feat: seed maintenance-thresholds.toml + close build Phase 1

The TOML carries every severity value the console and the system-health-check workflow grade against (the workflow's hard-won numbers: the 10 GB cache trigger, the 35/60-day scrub bands, the snapper TIMELINE limits from the 2026-05-26 /home lesson) plus the shipped curation defaults. Canonical home is configs/ here. Installer wiring stays Phase 13, so for now the file is hand-copied to ~/.config/archsetup/ on ratio.

Phase 1 of the build landed in dotfiles (43a39ac): maint package skeleton, two-layer thresholds engine, capability probe, and the status contract with three pilot collectors, 48 tests. The todo phase task flips to its dated log entry.

2 files changed, 89 insertions, 2 deletions

diff --git a/configs/maintenance-thresholds.toml b/configs/maintenance-thresholds.toml
new file mode 100644
index 0000000..f2b9a23
--- /dev/null
+++ b/configs/maintenance-thresholds.toml
@@ -0,0 +1,87 @@
+# maintenance-thresholds.toml — every severity value the maintenance console
+# and the system-health-check workflow grade against, plus the shipped
+# curation defaults. Owned and installed by archsetup (canonical:
+# configs/maintenance-thresholds.toml in the archsetup repo; installed to
+# ~/.config/archsetup/maintenance-thresholds.toml). Both consumers read the
+# installed path, so severity rules can never drift between them.
+#
+# User curation and overrides live in ~/.config/maint/curation.toml and merge
+# over this file (scalars: user wins; [curation.*]: entries − disable + add).
+# Never record user marks here — an archsetup update replaces this file.
+#
+# Seed values migrated 2026-07-07 from the system-health-check workflow's
+# hard-won prose rules (the 2026-05-26 /home snapshot lesson, the 10 GB cache
+# trigger, the 35/60-day scrub bands) and the maintenance-console design doc.
+
+[storage]
+df_warn_pct = 80
+df_crit_pct = 90
+btrfs_scrub_warn_days = 35
+btrfs_scrub_crit_days = 60
+zfs_scrub_warn_days = 35
+zfs_scrub_crit_days = 60
+zfs_capacity_warn_pct = 80          # ZFS performance degrades past 80
+zfs_capacity_crit_pct = 90
+zfs_frag_info_pct = 50
+
+[snapshots]
+# Sane snapper TIMELINE limits — the 2026-05-26 /home pile-up fix.
+timeline_hourly = 6
+timeline_daily = 7
+timeline_weekly = 2
+timeline_monthly = 2
+timeline_yearly = 0
+single_keep = 2                     # DELETE STALE keeps the newest N singles
+zfs_count_warn = 1000               # runaway retention
+zfs_space_warn_pct = 20             # snapshot space vs pool capacity
+
+[packages]
+cache_warn_gb = 10                  # suggest paccache beyond the weekly keep-3
+
+[updates]
+pending_warn = 50                   # "a lot" — reddens the strip border
+cache_stale_hours = 6               # network-tier cache older than this warns
+topgrade_warn_days = 14             # topgrade freshness
+
+[logs]
+app_log_warn_days = 7               # log-cleanup cron should hold ~7 days
+journal_digest_top = 10             # groups shown in the journal digest
+
+[power]
+battery_low_pct = 15                # feeds the diagnostic state (glyph red)
+charge_limit_pct = 80               # the SET 80% longevity cap on velox
+
+[backups]
+rsyncshot_daily_crit_hours = 48     # daily backup older than this is a fire
+
+[services]
+docker_reclaim_warn_gb = 5
+docker_reclaim_warn_pct = 50
+
+[refresh]
+# Cadence knobs (seconds unless named otherwise) — spec Decision 8.
+live_secs = 3
+fast_secs = 30
+glyph_scan_mins = 30
+net_scan_mins = 60
+
+# --- shipped curation defaults (user layer adds/disables, never edits) ------
+
+[curation.known_noise]
+# Journal-noise patterns bind to identifier + message snippet, never a whole
+# unit — a muted service's new errors still surface.
+entries = [
+  { identifier = "bluetoothd", pattern = "HFP" },
+  { identifier = "pixman", pattern = "Invalid glyph" },
+  { identifier = "xkbcomp", pattern = "Could not resolve keysym" },
+]
+
+[curation.expected_listeners]
+entries = ["sshd", "mpd", "tailscaled"]
+
+[curation.expected_containers]
+entries = ["winvm"]
+
+[curation.pacnew_safe_delete]
+# Regenerated files whose .pacnew is safe to drop (reflector-managed / local).
+entries = ["/etc/pacman.d/mirrorlist", "/etc/locale.gen"]
diff --git a/todo.org b/todo.org
index e7509d4..c379a3a 100644
--- a/todo.org
+++ b/todo.org
@@ -27,8 +27,8 @@ The vocabulary is open — topic tags are coined as needed — so these are conv
 :END:
 Build the maintenance console per [[file:docs/specs/2026-07-07-maintenance-console-spec.org][maintenance-console-spec.org]] (DOING; review incorporated 2026-07-07 — two rounds, all 13 decisions DONE, all 10 findings DONE, verdict Ready; Craig approved config paths + sysmon right-click re-homing). Design source of truth: [[file:docs/design/maintenance-console-design-ideas.org][maintenance-console-design-ideas.org]]; pixel reference: [[file:docs/prototypes/2026-07-07-maint-console-E5-selector-subpanel.html][E5 prototype]]. CLI-first =maint= package in dotfiles (archsetup-owns-dotfiles applies: edit, test, commit, push, note dotfiles inbox per phase); thresholds TOML + VM harness in archsetup. Each phase gates on green tests before its commit.
 
-*** TODO Phase 1 — package skeleton, thresholds, contract :solo:
-=maint/= scaffold + stow wiring, thresholds.py (TOML + user-layer merge + disable flags + env overrides), schema.py severity model, capability probe (battery ⇔ type==Battery), =maint status --json= with three pilot collectors, fake-binary harness in tests/maint/. Seed maintenance-thresholds.toml in archsetup from the workflow's values. Verify: unit suite green; =make test= picks up tests/maint/ via the glob.
+*** 2026-07-07 Tue @ 20:11:23 -0500 Built Phase 1 — package skeleton, thresholds, contract (dotfiles 43a39ac)
+maint/ package + shim + tests/maint/ (48 tests, fake-tool harness); thresholds two-layer merge with disable flags + env overrides; capability probe (battery ⇔ type==Battery, verified against ratio's Mains+USB tree); =maint status --json= with disk-usage/pacman-cache/failed-units pilots. Seeded configs/maintenance-thresholds.toml in archsetup from the workflow's values and installed a copy to ~/.config/archsetup/ on ratio (installer wiring stays Phase 13). Full make test green (50 suites). Live on ratio: worst=warn from the real 10.75 GB cache; du grades on its printed total, not its exit code (root-owned partial-download dirs make it exit 1) — pinned in a test.
 
 *** TODO Phase 2 — collectors: storage & snapshots :solo:
 btrfs (unallocated, scrub age, device error counters vs SMART), ZFS (health/capacity/frag/autotrim/scrub), SMART + last self-test, fstrim.timer, disk top-consumers digest (slow-local tier), snapshot counts split timeline·single·pre-post. Both-host fixtures. Verify: unit green + read-only =maint status --json= on ratio.