@bongos/core 1.19.1073 → 1.19.1074

package/modules/memory/module.json

@@ -2,6 +2,7 @@
   "key": "memory",
   "title": "Memory & recall",
   "description": "Per-builder session memory, the lexical recall/search retrieval layer (ADR 0060), and durable learnings. A core-domain module carved out of the GDS core in BV1.R72 (ADR 0091); default-on because every instance needs the build system's memory.",
+  "version": "1.0.0",
   "coreVersion": "^1.5.0",
   "default": true,
   "maintenance": {

package/modules/npm-release/module.json

@@ -2,6 +2,7 @@
   "key": "npm-release",
   "title": "npm release",
   "description": "The deploy page for a project that publishes an npm package from its GitHub repo — where every recently shipped task has got to (not merged, merged, in a version, live, released) and each version's list of work, read from the release notes the package itself carries (task 1002622) — and the same line on a task's own page (task 1004301). Built for the Bongos hall, which publishes @bongos/core; off everywhere else.",
+  "version": "1.0.0",
   "coreVersion": "^1.19.0",
   "default": false,
   "author": "Cloud Bongos",

package/modules/onboarding/module.json

@@ -2,6 +2,7 @@
   "key": "onboarding",
   "title": "Onboarding (admission · setup · newcomer floor)",
   "description": "The newcomer ADMISSION + ORIENTATION domain — the public access-request → Archon-approval gate, the server-ticked onboarding state machine (the 'Path into the City' checklist that graduates a Xenos to Thetes), the friction analyzer (feedback-without-asking on consented onboarding transcripts), and the evergreen newcomer-chore restock (a fresh first-builder task is always waiting). A core-domain module carved out of the GDS core in BV1.R81 (ADR 0093 §1); default-on because every instance onboards its own builders. The access-requests admission routes mount here; the core lifecycle (db.js claim/ship), auth callbacks, and the me/builders profile readers resolve the `onboarding` kernel PORT for the state-machine + restock surface they need — never importing the module.",
+  "version": "1.0.0",
   "coreVersion": "^1.19.532",
   "default": true,
   "maintenance": { "status": "core-maintained" },

package/modules/onboarding/onboarding-state.js

@@ -81,8 +81,8 @@ const ALL_STAGES = [...STAGES, GRADUATED];
 
 // The pre-auth, INFORMATIONAL step that sits AHEAD of auth_complete (task 470).
 // The state machine's first ENGINE stage is auth_complete, but the genuine
-// first action a newcomer takes is "obtain the repo" — clone it locally, or open
-// the hosted dev box where it is already cloned. That step is manual/external
+// first action a newcomer takes is "obtain the repo" — clone it locally. That
+// step is manual/external
 // (there is no server event for it) and intentionally NOT a member of STAGES, so
 // it never gates graduation, never advances current_stage, and never appears in
 // shapeForApi's tracked checklist. It exists purely so the system's own model of
@@ -92,7 +92,7 @@ const ALL_STAGES = [...STAGES, GRADUATED];
 const PRE_AUTH_STEP = {
   id: 'obtain_repo',
   label: 'Obtain the repo',
-  hint: 'Clone the project to thy machine — or open thy hosted dev box, where it is already cloned. The build commands live inside the repo, so this comes first.',
+  hint: 'Clone the project to thy machine. The build commands live inside the repo, so this comes first.',
   informational: true,
 };
 
