@bongos/core 1.19.1072 → 1.19.1074

package/docs/file-map.md

@@ -64,8 +64,7 @@
 │   │   ├── ops-gotchas.md       ← Postgres, Caddy, SSH, Mac toolchain recipes
 │   │   ├── windows-builders.md  ← (task 1002809) the Windows + Git Bash builder loop: worktree junction trap, api.js MSYS auto-repair, --body-file pattern, local test baseline
 │   │   ├── pixel-art-pipeline.md
-│   │   ├── overnight-builder.md ← (#358) operator runbook for the autonomous overnight session-runner
-│   │   └── managed-settings-remote-control.md ← (#599/ADR 0031 §1, #760/ADR 0038) operator+builder guide: distribute the locked Claude Desktop SSH config; the browser web-terminal (ttyd + Cloudflare Tunnel) on-ramp
+│   │   └── overnight-builder.md ← (#358) operator runbook for the autonomous overnight session-runner
 │   ├── research/                ← investigations that answer a question rather than record a decision (an ADR) or a procedure (a recipe)
 │   │   ├── task-network-map-readability.md ← (task 1003282, goal 1000072) the spike verdict: a node-link map of ~1,357 tasks is unreadable at every dependency density — 59–97% isolated dots, and the dense fix overplots 84% of them into the 40-node goal graph. Build the goal graph + a per-goal dependency forest; measure the real density with `--from` first
 │   │   └── task-network-map/    ← the figures that verdict argues from, rendered by scripts/gds/spike-task-map.js — regenerate, never hand-edit
@@ -74,22 +73,6 @@
 │   ├── session-log-archive.md   ← compressed older session-log prose
 │   └── voice.md                 ← task 1003976 (ADR 0298): the VOICE GUIDE — the standard a line of visible product copy is judged against. Eleven cited rules in two tiers: V1–V5 hard (a lens may assert a break), V6–V11 judgement (a lens flags, the artist decides), plus a Part C of what is deliberately NOT ruled on so a lens cannot manufacture findings in the gaps. Every rule derives from a line this project already praised or condemned in a recorded artist review, not from a general style guide. Part D is the rubric contract the advisory `reader` worker (task 1003977) is handed. DESIGN.md:346 points here for the copy half
 │
-├── infra/
-│   ├── Caddyfile                ← reverse proxy + Cloudflare Origin Cert TLS
-│   ├── example.service     ← systemd unit
-│   ├── box-idle-suspend.{service,timer}    ← (#598) 15-min CONTROL-PLANE sweep: snapshot-and-park idle dev boxes
-│   ├── box-dormant-reclaim.{service,timer} ← (#598) daily CONTROL-PLANE sweep: deprovision long-parked dev boxes
-│   ├── box-intent-runner.{service,timer}   ← (#701) 1-min CONTROL-PLANE runner: drain box_intents (auto-provision + wake-on-connect) via `box.js run-intents --apply`
-│   ├── box-drift-reconcile.{service,timer}  ← (#1289/ADR 0071) hourly CONTROL-PLANE sweep: repair DO⇄DB drift via `box.js reconcile-drift --apply` (kill zombie droplets, mark ghost rows destroyed)
-│   ├── box-heartbeat.sh         ← (#598) runs ON THE BOX: pings /api/bongos/box/heartbeat while in use, so the idle sweep measures activity not uptime
-│   ├── box-report-terminal.sh   ← (#760/ADR 0038) runs ON THE BOX: POSTs the box's web-terminal URL + basic-auth credential UP to /api/bongos/box/terminal so a Chromebook builder reads them from the web
-│   ├── box-source-fetch.sh      ← (#600/#898/ADR 0052) runs ON THE BOX post-clone: scope-aware source fetch (sparse starter / full) + idempotently installs & enables the box units (box-game-preview, box-terminal, close-box) on every fetch so existing boxes self-heal; also self-tests (task 843) — every cycle it black-box-probes box-terminal/cloudflared/box-game-preview + the terminal credential and restarts whatever's unhealthy, not just what's absent
-│   ├── builder-box-cloud-init.yaml ← (#598/#599/#760) first-boot bootstrap: Docker + devcontainer up, Claude Code + ttyd + cloudflared on host, box-terminal.service + cloudflared.service + heartbeat cron wired (substituted by box.js)
-│   ├── managed-settings.template.json ← (#599) Claude Desktop sshConfigs template (locked to one approved box); filled per-builder by gen-managed-settings.sh
-│   ├── gen-managed-settings.sh  ← (#599) operator: emit per-builder Claude Desktop managed-settings.json (JSON-safe node substitution + input validation, #667)
-│   ├── box-terminal.service     ← (#760/ADR 0038) always-on ttyd web terminal (127.0.0.1:7681, per-box basic-auth) for thin-device (Chromebook/browser) builders
-│   ├── cloudflared.service      ← (#760/ADR 0038) outbound-only Cloudflare Tunnel exposing the box terminal (no inbound ports); runs cloudflared-run.sh
-│   └── cloudflared-run.sh       ← (#760/ADR 0038) runs ON THE BOX: named tunnel (BOX_TUNNEL_TOKEN) or tokenless quick tunnel; writes the public URL to /run/otb/terminal-url
 ├── migrations/                 ← CORE (build-system / Bongos) migrations — schema + platform-universal seeds, applied on EVERY instance (migrate.sh `migrations/*.sql`). Game-module migrations moved to modules/game/migrations/ (BV1.R49).
 │   ├── instance/                ← OTB/product SCOPE-TRUTH seeds (versions, goals, done_when_criteria). Applied only on the OWNING instance — `GDS_APPLY_INSTANCE_SEEDS=1`, default OFF — so a vanilla/branded self-host never inherits them (task 1704 / ADR 0105). Merge-sorted with core by basename, so global order is preserved.
 │   ├── game/                    ← LEGACY game-module migrations (moved to modules/game/migrations/ in BV1.R49 — stem-keyed, so they did NOT re-run on prod). Kept here as a frozen archive; migrate.sh still applies them for backward compat.
@@ -114,7 +97,6 @@
 │   ├── 067_builder_boxes.sql    ← #598/ADR 0031: builder_boxes (per-builder dev box lifecycle state) + box_events ledger
 │   └── <redacted>.sql ← task 615: rename disciplines engineering→engineer, creative→artist|ideator; swaps both CHECK constraints + backfills tasks.discipline & builders.preferred_disciplines
 ├── modules/                    ← self-contained optional feature modules (ADR 0083 / docs/modules-contract.md). Each `modules/<key>/` is a full vertical slice — routes, migrations, skills, seam registrations — reached only through src/module-api.js. The loader discovers them at boot; no core file changes to add one.
-│   ├── dev-box/                ← per-builder cloud dev environments (DigitalOcean + Cloudflare tunnels, sandbox preview, branch publish). Template move (BV1.R43). CLAUDE.md, module.json, routes/box.js, boxes.js, box-access.js, box-onboard.js, do-api.js, cf-tunnel.js, http-api-client.js, box-credential.js.
 │   ├── game/                   ← the playable Example world — Phaser client, Colyseus rooms (WorldRoom/QueueRoom), world/terrain model, game DB tables, static assets. Moved BV1.R49 (task 1418). CLAUDE.md, module.json, routes/game.js, rooms/, world/, public/, migrations/.
