feat: seed maintenance-thresholds.toml + close build Phase 1

The TOML carries every severity value the console and the system-health-check workflow grade against (the workflow's hard-won numbers: the 10 GB cache trigger, the 35/60-day scrub bands, the snapper TIMELINE limits from the 2026-05-26 /home lesson) plus the shipped curation defaults. Canonical home is configs/ here. Installer wiring stays Phase 13, so for now the file is hand-copied to ~/.config/archsetup/ on ratio.

Phase 1 of the build landed in dotfiles (43a39ac): maint package skeleton, two-layer thresholds engine, capability probe, and the status contract with three pilot collectors, 48 tests. The todo phase task flips to its dated log entry.

1 files changed, 87 insertions, 0 deletions

diff --git a/configs/maintenance-thresholds.toml b/configs/maintenance-thresholds.toml
new file mode 100644
index 0000000..f2b9a23
--- /dev/null
+++ b/configs/maintenance-thresholds.toml
@@ -0,0 +1,87 @@
+# maintenance-thresholds.toml — every severity value the maintenance console
+# and the system-health-check workflow grade against, plus the shipped
+# curation defaults. Owned and installed by archsetup (canonical:
+# configs/maintenance-thresholds.toml in the archsetup repo; installed to
+# ~/.config/archsetup/maintenance-thresholds.toml). Both consumers read the
+# installed path, so severity rules can never drift between them.
+#
+# User curation and overrides live in ~/.config/maint/curation.toml and merge
+# over this file (scalars: user wins; [curation.*]: entries − disable + add).
+# Never record user marks here — an archsetup update replaces this file.
+#
+# Seed values migrated 2026-07-07 from the system-health-check workflow's
+# hard-won prose rules (the 2026-05-26 /home snapshot lesson, the 10 GB cache
+# trigger, the 35/60-day scrub bands) and the maintenance-console design doc.
+
+[storage]
+df_warn_pct = 80
+df_crit_pct = 90
+btrfs_scrub_warn_days = 35
+btrfs_scrub_crit_days = 60
+zfs_scrub_warn_days = 35
+zfs_scrub_crit_days = 60
+zfs_capacity_warn_pct = 80          # ZFS performance degrades past 80
+zfs_capacity_crit_pct = 90
+zfs_frag_info_pct = 50
+
+[snapshots]
+# Sane snapper TIMELINE limits — the 2026-05-26 /home pile-up fix.
+timeline_hourly = 6
+timeline_daily = 7
+timeline_weekly = 2
+timeline_monthly = 2
+timeline_yearly = 0
+single_keep = 2                     # DELETE STALE keeps the newest N singles
+zfs_count_warn = 1000               # runaway retention
+zfs_space_warn_pct = 20             # snapshot space vs pool capacity
+
+[packages]
+cache_warn_gb = 10                  # suggest paccache beyond the weekly keep-3
+
+[updates]
+pending_warn = 50                   # "a lot" — reddens the strip border
+cache_stale_hours = 6               # network-tier cache older than this warns
+topgrade_warn_days = 14             # topgrade freshness
+
+[logs]
+app_log_warn_days = 7               # log-cleanup cron should hold ~7 days
+journal_digest_top = 10             # groups shown in the journal digest
+
+[power]
+battery_low_pct = 15                # feeds the diagnostic state (glyph red)
+charge_limit_pct = 80               # the SET 80% longevity cap on velox
+
+[backups]
+rsyncshot_daily_crit_hours = 48     # daily backup older than this is a fire
+
+[services]
+docker_reclaim_warn_gb = 5
+docker_reclaim_warn_pct = 50
+
+[refresh]
+# Cadence knobs (seconds unless named otherwise) — spec Decision 8.
+live_secs = 3
+fast_secs = 30
+glyph_scan_mins = 30
+net_scan_mins = 60
+
+# --- shipped curation defaults (user layer adds/disables, never edits) ------
+
+[curation.known_noise]
+# Journal-noise patterns bind to identifier + message snippet, never a whole
+# unit — a muted service's new errors still surface.
+entries = [
+  { identifier = "bluetoothd", pattern = "HFP" },
+  { identifier = "pixman", pattern = "Invalid glyph" },
+  { identifier = "xkbcomp", pattern = "Could not resolve keysym" },
+]
+
+[curation.expected_listeners]
+entries = ["sshd", "mpd", "tailscaled"]
+
+[curation.expected_containers]
+entries = ["winvm"]
+
+[curation.pacnew_safe_delete]
+# Regenerated files whose .pacnew is safe to drop (reflector-managed / local).
+entries = ["/etc/pacman.d/mirrorlist", "/etc/locale.gen"]