staleness-disciplinelisted

# Staleness Discipline Define what "stale" means for a source store in the Mall, and how to remove an entry from `sources/supported-stores.json` without breaking downstream consumers. The Mall is read-mostly: downstream agents install from upstream at pinned refs. Pruning a source from the registry stops new catalog entries from that source but does not retroactively break existing installs (those still resolve to their pinned SHA). The discipline below keeps the catalog honest. ## When to Use - Weekly catalog-refresh PR shows a store with degraded signals (no recent commits, broken license signal, archived upstream) - A reviewer flags a store as no longer fit during PR review - `/prune-source` invocation ## What "stale" means An entry is stale if **any** of these apply: | Signal | Threshold | Where it shows up | |---|---|---| | Remote unreachable | `bootstrap-sources.cjs` clone fails in 2+ consecutive cron runs | Workflow log | | Upstream archived | `fetch-github-stats.cjs` returns `archived: true` | `scoring/github-stats.json` | | No upstream activity | `last_commit` older than 18 months | `scoring/github-stats.json` + maintenance signal = 0 | | License changed unfavorably | SPDX id changed to NOASSERTION or to a more restrictive license | `scoring/github-stats.json` `license` field | | Replaced by superior alternative | Another source covers the same domain better with higher trust scores | Per-store trust delta in `scoring/trust-audit.md` | | Persistent scan failur