role-responsibilities.js` (verbatim owner text, imports nothing), read by three consumers, with the one copy that CAN drift generated and CI-gated.** The hall reads it through `clientModules()` — already injected into every served page as `window.__MODULES__` and already carrying the discipline roster the statements are keyed by, so the profile renders with no new route, no fetch and no copy. The grader reads `responsibilityFor()` through the module doorway and states the standard in the prompt as the project's, not its own. The PACKS get a generated block: markdown cannot require a JS module, so their copy is the only one that can go stale — and it is the worst to lose, being what a session is actually instructed by. `gen-role-responsibilities.js` writes it from the ROLE REGISTRY (so a renamed pack, or Governor when the owner decides, needs no edit), and `role-pack-guard.js` fails CI on drift. Three consequences worth the record. (1) `fitness.js` needed an EXEMPTION for the owner's own prose: the ideator's statement opens "Make good ideas" and `ideas` is a module key, so the no-module-keys scan flagged an English word — paraphrasing to satisfy a scanner is precisely what the task forbids, so the reason is written down and the file's import DIRECTION is still guarded. (2) Registering the freshness check inside `checkGeneratedArtifactsFresh` pushed `fitness.js` one line past its 1,500-line ratchet; rather than raise the baseline (which the check forbids in its own message) the assertion MOVED into `role-pack-guard.js`, which already owns the packs — one check now answers "are the packs correct". (3) The generator matches each pack's own line ending, because `.md` checks out CRLF on Windows and LF in CI, and a generator that always wrote `\n` would make the gate red on one checkout and green on the other for a file nobody touched. A craft with no statement (`ui`, module-contributed per [ADR 0272](<redacted>.md); Governor, deferred per [ADR 0274](<redacted>.md)) renders NOTHING everywhere — no empty quote, no grader line — because a grader told a role has no written standard would supply its own. The profile's avatar was repinned to the top row (the head grid is `align-items:center`, fine for three short lines, wrong once the block made the column tall); verified in both themes in the hall preview. `tests/role_responsibilities.mjs` asserts the criterion's actual content by sweeping `src/`, `scripts/`, `modules/`, `tests/` and `docs/packs/` for any second copy. Rejected: three hand-written paragraphs (the drift would be invisible); a dedicated route for the hall (a fetch and a failure mode for static text already on a rail); storing the statements in the DB (not live state — a row puts the project's written standard outside code review); letting the grader describe a craft from its name (the invented standard this removes); raising `oversized_file_count` to let `fitness.js` grow.](<redacted>.md) | roles / grading / generated artifacts |
 | 0276 | [**The skill-listing budget cannot hold 64 skills and every trigger, so the number is ratcheted and the choice goes to the owner** ([task 1003620](https://cloudbongos.com/builders#/task/1003620) · goal 1000095 — *Working area 6*, criterion `wa6-role-experience`). Every SKILL.md description is resident in EVERY session for every craft, and `skill-lint` budgets the whole listing at 8,000 chars. It has been trimmed twice ([#1003548], [#1003587]) and grown back both times, because the 400-char per-description aim was a WARNING THAT ACCUMULATES. This task rewrote 49 of the 50 `.claude/skills/` descriptions — 17 warnings to 0, listing 25,624 → 19,316 chars, about 1,570 tokens returned to every session — with every trigger phrase preserved and CHECKED MECHANICALLY (a checker diffed the quoted phrases against HEAD and caught five real losses, all restored; four dropped strings were UI labels, not triggers). **8,000 was not reached, and the arithmetic says it cannot be:** across 64 skills the names (880) plus the mandatory quoted triggers (~5,370) are an irreducible ~6,250, leaving ~27 chars per skill to say what the skill DOES. Reaching the budget means trigger-only descriptions — trading truncation for the loss of the semantic signal routing leans on when the user’s words do not literally match a trigger. **Decision: ratchet `skill_listing_chars` at 19,316** in `fitness-ratchets.js` (fails open if the linter cannot load), so it cannot grow while the real question is open; the baseline is deliberately ABOVE skill-lint’s budget and is not a claim the budget is met. **Open and owner-gated:** delist skills (64 is a menu), scale the budget with the roster, or accept trigger-only text — recommendation is delist then rescale, filed as a blocker. `fitness.js`’s over-budget warning STAYS, as the visible trace of that question. Rejected: raising `LISTING_BUDGET_CHARS` to silence the warning (deletes the signal, not the debt); re-cutting the 14 module ui-design descriptions a week after [#1003587] wrote them, for ~2,000 chars toward a target still 9,000 away.](<redacted>.md) | skills / context budget / routing |
+| 0277 | [**A box is "in use" only while a human is attached, and the claim expires** ([task 1003507](https://cloudbongos.com/builders#/task/1003507) · goal 1000095 — *Working area 6*, criterion `wa6-role-experience`). `sweep-idle` skipped any box with `claude_active = true` at ANY age, and `claude_active` is a LATCH, not a level: only a heartbeat ping writes it, and `infra/box-heartbeat.sh` exits WITHOUT pinging when it sees nothing — so silence, the very signal the sweep exists to act on, could never clear it. Reproduced against the shipped selector: skipped at `idleMinutes` of 10, 120, 1440 and **5,256,000** (ten years). Not reaped late; never. The second leg is that `load > 0.2` kept `last_activity_at` bumping every 5 minutes anyway (a devcontainer plus an idle `claude` clears that floor on its own), so EITHER leg alone kept a box alive — which is why bounding only the veto looks like a fix and is not: the incident box's heartbeat was FRESH. Measured: `example-owner`'s box up since 2026-08-12, tmux `otb` UNATTACHED since 2026-08-15 18:01 UTC, `claude` burning 16 min of CPU across 25h of wall clock, **$20.21** of mostly-unattended compute. A THIRD defect, found while testing this and confirmed on clean `origin/main`, made the sweep inert regardless: `loadDeps()` read `_deps` before anything declared it, so it threw `ReferenceError` on first call and every command resolving a DigitalOcean client went with it — including `sweep-idle --apply`, which builds that client before the park loop. **The idle sweep could not park any box at all**, hidden because the suite's only `apply: true` test relied on the veto emptying the idle set before `makeDo()` was reached: one bug shielded by the other. **Decision: a box may not stay active longer than `BOX_UNATTENDED_MAX_HOURS` (12) without evidence a HUMAN was attached.** The heartbeat already computed that signal and folded it into one boolean; it now reports `attached` separately (login session, inbound SSH, open ttyd, or an ATTACHED tmux client via `#{session_attached}` — the signal that separates this box from a working one) and the server stamps `last_attached_at`. `claude_active` keeps its veto but it EXPIRES, bounded by a `claude_active_since` edge stamp. `pgrep -x claude` and the load floor remain reasons the box PINGS, never evidence anyone is THERE — a running process is not a person, and that distinction is the whole decision. The two `NULL` defaults deliberately DISAGREE: `last_attached_at` NULL means "no data" and keeps a pre-1003507 box on the old behaviour (core_238 pointedly does NOT backfill it — a backfilled `now()` starts a clock nothing can advance and parks every un-upgraded box one cap later, and box source sync is not prompt: idea 1000745 records 257 commits behind for three days), while `claude_active_since` NULL is REFUSED because an unknown latch age is the forever-latch itself, and is backfilled so the state is unreachable after deploy. 12h because parking is reversible since task 1002726 (snapshot kept), so a false positive costs one wake against $20.21 for no cap. Both clocks clear at park/wake/deprovision, or a woken box inherits an expired latch and is parked instantly — the fix reintroducing the bug from the far side. Rejected: tracking attachment INSTEAD of bounding the latch (the silent box keeps `true` forever, so the reported hole survives); bounding the latch alone (built first, and the verification probe caught it — the fresh heartbeat meant lifting the veto changed nothing); deleting the load floor (it is what makes an autonomous run count); measuring from `active_since` (that is uptime — parks a box worked on for days); raising `BOX_IDLE_MINUTES` (no threshold reaches an unbounded veto).](<redacted>.md) | dev box / cost / idle sweep |

package/docs/api/openapi.json

@@ -1775,7 +1775,7 @@
           "box"
         ],