 │   ├── discord/                ← outbound ship broadcast + inbound #ideas/#bugs bot + role-sync + channel management + account-link state + the Board Room mirror. Mirror only, never authority (ADR 0033). CLAUDE.md, module.json, routes/discord.js, routes/bug-attachments.js, discord-bot.js, discord-lib.js, board-broadcast.js (announce a window / edit the outcome onto it — R21/R22 of goal 1000069), migrations/discord_001_board_messages.sql.
 │   ├── art-pipeline/           ← self-improving pixel-art generation pipeline + the four otb-* art skills + the artist discipline. CLAUDE.md, module.json, routes/art-key.js, art/ (lives under art/ at repo root; module owns the route and discipline entry).
@@ -172,7 +154,7 @@
 │       ├── package-core.js      ← package the core as a versioned, installable artifact + pin manifest (`bongos package-core`; R84, ADR 0100 §1, [#1688](https://example.com/builders#/task/1688)): isPublishable() selection + mirror redaction + fail-closed no-leak gate → dist/bongos-core-<version>.{tgz,manifest.json}; version = src/module-api CORE_VERSION. Recipe: docs/recipes/packaging-the-core.md
 │       ├── release-notes.js     ← what each core release brought in (task 1004218): generated at pack time from the ref's HISTORY into the package's release-notes.json (exact per-release ranges, 1 MiB bound; package-core redacts its prose like a doc), read back by the upgrade runner for a from→to range; home of the one merge-summary parser
 │       ├── surface.js         ← who the CLI output is FOR: agent (default) or terminal (task 1003680). The `bongos` dispatcher sets BONGOS_SURFACE=terminal when a person types a verb; the skills and the card hook run `node scripts/gds/<verb>.js` directly and keep the agent card byte-identical. Never inferred from isTTY — a session's stdout is not a TTY either, so sniffing would invert it. Helpers: action() (/builder-ship N vs bongos ship N), taskRef(), strong()/em()/code(), table() (markdown vs aligned columns). Guarded by tests/cli_surface.mjs
-│       ├── sandbox-stage.js     ← stage the working tree on the live game preview (box OR local) for browser review before ship; resolvePreviewContext picks the context (`/builder-stage`; #927, ADR 0046; local: task 1056)
+│       ├── sandbox-stage.js     ← stage the working tree on the builder's local game preview for browser review before ship (`/builder-stage`; #927, ADR 0046; task 1056)
 │       ├── local-preview.js     ← builder CLI for the LOCAL sandbox: start/stop/status/restart/logs/url of the game-only preview at http://localhost:3100 (`npm run preview`; task 1056)
 │       ├── local-preview-lib.js ← core of the local sandbox launcher (detached `node src/preview-server.js`, pid/health/port mgmt); shared by local-preview.js + sandbox-stage.js (task 1056)
 │       ├── dev.js               ← `bongos dev`: one-command LOCAL launcher for a standalone instance (Postgres → createdb → migrate → server on the branding port → sign-in); up/stop/status (ADR 0149)
@@ -190,8 +172,6 @@
 │       ├── stray-unit-sweep.sh  ← (task 1003939) control-plane sweep: the ledger's torn-down slugs that still have a service/backup unit loaded or on disk (a torn-down project holding memory outside the ADR 0285 count); survey by default, `--apply` disables, removes, reloads, reset-failed's; DB/dumps/checkout/Caddy left alone
 │       ├── address-park-sweep.sh ← (task 1003947) control-plane sweep: the ledger's torn-down rows that still have a `<slug>.caddy` block or a hostname not yet parked (rows torn down before task 1002897 taught teardown to do both); survey by default, `--apply` removes the snippets, reloads Caddy and parks each non-reserved hostname at 192.0.2.1 via the DNS hook; the reserved rule, zone and apex come from the installed core
 │       ├── smoke-gds.js         ← public-surface + 401-check smoke test (asserts /api/pms/* now 404s — removed in V3.R01-followup #308)
-│       ├── box.js               ← (#598/ADR 0031) per-builder dev box lifecycle CLI: provision·park·wake·deprovision·sweep-idle·sweep-dormant·status (dry-run default, --apply to act; rank-gated)
-│       ├── smoke-box.sh         ← (#598) hermetic box-lifecycle smoke (no DB/DO/network): runs tests/boxes.mjs + tests/cf_tunnel.mjs (#771 named tunnel) + route-rank + module-load
 │       ├── recall.js            ← `/recall` CLI: two-call progressive-disclosure search (summary → `--expand <id>`) over Bongos retrieval layer (ADR 0060); `node scripts/gds/recall.js <query>`
 │       ├── capture.js           ← file an idea_inbox row from the CLI (the ideas.capture kernel port); backs the "capture a tangent" flow across skills. Task 1002927 / R151 taught it the GRADES: `--full --fields-file f.json` files a Full Idea, `--spark` is capture-then-mark (two requests — the route refuses a pre-marked capture), and after a plain quick capture it OFFERS to develop further. That offer is TTY-gated (`--no-prompt` too): capture.js is run by agents with no terminal and reads its body from stdin, so an unguarded prompt would hang every non-interactive caller. Task 1003070 / R09 (goal 1000071) taught it capture-time ROUTING: `--goal N` sends goal_id, `--goal none` opts out explicitly, and with neither it defaults to the caller's active claim's goal, else prints a one-line R07 suggester hint
 │       ├── spark.js            ← (tasks 1002920 / R144 + 1002921 / R145 + 1002922 / R146) the whole spark handoff from the terminal: mark one of your OWN quick ideas as a Big Idea Spark (`--undo` withdraws it), `--list` is the SPARK QUEUE, `--template` prints the five Full Idea fields, `--develop <id> --fields-file <json>` is the PICKUP (any builder; author + developer both recorded). Author-only server-side for the mark (it is the consent); its own command because sparking acts on an EXISTING idea, which is why capture.js refuses grade='spark'
@@ -237,7 +217,7 @@
 │   ├── bongos/                  ← the Bongos core kernel (mounted at /api/bongos; canonical path since the V4/BONGOS-V1 rename — /api/gds/* stays mounted forever as a permanent alias, /api/pms/* removed V3.R01-followup #308 — now 404). Own nested map: src/bongos/CLAUDE.md.
 │   │   ├── pool.js              ← the kernel-owned pg pool (R52 carve-out, task 1191/ADR 0062 §5): resolves DATABASE_URL → PG* → branding db.database (no hard-coded DB name); the core no longer imports the game's src/db.js
 │   │   ├── db.js / db-kernel.js ← the RESIDUE after the ADR 0091/0093 tranche 1+2 core-domain carve: builder identity/admission, rank/status management, auth sessions, the Discord/karma social twins, audit log, security_docs. The build state machine (tasks·claims·versions·done-when·ship) graduated to modules/lifecycle/db.js; grading/economy/ideas/security(feature)/builder-settings/onboarding/sessions/autonomy each graduated to their own `modules/<key>/` with a kernel PORT back-reference — see src/bongos/CLAUDE.md for the full carve map.
