@bongos/core 1.19.1072 → 1.19.1074

package/modules/hall-ui/public/settings.js

@@ -1197,14 +1197,9 @@
   // unchanged. Deep links activate their group first, so scrollIntoView lands on
   // a visible section.
 
-  // The Dev box group (box panel, desktop app, pairing) exists only where the
-  // dev-box module runs — a vanilla instance has no boxes to manage, so the
-  // whole group (rail entry included) stays out rather than showing an empty
-  // shell. RAIL_GROUPS derives from the items so a #dev-box anchor no-ops too.
   const RAIL_ITEMS = [
     { id: 'account', label: 'Account' },
     { id: 'access', label: 'Access & keys' },
-    ...(window.OTB.moduleOn('dev-box') ? [{ id: 'devbox', label: 'Dev box' }] : []),
     { id: 'preferences', label: 'Preferences' },
     { id: 'sound', label: 'Sound' },
     // task 1004296 — every project's version and its update; settings-software-update.js.
@@ -1213,7 +1208,7 @@
   const RAIL_GROUPS = RAIL_ITEMS.map((i) => i.id).concat('extensions');
   let rail = null;
 
-  // task 2172 — stable per-panel anchors (/settings#cli, /settings#dev-box, …)
+  // task 2172 — stable per-panel anchors (/settings#cli, /settings#voices, …)
   // so skills and docs can deep-link a panel without depending on internal
   // section ids. #art-key predates the map and IS its section id (the hall's
   // "Add your key" action + the CLI nudge target it) — kept verbatim.
@@ -1225,7 +1220,6 @@
     'disciplines': 'craft-scroll',
     'cli': 'cli-scroll',
     'art-key': 'art-key',
-    'dev-box-app': 'boxapp-scroll',
     'interaction': 'interaction-scroll',
     'wandering': 'wandering-scroll',
     'rendering': 'render-scroll',
@@ -1341,19 +1335,12 @@
     // DISPLAY NAME — the label beside your work (task 1669); seeded from /me.
     setupDisplayName(builder);
 
-    // DEV BOX APP — revealed once we know the viewer is a real builder,
-    // and only where the dev-box module runs (the group's rail entry is gated
-    // the same way above — task 2172).
-    if (window.OTB.moduleOn('dev-box')) {
-      $('#boxapp-scroll').hidden = false;
-      loadDevboxLatestVersion(); // #924: best-effort "latest version: X" courtesy line
-    }
     // CONNECTIONS — Discord (hidden unless the server has Discord configured).
     setupConnections(me && me.discord ? me.discord : null);
     // CLI ACCESS — re-issue a CLI bearer from this browser session.
     setupCliAccess();
     // MODULE PANELS — render any Settings panels modules contributed via the
-    // seam (BV1.R42). None today; ready for dev-box/discord/art once they leave core.
+    // seam (BV1.R42). None today; ready for discord/art once they leave core.
     mountContributedPanels();
     // Reveal the Extensions rail entry only when a module actually contributed:
     // the kit rail re-renders from the item list, then re-marks the active group.
@@ -1383,27 +1370,10 @@
     // the `needs` art_key item that drives the covered/action-needed banner.
     await loadArtKey(me);
     // Every section has now loaded/revealed — land any panel-anchor deep link
-    // (/settings#cli, #dev-box, …) on its visible section.
+    // (/settings#cli, #voices, …) on its visible section.
     applyHash();
   }
 
-  // #924: show the current published Dev Box app version next to the download
-  // buttons, read from the same public endpoint the app polls (/downloads/devbox/
-  // version → config/devbox-app.json). Best-effort: a fetch failure just leaves the
-  // courtesy line hidden — it must never break the settings page.
-  async function loadDevboxLatestVersion() {
-    try {
-      const r = await fetch('/downloads/devbox/version', { headers: { Accept: 'application/json' } });
-      if (!r.ok) return;
-      const v = await r.json();
-      if (v && v.version) {
-        const el = $('#boxapp-latest');
-        el.textContent = `Latest version: v${v.version}.`;
-        el.hidden = false;
-      }
-    } catch (_) { /* best-effort courtesy line — never break the page */ }
-  }
-
   wireRail();
   load();
 })();

package/modules/hall-ui/public/settings.states.json

@@ -4,8 +4,8 @@
   "surface": "hall-ui",
   "stub": { "prefix": "/builders/" },
   "modeQuery": false,
-  "ignoreRequests": ["/api/(gds|bongos)/", "/downloads/devbox/"],
-  "ignoreConsole": ["/api/(gds|bongos)/", "/downloads/devbox/", "\\b401\\b", "\\b404\\b", "Unauthorized", "Not Found", "load failed", "Password field"],
+  "ignoreRequests": ["/api/(gds|bongos)/"],
+  "ignoreConsole": ["/api/(gds|bongos)/", "\\b401\\b", "\\b404\\b", "Unauthorized", "Not Found", "load failed", "Password field"],
   "states": {
     "account": { "auth": true, "actions": [["wait", 900]], "expect": { "visible": ["#settings-h1", "#display-name-input", "#craft-chips", "#privacy-rows"] } },
     "access": { "auth": true, "url": "/settings#access", "actions": [["wait", 900]], "expect": { "visible": ["#cli-reissue-btn", "#sessions-list", "#artkey-card"] } },