         "summary": "POST /box/heartbeat",
-        "description": "POST /box/heartbeat — the box reports it is alive, resetting the idle clock. rank: any authenticated builder (own resource write). Optional body: { claude_active: bool } — when provided, records whether a `claude` process is running. The idle sweep skips boxes with claude_active=true, so an active Claude session keeps the box alive indefinitely. Heartbeats without a body behave as before (last_activity_at bumped, claude_active unchanged). task 919: allowBoxScope — box-heartbeat.sh (cron */5) runs with the box-scoped session.\n\n**Rank:** `any-builder` — Any authenticated builder (row-level ownership enforced in-handler).",
+        "description": "POST /box/heartbeat — the box reports it is alive, resetting the idle clock. rank: any authenticated builder (own resource write). Optional body: { claude_active: bool, attached: bool }. `claude_active` records whether a `claude` process is running; the idle sweep honours it as a veto, but since task 1003507 only for BOX_UNATTENDED_MAX_HOURS (a running process is not a person, and an unbounded veto pinned boxes active forever). `attached` is the human signal — a login session, an inbound SSH connection, an open browser terminal, or an attached tmux client — and stamps last_attached_at, the clock that cap is measured against. A heartbeat that omits `attached` (any box still running the pre-1003507 script) leaves the column NULL, which the sweep reads as \"no data\" and not as \"unattended\". Heartbeats without a body behave as before (last_activity_at bumped only). task 919: allowBoxScope — box-heartbeat.sh (cron */5) runs with the box-scoped session.\n\n**Rank:** `any-builder` — Any authenticated builder (row-level ownership enforced in-handler).",
         "x-rank": "any-builder",
         "x-source": "modules/dev-box/routes/box.js",
         "requestBody": {
@@ -19399,6 +19399,9 @@
         "properties": {
           "claude_active": {
             "type": "boolean"
+          },
+          "attached": {
+            "type": "boolean"
           }
         },
         "additionalProperties": true

package/docs/api-reference.md

@@ -91,7 +91,7 @@ Base path: `/api/bongos`. Ranks (enforced server-side, [ADR 0016](adr/<redacted>
 | GET | `/api/bongos/box/connect.ps1` | `public` | — | GET /box/connect.ps1 — the Windows (PowerShell) bootstrap script. |
 | GET | `/api/bongos/box/connect.sh` | `public` | — | GET /box/connect.sh — the macOS/Linux bootstrap script. |
 | POST | `/api/bongos/box/ensure` | `any-builder` | — | POST /box/ensure — "make my box ready". |
-| POST | `/api/bongos/box/heartbeat` | `any-builder` | `claude_active` | POST /box/heartbeat — the box reports it is alive, resetting the idle clock. |
+| POST | `/api/bongos/box/heartbeat` | `any-builder` | `claude_active`, `attached` | POST /box/heartbeat — the box reports it is alive, resetting the idle clock. |
 | POST | `/api/bongos/box/host-keys` | `any-builder` | `host_keys` | POST /box/host-keys — the box publishes its own PUBLIC SSH host keys (task 1187 / idea 235). |
 | GET | `/api/bongos/box/managed-settings` | `any-builder` | — | GET /box/managed-settings — the caller's Claude Desktop managed-settings.json. |
 | GET | `/api/bongos/box/me` | `any-builder` | — | GET /box/me — the caller's own box. |

package/docs/module-api-changelog.md

@@ -1751,5 +1751,9 @@ is load-bearing: the script throws rather than guess if it is missing, and
         landed since 1.19.649 with no explicit bump. run 34523753119. (task 1002620)
   1.19.651 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
         landed since 1.19.650 with no explicit bump. run 34526936330. (task 1002620)
+  1.19.652 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+        landed since 1.19.651 with no explicit bump. run 34529655648. (task 1002620)
+  1.19.653 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+        landed since 1.19.652 with no explicit bump. run 34543713846. (task 1002620)
 ---------------------------------------------------------------------------
 ```

package/migrations/core_238_box_unattended_cap.sql

@@ -0,0 +1,57 @@
+-- migration core_238: bound how long a dev box may claim to be in use
+-- (task 1003507).
+--
+-- WHY: a box could assert "in use" forever from two proxies, neither of which
+-- implies a human is present.
+--
+--   1. claude_active is a LATCH, not a level. Only a heartbeat ping writes it,
+--      and infra/box-heartbeat.sh exits WITHOUT pinging when it sees no
+--      activity - so silence, the very signal the idle sweep exists to act on,
+--      could never clear it. selectIdleBoxes() skipped claude_active=true rows
+--      with no time bound, so such a box was unreapable at EVERY threshold.
+--   2. `load > 0.2` kept last_activity_at bumping, so the activity clock never
+--      went stale either. A running devcontainer plus an idle `claude` clears
+--      that floor on its own.
+--
+-- Together they made an abandoned interactive `claude` at its prompt in an
+-- UNATTACHED tmux session indistinguishable from a working one. Measured: one
+-- box unattended since 2026-08-15 burned 20.21 USD of compute the sweep could
+-- not reach.
+--
+-- Two columns, because the fix needs two clocks:
+--   claude_active_since - when claude_active last went false->true, so the veto
+--                         can be bounded by how long it has been claimed.
+--   last_attached_at    - when a HUMAN was last actually attached (a login
+--                         session, an inbound SSH connection, an open browser
+--                         terminal, or an attached tmux client). The heartbeat
+--                         already computed this and folded it into one boolean;
+--                         it now reports it separately.
+--
+-- Idempotent: ADD COLUMN IF NOT EXISTS, and the backfill is guarded on IS NULL
+-- so a fresh restore + replay never moves a stamp later beats have written.
+
+BEGIN;
+
+ALTER TABLE builder_boxes
+  ADD COLUMN IF NOT EXISTS claude_active_since timestamptz;
+
+ALTER TABLE builder_boxes
+  ADD COLUMN IF NOT EXISTS last_attached_at timestamptz;
+
+-- Backfill claude_active_since ONLY. A box that is claude_active right now has
+-- no recorded latch age, and refusing an unknown age would park boxes that are
+-- genuinely in use the moment this deploys. Stamp now() so every live box gets
+-- one full grace window; the next heartbeat keeps it honest from there.
+UPDATE builder_boxes
+   SET claude_active_since = now()
+ WHERE claude_active = true
+   AND claude_active_since IS NULL;
+
+-- last_attached_at is deliberately NOT backfilled. A box still running a
+-- heartbeat from before this change never reports attachment, so its column
+-- stays NULL forever - and selectIdleBoxes reads NULL as "no attachment data"
+-- rather than "unattended", which is what keeps such a box on the old behaviour
+-- instead of parking it mid-work. Backfilling now() would instead start a clock
+-- that nothing can ever advance, and park every un-upgraded box after the cap.
+
+COMMIT;

package/modules/dev-box/boxes.js

@@ -164,22 +164,100 @@ function effectiveActivityMs(row) {
   return toMs(row.last_activity_at) ?? toMs(row.active_since) ?? toMs(row.provisioned_at);
 }
 
-// Idle = active boxes whose effective activity is older than idleMinutes AND
-// that don't have an active Claude process. A box with claude_active=true is
-// kept alive regardless of last_activity_at — the session ends when Claude stops.
-// Pure: caller passes the candidate rows and nowMs; returns the subset to deprovision.
-function selectIdleBoxes(rows, { idleMinutes, nowMs } = {}) {
+// ---- the unattended cap (task 1003507) ------------------------------------
+//
+// A box used to be able to assert "in use" forever from two proxies, neither of
+// which implies a human is present:
+//
+//   1. `pgrep -x claude` -> claude_active=true, which selectIdleBoxes skipped
+//      with NO time bound. claude_active is a LATCH, not a level: only a
+//      heartbeat ping writes it, and box-heartbeat.sh exits WITHOUT pinging when
+//      it sees nothing — so silence, the very signal the sweep exists to act on,
+//      could never clear it. Unreapable at EVERY threshold, forever.
+//   2. `load > 0.2` -> ACTIVE=1, which keeps bumping last_activity_at. A running
+//      devcontainer plus an idle `claude` clears that floor on its own, so the
+//      activity clock never went stale either.
+//
+// Together they made an abandoned interactive `claude` at its prompt in an
+// UNATTACHED tmux session indistinguishable from a working one, and one such box
+// burned $20.21 of unattended compute the sweep could not reach. Bounding only
+// (1) does not stop the bleeding, because (2) keeps the box out of the idle set
+// on its own — so both proxies are bounded by the same policy:
+//
+//   A box may not stay active for longer than `unattendedMaxHours` without
+//   evidence that a human was actually attached to it.