-│   │   ├── auth.js              ← GitHub Device Flow (CLI) + Authorization Code (web) + middleware (requireBuilder, requireRank, allowBoxScope)
+│   │   ├── auth.js              ← GitHub Device Flow (CLI) + Authorization Code (web) + middleware (requireBuilder, requireRank, requirePermission)
 │   │   ├── routes.js            ← thin mounter — imports each routes/* sub-router + every enabled module's routes and stitches them behind kernel-composed auth
 │   │   ├── api-prefix.js        ← API_PREFIX ('/api/bongos') + LEGACY_API_PREFIXES ('/api/gds' permanent alias) + API_VERSION
 │   │   ├── api-path-404.js      ← recognize Bongos-API-shaped paths that missed the mount → JSON 404 + corrective hint (server.js catch-all; V4.R14, [#952](https://example.com/builders#/task/952))
@@ -260,19 +240,13 @@
 │   │   ├── goal-scope-check.js / hierarchy-config.js / module-scope-map.js ← goal-scope protected-path checks, the configurable work-hierarchy tiers, and the module→file-glob map
 │   │   ├── project-door.js      ← the project's COMPOSED join/apply door — visibility × join_grant × joinability → open | apply | invite_only | locked (BV1.R12 / task 1002331, ADR 0182 D6 + ADR 0247). PURE + kernel; published as api.projectJoinDoor() so the public POST /access-requests, the hall landing form, the CLI and the hub's join relay cannot answer one stranger differently — and since task 1003579 (ADR 0256) the SIGN-IN gate reads it too (openEnrollmentEnabled), which is why joinabilityMode() lives here rather than in auth-admission.js
 │   │   ├── artist-gate.js       ← the project's ARTIST GATE — off | advisory | strict (task 1003575, ADR 0241). PURE + kernel; published as api.artistGate so the lifecycle cascade ("file this review?") and the pin move ("does an open one hold?") resolve the same knob through one reader. It reads a STATE (is a cascade-filed artist review still open?), never a verdict, and what it can hold is the DEPLOY, never a builder's ship — that boundary is the whole reconciliation with ADR 0162
-│   │   ├── path-match.js / repo-info.js / metrics.js / uptime-poller.js / app-pair.js ← touches[] overlap matcher, git-remote parser, Prometheus metrics endpoint, uptime poller, Claude-Desktop pairing store
+│   │   ├── path-match.js / repo-info.js / metrics.js / uptime-poller.js ← touches[] overlap matcher, git-remote parser, Prometheus metrics endpoint, uptime poller
 │   └── world/
 │       ├── terrain.js           ← (Phase D + ADR 0012, CJS): TERRAIN + OBJECT enums + BLOCKING_TERRAINS + BLOCKING_OBJECTS (server twin of public/game/world/terrain.js)
 │       └── map.js               ← (Phase D + ADR 0012): two-grid INITIAL_MAP {ground, objects}; isBlocked checks both layers (mirrors public/game/world/{terrain,map}.js)
 │   (public-status/ moved to modules/status-ui/public/ in BV1.R84 — see the modules/ block above)
 │   (public-builders/ moved to modules/hall-ui/public/ in BV1.R85 — the authenticated builders' hall; see the modules/ block above. It keeps its DEDICATED serving block in src/bongos/serve-internal.js: the builders.<apex> + apex /builders/* shim, canonical redirects, the citizen/Archon page gates, asset-stamping, and the module hall-widget injection — partitioned out of the generic web-surface loop. index.html=the hall dashboard; work/board/roadmap/goals/watch/gate/settings/ranks/sessions/primer/diagrams/atlas pages (harbor + pair left with the dev box, task 1003890); ideas.{html,js,css}=the Full Idea composer (task 1002928 / R152 of goal 1000062 — the five R141 fields with a live R142 completeness meter, both fetched from the server so the page carries no copy of the rules; drafts in localStorage so navigation costs nothing. Task 1002930 / R154 added the SPARK QUEUE above it and a second mode: `?develop=<id>` reuses the same form to develop a spark — the spark's words shown above the fields, its title read-only, and the file routed to POST /inbox/:id/develop instead of POST /inbox, under its own per-idea draft key); idea.html/idea.js=the idea-detail PAGE (/idea/:id, task 1002929 / R153 — the SECOND two-segment hall page after /task/:id: grade, the five answers in template order, the score, and both attributions. The GRADE decides what the page contains — a quick idea gets no five-field skeleton. task-detail.js keeps the #/idea/N overlay because ~320 of its lines are the Metic+ triage panel; the overlay now links here); profile.html/profile.js=the public, shareable builder profile page (/profile?id=N — rank, works, credits, karma, achievements; task 1467); profile-connections.js=section 6 of that page, the hub-only connections block (task 1002296 / R20 of goal 1000045 — the viewer-relative 1st/2nd/3rd/out-of-network label, the mutuals it was computed from, the connect button, and on your own profile both request queues plus your connections ledger. Loaded BEFORE profile.js, which calls window.OTBConnections.render behind a guard, so a page that omits the script simply has no section; the section reveals only when the hub's /connections routes answer, exactly as the cross-project record does. ADR 0212 records why it is on this page rather than the not-yet-built /u/&lt;handle&gt;, and why it addresses a builder by github_login and then uses the canonical handle the API echoes back); profile-canonical.js=the canonical-profile wiring for that page (task 1002804 / P08, ADR 0214 — on a FEDERATED instance the rel=canonical plus the visible "see the cross-project record" link-out ADR 0171 D1 asks for; on the HUB the numeric ?id= form redirects to the handle URL instead, because a page cannot both redirect to a URL and declare it canonical. All three read ONE resolver, modules/platform-identity/canonical-profile.js, which answers null while /u/&lt;handle&gt; does not exist — so everything is dark today and one boolean turns it all on together); task.html/task.js=the task-detail page (/task/:id, task 751 — replaced the old #/task/N overlay); builders.js=the controller; dom-utils.js/hall-widgets.js=the widget+settings-panel registries.)
 │
-├── infra/                          ← ON-BOX scripts (task 1002699): the four reporter/heartbeat crons every dev box runs from its /workspace clone — box-heartbeat.sh (idle-sweep activity signal), box-report-version.sh (HEAD → POST /box/version), box-report-host-keys.sh (SSH host keys → POST /box/host-keys), box-report-terminal.sh (ttyd URL+credential → POST /box/terminal). Delivered by the workspace clone itself (modules/dev-box/box-access.js sparse scope includes infra/); crons self-installed by box-source-fetch.sh's per-tick bring-up. API base resolves GDS_BASE env → session-file api_base → skip (no hardcoded host in the neutral core).
-│   ├── src/                        ← main process: main.js (tray/window/IPC), brand.js (ADR 0004 — the ONE civ-name string), pairing.js, box-controller.js, gds-client.js, session-store.js (shares ~/.config/otb/gds-session.json with the CLI), ssh-setup.js (key 600 + known_hosts replace + managed-settings install w/ elevation), tray.js, preload.js
-│   ├── renderer/                   ← the panel UI (sandboxed; parchment theme)
-│   ├── assets/tray/ + build-resources/ ← generated icons (scripts/gen-icons.js; build-resources name dodges the global build/ gitignore)
-│   └── test/unit.mjs               ← hermetic unit tests (run by the CI workflow, not the root gate)
-│
 ├── modules/public-landing/public/   ← the APEX front door + hub surfaces. Its OWN MODULE since task 1003322 / ADR 0218 (manifest declares { apexRoot: true, dir: "public" } — the apex is not a Host prefix), still served by src/platform-server.js (landingPage(): apex-only strip → brand-token stamp → theme injection → ?v= asset stamp). Ships to EVERY instance; <!--apex-only:start/end--> regions are removed on a child
 │   ├── index.html                  ← the landing (/) — v3 "the template's page" of the chrome world (task 1003298, ADR 0196): server-stamped head, the breath (CSS-only signature), live figures/ledger/orbs from the public feeds baked inside sentinels; page-local <style> only (no :root), links /assets/world.css
 │   ├── projects.html               ← the hub (/projects?view=map|mine|manage|new) on cosmos.css (A4, task 1003299, rebuilds it in the world)
@@ -365,8 +339,7 @@ tests/
 ├── session_506_regression.mjs    ← (6D.5): the #506 regression gate — runs the engine over tests/fixtures/session-506-digest.json, asserts the hand-labelled findings (→#513/#514/#468) reproduce.