@@ -126,10 +126,10 @@ const STAGE_LABELS = {
 // onboarding model never named that step, so the hint now points at it ahead of
 // the sign-in itself. See PRE_AUTH_STEP below for the standalone representation.
 const STAGE_HINTS = {
-  auth_complete:    'First obtain the repo — clone it (or open thy hosted dev box, where it is already cloned) — then sign in via GitHub Device Flow or the web sign-in.',
+  auth_complete:    'First obtain the repo — clone it — then sign in via GitHub Device Flow or the web sign-in.',
   pick_disciplines: 'Pick the work that calls thee — engineer, artist, ideator, or any mix.',
   first_start:      'Run /builder-start to see claimable works.',
-  first_claim:      'Claim a task with /builder-claim N — then on thy dev box run /builder-sync, and thy box pulls exactly that task\'s code (naught else) within seconds.',
+  first_claim:      'Claim a task with /builder-claim N — it is thine alone until thou shippest it.',
   ship_three:       'Carry three tasks through with /builder-ship — the third makes thee a Thetes.',
   graduated:        '',
 };
@@ -147,28 +147,16 @@ function isKnownStage(stage) {
 // hall renders — a short, action-only orientation path for a brand-new Xenos.
 // Every step auto-detects (#777, per Lars: no manual ticks — "the city watches"):
 //
-//   1. box_connect      — cleared the moment the builder PROPERLY connects to
-//                         their dev box, i.e. a running `claude` process is seen
-//                         on the box. Backed by builder_boxes.first_connected_at
-//                         (stamped write-once by boxes.bumpActivity on the first
-//                         claude_active=true heartbeat); passed in as
-//                         `boxConnected` (boxes.hasEverConnected). FIRST because
-//                         nothing else can happen until the box works — its hint
-//                         points the newcomer at the welcome panel's setup steps
-//                         (#823). `source: 'box'`.
-//   2. join_discord     — cleared by a live Discord link (discord.linked). The
+//   1. join_discord     — cleared by a live Discord link (discord.linked). The
 //                         hall's "Connect Discord & join" button runs the
 //                         existing OAuth flow (auto-join + rank role); linking
 //                         clears the step. `source: 'discord'`.
-//   3. pick_disciplines — the real engine stage, cleared by the craft picker.
-//   4. cli_setup        — cleared once the builder has authenticated the GDS CLI
-//                         (ran /builder-setup, or the box-connect bootstrap — both
-//                         mint a source='cli' session). Detected via
-//                         db.hasCliSession; passed in as `cliAuthed`. Distinct
-//                         from box_connect: connecting gets Claude running on the
-//                         box; setup signs the GDS in so /builder-* works (Lars,
-//                         #823: "both have a place"). `source: 'cli'`.
-//   5. ship_three       — the real engine stage. Auto, live "N of 3" counter,
+//   2. pick_disciplines — the real engine stage, cleared by the craft picker.
+//   3. cli_setup        — cleared once the builder has authenticated the CLI
+//                         (ran /builder-setup, which mints a source='cli'
+//                         session). Detected via db.hasCliSession; passed in as
+//                         `cliAuthed`. `source: 'cli'`.
+//   4. ship_three       — the real engine stage. Auto, live "N of 3" counter,
 //                         clears at 3 ships (= the xenos->thetes promotion).
 //
 // The old 'auth_complete' (GitHub web sign-in) is intentionally NOT shown — a
@@ -181,7 +169,6 @@ function isKnownStage(stage) {
 // derive `cleared` for each step. NONE of these are members of STAGES, so none
 // affect nextStage/graduation — they are display-only.
 const DISPLAY_STEPS = [
-  { id: 'box_connect',      source: 'box' },
   { id: 'join_discord',     source: 'discord' },
   { id: 'pick_disciplines', source: 'stage' },
   { id: 'cli_setup',        source: 'cli' },
@@ -189,18 +176,16 @@ const DISPLAY_STEPS = [
 ];
 
 const DISPLAY_LABELS = {
-  box_connect:      'Connect to thy dev box',
   join_discord:     'Join the Discord server',
   pick_disciplines: 'Choose thy craft — engineer, artist, or ideator',
-  cli_setup:        'Run /builder-setup on thy dev box',
+  cli_setup:        'Run /builder-setup',
   ship_three:       'Ship three works — and rise to Thetes',
 };
 
 const DISPLAY_HINTS = {
-  box_connect:      'Follow the steps in the welcome scroll above to get Claude running on thy dev box — this ticks itself the moment thou art connected.',
   join_discord:     'Connect Discord — thou art auto-joined to the city\'s server and given thy rank.',
   pick_disciplines: 'Pick the work that calls thee — engineer, artist, ideator, or any mix.',
-  cli_setup:        'Sign the GDS in on thy dev box with /builder-setup — this ticks itself once thou art signed in.',
+  cli_setup:        'Sign the CLI in with /builder-setup — this ticks itself once thou art signed in.',
   ship_three:       'Carry three tasks through with /builder-ship — the third makes thee a Thetes.',
 };
 