+//
+// "Attached" is what the heartbeat already knew and used to throw away by
+// folding it into one boolean: a login session (`who`), an established inbound
+// SSH connection, an open browser terminal (ttyd), or an ATTACHED tmux client.
+// It now reports that separately and the server stamps `last_attached_at`.
+const HOUR_MS = 3_600_000;
+
+// Has a human been attached recently enough for this box's claims to stand?
+//   - no cap configured        -> yes (the pre-1003507 unbounded behaviour;
+//                                 the policy lives in the caller's CONFIG)
+//   - last_attached_at unset   -> yes. A box whose heartbeat predates this change
+//                                 never reports attachment, so its column stays
+//                                 NULL forever — treating unknown as unattended
+//                                 would park every such box mid-work. NULL is
+//                                 deliberately NOT backfilled for that reason.
+//   - within the cap           -> yes
+//   - older than the cap       -> no; the box is unattended
+function attendedRecently(row, { nowMs, unattendedMaxHours } = {}) {
+  if (!Number.isFinite(unattendedMaxHours) || unattendedMaxHours <= 0) return true;
+  const at = toMs(row.last_attached_at);
+  if (at == null) return true;
+  return at > nowMs - unattendedMaxHours * HOUR_MS;
+}
+
+// Does claude_active still earn this box a pass from the idle sweep? Bounded by
+// how long it has been claimed, read off `claude_active_since` (migration
+// core_238, stamped on the false->true edge so it measures the whole session
+// rather than the last beat). An unknown age is refused: core_238 backfills every
+// box that is claude_active at deploy, so a NULL stamp under a true flag is the
+// forever-latch this fixes, not a live session.
+function claudeVetoHolds(row, { nowMs, unattendedMaxHours } = {}) {
+  if (!row.claude_active) return false;
+  if (!Number.isFinite(unattendedMaxHours) || unattendedMaxHours <= 0) return true;
+  const since = toMs(row.claude_active_since);
+  if (since == null) return false;
+  return since > nowMs - unattendedMaxHours * HOUR_MS;
+}
+
+// Idle = active boxes that are either (a) quiet past idleMinutes with no live
+// claude_active veto, or (b) still chattering but unattended past the cap. (b) is
+// the abandoned-session case: the heartbeat is fresh, so (a) can never fire.
+// Pure: caller passes the candidate rows and nowMs; returns the subset to park.
+function selectIdleBoxes(rows, { idleMinutes, nowMs, unattendedMaxHours } = {}) {
   if (!Number.isFinite(idleMinutes) || idleMinutes <= 0) return [];
   if (!Number.isFinite(nowMs)) return [];
   const cutoff = nowMs - idleMinutes * 60_000;
   return (rows || []).filter((r) => {
     if (r.state !== 'active') return false;
-    if (r.claude_active) return false;
+    if (!attendedRecently(r, { nowMs, unattendedMaxHours })) return true;
+    if (claudeVetoHolds(r, { nowMs, unattendedMaxHours })) return false;
     const a = effectiveActivityMs(r);
     return a != null && a <= cutoff;
   });
 }
 
+// Why the sweep picked a box, for the operator log. Mirrors selectIdleBoxes'
+// branches exactly — if these two ever disagree the log is lying, so they are
+// read together.
+function idleReason(row, { nowMs, idleMinutes, unattendedMaxHours } = {}) {
+  if (!attendedRecently(row, { nowMs, unattendedMaxHours })) {
+    const h = Math.round((nowMs - toMs(row.last_attached_at)) / HOUR_MS);
+    return `unattended ${h}h (cap ${unattendedMaxHours}h) — abandoned session`;
+  }
+  const mins = Math.round((nowMs - (effectiveActivityMs(row) || nowMs)) / 60_000);
+  if (row.claude_active) {
+    const since = toMs(row.claude_active_since);
+    const held = since == null ? 'no claude_active_since recorded' : `claude_active ${Math.round((nowMs - since) / HOUR_MS)}h`;
+    return `idle ${mins}m, ${held} past the ${unattendedMaxHours}h cap`;
+  }
+  return `idle ${mins}m`;
+}
+
 // Dormant = parked boxes that have been parked longer than dormantDays. These
 // get fully de-provisioned (snapshot deleted too) to reclaim the last cents.
 // Since task 1002726 this is the ONLY automated path that destroys a snapshot —
@@ -469,7 +547,7 @@ async function recordEvent(db, { boxId, builderId, event, detail, costUsd, actor
 // active box, so logging one per beat would grow the ledger unbounded
 // (~100K rows/builder/year). last_activity_at IS the heartbeat record; box_events
 // is reserved for the rare lifecycle transitions (provision/park/wake/deprovision/cost).
-async function bumpActivity(db, builderId, { claudeActive } = {}) {
+async function bumpActivity(db, builderId, { claudeActive, attached } = {}) {
   const hasClaude = typeof claudeActive === 'boolean';
   const claudeCol = hasClaude ? ', claude_active = $2' : '';
   // The FIRST time a box reports a live `claude` process, stamp
@@ -481,10 +559,29 @@ async function bumpActivity(db, builderId, { claudeActive } = {}) {
   const connectedCol = (hasClaude && claudeActive === true)
     ? ', first_connected_at = COALESCE(first_connected_at, now())'
     : '';
+  // task 1003507 — claude_active_since is the EDGE, not the level: stamped when
+  // the flag goes false->true (COALESCE keeps the original edge across a run of
+  // true beats, so the latch measures the whole session, not the last 5 minutes)
+  // and cleared on a false beat so the next session starts a fresh clock. Without
+  // this the flag has no age, and selectIdleBoxes cannot bound its own veto.
+  const sinceCol = hasClaude
+    ? (claudeActive === true
+      ? ', claude_active_since = COALESCE(claude_active_since, now())'
+      : ', claude_active_since = NULL')
+    : '';
+  // task 1003507 — `attached` is the HUMAN signal (a login session, an inbound
+  // SSH connection, an open browser terminal, or an attached tmux client), kept
+  // separate from claude_active because a running process is not a person. Only
+  // a true beat writes it: last_attached_at is a high-water mark, so a beat that
+  // reports nobody attached leaves the last real attachment where it was and the
+  // unattended clock keeps running. A box whose heartbeat predates this change
+  // never sends the field, leaving the column NULL, which selectIdleBoxes reads
+  // as "no data" rather than "unattended".
+  const attachedCol = attached === true ? ', last_attached_at = now()' : '';
   const params = hasClaude ? [builderId, claudeActive] : [builderId];
   const { rows } = await db.query(
     `UPDATE builder_boxes
-        SET last_activity_at = now(), updated_at = now()${claudeCol}${connectedCol}
+        SET last_activity_at = now(), updated_at = now()${claudeCol}${connectedCol}${sinceCol}${attachedCol}
       WHERE builder_id = $1 AND state = 'active'
       RETURNING state`,
     params
@@ -516,6 +613,10 @@ const SETTABLE_BOX_COLUMNS = new Set([
   'scope', 'provisioned_rank', 'region', 'size_slug', 'droplet_id', 'droplet_name',
   'snapshot_id', 'ip', 'hostname', 'last_activity_at', 'provisioned_at',
   'active_since', 'parked_at', 'destroyed_at', 'error_note', 'claude_active',
+  // task 1003507 — park/wake/deprovision clear the claude_active latch and its
+  // clock together. A woken box that kept a stale claude_active_since would be
+  // instantly reapable, which is the fix reintroducing the bug from the far side.
+  'claude_active_since', 'last_attached_at',
   // host_keys/host_keys_at are normally written by setBoxHostKeys(), but
   // deprovisionOne() clears them on teardown so a rebuilt box never serves its
   // predecessor's SSH identity (idea 310) — hence they are settable here too.
@@ -889,7 +990,10 @@ module.exports = {
   storageCostUsd,
   summarizeBoxCost,
   // pure — selection
+  attendedRecently,
+  claudeVetoHolds,
   effectiveActivityMs,
+  idleReason,
   selectIdleBoxes,
   selectDormantBoxes,
   selectDormantWarnBoxes,

package/modules/dev-box/routes/box.js

@@ -633,21 +633,29 @@ module.exports = function buildBoxRouter() {
 
   // POST /box/heartbeat — the box reports it is alive, resetting the idle clock.
   // rank: any authenticated builder (own resource write). Optional body:
-  // { claude_active: bool } — when provided, records whether a `claude` process
-  // is running. The idle sweep skips boxes with claude_active=true, so an active
-  // Claude session keeps the box alive indefinitely. Heartbeats without a body
-  // behave as before (last_activity_at bumped, claude_active unchanged).