 ├── grade_attempts.mjs            ← (6D.6): logGradeAttempt swallow-safety + param coercion via an injected queryFn (no DB).
 ├── linkify_refs.mjs              ← (#604): the doc-linkifier classifier — pins which `#NNN` rewrite (tasks) vs stay bare (heading anchors, link targets, idea/blocker/session/PR ids, code spans), incl. comma-list entity inheritance + idempotency.
-├── docs_scrubber_damage.mjs      ← (task 1004027, part 4 of the scrubber-damage family after 1004021/1004022): docs/recipes/managed-settings-remote-control.md had TWO pieces of real prose replaced by the literal `<redacted>` — an in-page anchor target and an `infra/*.sh` script name — while FOUR other `<redacted>` in the same file are deliberate stand-ins for real secrets. Pins both halves: every in-page anchor resolves through docs-entropy's own parseFile (so the slug asserted is the slug the lint computes), the key-sync cron names the script `scripts/gds/box-infra.js` actually bakes into the cloud-init, and the placeholder count stays at EXACTLY four, matched by context rather than line number. The last assertion is the point — the anchor lint only reads link targets, so a global sweep of the literal would leave doc_broken_anchors at 0 while destroying four correct lines.
-├── sandbox_stage.mjs             ← (#927, ADR 0046): sandbox-first review gate — box detection, BOX_PREVIEW_HOSTNAME parsing, previewable-surface matching, decideShipGate table, tree-stamp freshness (temp git repo), runShipGate composition with injected fs/exec/prompt.
+├── sandbox_stage.mjs             ← (#927, ADR 0046): sandbox-first review gate — previewable-surface matching, decideShipGate table, tree-stamp freshness (temp git repo), runShipGate composition with injected fs/exec/prompt.
 ├── session_start_freshness.mjs   ← (#1277, ADR 0067): the SessionStart freshness decision (decideFreshness) — pull ONLY on a clean `main` full clone strictly behind origin/main; warn in every other behind case; skip when up to date.
 ├── own_scope_guard.mjs           ← (task 1003343, goal 1000045 criterion own-scope-held-by-a-test): the OWN-SCOPE structural guard, generalised out of memory_isolation.mjs. An explicit inventory of own-scoped route files; inside them the route's declared PATH decides — a path naming no builder must never read a subject from the request (direct, optional-chained, destructured, aliased, computed-key or header), a path that DOES name one needs a per-route exemption whose gate the guard verifies is present. Repo-wide backstop: any file mounting a `/me` route must be in the inventory. Source-grepping, so it runs in the DB-free `unit` lane.
 ├── account_existence_rate_limit.mjs ← (task 1003339, goal 1000045, ADR 0209): the two PUBLIC account-existence probes (onboarding GET /access-requests/status + core GET /auth/web/admission-status) share ONE per-IP budget. Counts to the limit on each route, proves the budget is shared in both directions and when alternated, moves Date.now to prove the window slides on the real mounted route, and proves a refused probe issues no query. DB-free; mutation-checked three ways.
@@ -447,8 +420,6 @@ tests/
 ├── artifact-staleness/SKILL.md        ← freshness backstop for the gitignored deploy-generated navigation docs (task 1001930, ADR 0110 pt.5): docs/repo-map.md and docs/session-log-index.md are untracked, so no PR gate can see them and a broken deploy regen step leaves a stale or missing map with only a journald line as the alarm. Asks each artifact's own generator (--check-whole) whether it still matches the served commit, reports absent and stale separately, and posts findings to Discord #ship-news itself. INSTANCE-SIDE ONLY — a fresh CI clone legitimately lacks these files, so it declares no cadence and no workflow fires it; config/scheduled-routines.json records the intended daily cadence.
 ├── bfg/SKILL.md                       ← nightly BFG pass (MAS Phase 6, ADR 0026) — doc/memory hygiene + DB counter-vs-ledger drift (Part A), per-builder interaction scoring into transferable-practice suggestions (Part B), and the audited cross-builder memory write (Part C, OFF unless BFG_WRITE_ENABLED) (restored in task 1003365; unscheduled in core — only redteam-weekly has a firing workflow; config/scheduled-routines.json records the intended cadence)
 ├── bfg-session-eval/SKILL.md          ← nightly session-inefficiency evaluator (MAS Phase 6D, ADR 0027) — mines the session corpus for wasteful sessions and files the fixes as idea_inbox rows plus a docs/audits report (restored in task 1003365; unscheduled in core — only redteam-weekly has a firing workflow; config/scheduled-routines.json records the intended cadence)
-├── box-dormant-reclaim/SKILL.md       ← daily control-plane sweep that fully de-provisions dev boxes parked longer than BOX_DORMANT_DAYS, destroying the leftover snapshot and pinging the builder (ADR 0031 §5(a)); a no-op on an instance with no managed boxes (restored in task 1003365; unscheduled in core — only redteam-weekly has a firing workflow; config/scheduled-routines.json records the intended cadence)
-├── box-idle-suspend/SKILL.md          ← hourly control-plane sweep that DESTROYS idle dev boxes — droplet and snapshot, not a reversible park — once BOX_IDLE_MINUTES elapses with no heartbeat (ADR 0031 §5(a), task 804) (restored in task 1003365; unscheduled in core — only redteam-weekly has a firing workflow; config/scheduled-routines.json records the intended cadence)
 ├── core-update-subscription/SKILL.md  ← daily patch-only auto-upgrade of subscribed consumer instances (ADR 0136) — deterministic `subscribe.js` step, health-gated with auto-rollback; opt-in and autonomy-gated, so a no-op until an operator arms it (restored in task 1003365; unscheduled in core — only redteam-weekly has a firing workflow; config/scheduled-routines.json records the intended cadence)
 ├── dep-audit-nightly/SKILL.md         ← nightly dependency-vulnerability scan (`scripts/security/dep-audit.js`) across npm and the droplet's system packages; findings become idea_inbox rows plus one vulnerability_report per high/critical (restored in task 1003365; unscheduled in core — only redteam-weekly has a firing workflow; config/scheduled-routines.json records the intended cadence)
 ├── diagram-drift/SKILL.md             ← daily deterministic backstop that re-derives the onboarding diagrams from migrations plus the live version API and files an idea when the committed ones have drifted (`check.js --file-idea`) (restored in task 1003365; unscheduled in core — only redteam-weekly has a firing workflow; config/scheduled-routines.json records the intended cadence)

package/docs/module-api-changelog.md

@@ -2631,5 +2631,9 @@ is load-bearing: the script throws rather than guess if it is missing, and
         landed since 1.19.1070 with no explicit bump. run 36473239367. (task 1002620)
   1.19.1072 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
         landed since 1.19.1071 with no explicit bump. run 36474285523. (task 1002620)
+  1.19.1073 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+        landed since 1.19.1072 with no explicit bump. run 36485068639. (task 1002620)
+  1.19.1074 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+        landed since 1.19.1073 with no explicit bump. run 36510198162. (task 1002620)
 ---------------------------------------------------------------------------
 ```

package/docs/modules-contract.md

@@ -31,7 +31,7 @@ The **only** core file a module may `require`. It re-exports the kernel capabili
 |---|---|
 | `requireBuilder` / `requireRank` / `rankMeetsThreshold` | Auth gates (ADR 0016). Modules self-gate per route: write routes call `api.requireRank(rank)`; authenticated read routes call `api.requireBuilder`; intentionally public read routes (e.g. leaderboard, claimable tasks) need no gate. The fitness check enforces the write-route rule; audit is composed at the kernel level before module routes mount. |
 | `requireBfgPrincipal` | Gate a route to the BFG agent principal. |
-| `allowBoxScope` | Opt a bootstrap route in to box-scoped session tokens. |
+| `allowBoxScope` | **Deprecated no-op** (task 1003894): the narrowing session scope it opted a route into was retired, and a session of an undeclared source is now denied on every route regardless. Kept so the doorway loses no export inside 1.x; drop at the next MAJOR. |
 | `pool` | The shared Postgres pool. A module owns its `<key>_*` tables via its migrations. |
 | `instanceDbName` | The resolved DB name (from branding). |
 | `db` | Kernel-managed DB helpers (`getBuilderById`, `setBuilderBoxBlocked`, `getBuilderGeminiKeyRow`, `setBuilderGeminiKey`, `clearBuilderGeminiKey`, `insertAuditLog`, `createTask`). Grow this additive-only. |
@@ -79,6 +79,8 @@ Every module must have a `module.json` at its root (`modules/<key>/module.json`)
   "key":         "dev-box",           // REQUIRED. ^[a-z][a-z0-9-]*$ — must match the dir name.
