mod: Ext 12 — temporal burst detection, 292/292

Reports gain an :at tick (deterministic, supplied). mod/decide-temporal counts
reports about a subject within [now-window, now], asserts burst_count/2, and a
(:burst-at-least K) rule fires only on a real burst. 3 reports at 10/11/12 → hide;
3 at 1/2/12 (window 5) → keep, while the plain count rule escalates both. Fifth
report field threaded through rebuild helpers, non-breaking. +15 tests.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

plans/mod-on-sx.md

@@ -16,7 +16,7 @@ federation extension.
 
 ## Status (rolling)
 
-`bash lib/mod/conformance.sh` → **277/277** (roadmap + 11 extensions complete)
+`bash lib/mod/conformance.sh` → **292/292** (roadmap + 12 extensions complete)
 
 ## Ground rules
 
@@ -147,6 +147,12 @@ lib/mod/fed.sx
   derivation goal-by-goal with `[proved]`/`[unproved]` marks and unification
   bindings. E.g. `Report rc: escalate (rule: repeated-escalate)` … `[proved]
   report(rc, B, S), report_count(S, N), N >= 3  {B=ann, N=3, S=dave}`.
+- [x] **Ext 12 — temporal burst detection** (`lib/mod/temporal.sx`, +15). Reports
+  gain an `:at` tick (deterministic, supplied — never clock-read).
+  `mod/decide-temporal now window` counts reports about the subject within
+  `[now-window, now]`, asserts `burst_count/2`, and a `(:burst-at-least K)` rule
+  fires only on a real burst. Verified: 3 reports at ticks 10/11/12 → hide;
+  3 reports at 1/2/12 (window 5) → keep, while the plain count rule escalates both.
 - [x] **Ext 11 — batch triage + corpus analytics** (`lib/mod/batch.sx`, +17).
   `mod/decide-batch` triages a queue; `mod/action-histogram` summarizes outcomes by
   action; `mod/rule-coverage` / `mod/never-fired` measure which rules fire across a
@@ -196,6 +202,12 @@ lib/mod/fed.sx
 
 ## Progress log
 
+- **Ext 12 — temporal burst detection, 292/292** (+15). Adds the time dimension:
+  a windowed count distinguishes a burst from slow accumulation, where the plain
+  count rule cannot. Time is a supplied tick (`:at`), keeping everything
+  deterministic and testable — no clock primitive. Fifth report field (`:at`)
+  threaded through the rebuild helpers, same non-breaking pattern as
+  evidence/attrs/signals; all 277 prior tests stayed green.
 - **Ext 11 — batch triage + corpus analytics, 277/277** (+17). Operational layer:
   triage a queue, histogram the outcomes, and measure rule coverage over real
   data. `never-fired` pairs with lint (Ext 5) — static "can't fire" vs empirical