+  // { claude_active: bool, attached: bool }.
+  //
+  // `claude_active` records whether a `claude` process is running; the idle sweep
+  // honours it as a veto, but since task 1003507 only for BOX_UNATTENDED_MAX_HOURS
+  // (a running process is not a person, and an unbounded veto pinned boxes active
+  // forever). `attached` is the human signal — a login session, an inbound SSH
+  // connection, an open browser terminal, or an attached tmux client — and stamps
+  // last_attached_at, the clock that cap is measured against. A heartbeat that
+  // omits `attached` (any box still running the pre-1003507 script) leaves the
+  // column NULL, which the sweep reads as "no data" and not as "unattended".
+  // Heartbeats without a body behave as before (last_activity_at bumped only).
   // #919: allowBoxScope — box-heartbeat.sh (cron */5) runs with the box-scoped session.
   router.post('/box/heartbeat', auth.allowBoxScope, auth.requireBuilder, async (req, res) => {
     // strict:false — heartbeat is a machine ping from SHIPPED box clients that
     // can't update in lockstep with the server (the ADR-0117 un-updatable-consumer
     // concern). Validate the known field's type, but tolerate a future/extra field
     // rather than reject a resilience-critical ping (the idle sweep keys off it).
-    if (validateOrRespond(req, res, { claude_active: { type: 'boolean' } }, { strict: false })) return;
+    if (validateOrRespond(req, res, { claude_active: { type: 'boolean' }, attached: { type: 'boolean' } }, { strict: false })) return;
     try {
       const body = req.body || {};
       const claudeActive = typeof body.claude_active === 'boolean' ? body.claude_active : undefined;
-      const state = await boxes.bumpActivity(pool, req.builder.id, { claudeActive });
+      const attached = typeof body.attached === 'boolean' ? body.attached : undefined;
+      const state = await boxes.bumpActivity(pool, req.builder.id, { claudeActive, attached });
       res.json({ ok: true, state: state || 'none' });
     } catch (err) {
       log.error('[gds] POST /box/heartbeat', err);

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.651",
+  "version": "1.19.653",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.19.651",
+      "version": "1.19.653",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.651",
+  "version": "1.19.653",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/scripts/gds/box-infra.js

@@ -62,6 +62,14 @@ const CONFIG = {
   size: process.env.BOX_SIZE || 's-2vcpu-4gb',
   baseImage: process.env.BOX_BASE_IMAGE || 'ubuntu-24-04-x64',
   idleMinutes: numEnv('BOX_IDLE_MINUTES', 10),
+  // task 1003507 — the longest a box may stay active without evidence that a
+  // HUMAN was attached to it. One number bounds both proxies that used to keep a
+  // box alive on their own (a running `claude` process; load above the floor), so
+  // an abandoned session can no longer pin a droplet forever. 12h is deliberately
+  // generous — longer than any interactive session, long enough for a real
+  // overnight autonomous run — because being wrong costs one wake, while having
+  // no cap at all cost $20.21 on a single box.
+  unattendedMaxHours: numEnv('BOX_UNATTENDED_MAX_HOURS', 12),
   dormantDays: numEnv('BOX_DORMANT_DAYS', 14),
   // task 1002727 — how many days BEFORE the reclaim a builder gets warned.
   dormantWarnLeadDays: numEnv('BOX_DORMANT_WARN_LEAD_DAYS', 3),

package/scripts/gds/box.js

@@ -28,7 +28,8 @@
 //
 // Config (env): DO_API_TOKEN (live only), BOX_PROVISION_MIN_RANK (default xenos),
 //   BOX_REGION (nyc3), BOX_SIZE (s-2vcpu-4gb), BOX_BASE_IMAGE (ubuntu-24-04-x64),
-//   BOX_IDLE_MINUTES (10), BOX_DORMANT_DAYS (14), BOX_SSH_KEY_IDS (comma list),
+//   BOX_IDLE_MINUTES (10), BOX_UNATTENDED_MAX_HOURS (12), BOX_DORMANT_DAYS (14),
+//   BOX_SSH_KEY_IDS (comma list),
 //   BOX_DNS_HOOK (optional command, gets BOX_HOSTNAME/BOX_IP in env), BOX_TAG.
 
 const fs = require('node:fs');
@@ -109,6 +110,21 @@ async function preflightCookieStripScope() {
   return scope;
 }
 
+// Lazily-built handles to the heavy dependencies (DB pool, DO/CF clients), so a
+// dry-run or a --help never opens a pool or requires a network client.
+//
+// task 1003507 — this was UNDECLARED. `_deps = {...}` further down is an
+// assignment, which in sloppy mode would have created a global, but
+// `if (_deps)` READS it first, and reading an undeclared identifier is a
+// ReferenceError. So loadDeps() threw on its first call, every time, and every
+// command that reaches makeDo()/makeCf() went with it — including
+// `sweep-idle --apply`, which resolves its DO client before the park loop.
+// The idle sweep therefore could not park ANY box, which is a second and
+// entirely separate reason the abandoned box in this task was never reaped.
+// No test caught it because the only apply:true test relied on the
+// claude_active veto emptying the idle set before makeDo() was reached.
+let _deps = null;
+
 function loadDeps() {
   if (_deps) return _deps;
   // eslint-disable-next-line global-require
@@ -559,6 +575,10 @@ async function parkOne(pool, boxes, doApi, box, { actor }) {
   await boxes.setBoxState(pool, box.builder_id, 'parked', {
     snapshot_id: snapshotId, parked_at: new Date(now),
     droplet_id: null, ip: null, active_since: null,
+    // task 1003507 — the droplet is gone, so there is no `claude` process to
+    // report. Clearing the flag AND its clock here means a wake starts a fresh
+    // session rather than inheriting an expired latch and being reaped at once.
+    claude_active: false, claude_active_since: null,
   });
   await boxes.recordEvent(pool, {
     boxId: box.id, builderId: box.builder_id, event: 'park',
@@ -610,6 +630,10 @@ async function cmdWake(pool, boxes, ref, { apply }) {
     const now = new Date();
     await boxes.setBoxState(pool, builder.id, 'active', {
       droplet_id: String(droplet.id), ip, active_since: now, last_activity_at: now, parked_at: null,
+      // task 1003507 — a woken box has reported nothing yet. Start the latch and
+      // its clock clean so the first real heartbeat sets both, rather than the
+      // box re-entering the sweep carrying a stale claim from its last session.