package/modules/hall-ui/public/studio.html

@@ -189,7 +189,7 @@
 <script src="/builders/approval-queue.js"></script>
 <!-- The page names and the draft body (the tweak editor's pure rules), then
      the studio's own. -->
-<script src="/builders/tweak-editor-lib.js?v=2026-09-28-tw10"></script>
+<script src="/builders/tweak-editor-lib.js?v=2026-09-28-tw23"></script>
 <script src="/builders/studio-lib.js?v=2026-09-28-tw16"></script>
 <script src="/builders/studio.js?v=2026-09-28-tw16"></script>
 </body>

package/modules/hall-ui/public/style.css

@@ -230,7 +230,7 @@
   --z-drawer: 150;
   /* A confirm dialog is the one thing that must sit above the drawer: it is
      asking a question the drawer's content cannot answer. Added by task 1003307
-     because harbor and gate had each guessed a bare number for exactly this
+     because two pages had each guessed a bare number for exactly this
      (200 and 50), which is what a missing layer looks like. */
   --z-modal: 160;
   --z-diagram-full: 9999;
@@ -1303,7 +1303,6 @@ html[data-fullscreen="on"] .fullscreen-toggle {
 .stat-tile:first-child { border-left: 0; }
 .stat-tile__label,
 .gate-stat__label,
-.harbor-stat__label,
 .watch-stat__label {
   font-family: var(--label-face);
   font-size: var(--label-size);
@@ -1313,7 +1312,6 @@ html[data-fullscreen="on"] .fullscreen-toggle {
 }
 .stat-tile__num,
 .gate-stat__value,
-.harbor-stat__value,
 .watch-stat__num {
   font-family: var(--font-display);
   font-size: clamp(26px, 2.6vw, 34px);
@@ -2433,11 +2431,6 @@ main [id] { scroll-margin-top: calc(var(--topbar-h) + 16px); }
 .setup__tab:first-child { padding-left: 0; }
 .setup__tab:hover { color: var(--ink); }
 .setup__tab[aria-selected="true"] { color: var(--ink); border-bottom-color: var(--accent); }
-.setup__tab-tag { font-family: var(--label-face); font-size: 10.5px; letter-spacing: var(--label-space); text-transform: var(--label-case); margin-left: 6px; color: var(--ink-faint); }
-.setup__tab-tag--rec { color: var(--ok); }
-.setup__pane { display: none; }
-.setup[data-config="desktop"] .setup__pane--desktop { display: block; }
-.setup[data-config="online"] .setup__pane--online { display: block; }
 .setup__steps { margin: 8px 0; padding-left: 20px; font-size: 13.5px; }
 .setup__steps li { margin: 6px 0; }
 /* The setup panel's prose links ("Git", "Claude Code", "primer") take the
@@ -3512,6 +3505,11 @@ a.stat-tile:hover .stat-tile__sub { color: var(--ink-soft); }
 .next-up__title { font-weight: 400; font-size: 14px; color: var(--ink); }
 .next-up__title:hover { color: var(--accent-ink); }
 .next-up__meta { font-family: var(--font-mono); font-size: 11.5px; color: var(--ink-faint); font-variant-numeric: tabular-nums; }
+/* task 1003459: the row's Claim button reuses .task__claim's pill (the
+   claimable card's own accent fill, style.css ~2769) rather than a second
+   definition — align-self keeps it from stretching to the column's full
+   width, which flex's default cross-axis stretch would otherwise do. */
+.next-up__item .task__claim { align-self: flex-start; margin-top: 4px; }
 .next-up__foot { margin: 14px 0 18px; font-size: 13px; }
 
 /* ---------- jump palette (task 2178) ----------
@@ -3638,16 +3636,16 @@ html.palette-open { overflow: hidden; }
    state is a HAIRLINE in its own colour with no fill, and a scope is a quiet
    mono chip. Neither is pressable, so neither takes the accent.
 
-   These live here because five pages had already invented them separately —
-   .gov-pill, .harbor-pill, .gate-pill, .badge, .mod-chip — each re-spelling the
-   label voice as literals. The shell had no neutral pill to take: .chip below is
+   These live here because several pages had already invented them separately —
+   .gov-pill, .gate-pill, .badge, .mod-chip — each re-spelling the label voice
+   as literals. The shell had no neutral pill to take: .chip below is
    the accent-tinted FILTER chip, and it means "press me".
 