   "title":       "Dev boxes",         // REQUIRED. Human label.
   "description": "…",                 // REQUIRED. One sentence.
+  "version":     "1.0.0",             // REQUIRED. The module's OWN exact version "X.Y.Z" (not a range) —
+                                      //   what update, rollout channels and re-assessment name (task 1003781).
   "coreVersion": "^1.2.0",           // REQUIRED. semver range of CORE_VERSION this module supports.
   "default":     false,               // OPTIONAL (default false). Fail-safe when no config names it.
   "author":      "…",                 // OPTIONAL. Attribution (ADR 0107 §2) — portable, not a cross-Bongos FK.
@@ -330,6 +332,7 @@ This creates `modules/<key>/` with:
 ### 3. Declare
 
 Update `module.json`:
+- Set `version` to the module's own exact version (`"1.0.0"` for a first release; bump it on every change you ship).
 - Set `coreVersion` to `^<CORE_VERSION>` (the current doorway version).
 - Declare everything the module contributes in `contributes`.
 - List ports under `provides`/`consumes`.
@@ -348,6 +351,15 @@ Or via env: `<PREFIX>_MODULE_<KEY>=1`. The loader discovers and mounts it on nex
 
 Run `bongos upgrade` to confirm coreVersion compatibility, then `node scripts/gds/fitness.js` to confirm the boundary checks pass. The `unit` CI job runs fitness on every PR.
 
+### 6. Publish to the store (optional)
+
+`bongos module publish <key>` packs `modules/<key>/` as one version for the Bongos-hosted module store ([ADR 0338](adr/0338-modules-travel-through-a-bongos-hosted-store.md)): a tarball plus hash manifest in the core release's own format (`scripts/gds/module-artifact.js` over `artifact-format.js`), then uploads it to `POST /store/modules/:key/versions`. `--dry-run` packs without uploading; `--out <dir>` also writes the tarball and its manifest.
+
+- The version is `module.json`'s `version`. Each version is published **once** and must be newer than the last — bump it to publish a fix.
+- Your first publish of a key makes you its author; only the author can publish later versions, and a delisted key takes none.
+- The publish denylist applies (ADR 0098), plus a refusal of credential-named files (`.env*`, `*.pem`, `*.key`, `id_rsa`, …) anywhere in the module. The store re-checks every hash and the denylist itself.
+- Gate: Metic+ (`module.submit`) for now. This is not `bongos module submit`, which proposes a module *into* core.
+
 ## Carving an existing core domain (the `db.js` per-domain pattern)
 
 Most BONGOS-V1 module work is not scaffolding a *new* module — it's **carving an existing core domain out of the monolith** (ADR 0091, criterion C7). The reference carve is the kernel slice `src/bongos/db-kernel.js` (BV1.R69); the feature precedents are `modules/discord/db.js` + `modules/game/db.js`. Every later carve (memory R72, grading R73, …) copies this recipe. The invariant is **OTB byte-identical** at every step — you are *moving* code, not changing behavior.

package/docs/onboarding/diagrams/04-architecture.mmd

@@ -4,18 +4,10 @@ config:
   layout: elk
 ---
 flowchart TB
-    subgraph DEVICE["YOUR DEVICE — only the screen lives here"]
-        APP["Claude desktop app or browser tab\n(shows files · sends your messages · holds NO code)"]
-    end
-
-    subgraph BOX["DEV BOX — a machine WE create on DigitalOcean (gated · revocable · audited; Metic+ may instead clone locally)"]
-        WORKER["Claude Code WORKER\n(opens files · runs commands · runs the /builder-* skills)"]
-        CODE["the code — git clone + per-builder worktrees (.claude/worktrees/*)\nfor sub-Metic builders it lives ONLY here · CLAUDE.md is DESCRIPTIVE only"]
+    subgraph MACHINE["YOUR MACHINE — a clone of the instance repo"]
+        WORKER["Claude Code — the desktop app or the terminal\n(opens files · runs commands · runs the /builder-* skills)"]
+        CODE["the code — git clone + per-task worktrees (.claude/worktrees/*)\nCLAUDE.md is DESCRIPTIVE only"]
         LOCAL["local ~/.claude memory\nMAP = MEMORY.md — a one-line index loaded EVERY session\n(a guard + auto-tidy keep it light; ADR 0074)\n+ drawer of full notes, loaded only on demand"]
-        ORIGIN["credential-less git origin\n(NO GitHub push secret on the box — by design)"]
-        BOXTOK["box-scoped Bongos token\n(deny-by-default: bootstrap endpoints only;\nrejected for branch upload → re-auth first — LIVE)"]
-        PREVIEW["sandbox preview server on :3000\n→ a per-builder sandbox URL (LIVE)"]
-        SWITCH["on / off + browser terminal\n(desktop app LIVE · ttyd-over-tunnel LIVE)"]
     end
 
     subgraph SERVER["THE INSTANCE SERVER — localhost:3000 (the authority AND production)"]
@@ -24,7 +16,7 @@ flowchart TB
         DB["Postgres — tasks · claims · versions · builders.rank\ncredit_log · grades · idea_inbox · builder_memory\n(KING for work-state + permissions; CLAUDE.md only describes it)"]
         RANK["auth.requireRank — checked per request, NO caching\n(ADR 0016: a demotion takes effect on the next request)"]
         SRVMEM["server-side builder_memory store\nLIVE: per-builder · isolated · forensic read at Metic+ (ADR 0157)\nyour memory follows you across machines & worktrees\n/recall fetches only the relevant subset (ADR 0060)\n(R54 / R55 / R56 / R57 — all shipped)"]
-        PUSHTOK["server-held push credential\n(GitHub App, short-lived tokens — the box never holds it)"]
+        PUSHTOK["server-held push credential\n(GitHub App, short-lived tokens — for a checkout that has none of its own)"]