+      claude_active: false, claude_active_since: null,
     });
     await boxes.recordEvent(pool, { boxId: box.id, builderId: builder.id, event: 'wake', detail: `droplet ${droplet.id} ${ip || ''}`, actor: actorTag() });
     // #602: the box just ended a PARKED interval (snapshot retained) — accrue its
@@ -724,7 +748,7 @@ async function deprovisionOne(pool, boxes, doApi, box, { actor, login, sleepFn }
   if (CONFIG.dnsHook && dnsHost) runDnsHookBlackhole(dnsHost);
   await boxes.setBoxState(pool, box.builder_id, 'destroyed', {
     destroyed_at: new Date(now), droplet_id: null, ip: null, snapshot_id: null,
-    active_since: null, parked_at: null, claude_active: false,
+    active_since: null, parked_at: null, claude_active: false, claude_active_since: null,
     // idea 310: a rebuilt box mints fresh SSH host keys, but the GDS row kept the
     // OLD keys until the new box re-reported (~10 min). In that window GET /box/me
     // served a stale identity and the desktop app pinned the WRONG key — the
@@ -811,18 +835,20 @@ async function cmdDeprovision(pool, boxes, ref, { apply }) {
 
 async function cmdSweepIdle(pool, boxes, { apply }) {
   const rows = await boxes.listBoxes(pool, { state: 'active' });
-  const idle = boxes.selectIdleBoxes(rows, { idleMinutes: CONFIG.idleMinutes, nowMs: Date.now() });
-  console.log(`idle sweep (threshold=${CONFIG.idleMinutes}m${apply ? '' : ', dry-run'}): ${idle.length} of ${rows.length} active box(es) idle`);
+  const sweepNow = Date.now();
+  const sel = { idleMinutes: CONFIG.idleMinutes, nowMs: sweepNow, unattendedMaxHours: CONFIG.unattendedMaxHours };
+  const idle = boxes.selectIdleBoxes(rows, sel);
+  console.log(`idle sweep (threshold=${CONFIG.idleMinutes}m, unattended cap=${CONFIG.unattendedMaxHours}h${apply ? '' : ', dry-run'}): ${idle.length} of ${rows.length} active box(es) idle`);
   if (idle.length === 0) { console.log('  nothing idle — exit clean'); return { parked: 0 }; }
   const doApi = apply ? makeDo(apply) : null;
   let parked = 0, errors = 0;
   for (const box of idle) {
-    const mins = Math.round((Date.now() - (boxes.effectiveActivityMs(box) || Date.now())) / 60000);
-    if (!apply) { console.log(`  would park @${box.github_login}'s box (idle ${mins}m, droplet ${box.droplet_id})`); continue; }
+    const why = boxes.idleReason(box, sel);
+    if (!apply) { console.log(`  would park @${box.github_login}'s box (${why}, droplet ${box.droplet_id})`); continue; }
     try {
       await parkOne(pool, boxes, doApi, box, { actor: 'sweep:idle' });
       parked++;
-      console.log(`  ✓ parked @${box.github_login} (idle ${mins}m — snapshot kept, compute stopped)`);
+      console.log(`  ✓ parked @${box.github_login} (${why} — snapshot kept, compute stopped)`);
     } catch (e) {
       // A park that fails must NOT fall through to a destroy — leaving the box
       // at 'error' with its droplet intact is strictly safer than reclaiming it,
@@ -1058,7 +1084,7 @@ async function cmdReconcileDrift(pool, boxes, { apply }) {
       await teardownEdgeForLogin(g.login, { apply });
       await boxes.setBoxState(pool, g.builderId, 'destroyed', {
         destroyed_at: new Date(nowMs), droplet_id: null, ip: null, snapshot_id: null,
-        active_since: null, parked_at: null, claude_active: false,
+        active_since: null, parked_at: null, claude_active: false, claude_active_since: null,
         host_keys: null, host_keys_at: null,
       });
       if (row) {
@@ -1198,7 +1224,7 @@ Commands:
   deprovision <builder>  destroy droplet AND snapshot (full reclaim)
   run-intents            drain the auto-provision/wake-on-connect queue (#701):
                          execute each pending box_intents row (provision/wake)
-  sweep-idle             park active boxes idle > ${CONFIG.idleMinutes}m
+  sweep-idle             park active boxes idle > ${CONFIG.idleMinutes}m, or unattended > ${CONFIG.unattendedMaxHours}h
   sweep-dormant          warn at ${Math.max(CONFIG.dormantDays - CONFIG.dormantWarnLeadDays, 0)}d, then deprovision boxes parked > ${CONFIG.dormantDays}d
                          (never reclaims a box that was not warned first)
   reconcile              source-access clawback: deprovision below-floor/inactive

package/scripts/gds/fitness-checks-vocabulary.js

@@ -48,11 +48,36 @@ const VOCAB_ALLOW = [
   },
 ];
 
-// A line CITING a historical artifact by its real name: an ADR filename, the
-// docs/governance/ evidence folder, or one of the already-applied
-// governance_NNN migrations. These names are permanent (see the header), so a
-// reference to one is a citation, not drift.
-const VOCAB_HISTORICAL_REF = /docs\/adr\/|docs\/governance\/|docs\/session-logs\/|governance_0\d\d/;
+// A line CITING a durable artifact by its real name: an ADR filename, the
+// docs/governance/ evidence folder, one of the already-applied migrations, or
+// the cross-goal pass-event contract. These names are permanent (see the
+// header), so a reference to one is a citation, not drift.
+//
+// The migration family is `govern(ance|ment)_NNN` on purpose. government_001
+// RENAMED the governance_NNN family to government_NNN, so half the applied
+// migrations on disk carry each spelling and BOTH are permanent — and the
+// rename migration's own filename (`government_001_rename_from_governance.sql`)
+// says the banned word while matching neither half of the old regex. That is
+// not drift; it is the one filename that has to name what it renamed.
+//
+// docs/specs/board-room-pass-event-contract.md is here for the same reason a
+// migration filename is: it is the agreed cross-goal name of the economy-side
+// award (awardIdeaGovernancePassCredit) and the credit_log reason family
+// idea.credit.governance_pass:<id>. Those are durable ledger rows and another
+// goal's method signature — a line pointing at the contract is citing a name
+// this surface does not own and cannot rename.
+const VOCAB_HISTORICAL_REF = /docs\/adr\/|docs\/governance\/|docs\/session-logs\/|govern(?:ance|ment)_0\d\d|board-room-pass-event-contract/;
+
+// Naming the RULE stays legal — a line that cites ADR 0174 or the task that
+// built the wall is meta-commentary about the ban, and meta-commentary has to
+// be able to say the banned word. Same principle as check 19b's
+// GOAL_VOCAB_CITATION, and deliberately preferred over a per-file VOCAB_ALLOW
+// entry: the exemption belongs to the CITATION, not to whichever file happens
+// to hold it today. (Adding '.md' to VOCAB_EXTS brought the module's own
+// nested CLAUDE.md into scope — the file that TEACHES this rule, which states
+// it in the same breath. Three allowlist entries would have taken the cap of 5
+// to its limit for lines whose only sin is quoting the rule correctly.)
+const VOCAB_CITATION = /ADR 0174|task 1003008/;
 
 const VOCAB_SURFACE = [
   'modules/government',
@@ -67,7 +92,13 @@ const VOCAB_SURFACE = [
   'modules/hall-ui/public/board-room.html',
   'modules/hall-ui/public/board-room.css',
 ];
-const VOCAB_EXTS = new Set(['.js', '.json', '.html', '.css']);
+// '.md' is load-bearing, not tidiness (task 1003120). A nested CLAUDE.md is
+// INSTRUCTION: it loads on demand for every agent working in the module, and
+// the agent that reads the wrong vocabulary there goes on to write it into the
+// code. Leaving markdown unscanned is how modules/government/CLAUDE.md came to
+// assert the INVERSE of ADR 0174 and survive a criterion review (task 1003118).
+// The doc surface is the higher-leverage one to guard, and it was the unguarded one.
+const VOCAB_EXTS = new Set(['.js', '.json', '.html', '.css', '.md']);
 const VOCAB_BANNED = [
   { re: /\brole/i,       label: 'role',       hint: '"role" is reserved for the crafts (Artist / Ideator / Builder). On this surface the noun is RANK.' },
   { re: /governance/i,    label: 'governance', hint: 'the pre-ADR-0174 name of this surface. It is the GOVERNMENT now.' },
@@ -202,6 +233,9 @@ function checkVocabularyWall() {
         // too, or the code could not point at the migration that created its own
         // tables. Same principle, applied to the line rather than the file.
         if (VOCAB_HISTORICAL_REF.test(scanLine)) continue;
+        // A line that CITES the rule is meta-commentary about the ban, not an
+        // instance of it. Costs no allowlist entry and travels with the sentence.
+        if (VOCAB_CITATION.test(scanLine)) continue;
         const excused = VOCAB_ALLOW.some((a) => a.file === rel && scanLine.toLowerCase().includes(a.match));
         if (excused) continue;
         violations.push(`${rel}:${i + 1}: "${b.label}" — ${b.hint}  →  ${line.trim().slice(0, 90)}`);
@@ -214,8 +248,52 @@ function checkVocabularyWall() {
     hardFail: violations.length > 0,
     violations,
     warnings: [],
-    note: `${scanned} government-surface file(s) scanned for "role"/"governance"; `
-        + `${VOCAB_ALLOW.length} documented allowlist entr(y|ies). Historical migrations + docs/adr are excluded by construction, not suppressed.`,
+    note: `${scanned} government-surface file(s) scanned for "role"/"governance" (${[...VOCAB_EXTS].sort().join(' ')}); `
+        + `${VOCAB_ALLOW.length} documented allowlist entr(y|ies), plus the citation rule. `
+        + 'Historical migrations + docs/adr are excluded by construction, not suppressed.',
+  };
+}
+
+// ── Check 19c — a rename sweep that ate its own arrow (task 1003120) ─────────
+//
+// THE HOLE CHECK 19 CANNOT SEE. Checks 19 and 19b grep for a BANNED WORD, so
+// they are structurally blind to the damage that actually happened in task
+// 1003118: a find-and-replace ran over a doc that was DESCRIBING the rename, and
+// swept BOTH sides of every rename pair. `governance` → `government` became
+// `government` → `government`. Not one banned word survives that edit, so the
+// wall passed — while the nested CLAUDE.md now taught the next agent that the
+// old name and the new name were the same word, and asserted the inverse of
+// ADR 0174 through a criterion review.