    The state colours are the hall's fixed verification vocabulary, never the
    world's warm accent states (ADR 0196 §2): a status must not re-tint when an
    instance re-brands. */
 /* The names below are the SAME pill, found by the task 1003307 audit:
-   government, harbor, gate and watch each invented one because the shell had
+   government, gate and watch each invented one because the shell had
    none to take (modules had one too; its rows take .fact-pill by name since
    task 1003472). They are aliased rather than renamed because renaming would
    mean editing the JS row builders, and a class name is not what was wrong —
@@ -3655,7 +3653,6 @@ html.palette-open { overflow: hidden; }
    in their own sheets. */
 .fact-pill,
 .gov-pill,
-.harbor-pill,
 .gate-pill,
 .badge {
   display: inline-flex;

package/modules/hall-ui/public/task.html

@@ -69,6 +69,9 @@
 <script src="/builders/brand-apply.js?v=2026-06-19-r56" defer></script>
 <script src="/builders/md-reader.js" defer></script>
 <script src="/builders/hall-visual.js?v=2026-09-16-visual1" defer></script>
-<script src="/builders/task.js?v=2026-09-26-taskwhere" defer></script>
+<!-- task 1003459: the hall's ONE claim/release action (task 1003458) — this
+     page's Claim it button consumes it rather than a second hand-rolled POST. -->
+<script src="/builders/claim-action.js?v=2026-09-26-claimaction1" defer></script>
+<script src="/builders/task.js?v=2026-09-28-taskclaim" defer></script>
 </body>
 </html>

package/modules/hall-ui/public/task.js

@@ -142,6 +142,15 @@
     }
   }
 
+  // task 1003459 — the hall's ONE claim action (task 1003458), consumed here so
+  // a task's own page can claim it directly instead of only handing over the
+  // copyable `/builder-claim N` string. `load` is hoisted below; reusing it as
+  // the refresh means a successful (or 409-refused) claim re-renders the whole
+  // record from the server's own state, the same idiom every other write here
+  // already follows.
+  const { makeClaimAction } = window.OTBClaimAction;
+  const claimAction = makeClaimAction({ postJSON, toast, API, refresh: load });
+
   // task 759: run a lifecycle action (ship / confirm), then reload so the page
   // re-renders at the new status. On failure, surface the server's refusal and
   // re-enable the button. `load` is hoisted below.
@@ -711,7 +720,16 @@
     const ownsLastClaim = !!(viewer && lastClaim && lastClaim.github_login &&
       lastClaim.github_login === viewer.github_login);
     let lifecycle = '';
-    if (t.status === 'confirmed' && (isSupervisor || ownsLastClaim)) {
+    // task 1003459 — the same door the Work board and Goals page already open.
+    // `ready` is the one status the claim gate can actually admit (backlog
+    // needs a promote first, blocked waits on a dependency, and both already
+    // say so in the lifecycle rail above) — every other refusal (rank, an
+    // owed rebase, a module/touches conflict, …) is still possible and still
+    // surfaces, because claimAction.claim() carries the same friendlyClaimError
+    // switch the board uses, not a second guess at it here.
+    if (t.status === 'ready') {
+      lifecycle = `<button class="td-btn td-btn--primary" type="button" id="claim-btn">Claim it</button>`;
+    } else if (t.status === 'confirmed' && (isSupervisor || ownsLastClaim)) {
       lifecycle = `<button class="td-btn td-btn--primary" type="button" id="ship-btn">Ship it</button>`;
     } else if (t.status === 'completed') {
       lifecycle = rank === 'archon'
@@ -823,6 +841,23 @@
       });
     }
 
+    const claimBtn = $('#claim-btn');
+    if (claimBtn) {
+      claimBtn.addEventListener('click', async () => {
+        if (claimBtn.disabled) return;
+        claimBtn.disabled = true;
+        claimBtn.textContent = '…';
+        const out = await claimAction.claim(t.id);
+        // A redirect to sign-in is already navigating away; re-enabling here
+        // would just invite a click that can't land (task.js's own pattern,
+        // runLifecycle above).
+        if (!out.ok && !out.redirected) {
+          claimBtn.disabled = false;
+          claimBtn.textContent = 'Claim it';
+        }
+      });
+    }
+
     const shipBtn = $('#ship-btn');
     if (shipBtn) {
       shipBtn.addEventListener('click', () => {

package/modules/hall-ui/public/tweak-editor-lib.js

@@ -107,6 +107,23 @@
     return `uploaded · ${n} ${n === 1 ? 'line' : 'lines'} from your doc`;
   }
 