         DEPLOY["auto-pull deploy (ADR 0129)\na timer pulls THIS instance repo every ~2 min →\nnpm ci if the pin changed → migrate → regenerate docs → restart → healthz"]
     end
 
@@ -34,20 +26,17 @@ flowchart TB
 
     LIVEAPP["the live app — localhost:3000\n(same server · same Node process as /api/bongos/*)"]
 
-    APP -->|"1 · toggle box on / open terminal"| SWITCH
-    SWITCH --> WORKER
-    WORKER -->|"2 · edit + commit"| CODE
-    WORKER -->|"3 · re-auth in browser"| API
-    WORKER -->|"4 · upload branch as a git bundle"| API
-    API -->|"5 · push + open PR + auto-merge (LIVE)"| MAIN
-    MAIN -->|"6 · the instance auto-pulls its own main"| DEPLOY
-    DEPLOY -->|"7 · migrate · regenerate docs · restart"| LIVEAPP
+    WORKER -->|"1 · edit + commit"| CODE
+    WORKER -->|"2 · push the branch + open a PR (a machine signed in to GitHub)"| MAIN
+    WORKER -->|"2 · or upload the branch as a git bundle (no push credential here)"| API
+    API -->|"3 · the server pushes it + opens the PR (LIVE)"| MAIN
+    MAIN -->|"4 · the instance auto-pulls its own main"| DEPLOY
+    DEPLOY -->|"5 · migrate · regenerate docs · restart"| LIVEAPP
     CORE --- API
     PUSHTOK -.-> API
-    ORIGIN -. "direct push blocked" .-> MAIN
     API -. "claim / ship / cost" .-> WORKER
     LOCAL -->|"sync on ship (push)"| SRVMEM
     SRVMEM -->|"pull on session start"| LOCAL
 
-    NEXT["The whole box → production path is LIVE: a credential-less box uploads its branch, the server merges it, and the instance auto-pulls + redeploys — hardware-verified end-to-end (1027 · 1028)."]
+    NEXT["Both ways onto main work today: a machine signed in to GitHub pushes its own branch, and a checkout without a push credential uploads it for the server to push. Either way the instance auto-pulls and redeploys."]
     LIVEAPP --- NEXT

package/docs/onboarding/diagrams/README.md

@@ -2,7 +2,7 @@
 
 Five flowcharts that explain Bongos to a new builder at a glance. Each diagram is committed as **Mermaid source** (`.mmd`) plus a rendered **`.svg`** (the crisp, pannable/zoomable asset) and **`.png`** (a static fallback / external-embed image), embedded in the `/builders` hall at `/builders/diagrams` and the builder primer ([V3.R13 / #237](../../../CLAUDE.md)). On those pages the diagrams are **pan-and-zoom canvases** (drag to pan, scroll to zoom, fullscreen) — see [`modules/hall-ui/public/diagram-viewer.js`](../../../modules/hall-ui/public/diagram-viewer.js).
 
-> Built under **V3.R76 ([#295](https://example.com/builders#/task/295))**; auto-regeneration + drift detection added under **[#356](https://example.com/builders#/task/356)/[#357](https://example.com/builders#/task/357)**; conceptual diagrams (03/04) made auto-generated under **[#436](https://example.com/builders#/task/436)**; a dev-box topology diagram (06) added under **[#1031](https://example.com/builders#/task/1031)** and then **merged with 04 into the single `04-architecture` map + SVG pan/zoom viewer under [#1059](https://example.com/builders#/task/1059)**.
+> Built under **V3.R76 ([#295](https://example.com/builders#/task/295))**; auto-regeneration + drift detection added under **[#356](https://example.com/builders#/task/356)/[#357](https://example.com/builders#/task/357)**; conceptual diagrams (03/04) made auto-generated under **[#436](https://example.com/builders#/task/436)**; consolidated into the single **`04-architecture` map + SVG pan/zoom viewer under [#1059](https://example.com/builders#/task/1059)**.
 
 ### Auto-generated vs hand-authored (important)
 
@@ -11,7 +11,7 @@ Five flowcharts that explain Bongos to a new builder at a glance. Each diagram i
 | Diagram | What drives its state |
 |---|---|
 | `01-task-lifecycle` · `02-rank-ladder` · `05-versioning` (**mechanical**) | The task-status set + rank enum/wiring (read from `migrations/` + `src/bongos/`) and the live version set (production API). No auth needed — always regenerate. |
-| `03-drachmae-karma` · `04-architecture` (**conceptual**) | Each feature-piece is **LIVE iff its backing Bongos task is `shipped`**, plus 03's "N seeded" count from the achievements seed in `migrations/`. These read the **authenticated** `/tasks/:id` status, so when no Bongos session is available (headless run, no creds) the generator **skips** 03/04 and leaves them untouched rather than emit wrong data. (04's device/box/server/GitHub *topology* is structural; only its LIVE/PLANNED markers — the memory chain + the box→prod ship-flow legs — are task-gated.) |
+| `03-drachmae-karma` · `04-architecture` (**conceptual**) | Each feature-piece is **LIVE iff its backing Bongos task is `shipped`**, plus 03's "N seeded" count from the achievements seed in `migrations/`. These read the **authenticated** `/tasks/:id` status, so when no Bongos session is available (headless run, no creds) the generator **skips** 03/04 and leaves them untouched rather than emit wrong data. (04's machine/server/GitHub *topology* is structural; only its LIVE/PLANNED markers — the memory chain + the ship-flow legs — are task-gated.) |
 
 The mechanical diagrams regenerate **on every deploy** (`ship.js` / `/merge-mode` run `gen-diagrams.js` before deploying; a changed diagram is committed and shipped automatically). The conceptual diagrams regenerate the same way whenever a session is present (the deploy host has one). The `diagram-drift` routine remains as a belt-and-braces backstop. So `/builders/diagrams` is never more than one deploy behind the live architecture.