+//
+// An arrow between two identical names states nothing. It is only ever the
+// fossil of a sweep, so flagging the SHAPE catches the defect on the day it
+// lands, with no vocabulary to enumerate. Measured on the whole tree: the one
+// hit outside this surface is ADR 0194's `open` → `open`, a real mapping
+// sentence — which is why the check is scoped to the government surface (the
+// files the rename actually swept) rather than run repo-wide.
+const RENAME_IDENTITY_RE = /`([\w./-]+)` *(?:→|->) *`\1`/;
+
+function checkGovernmentRenameIdentity() {
+  const violations = [];
+  let scanned = 0;
+  for (const { abs, rel } of vocabFilesToScan()) {
+    scanned += 1;
+    fs.readFileSync(abs, 'utf8').split('\n').forEach((line, i) => {
+      const m = RENAME_IDENTITY_RE.exec(line);
+      if (!m) return;
+      violations.push(`${rel}:${i + 1}: \`${m[1]}\` → \`${m[1]}\` — a rename arrow between two IDENTICAL names states nothing. `
+        + 'A sweep ate one side of the pair (task 1003118); restore the name it renamed FROM.'
+        + `  →  ${line.trim().slice(0, 90)}`);
+    });
+  }
+  return {
+    name: 'a rename arrow names two different things (task 1003120)',
+    ok: violations.length === 0,
+    hardFail: violations.length > 0,
+    violations,
+    warnings: [],
+    note: `${scanned} government-surface file(s) scanned for \`X\` → \`X\` pairs; no allowlist — `
+        + 'an arrow between identical names has no legitimate form to excuse.',
   };
 }
 
@@ -225,12 +303,15 @@ module.exports = {
   GOAL_VOCAB_LINE_SCOPED,
   GOAL_VOCAB_SURFACE,
   LIFECYCLE_DB_FILES,
+  RENAME_IDENTITY_RE,
   VOCAB_ALLOW,
   VOCAB_BANNED,
+  VOCAB_CITATION,
   VOCAB_EXTS,
   VOCAB_HISTORICAL_REF,
   VOCAB_SURFACE,
   checkGoalMembershipVocabulary,
+  checkGovernmentRenameIdentity,
   checkVocabularyWall,
   vocabFilesToScan,
 };

package/scripts/gds/fitness.js

@@ -36,7 +36,7 @@ const { resolveCoreRoot, resolveInstanceRoot } = require('../../src/instance-con
 const { CORE_ROOT, INSTANCE_ROOT, MODULE_ROOTS, REPO_ROOT, rel, walkJs, walkJsAllRoots } = require('./fitness-lib.js');
 const { IDENTITY_SCAN_ALLOWED, IDENTITY_SCAN_EXCLUDE, IDENTITY_SCAN_EXTRA_FILES, IDENTITY_SCAN_EXTS, IDENTITY_SCAN_ROOTS, IDENTITY_SCAN_SKIP_DIRS, PROMPT_IDENTITY_LITERALS, checkDesignContract, checkKernelPromptsNoHardcodedIdentity, checkNeutralConfigsNoHostIdentity, collectIdentityFiles, scanPromptIdentity, stripCommentsForIdentity } = require('./fitness-checks-identity.js');
 const { WRITE_VALIDATION_BASELINE, WRITE_VALIDATION_EXEMPT, checkWriteRoutesValidated, scanUnvalidatedWriteRoutes } = require('./fitness-checks-write-validation.js');
-const { GOAL_VOCAB_CITATION, GOAL_VOCAB_LINE_SCOPED, GOAL_VOCAB_SURFACE, LIFECYCLE_DB_FILES, VOCAB_ALLOW, VOCAB_BANNED, VOCAB_EXTS, VOCAB_HISTORICAL_REF, VOCAB_SURFACE, checkGoalMembershipVocabulary, checkVocabularyWall, vocabFilesToScan } = require('./fitness-checks-vocabulary.js');
+const { GOAL_VOCAB_CITATION, GOAL_VOCAB_LINE_SCOPED, GOAL_VOCAB_SURFACE, LIFECYCLE_DB_FILES, RENAME_IDENTITY_RE, VOCAB_ALLOW, VOCAB_BANNED, VOCAB_CITATION, VOCAB_EXTS, VOCAB_HISTORICAL_REF, VOCAB_SURFACE, checkGoalMembershipVocabulary, checkGovernmentRenameIdentity, checkVocabularyWall, vocabFilesToScan } = require('./fitness-checks-vocabulary.js');
 // ============================================================================
 // Check 1 — core ↔ host/game import boundary (ADR 0062 §1 cut-line)
 // ============================================================================
@@ -1374,6 +1374,7 @@ const CHECKS = [
   checkErrorEnvelope, // Check 17 — BV1 R03 / task 1990: no route hand-rolls a flat error (ADR 0116)
   checkVocabularyWall, // Check 19 — ADR 0174 / goal 1000068 R07: "role" is a craft, never a rank
   checkGoalMembershipVocabulary, // Check 19b — ADR 0177 / task 1003013: the FOURTH "role" (goal membership)
+  checkGovernmentRenameIdentity, // Check 19c — task 1003120: `X` → `X`, the rename arrow a sweep ate both sides of (the shape checks 19/19b are blind to)
   checkWriteRoutesValidated, // Check 18 — BV1 R12 / task 1999: every body-reading write route validates (ADR 0118)
   require('./fitness-ratchets.js').checkQualityRatchets, // Check 20 — task 1003129: quality budgets only tighten (mechanics + knip CI step live in fitness-ratchets.js)
   require('./doc-cli-guard.js').checkDocNamesRealCli, // Check 22 — task 1003165 / G01: a doc that names a CLI invocation must match the real CLI
@@ -1434,8 +1435,8 @@ function main() {
 if (require.main === module) main();
 
 module.exports = {
-  checkVocabularyWall, VOCAB_ALLOW,
-  checkGoalMembershipVocabulary, GOAL_VOCAB_SURFACE,
+  checkVocabularyWall, VOCAB_ALLOW, VOCAB_CITATION, VOCAB_EXTS, vocabFilesToScan,
+  checkGoalMembershipVocabulary, GOAL_VOCAB_SURFACE, checkGovernmentRenameIdentity, RENAME_IDENTITY_RE, // 19c — task 1003120
   runAll,
   resolvesToHostGame,
   checkCoreHostBoundary,

package/src/module-api.js

@@ -71,7 +71,7 @@ const { responsibilityFor, ROLE_RESPONSIBILITIES } = require('./role-responsibil
 // there. scripts/gds/bump-version.js still rewrites the literal below; it appends
 // the entry to that file. Look for a version's history there, not here.
 // ---------------------------------------------------------------------------
-const CORE_VERSION = '1.19.651'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
+const CORE_VERSION = '1.19.653'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('dev-box'); log.info('mounted');

package/tests/boxes.mjs

@@ -170,7 +170,7 @@ t('selectIdleBoxes: guards bad inputs', () => {
   assert.deepEqual(boxes.selectIdleBoxes([], { idleMinutes: 30, nowMs: NaN }), []);
 });
 
-t('selectIdleBoxes: skips boxes where claude_active=true regardless of age', () => {
+t('selectIdleBoxes: with NO cap configured, claude_active=true skips regardless of age (pre-1003507 path)', () => {
   const rows = [
     // Old + claude running → kept alive.
     { state: 'active', github_login: 'clauding', last_activity_at: new Date(NOW - 60 * 60000).toISOString(), claude_active: true },
@@ -183,6 +183,114 @@ t('selectIdleBoxes: skips boxes where claude_active=true regardless of age', ()
   assert.deepEqual(idle.map((r) => r.github_login).sort(), ['idle', 'legacy']);
 });
 
+// --- task 1003507: the unattended cap ---------------------------------------
+//
+// The bug had TWO legs and either one alone kept an abandoned box alive:
+//   (1) claude_active is a latch only a ping can clear, and the sweep honoured it
+//       with no time bound at all -> unreapable at every threshold, forever;
+//   (2) load > 0.2 kept last_activity_at fresh, so the idle clock never expired.
+// The reported box had BOTH, which is why these tests model a FRESH heartbeat:
+// a fix that only bounds (1) leaves the box alive through (2) and looks green
+// against a stale-heartbeat fixture.