+  // A refused upload, as the panel says it (task 1004354): a headline naming
+  // what happened, the next step in plain words, and whether a fresh download
+  // is part of that step. The server's own what_this_means sits between them.
+  const REDOWNLOAD = 'Or download this page again, make your changes in the new file, and upload that.';
+  const UPLOAD_REFUSALS = Object.freeze({
+    wrong_page: { title: 'This file is a different page.', next: `Pick the file you downloaded from this page and upload it again. ${REDOWNLOAD}`, download: true },
+    reading_moved: { title: 'This page changed after you downloaded it.', next: 'Download this page again, copy your changes into the new file, and upload that.', download: true },
+    structure_changed: { title: 'Some lines in your file moved.', next: `Put the lines listed here back the way they were, one paragraph per line, and upload again. ${REDOWNLOAD}`, download: true },
+    not_a_docx: { title: 'That file is not a Word file.', next: 'Upload the .docx you downloaded here. From Google Docs, choose File, then Download, then Microsoft Word (.docx).', download: false },
+    upload_too_large: { title: 'That file is too big.', next: `Take out any pictures you pasted in and upload it again. ${REDOWNLOAD}`, download: true },
+    page_not_held: { title: 'Someone else is writing this page now.', next: 'Reload the editor to see who holds it. Your file is still on your computer.', download: false },
+    page_in_flight: { title: 'This page has already been submitted.', next: 'Reload the editor. Its words are frozen until it ships or is sent back.', download: false },
+  });
+  function uploadRefusal(code) {
+    return UPLOAD_REFUSALS[code] || { title: 'Your file was not saved.', next: `Try the upload again. ${REDOWNLOAD}`, download: true };
+  }
+
   // A page's name as the artist reads it ("Home", "Projects"). The inventory's
   // title is the page's <title>, and on the apex that is a branding template
   // ("{{productName}}: {{tagline}}"), which is not a name. So a templated title
@@ -131,7 +148,7 @@
     return PAGE_ID_RE.test(id) ? id : null;
   }
 
-  const api = { NOTES, sectionsOf, isChanged, noteFor, draftBody, changedCount, counterText, initialValues, rowsFor, liveUrl, uploadedLabel, displayTitle, pageIdFrom };
+  const api = { NOTES, sectionsOf, isChanged, noteFor, draftBody, changedCount, counterText, initialValues, rowsFor, liveUrl, uploadedLabel, uploadRefusal, displayTitle, pageIdFrom };
   if (typeof window !== 'undefined') window.OTBTweakEditor = api;
   if (typeof module !== 'undefined' && module.exports) module.exports = api;
 })();

package/modules/hall-ui/public/tweak-editor.css

@@ -404,6 +404,22 @@ html:not([data-fullscreen="on"]) .tw-bar { top: calc(var(--topbar-h, 56px) + 12p
 .tw-stage .tw-linkish:focus-visible { outline: 2px solid var(--tw-accent); outline-offset: 2px; }
 .tw-done__error { margin: 0; font-size: 14px; line-height: 1.5; color: var(--tw-link); }
 
+/* A REFUSED UPLOAD (task 1004354). Not on the artboard, which has no failing
+   state: the "is in" panel's own glass and scrim, so a refusal is as
+   unmissable as a submit. It scrolls inside itself on a short phone rather
+   than hide its buttons below the window. */
+.tw-refused .tw-done__panel { max-height: calc(100vh - 32px); overflow-y: auto; }
+.tw-refused__list {
+  margin: 0;
+  padding-left: 18px;
+  font-size: 14px;
+  line-height: 1.5;
+  color: var(--tw-ink-soft);
+}
+.tw-refused__list li { margin: 2px 0; overflow-wrap: anywhere; }
+.tw-refused__list[hidden] { display: none; }
+.tw-refused__next { margin: 0; font-size: 15px; line-height: 1.5; color: var(--tw-ink); }
+
 /* PHONE WIDTH (not on the artboard, which is 1440 wide). The bar stops being
    one pill and becomes a glass card of two rows: where you are and how far,
    then the four doors, wrapping. The paper takes the width, and each margin