 
@@ -49,7 +49,7 @@ Where each comes from and where each goes. Key facts: **example = credits** (sam
 Source: [`03-drachmae-karma.mmd`](03-drachmae-karma.mmd)
 
 ### 4. The complete architecture — where your work runs and how code reaches production
-One map of the whole system, merging the old "server ↔ repo ↔ memory" three-layer view with the dev-box → production ship flow. The four places Claude Code splits across — your **device** (screen only) · the **dev box** (the worker, the code, *and* your local memory dir) · the **server/droplet** (authority *and* production: Postgres, the server-side memory store, the push credential) · **GitHub** (branch-protected main + Actions) — plus two flows woven through it: the **per-builder memory layer** (ADR 0024 — local ↔ server, sync-on-ship / pull-on-start) and the **box → prod ship path** (a credential-less box re-auths and uploads its branch as a git bundle; the server pushes it with a GitHub App credential; the PR auto-merges and GitHub Actions deploys — no droplet key on any box). Every feature-piece + flow edge is LIVE/solid iff its backing task is `shipped`. Backing tasks: memory chain [#273](https://example.com/builders#/task/273)–[#276](https://example.com/builders#/task/276); dev box [#904](https://example.com/builders#/task/904)/[#774](https://example.com/builders#/task/774)/[#897](https://example.com/builders#/task/897)/[#919](https://example.com/builders#/task/919); box→prod [#1025](https://example.com/builders#/task/1025)/[#859](https://example.com/builders#/task/859)/[#1028](https://example.com/builders#/task/1028)/[#1027](https://example.com/builders#/task/1027) (all shipped → the map reads all-LIVE today). See [ADR 0024](../../adr/0024-cloneable-repo-local-first-memory.md) (cloneable memory), [ADR 0055](../../adr/0055-server-mediated-branch-publish.md) (server-mediated publish), [ADR 0053](../../adr/0053-scoped-dev-box-session.md) (scoped box token), [ADR 0042](../../adr/0042-builder-self-deploy-ci-auto-merge.md) (CI self-deploy), [ADR 0016](../../adr/0016-trust-boundary-server-enforced-permissions.md) (trust boundary).
+One map of the whole system. The three places the work lives — **your machine** (the Claude Code worker, the code, *and* your local memory dir) · the **server** (authority *and* production: Postgres, the server-side memory store, the push credential) · **GitHub** (branch-protected main) — plus two flows woven through it: the **per-builder memory layer** (ADR 0024 — local ↔ server, sync-on-ship / pull-on-start) and the **ship path** (a machine signed in to GitHub pushes its own branch and opens the PR; a checkout with no push credential uploads its branch as a git bundle and the server pushes it with a GitHub App credential; either way the PR auto-merges and the instance auto-pulls its own main). Every feature-piece + flow edge is LIVE/solid iff its backing task is `shipped`. Backing tasks: memory chain [#273](https://example.com/builders#/task/273)–[#276](https://example.com/builders#/task/276); ship path [#1025](https://example.com/builders#/task/1025)/[#1028](https://example.com/builders#/task/1028) (all shipped → the map reads all-LIVE today). See [ADR 0024](../../adr/0024-cloneable-repo-local-first-memory.md) (cloneable memory), [ADR 0055](../../adr/0055-server-mediated-branch-publish.md) (server-mediated publish), [ADR 0129](../../adr/0129-cloudbongos-control-plane-pull-deploy.md) (auto-pull deploy), [ADR 0016](../../adr/0016-trust-boundary-server-enforced-permissions.md) (trust boundary).
 
 ![The complete architecture](04-architecture.png)
 

package/docs/onboarding/diagrams/assertions.json

@@ -111,7 +111,7 @@
   },
   "architecture": {
     "diagram": "04-architecture",
-    "_comment": "Pieces of 04-architecture gated on a backing Bongos task. A piece is LIVE iff its task is 'shipped'; live_tasks must ALL be shipped, pending_tasks must NOT yet be. Rebuilt by scripts/gds/gen-diagrams.js in lockstep with the diagram, so this is the drift checker's backstop. The device/box/server/GitHub topology is structural (not task-gated); these are the LIVE/PLANNED markers. MEMORY layer (ADR 0024): 273 schema / 274 sync-on-ship / 275 pull-on-start / 276 isolation. DEV BOX + box→prod: 904/774 (on-off + browser terminal), 897 (sandbox preview), 919 (scoped box token), 1025 (server-mediated publish), 1028 (GitHub App push credential), 1027 (end-to-end hardware-verify). The deploy leg is the standalone AUTO-PULL (ADR 0108/0129), not a task-gated GitHub-Actions CI job, so 859 is intentionally absent. Supersedes the old server_repo_memory + dev_box slices.",
+    "_comment": "Pieces of 04-architecture gated on a backing Bongos task. A piece is LIVE iff its task is 'shipped'; live_tasks must ALL be shipped, pending_tasks must NOT yet be. Rebuilt by scripts/gds/gen-diagrams.js in lockstep with the diagram, so this is the drift checker's backstop. The machine/server/GitHub topology is structural (not task-gated); these are the LIVE/PLANNED markers. MEMORY layer (ADR 0024): 273 schema / 274 sync-on-ship / 275 pull-on-start / 276 isolation. Ship flow: 1025 (server-mediated publish, for a checkout with no push credential), 1028 (GitHub App push credential). The deploy leg is the standalone AUTO-PULL (ADR 0108/0129), not a task-gated GitHub-Actions CI job, so 859 is intentionally absent.",
     "live_tasks": [
       {
         "id": 273,
@@ -129,29 +129,9 @@
         "id": 276,
         "label": "R57 — per-builder isolation + forensic read at Metic+ (ADR 0157)"
       },
-      {
-        "id": 904,
-        "label": "devbox-app — desktop on-off switch"
-      },
-      {
-        "id": 774,
-        "label": "browser-only box terminal (ttyd over tunnel)"
-      },
-      {
-        "id": 897,
-        "label": "per-builder sandbox live preview"
-      },
-      {
-        "id": 919,
-        "label": "scoped dev-box session (box token deny-by-default)"
-      },
       {
         "id": 1025,
-        "label": "server-mediated branch publish (box uploads bundle, server pushes)"
-      },
-      {
-        "id": 1027,
-        "label": "hardware-verify the box-to-prod flow end-to-end"
+        "label": "server-mediated branch publish (a checkout with no push credential uploads a bundle, the server pushes)"
       },
       {
         "id": 1028,

package/docs/onboarding/primer.md

@@ -98,7 +98,7 @@ What doesn't work well:
 As you work, Claude writes down durable facts — your standing preferences, a gotcha that cost real time, the current state of the project — so the next session doesn't start cold. You don't manage any of this by hand, but it's worth knowing the shape:
 
 - **The map** (`MEMORY.md`) — a short index loaded at the **start of every session**: one line per memory, just enough to know *what* is known and where the detail lives. Kept deliberately small.
-- **The drawer** — the full notes themselves. They live on your machine, sync to the server (so your memory follows you across machines and boxes), and are searchable with `/recall`. They cost nothing until something fetches them.
+- **The drawer** — the full notes themselves. They live on your machine, sync to the server (so your memory follows you across machines), and are searchable with `/recall`. They cost nothing until something fetches them.
 
 The map stays light on its own: a session-start guard warns if it's drifting large, and an auto-tidy moves the oldest, least-relevant notes off the map into the drawer when it crosses a threshold — **nothing is deleted**, it's just no longer loaded every session (a `/recall` away when a task needs it). Your standing rules, and anything pinned, always stay on the map. Full picture: [ADR 0074](../adr/0074-memory-map-stays-light.md) and [diagram 4 — the architecture](diagrams/).