+const CAP = 12;
+const HOURS = (n) => n * 60 * 60000;
+const at = (ms) => new Date(ms).toISOString();
+
+// The reported incident, to scale: droplet up 5 days, heartbeat 5 min old, a
+// `claude` process running, nobody attached for 21h.
+const abandonedBox = () => ({
+  state: 'active', github_login: 'abandoned', claude_active: true,
+  claude_active_since: at(NOW - HOURS(21)),
+  last_activity_at: at(NOW - 5 * 60000),
+  last_attached_at: at(NOW - HOURS(21)),
+  active_since: at(NOW - 5 * 24 * 60 * 60000),
+});
+const swept = (rows, over = {}) => boxes.selectIdleBoxes(rows, {
+  idleMinutes: 30, nowMs: NOW, unattendedMaxHours: CAP, ...over,
+}).map((r) => r.github_login);
+
+t('selectIdleBoxes: an unattended box past the cap is reaped even with a FRESH heartbeat', () => {
+  // The regression that matters: last_activity_at is 5 min old, so the ordinary
+  // idle rule can never fire. Only the attachment clock catches this box.
+  assert.deepEqual(swept([abandonedBox()]), ['abandoned']);
+});
+
+t('selectIdleBoxes: a box with a human attached is spared regardless of the cap', () => {
+  assert.deepEqual(swept([{ ...abandonedBox(), last_attached_at: at(NOW - 10 * 60000) }]), []);
+  assert.deepEqual(swept([{ ...abandonedBox(), last_attached_at: at(NOW - HOURS(11)) }]), []);
+});
+
+t('selectIdleBoxes: the cap boundary', () => {
+  assert.deepEqual(swept([{ ...abandonedBox(), last_attached_at: at(NOW - HOURS(12) + 60000) }]), []);
+  assert.deepEqual(swept([{ ...abandonedBox(), last_attached_at: at(NOW - HOURS(12) - 60000) }]), ['abandoned']);
+});
+
+t('selectIdleBoxes: a latched claude_active box that stopped heartbeating is reaped', () => {
+  // Leg (1) on its own: silence cannot clear the flag, so before this fix the
+  // row survived every sweep at every threshold.
+  assert.deepEqual(swept([{
+    state: 'active', github_login: 'zombie', claude_active: true,
+    claude_active_since: at(NOW - 365 * 24 * 60 * 60000),
+    last_activity_at: at(NOW - 365 * 24 * 60 * 60000),
+    last_attached_at: null,
+  }]), ['zombie']);
+});
+
+t('selectIdleBoxes: a box with NO attachment data keeps the old behaviour', () => {
+  // A box still running the pre-1003507 heartbeat never reports `attached`, so
+  // last_attached_at stays NULL. NULL must read as "no data", never as
+  // "unattended" — otherwise this fix parks every un-upgraded box mid-work.
+  // (core_238 deliberately does not backfill the column for the same reason.)
+  assert.deepEqual(swept([{
+    state: 'active', github_login: 'legacy', claude_active: true,
+    claude_active_since: at(NOW - HOURS(2)),
+    last_activity_at: at(NOW - 5 * 60000),
+    last_attached_at: null,
+  }]), []);
+  // ...but it is still reapable the ordinary way once it goes quiet.
+  assert.deepEqual(swept([{
+    state: 'active', github_login: 'legacy2', claude_active: false,
+    last_activity_at: at(NOW - HOURS(1)), last_attached_at: null,
+  }]), ['legacy2']);
+});
+
+t('selectIdleBoxes: omitting the cap preserves the unbounded veto exactly', () => {
+  assert.deepEqual(swept([abandonedBox()], { unattendedMaxHours: undefined }), []);
+  assert.deepEqual(swept([abandonedBox()], { unattendedMaxHours: 0 }), []);
+});
+
+t('attendedRecently: NULL is unknown (true), not unattended', () => {
+  assert.equal(boxes.attendedRecently({ last_attached_at: null }, { nowMs: NOW, unattendedMaxHours: CAP }), true);
+  assert.equal(boxes.attendedRecently({ last_attached_at: at(NOW - HOURS(1)) }, { nowMs: NOW, unattendedMaxHours: CAP }), true);
+  assert.equal(boxes.attendedRecently({ last_attached_at: at(NOW - HOURS(20)) }, { nowMs: NOW, unattendedMaxHours: CAP }), false);
+  // No cap configured -> nothing is ever "unattended".
+  assert.equal(boxes.attendedRecently({ last_attached_at: at(NOW - HOURS(999)) }, { nowMs: NOW }), true);
+});
+
+t('claudeVetoHolds: a true flag with no recorded start is refused', () => {
+  // An unknown latch age is exactly the forever-latch being fixed, so it must
+  // NOT be honoured — core_238 stamps every box that is claude_active on deploy.
+  assert.equal(boxes.claudeVetoHolds(
+    { claude_active: true, claude_active_since: null }, { nowMs: NOW, unattendedMaxHours: CAP }
+  ), false);
+  assert.equal(boxes.claudeVetoHolds(
+    { claude_active: true, claude_active_since: at(NOW - HOURS(2)) }, { nowMs: NOW, unattendedMaxHours: CAP }
+  ), true);
+  assert.equal(boxes.claudeVetoHolds(
+    { claude_active: true, claude_active_since: at(NOW - HOURS(20)) }, { nowMs: NOW, unattendedMaxHours: CAP }
+  ), false);
+  assert.equal(boxes.claudeVetoHolds({ claude_active: false }, { nowMs: NOW, unattendedMaxHours: CAP }), false);
+});
+
+t('idleReason: names the clock that actually selected the box', () => {
+  const opts = { nowMs: NOW, idleMinutes: 30, unattendedMaxHours: CAP };
+  assert.match(boxes.idleReason(abandonedBox(), opts), /unattended 21h/);
+  assert.match(boxes.idleReason({
+    state: 'active', claude_active: false,
+    last_activity_at: at(NOW - HOURS(1)), last_attached_at: at(NOW - 60000),
+  }, opts), /idle 60m/);
+});
+
 t('selectDormantBoxes: picks parked boxes past the dormant threshold', () => {
   const rows = [
     { state: 'parked', github_login: 'gone', parked_at: new Date(NOW - 20 * DAY).toISOString() },
@@ -1264,6 +1372,7 @@ function sweepHarness({ idleRows, parkThrows = null }) {
     async listBoxes() { return idleRows; },
     selectIdleBoxes: boxes.selectIdleBoxes,
     effectiveActivityMs: boxes.effectiveActivityMs,
+    idleReason: boxes.idleReason,
     async setBoxState(_db, _bid, state, patch) { states.push({ state, patch }); return {}; },
     async recordComputeCost() { return 0; },
     async recordEvent(_db, e) { events.push(e); },
@@ -1321,17 +1430,65 @@ await ta('cmdSweepIdle: dry-run reports "would park" and touches nothing', async
   assert.equal(h.states.length, 0, 'no state written in dry-run');
 });
 
-await ta('cmdSweepIdle: a box running Claude is never parked mid-session', async () => {
+await ta('cmdSweepIdle: a box mid-session is never parked', async () => {
+  // Genuinely in use: Claude started 20 min ago and somebody is attached.
   const busy = {
     id: 4, builder_id: 4, state: 'active', droplet_id: '1', github_login: 'busy',
     last_activity_at: new Date(Date.now() - 99 * 3600_000).toISOString(), claude_active: true,
+    claude_active_since: new Date(Date.now() - 20 * 60_000).toISOString(),
+    last_attached_at: new Date(Date.now() - 20 * 60_000).toISOString(),
   };
   const h = sweepHarness({ idleRows: [busy] });
   const res = await boxCli.cmdSweepIdle({}, h.fakeBoxes, { apply: true });
-  assert.equal(res.parked, 0, 'claude_active holds the box open regardless of age');
+  assert.equal(res.parked, 0, 'a live session still holds the box open');
   assert.equal(h.states.length, 0);
 });
 
+await ta('cmdSweepIdle: task 1003507 — a box claiming claude_active for 99h with nobody attached IS parked', async () => {
+  // The reported incident, end to end through the command. Before this task the
+  // sweep skipped the row on claude_active alone and reported 0 idle; it now
+  // parks it (snapshot kept), and the log names the clock that selected it.