package/modules/hall-ui/public/tweak-editor.html

@@ -11,7 +11,7 @@
   <link rel="preconnect" href="https://fonts.googleapis.com">
   <link rel="preconnect" href="https://fonts.gstatic.com" crossorigin>
   <link rel="stylesheet" href="/builders/style.css?v=2026-07-02-shell1">
-  <link rel="stylesheet" href="/builders/tweak-editor.css?v=2026-09-28-tw10">
+  <link rel="stylesheet" href="/builders/tweak-editor.css?v=2026-09-28-tw23">
 </head>
 <!-- THE TWEAK EDITOR (task 1004321 / BV2.TW10, goal 1000095; ADR 0341 D4 and
      D11). docs/design/mocks/tweak-mode/Editor.dc.html is the master design:
@@ -93,6 +93,29 @@
             <div class="tw-picks" id="tw-picks" hidden></div>
           </div>
         </div>
+
+        <!-- A refused upload (task 1004354): the "is in" panel's glass over the
+             whole window, so it cannot scroll away. What happened, the lines
+             it names, and what to do. The notice on the paper stays after it
+             closes. -->
+        <div class="tw-done tw-refused" id="tw-refused" hidden>
+          <div class="tw-done__panel" role="alertdialog" aria-modal="true" aria-labelledby="tw-refused-title" aria-describedby="tw-refused-what">
+            <div class="tw-done__head">
+              <span class="tw-next__label">nothing was saved</span>
+              <h2 class="tw-done__title" id="tw-refused-title" tabindex="-1">Your file was not saved.</h2>
+              <p class="tw-done__sub" id="tw-refused-what"></p>
+            </div>
+            <ul class="tw-refused__list" id="tw-refused-list" hidden></ul>
+            <div class="tw-next">
+              <span class="tw-next__label">what to do</span>
+              <p class="tw-refused__next" id="tw-refused-next"></p>
+            </div>
+            <div class="tw-done__acts">
+              <button class="tw-take" id="tw-refused-download" type="button">download this page again</button>
+              <button class="tw-linkish" id="tw-refused-close" type="button">close</button>
+            </div>
+          </div>
+        </div>
       </main>
 
       <footer class="app-foot" id="app-foot"></footer>
@@ -105,7 +128,7 @@
 <script src="/builders/shell.js?v=2026-09-28-archive"></script>
 <script src="/builders/palette.js" defer></script>
 <script src="/builders/dom-utils.js?v=2026-06-23-contrib"></script>
-<script src="/builders/tweak-editor-lib.js?v=2026-09-28-tw10"></script>
-<script src="/builders/tweak-editor.js?v=2026-09-28-tw10"></script>
+<script src="/builders/tweak-editor-lib.js?v=2026-09-28-tw23"></script>
+<script src="/builders/tweak-editor.js?v=2026-09-28-tw23"></script>
 </body>
 </html>

package/modules/hall-ui/public/tweak-editor.js

@@ -244,6 +244,34 @@
     const msg = (d && d.what_this_means) || errMessage(data) || fallback;
     const items = refusalItems(d || {});
     notice(`<p>${escapeHtml(msg)}</p>${items.length ? `<ul>${items.map((i) => `<li>${escapeHtml(i)}</li>`).join('')}</ul>` : ''}`);
+    return { msg, items };
+  }
+
+  // A refused UPLOAD also opens the panel over the whole window (task
+  // 1004354): an artist uploads from the bar, often far down the page, where a
+  // notice at the top of the paper is off screen. It names what happened and
+  // the next step; the paper's notice stays after it closes.
+  function showRefused(data, said) {
+    const code = data && data.error ? data.error.code : null;
+    const r = lib.uploadRefusal(code);
+    $('tw-refused-title').textContent = r.title;
+    $('tw-refused-what').textContent = said.msg;
+    const list = $('tw-refused-list');
+    list.innerHTML = said.items.map((i) => `<li>${escapeHtml(i)}</li>`).join('');
+    list.hidden = !said.items.length;
+    $('tw-refused-next').textContent = r.next;
+    $('tw-refused-download').hidden = !r.download;
+    $('tw-bar').inert = true;
+    $('tw-paper').inert = true;
+    $('tw-refused').hidden = false;
+    $('tw-refused-title').focus();
+  }
+  function closeRefused() {
+    if ($('tw-refused').hidden) return;
+    $('tw-refused').hidden = true;
+    $('tw-bar').inert = false;
+    $('tw-paper').inert = false;
+    $('tw-upload').focus();
   }
 
   // Leaving with an unsaved change: one last save that outlives the page.
@@ -294,7 +322,7 @@
     btn.disabled = false;
     if (!r.ok) {
       btn.textContent = 'upload .docx';
-      refusal(r.data, 'The file could not be read. Nothing was saved.');
+      showRefused(r.data, refusal(r.data, 'The file could not be read. Nothing was saved.'));
       return;
     }
     notice('');
@@ -403,6 +431,7 @@
   document.addEventListener('focusout', (ev) => {
     if (ev.target && ev.target.classList && ev.target.classList.contains('tw-line')) flush();
   });
+  document.addEventListener('keydown', (ev) => { if (ev.key === 'Escape') closeRefused(); });
   window.addEventListener('resize', () => { document.querySelectorAll('textarea.tw-line').forEach(fit); });
 
   document.addEventListener('click', async (ev) => {
@@ -411,6 +440,8 @@
     if (t.closest('#tw-upload')) { $('tw-file').click(); return; }
     if (t.closest('#tw-submit')) { submit(); return; }
     if (t.closest('#tw-take')) { takeNext(); return; }
+    if (t.closest('#tw-refused-close')) { closeRefused(); return; }
+    if (t.closest('#tw-refused-download')) { closeRefused(); download(); return; }
     if (t.closest('#tw-claim')) {
       const b = t.closest('#tw-claim');
       b.disabled = true;