@@ -454,25 +439,21 @@ function stageDetail(stageId, shipCount) {
 //                      → the counter isn't rendered.
 // opts.discordLinked — whether the builder has a live Discord link. Clears the
 //                      'join_discord' step (the OAuth flow sets the link).
-// opts.boxConnected  — whether the builder's dev box has ever reported a live
-//                      Claude process (boxes.hasEverConnected → first_connected_at).
-//                      Clears the 'box_connect' step (#823).
 // opts.cliAuthed     — whether the builder has ever authenticated the GDS CLI
 //                      (db.hasCliSession). Clears the 'cli_setup' step.
-function shapeForApi(state, { shipCount = null, discordLinked = false, boxConnected = false, cliAuthed = false } = {}) {
+function shapeForApi(state, { shipCount = null, discordLinked = false, cliAuthed = false } = {}) {
   const completed   = new Set((state && state.completed_stages) || []);
   const currentReal = (state && state.current_stage) || STAGES[0];
   const graduated   = currentReal === GRADUATED;
 
   // Per-step cleared resolution, by `source`. 'stage' mirrors hasCleared (in
-  // completed_stages, OR the engine advanced past it). 'discord'/'box'/'cli'
-  // derive from live signals passed by the route. A graduated builder has cleared
+  // completed_stages, OR the engine advanced past it). 'discord'/'cli' derive
+  // from live signals passed by the route. A graduated builder has cleared
   // everything by definition (keeps the displayed list coherent even though the
   // panel hides on graduation — a roster/profile read could still surface this).
   const stepCleared = (step) => {
     if (graduated) return true;
     if (step.source === 'discord') return !!discordLinked;
-    if (step.source === 'box') return !!boxConnected;
     if (step.source === 'cli') return !!cliAuthed;
     // 'stage'
     if (completed.has(step.id)) return true;

package/modules/onboarding/routes/access-requests.js

@@ -1,9 +1,9 @@
 // src/bongos/routes/access-requests.js — onboarding cold-start (2026-05-30).
 //
 // The hall is gated: a brand-new person can't enter until an Archon admits
-// them. Admission is the ONLY gate — newcomers build on hosted dev boxes, so
-// they need no GitHub repo access / collaborator invite (2026-06-07). 'invited'
-// just means "Archon-approved for the hall"; the web sign-in (auth.js) checks
+// them. Admission is the ONLY gate sign-in applies — there is no GitHub repo-
+// access / collaborator check in it (2026-06-07). 'invited' just means
+// "Archon-approved for the hall"; the web sign-in (auth.js) checks
 // exactly that one flag. This router is how they ask and how the Archon
 // answers:
 //

package/modules/platform-identity/module.json

@@ -2,6 +2,7 @@
   "key": "platform-identity",
   "title": "Platform identity (hub IdP)",
   "description": "The Cloud Bongos hub identity-provider surface (ADR 0141): platform accounts, an SSO client registry, and an OAuth authorization-code login handoff so one platform account reaches any hosted project's builders hall with no second GitHub sign-in. Identity ONLY — the hub never mints or carries rank/credits/admission (the ADR 0016 trust boundary). Enabled ONLY on the hub instance (cloudbongos.com); ordinary hosted + self-hosted instances leave it off, so it adds zero attack surface for the common case.",
+  "version": "1.0.0",
   "coreVersion": "^1.14.0",
   "default": false,
   "author": "Cloud Bongos",

package/modules/platform-identity/platform-identity.js

@@ -87,14 +87,21 @@ function clientSecretValid(client, presentedSecret) {
 // Decide whether a RESOLVED hub session may complete the SSO handoff. resolveSession
 // (the raw resolver the browser leg uses so it can redirect-to-sign-in rather than
 // 401) does NOT apply the deny gates requireBuilder does (src/bongos/auth.js) — so
-// this replicates them: a deactivated account (status 'inactive'), a dev-box-scoped
-// token (source 'box', which lives OUTSIDE the ADR 0016 trust boundary), and any
-// non-human service principal (system_role set) must NOT federate. Pure + exported
-// so the gate is unit-tested directly. Returns { ok, reason }.
+// this replicates them: a deactivated account (status 'inactive'), a session whose
+// source the kernel's session-source registry does not declare, and any non-human
+// service principal (system_role set) must NOT federate. Pure + exported so the
+// gate is unit-tested directly. Returns { ok, reason }.
+//
+// FEDERATION_SOURCES mirrors modules/government/session-scopes.json — a module may
+// not read another module's files, and the doorway exports no lookup for it — and
+// tests/platform-identity.mjs pins the two lists equal, so a source declared or
+// retired there without the same edit here fails the build instead of drifting.
+const FEDERATION_SOURCES = Object.freeze(['cli', 'web', null]);
 function sessionUsableForFederation(session) {
   if (!session) return { ok: false, reason: 'no_session' };
   if (session.status === 'inactive') return { ok: false, reason: 'inactive' };
-  if (session.source === 'box') return { ok: false, reason: 'box_scope' };
+  const source = session.source === undefined ? null : session.source;
+  if (!FEDERATION_SOURCES.includes(source)) return { ok: false, reason: 'session_scope' };
   if (session.system_role) return { ok: false, reason: 'service_principal' };
   return { ok: true, reason: null };
 }
@@ -1395,6 +1402,7 @@ module.exports = {
   clientSecretValid,
   redirectUriAllowed,
   sessionUsableForFederation,
+  FEDERATION_SOURCES,
   safeAvatarUrl,
   // accounts
   upsertAccount,