 
@@ -114,7 +114,7 @@ Other depth, in roughly the order you'll need it:
 - [`docs/onboarding/example-and-karma.md`](drachmae-and-karma.md) — the full reward economy: how example and karma are earned, the cost-plus session reward, and the monthly budget cap
 - [`docs/onboarding/slash-commands.md`](slash-commands.md) — which slash commands ship with Claude Code and which are this project's, and what to do about the ones that collide
 - [`docs/architecture.md`](../architecture.md) — live system: droplet, stack, schema, API surface
-- [`docs/modules-contract.md`](../modules-contract.md) — the product is built as a small core plus swappable `modules/<key>/` (dev boxes, the game, Discord, art, and more); this is the live roster and how a task lands inside one
+- [`docs/modules-contract.md`](../modules-contract.md) — the product is built as a small core plus swappable `modules/<key>/` (the game, Discord, art, and more); this is the live roster and how a task lands inside one
 - [`docs/canonical-permissions.md`](../canonical-permissions.md) — who can do what (rank gates)
 - [`docs/file-map.md`](../file-map.md) — where every folder is and what it contains
 - [`docs/recipes/`](../recipes/) — long-form ops gotchas (read before deploying)
@@ -131,28 +131,14 @@ You don't need to be a programmer to build here. Entry to the project is **appro
 Claude Code is **three pieces that can live in different places**:
 
 - **The screen** — the window you look at and type into. Always on *your* device (the Claude desktop app, or a browser tab). It just shows files and sends your messages.
-- **The worker** — the part that opens files, runs commands, edits code, runs the project. Runs in **one place you choose**.
-- **The brain** — the AI model itself. **Always on Anthropic's servers**, whatever else you pick.
+- **The worker** — the part that opens files, runs commands, edits code, runs the project.
+- **The brain** — the AI model itself. **Always on Anthropic's servers**.
 
-You only ever choose **where the worker goes** — and that single choice *is* your setup path.
+Today the worker runs in one place: **your own computer**, working on a clone of the project. The single map that shows the whole picture — your device, the per-builder memory layer, the server (authority *and* production), and how code travels to prod — is [diagram 4, *The complete architecture*](diagrams/).
 
-### Three ways to set up
+> **Why a copy of the code at all?** The `/builder-*` commands you'll use every session aren't a separate download — they live *inside* the project's code (in `.claude/skills/`). The moment Claude Code **starts a session on a folder that already holds the code**, all the commands appear automatically. So "get the code" and "get the commands" are the same step — there's no plugin or zip to install. (One wrinkle: if you *clone the code mid-session into a folder that started empty*, the commands won't appear until you start a fresh session on that folder — step 3 handles it.)
 
-| Path | Where the worker runs | Who it's for |
-|---|---|---|
-| **Cloud box** — *the default for new builders* | A dev box we create for you on DigitalOcean; your desktop app connects to it | Anyone new on a Mac or Windows machine. Nothing to install but the app — the code never lands on your own disk |
-| **Remote Control** | The **same** cloud box, but driven from a browser tab — [step-by-step guide](browser-terminal-guide.md) | Chromebooks / iPads / phones that can't run the desktop app |
-| **Local** — *trusted builders only (Metic and up)* | Your own computer | Power users who'd rather run the code on their own hardware to save the box cost |
-
-Your **first** cloud box is created hands-off; a returning box wakes itself; you never wait on an operator. (Entry to the project is already approval-gated — an Archon admitted you when you joined — so there's no separate per-box approval step.)
-
-> **Why is Local trusted-only?** Below Metic, the project's code lives **only inside the cloud box we control** — gated, revocable, and audited. Holding a permanent copy on your own machine is a trust grant that arrives when you're promoted to Metic, not on day one. New builders work in the box.
-
-> **Where things stand today.** The cloud-box on-ramp is built *and* now verified end-to-end — the desktop on/off app, the browser terminal, the per-builder sandbox preview, and the box → production ship path (a credential-less box uploads its branch and the server merges + deploys it via a GitHub App credential) have all shipped, and the whole box → production chain has been hardware-verified on a real box ([#1027](https://example.com/builders#/task/1027), [#1028](https://example.com/builders#/task/1028)). So the **cloud box is the proven default for new builders.** The **local-clone route below is the permanent home for Metic-and-up builders** — a fully supported alternative, not a stopgap. The single map that shows the whole picture — device, dev box, the per-builder memory layer, the server (authority *and* production), and how code travels from a box to prod — is [diagram 4, *The complete architecture*](diagrams/).
-
-> **Why a copy of the code at all?** The `/builder-*` commands you'll use every session aren't a separate download — they live *inside* the project's code (in `.claude/skills/`). The moment Claude Code **starts a session on a folder (or box) that already holds the code**, all the commands appear automatically. So "get the code" and "get the commands" are the same step — there's no plugin or zip to install. (One wrinkle: if you *clone the code mid-session into a folder that started empty*, the commands won't appear until you start a fresh session on that folder — step 3 handles it.)
-
-### The steps that work today (local route)
+### The steps
 
 Take them in order — each one sets up the next, from "I'm admitted" to "I'm looking at work I can claim."
 
@@ -193,11 +179,6 @@ Run `/builder-start` to see what you can claim — no acknowledgment step needed
 
 When you ship your **first** task, example land in your column and you're inducted as a citizen of Example. Ship your **third** and you graduate to **Thetes** — the one-claim limit lifts and the whole general queue opens to you. Welcome.
 
-## Your own dev box
-
-Every active builder — from your very first day as a **Xenos**, and **whatever your craft** (engineer, artist, or ideator) — gets a **personal dev box and a live game preview of your own**. There's no separate Archon approval to unlock them: being admitted to the project *is* the approval. Two everyday commands put them at your fingertips:
-
-- **`/builder-box`** — your box's control panel. It shows whether your box is awake, what it has cost, and your sign-in details, and it can **wake or (re)create your box hands-off** when it's asleep — you never wait on an operator. It's also where you find your **sandbox URL** (below) and, on a Chromebook or tablet, the browser-terminal link. Reach for it whenever you're unsure your box is up or you need to get back onto it.
-- **`/builder-stage`** — your private preview. Before you ship a change that touches the game, run `/builder-stage` to push your current edits to your **sandbox** — a personal copy of the game at `sandbox-<your-login>.example.com` that reflects only *your* work-in-progress. Open the link, watch your change running for real, and only then ship it. Nothing you stage there touches the live game or anyone else's box.
+## Previewing your change
 
-In short: `/builder-box` gets you a workshop; `/builder-stage` lets you see your work on the shelf before it reaches the shop floor.
+Before you ship a change that touches the game, run **`/builder-stage`** to start your own private copy of the game on your computer (at `http://localhost:<port>`) with your current edits in it. Open the link, watch your change running for real, and only then ship it. Nothing you stage there touches the live game or anyone else's work.

package/docs/page-inventory.json

@@ -13,7 +13,7 @@
     "pages": 38,
     "surfaces": 3,
     "with_states": 31,
-    "states": 167
+    "states": 168
   },
   "surfaces": [
     {
@@ -475,6 +475,7 @@
         "modules/hall-ui/public/goal-inbox.js",
         "modules/hall-ui/public/hall-render.js",
         "modules/hall-ui/public/profile-nudge.js",
+        "modules/hall-ui/public/claim-action.js",
         "modules/hall-ui/public/builders.js",
         "modules/hall-ui/public/copy-on-click.js"
       ],
@@ -898,6 +899,7 @@
         "modules/hall-ui/public/brand-apply.js",
         "modules/hall-ui/public/md-reader.js",
         "modules/hall-ui/public/hall-visual.js",
+        "modules/hall-ui/public/claim-action.js",
         "modules/hall-ui/public/task.js"
       ],
       "states_files": [
@@ -1159,6 +1161,7 @@
         "in-new-modules-search",
         "in-new-home",
         "in-new-address",
+        "in-new-app",
         "in-new-review",
         "in-new-done",
         "in-new-resume-offer",