package/modules/hall-ui/public/work.js

@@ -606,7 +606,7 @@
   }
 
   // Editors and the Claude desktop/CLI app autolink any bare "#NNN" in a session
-  // transcript to the dev box's GitHub remote (…/issues/NNN), which 404s because
+  // transcript to the checkout's GitHub remote (…/issues/NNN), which 404s because
   // our records number tasks separately from GitHub. So the scroll we hand the
   // builder must never carry a bare "#NNN": write "task NNN" + the clickable hall
   // URL, and strip "#NNN" out of the (free-text) task description too.

package/modules/hall-ui/records/tweak-editor.md

@@ -25,6 +25,7 @@ The paper is paper and the room is the room whatever the hall's theme: the stage
 - **A focused line gets a hairline accent ring** beside the artboard's warm wash (the hall's focus rule, `tests/hall_audit.mjs` §10).
 - **"pick another" opens the other pages in place** as chips under the actions (the studio artboard's own "pick another"), where the editor artboard linked to the studio, whose flow panel is TW16's.
 - **Boxes grow to their words** rather than the artboard's rows 1 or 2.
+- **A refused upload opens a panel** (task 1004354, `#tw-refused`): the "is in" panel's glass and scrim over the whole window, a headline per refusal (`lib.uploadRefusal`), the server's words, the lines it names, "what to do", and "download this page again" or close (Escape too). An artist uploads from the bar, often far down the page, where the paper's notice was off screen. The notice stays on the paper after the panel closes. The kit has no file-upload action, so the panel is proven in `tests/hall_tweak_editor.mjs` and by shots of a real browser at 1440 and 390, not by a states.json state.
 - **Not on the artboard at all:** the phone layout (the bar becomes a two-row glass card, notes drop under their lines), the shell's full-screen button top right, the read-only and refusal notices on the paper, the chrome view (the switch off), and light mode.
 
 ## The proof

package/modules/ideas/module.json

@@ -2,6 +2,7 @@
   "key": "ideas",
   "title": "Ideas",
   "description": "The idea inbox (capture, triage, criterion-proposal ratification) and the blockers queue — the methodology surfaces that feed the backlog. A core-domain module carved out of the GDS core in BV1.R78 (ADR 0093 §1); default-on because every instance captures ideas and tracks what's stuck on its owner. Registers the `ideas.capture` kernel PORT the discord #ideas inbound resolves (ADR 0093 §5 — retiring the temporary `captureIdea` doorway leak).",
+  "version": "1.0.0",
   "coreVersion": "^1.8.0",
   "default": true,
   "maintenance": {

package/modules/lifecycle/db-claim-reads.js

@@ -34,61 +34,6 @@ async function getActiveClaimsForBuilder(builderId) {
   return rows;
 }
 