+  const abandoned = {
+    id: 5, builder_id: 5, state: 'active', droplet_id: '591743808', github_login: 'abandoned',
+    last_activity_at: new Date(Date.now() - 5 * 60_000).toISOString(),
+    claude_active: true,
+    claude_active_since: new Date(Date.now() - 99 * 3600_000).toISOString(),
+    last_attached_at: new Date(Date.now() - 99 * 3600_000).toISOString(),
+  };
+  const h = sweepHarness({ idleRows: [abandoned] });
+  const lines = [];
+  const origLog = console.log;
+  console.log = (...a) => lines.push(a.join(' '));
+  let res;
+  try {
+    res = await boxCli.cmdSweepIdle({}, h.fakeBoxes, { apply: false });
+  } finally { console.log = origLog; }
+  assert.equal(res.parked, 0, 'dry-run writes nothing');
+  assert.ok(lines.some((l) => /would park .*abandoned/.test(l)), 'the abandoned box is selected');
+  assert.ok(lines.some((l) => /unattended 99h/.test(l)), 'the log names the unattended clock, not the idle one');
+});
+
+await ta('loadDeps: task 1003507 — resolving deps does not throw ReferenceError', async () => {
+  // _deps was UNDECLARED, so loadDeps() threw on its first call and every
+  // command reaching makeDo()/makeCf() died with it — including
+  // `sweep-idle --apply`, which builds its DO client before the park loop, so
+  // the sweep could never park anything. Reached here through the same
+  // apply:true path that hid the bug: the assertion is that we get PAST dep
+  // resolution, whatever the fake DO client then does.
+  const row = {
+    id: 6, builder_id: 6, state: 'active', droplet_id: '1', github_login: 'reap',
+    last_activity_at: new Date(Date.now() - 99 * 3600_000).toISOString(), claude_active: false,
+  };
+  const h = sweepHarness({ idleRows: [row] });
+  const origLog = console.log;
+  console.log = () => {};
+  let err = null;
+  try {
+    await boxCli.cmdSweepIdle({}, h.fakeBoxes, { apply: true });
+  } catch (e) { err = e; } finally { console.log = origLog; }
+  assert.ok(!(err && /_deps is not defined/.test(err.message)), `loadDeps threw: ${err && err.message}`);
+});
+
 console.log('\ntask 1002727 — the dormant sweep warns before it takes:');
 
 const DORMANT_DAY = 86_400_000;

package/tests/government_vocabulary.mjs

@@ -46,18 +46,113 @@ test('a planted "governance" on the government surface REDS the build', () => {
 // Plant a line into a real government-surface file, run the check, restore.
 // Uses the real file rather than a fixture so the test exercises the same path
 // resolution the CI gate does.
-function withPlantedLine(line) {
+function withPlantedLine(line, relParts = ['modules', 'government', 'resolver.js'], check = 'checkVocabularyWall') {
   const fs = require('node:fs');
-  const target = path.join(ROOT, 'modules', 'government', 'resolver.js');
+  const target = path.join(ROOT, ...relParts);
   const original = fs.readFileSync(target, 'utf8');
   try {
     fs.writeFileSync(target, `${original}\n${line}\n`);
-    return fitness.checkVocabularyWall().violations;
+    return fitness[check]().violations;
   } finally {
     fs.writeFileSync(target, original);
   }
 }
 
+const MD = ['modules', 'government', 'CLAUDE.md'];
+
+// ---------- markdown is inside the wall (task 1003120) ----------
+//
+// The gap this closes: a nested CLAUDE.md is INSTRUCTION — it loads on demand
+// for every agent working in the module, and the agent that reads the wrong
+// vocabulary there writes it into the code next. It sat outside the very rule
+// it describes, which is how it came to teach the INVERSE of ADR 0174 and
+// survive a criterion review (task 1003118).
+
+test('the wall scans markdown — the doc that TEACHES the rule is inside it', () => {
+  assert.ok(fitness.VOCAB_EXTS.has('.md'),
+    'markdown must be scanned: the highest-leverage vocabulary surface is the nested '
+    + 'CLAUDE.md an agent reads before writing code, not the code itself');
+  const scanned = fitness.vocabFilesToScan().map((f) => f.rel);
+  assert.ok(scanned.includes('modules/government/CLAUDE.md'),
+    `the module's own nested doc must be in scope; scanned: ${scanned.join(', ')}`);
+});
+
+test('a planted "role" in a government MARKDOWN file REDS the build', () => {
+  const planted = withPlantedLine('A custom role may hold this permission.', MD);
+  assert.ok(planted.some((v) => /CLAUDE\.md.*"role"/.test(v)),
+    'a doc that teaches the banned vocabulary must be caught — otherwise adding '
+    + '.md to VOCAB_EXTS bought nothing');
+});
+
+// ---------- the citation rule is an exemption, not a hole ----------
+//
+// Preferred over three more VOCAB_ALLOW entries (which would have taken the cap
+// of 5 to its limit) because the exemption belongs to the CITATION, not to
+// whichever file happens to hold it. So it has to be narrow, and both halves of
+// that are load-bearing: it lets the rule be NAMED, and nothing else.
+
+test('a line that CITES the rule may say the banned word', () => {
+  const planted = withPlantedLine('On this surface "role" is banned — see ADR 0174.', MD);
+  assert.ok(!planted.some((v) => /CLAUDE\.md/.test(v)),
+    'meta-commentary about the ban has to be able to name it, or the doc could '
+    + 'not state the rule it enforces');
+});
+
+test('the citation rule does NOT excuse the rest of the line', () => {
+  // Same file, same banned word, no citation: still caught. Without this the
+  // exemption could be silently widened to "this file is fine" and stay green.
+  const planted = withPlantedLine('A custom role may hold this permission.', MD);
+  assert.ok(planted.some((v) => /CLAUDE\.md/.test(v)),
+    'a line with no citation must still red — an exemption that covers the file '
+    + 'rather than the sentence is an allowlist wearing a regex');
+});
+
+test('the allowlist did not grow to absorb the markdown surface', () => {
+  // The whole point of the citation rule: bringing .md into scope surfaced three
+  // legitimate lines, and NONE of them cost an allowlist slot.
+  assert.ok(fitness.VOCAB_ALLOW.length <= 4,
+    `the allowlist grew to ${fitness.VOCAB_ALLOW.length} when .md came into scope. `
+    + 'The citation rule exists so it would not have to.');
+});
+
+// ---------- check 19c: the rename arrow a sweep ate both sides of ----------
+//
+// The defect checks 19 and 19b are structurally blind to. Task 1003118 ran a
+// find-and-replace over a doc DESCRIBING the rename and swept both sides of
+// every pair: `governance` → `government` became `government` → `government`.
+// No banned word survives that edit, so the wall passed while the doc taught
+// the next agent that the old and new names were the same word.
+
+test('the government surface carries no identity rename arrows today', () => {
+  const r = fitness.checkGovernmentRenameIdentity();
+  assert.equal(r.ok, true,
+    `an \`X\` → \`X\` arrow is on the surface:\n${r.violations.join('\n')}`);
+  assert.ok(r.note.includes('file(s) scanned'), 'the check must report what it scanned');
+});
+
+test('a planted `X` → `X` pair REDS the build', () => {
+  const planted = withPlantedLine('The sweep renamed `ranks.js` → `ranks.js` here.', MD, 'checkGovernmentRenameIdentity');
+  assert.ok(planted.some((v) => /ranks\.js/.test(v)),
+    'an arrow between two identical names states nothing and is only ever the '
+    + 'fossil of a sweep — it must be caught');
+});
+
+test('a REAL rename arrow is left alone', () => {
+  // The check must not punish the sentence it exists to protect: a doc
+  // describing the rename correctly names two different things.
+  const planted = withPlantedLine('The sweep renamed `governance_001` → `government_001` here.', MD, 'checkGovernmentRenameIdentity');
+  assert.equal(planted.length, 0,
+    `a legitimate A → B rename must pass, or the rule teaches docs not to describe `
+    + `renames at all:\n${planted.join('\n')}`);
+});
+
+test('the rename-identity check has no allowlist to erode', () => {
+  const r = fitness.checkGovernmentRenameIdentity();
+  assert.ok(/no allowlist/.test(r.note),
+    'an arrow between identical names has no legitimate form, so there is nothing '
+    + 'to excuse — and no slot for a future exemption to grow into');
+});
+
 // ---------- the allowlist is small, reasoned, and real ----------
 
 test('every allowlist entry carries a written reason', () => {