-// Task-scoped dev box (goal 1000051 / R92, ADR 0148 §2). The set-union of the
-// module KEYS a builder's active claims put in scope: each active claim's task →
-// its goal → goal.scope_modules (the ADR 0086 scope wall), unioned + deduped
-// across all the builder's active claims. This is the "what code does this
-// builder's current work need" signal the dev-box source-access resolver
-// (modules/dev-box/box-access.js, wired in R93/R94) maps to git sparse-checkout
-// globs via the doorway `moduleScopeMap`. Returns [] when the builder holds no
-// active claim, or when every claimed task carries no goal / an empty
-// scope_modules — the box then falls back to BASE-only (the pre-existing Bongos
-// instance). KEYS only; glob resolution is the box module's job (it reaches
-// moduleScopeMap through the doorway, never a core-internal require — the
-// R90/ADR-0148 boundary). Honours the #538 deps.pool test seam
-// (NODE_ENV==='test' only), like the goals reads above.
-async function moduleScopeForActiveClaims(builderId, deps = {}) {
-  const activePool = (deps.pool && process.env.NODE_ENV === 'test') ? deps.pool : pool;
-  const id = Number(builderId);
-  if (!Number.isInteger(id)) {
-    throw new Error('moduleScopeForActiveClaims: builderId must be numeric');
-  }
-  const { rows } = await activePool.query(
-    `SELECT DISTINCT m AS module_key
-       FROM claims c
-       JOIN tasks t ON t.id = c.task_id
-       JOIN goals g ON g.id = t.goal_id
-       CROSS JOIN LATERAL unnest(g.scope_modules) AS m
-      WHERE c.builder_id = $1 AND c.released_at IS NULL
-      ORDER BY m`,
-    [id]
-  );
-  return rows.map((r) => r.module_key);
-}
-
-// Task 1002729 — the companion signal moduleScopeForActiveClaims cannot carry.
-// That query INNER JOINs goals and unnests scope_modules, so it returns [] for
-// BOTH "this builder holds no claim" and "this builder holds claims whose goals
-// declare no scope_modules". Those must not be treated alike: the first is a
-// genuinely unscoped box (BASE-only is right), the second is a builder actively
-// working who would be handed a box with no modules/ at all. Live evidence for
-// why this matters: 247 of 248 source grants on the cloudbongos fleet resolved to
-// BASE, including an Archon holding 7 active claims — every one of those claims
-// sat on a goal with scope_modules = {}. Counts CLAIMS, deliberately not joining
-// goals, so it stays true regardless of how the goal wall is (or isn't) declared.
-async function activeClaimCountForBuilder(builderId, deps = {}) {
-  const activePool = (deps.pool && process.env.NODE_ENV === 'test') ? deps.pool : pool;
-  const id = Number(builderId);
-  if (!Number.isInteger(id)) {
-    throw new Error('activeClaimCountForBuilder: builderId must be numeric');
-  }
-  const { rows } = await activePool.query(
-    `SELECT count(*)::int AS n FROM claims WHERE builder_id = $1 AND released_at IS NULL`,
-    [id]
-  );
-  return rows.length ? Number(rows[0].n) : 0;
-}
-
 // task 1642 — every active claim bound to a given CLI session. "Active" is the
 // claims-table convention (released_at IS NULL); there is NO `status` column on
 // claims (a common misread — the task's status lives on `tasks`). Keyed on
@@ -159,7 +104,7 @@ async function getLastClaimHolder(taskId) {
 // reading it.
 //
 // `deps.pool` is the family's test-only pool seam (task 538), honoured ONLY under
-// NODE_ENV==='test' (the same line moduleScopeForActiveClaims uses above), so
+// NODE_ENV==='test' (the same line the family's other reads use), so
 // tests/grade_diff_hash.mjs can drive the lift with a fake row instead of a
 // real Postgres (task 1003490). Production callers pass the task id alone.
 async function getTaskGrade(taskId, deps = {}) {
@@ -217,12 +162,10 @@ async function getTaskSessionLogs(taskId) {
 }
 
 module.exports = {
-  activeClaimCountForBuilder,
   getActiveClaimsForBuilder,
   getActiveClaimsForSession,
   getLastClaimHolder,
   getTaskClaims,
   getTaskGrade,
   getTaskSessionLogs,
-  moduleScopeForActiveClaims,
 };

package/modules/lifecycle/db-ship.js

@@ -672,11 +672,6 @@ async function shipTask({ taskId, builderId, landAssurance }, deps = {}) {
       console.log('[gds] graduation broadcast post-ship failed:', e && e.message);
     }
   }
-  if (rankGraduation) {
-    await seams.emitAsync('builder.box-reconcile-needed', {
-      builderId: actualShipperId, rank: 'thetes', status: rankGraduation.status, actor: 'auto-graduation:#692',
-    }).catch(() => {});
-  }
   await recordShipAssurance({ insertAuditLog, taskId, builderId: actualShipperId, assurance: shipAssuranceValue, log });
   return {
     ...shipRow,

package/modules/lifecycle/db.js

@@ -203,14 +203,12 @@ const {
 } = require('./db-overrides.js');
 const { applyGrade } = require('./db-grade.js');
 const {
-  activeClaimCountForBuilder,
   getActiveClaimsForBuilder,
   getActiveClaimsForSession,
   getLastClaimHolder,
   getTaskClaims,
   getTaskGrade,
   getTaskSessionLogs,
-  moduleScopeForActiveClaims,
 } = require('./db-claim-reads.js');
 const {
   claimTask,
@@ -333,8 +331,6 @@ module.exports = {
   getClaimPublishedSha, // task 1547 — read the published tip for the reconcile gate
   shippedTasksByPublishedSha, // task 1004090 / BV2.R15 — the reverse read, for removal attribution
   getActiveClaimsForBuilder,
-  moduleScopeForActiveClaims, // goal 1000051 / R92 — dev-box task-scoped source access (ADR 0148 §2)
-  activeClaimCountForBuilder, // task 1002729 — distinguishes "no claim" from "claim with an empty goal wall"
   getActiveClaimsForSession,
   getLastClaimHolder, // --regrade ownership guard (#678)
   getTaskGrade,       // V4.R08 — diff-hash reuse check before grading

package/modules/lifecycle/kickoff-checklist.js

@@ -107,10 +107,6 @@ function moduleKeySteps(spec) {
     tasks.push({ title: 'Provide Discord bot token + webhooks', kind: 'infra',
       description: 'The discord module needs a bot token + webhook URLs + DISCORD_BOT_ENABLED=true. Note: outbound/link surfaces fire on credentials even if the module flag is later turned off.' });
   }
-  if (enabled.has('dev-box')) {
-    tasks.push({ title: 'Provide a DigitalOcean API token for dev boxes', kind: 'infra',
-      description: 'The dev-box module needs a DigitalOcean API token (and optionally Cloudflare) on the operator control plane before any builder box can be provisioned.' });
-  }
   return tasks;
 }
 

package/modules/lifecycle/lifecycle.js

@@ -168,12 +168,4 @@ module.exports = {
   // analytics.js (the AI-dev-curve): the builder + ecosystem analytics.
   builderAnalytics: (...a) => db.builderAnalytics(...a),
   ecosystemAnalytics: (...a) => db.ecosystemAnalytics(...a),
-  // dev-box (modules/dev-box/routes/box.js, via resolveOptional('lifecycle')): the
-  // module-key scope of a builder's active claims — the task-scoped source-access
-  // resolver (goal 1000051 / R92, ADR 0148 §2). Keys only; box-access maps them to
-  // git sparse-checkout globs through the doorway `moduleScopeMap`.
-  moduleScopeForActiveClaims: (...a) => db.moduleScopeForActiveClaims(...a),
-  // task 1002729 — the "is this builder actually working right now" signal that
-  // lets box-access tell an unscoped box from a crippled one (see db.js).
-  activeClaimCountForBuilder: (...a) => db.activeClaimCountForBuilder(...a),
 };

package/modules/lifecycle/module.json

@@ -2,6 +2,7 @@
   "key": "lifecycle",
   "title": "Lifecycle (the build state machine)",
   "description": "The build state machine \u2014 tasks \u00b7 claims \u00b7 versions \u00b7 done-when criteria \u00b7 goals \u00b7 dependencies \u00b7 the claim\u2192ship\u2192grade\u2192credit lifecycle \u00b7 override requests \u00b7 the ship/confirm/promote orchestration \u00b7 github-push + merge-lease + conflict-resolve + the publish reconciler. The LAST and most-coupled core domain carved out of the GDS core in BV1.R86 (ADR 0093 \u00a71,\u00a73, 02-module-map \u00a74 \u2014 kept whole, never split). default-on; every instance runs the lifecycle. Registers the `lifecycle` kernel PORT (createTask \u00b7 VOTABLE_TASK_STATUSES \u00b7 classifyTaskKind \u00b7 tallyPeerVotes + the work-tracking reads) that core read routes + the ideas/discord/autonomy modules resolve. As a transaction-participant it RESOLVES the `reward` + `onboarding` ports inside its claim/ship/confirm txns \u2014 but via resolveOptional (graceful, like sessions\u2192reward), so consumes is empty: a vanilla instance without those modules degrades the credit/onboarding writes to best-effort no-ops, it does not fail.",
+  "version": "1.0.0",
   "coreVersion": "^1.12.0",
   "default": true,
   "maintenance": {

package/modules/lifecycle/routes/tasks.js

@@ -1115,12 +1115,11 @@ module.exports = function buildTasksRouter() {
   // using its own push credential — a GitHub App installation token (preferred,
   // task 1028) or the GITHUB_PUSH_TOKEN PAT fallback; single repo, Contents:write
   // + PR:write + Actions:read — it CANNOT push to branch-protected main nor bypass
-  // required checks. The box holds NO github credential, so the #919 model is
-  // preserved.
+  // required checks. The uploading checkout holds NO GitHub credential, so the
+  // #919 model is preserved.
   //
-  // AUTH: requireBuilder + gateTaskOwnership, deliberately NOT allowBoxScope — a
-  // box-scoped session is 403'd here (it must `/builder-reauth` to a real cli
-  // session first). The grade already ran client-side against this exact HEAD
+  // AUTH: requireBuilder + gateTaskOwnership. The grade already ran client-side
+  // against this exact HEAD
   // (ship.js grades BEFORE this call), and the bundle-tip == claimed head_sha
   // check below binds the pushed code to that graded sha.
   const publishUpload = express.json({ limit: PUBLISH_BODY_LIMIT });
@@ -1352,8 +1351,7 @@ module.exports = function buildTasksRouter() {
   // ADR-0058 gate-review BLOCKS a Metic+ author's gate-surface PR shipped from a
   // laptop and they can't self-approve their own PR (hit live on task 1162 / PR #131).
   //
-  // AUTH mirrors publish-branch EXACTLY: requireBuilder + gateTaskOwnership, and
-  // deliberately NOT allowBoxScope (a box-scoped session 403s — it must reauth). The
+  // AUTH mirrors publish-branch EXACTLY: requireBuilder + gateTaskOwnership. The
   // attestation power is bounded: gate-author-trust clears a NEEDS_TRUST surface for
   // a Metic+ author only and NEVER the hard floor (which always needs an owner
   // review), so a Metic+ vouching for their own task's head stays within their tier.