package/modules/platform-identity/routes/sso.js

@@ -265,8 +265,8 @@ module.exports = function ssoRoutes() {
       }
       const msg = usable.reason === 'inactive'
         ? 'This account is no longer active. Ask an Archon on the hub if you believe this is an error.'
-        : usable.reason === 'box_scope'
-          ? 'A dev-box session cannot be used for cross-project sign-in. Sign in from a browser or run /builder-reauth.'
+        : usable.reason === 'session_scope'
+          ? 'This kind of session cannot be used for cross-project sign-in. Sign in from a browser or run /builder-reauth.'
           : 'This session type cannot be used for cross-project sign-in.';
       return res.status(403).type('text/html').send(errorPage(msg));
     }

package/modules/platform-identity/tests/platform-identity.mjs

@@ -119,9 +119,23 @@ t('a deactivated account may NOT federate (mirrors requireBuilder status gate)',
   assert.deepEqual(r, { ok: false, reason: 'inactive' });
 });
 
-t('a dev-box-scoped token may NOT federate (outside the trust boundary)', () => {
-  const r = P.sessionUsableForFederation({ github_id: 1, status: 'active', source: 'box' });
-  assert.deepEqual(r, { ok: false, reason: 'box_scope' });
+t('a session of an undeclared source (a leftover dev-box token) may NOT federate', () => {
+  for (const source of ['box', 'not-a-source']) {
+    const r = P.sessionUsableForFederation({ github_id: 1, status: 'active', source });
+    assert.deepEqual(r, { ok: false, reason: 'session_scope' }, source);
+  }
+  // cli, web and the legacy sourceless row still federate.
+  for (const source of ['cli', 'web', null, undefined]) {
+    assert.equal(P.sessionUsableForFederation({ github_id: 1, status: 'active', source }).ok, true, String(source));
+  }
+});
+
+t('FEDERATION_SOURCES is exactly the kernel session-source registry', () => {
+  // platform-identity may not read the government module, so it mirrors the list;
+  // this pin is what stops the copy drifting from modules/government/session-scopes.json.
+  const reg = JSON.parse(readFileSync(new URL('../../government/session-scopes.json', import.meta.url), 'utf8'));
+  const declared = reg.scopes.map((r) => (r.source === undefined ? null : r.source));
+  assert.deepEqual([...P.FEDERATION_SOURCES].sort(), declared.sort());
 });
 
 t('a service principal (system_role set) may NOT federate', () => {

package/modules/provisioning/module.json

@@ -2,6 +2,7 @@
   "key": "provisioning",
   "title": "Instance provisioning",
   "description": "Stand up + operate a Cloud Bongos instance's own infrastructure (server, database, domain, DNS, TLS) via the API, so an owner does not manage infra by hand (ADR 0111). Owns the web-tier REQUEST + STATE surface only: it enqueues provisioning intents + reads instance state \u2014 it holds NO cloud-provider tokens and calls NO cloud API. A separate control-plane runner (scripts/gds/provision.js, task P3) is the sole token-holder that drains the intents. Distinct from the `hosting` module (ADR 0092), which brokers compute WORKLOADS.",
+  "version": "1.0.0",
   "coreVersion": "^1.14.0",
   "default": false,
   "author": "Cloud Bongos",

package/modules/provisioning/provisioning.js

@@ -7,8 +7,8 @@
 // intents. The control-plane runner (scripts/gds/provision.js, task P3) is the sole
 // token-holder that drains provisioning_intents and does the real infra work.
 //
-// `db` is dependency-INJECTED (passed in as the first arg), exactly like
-// modules/dev-box/boxes.js — so this file has NO core require and is trivially
+// `db` is dependency-INJECTED (passed in as the first arg), so this file has NO
+// core require and is trivially
 // unit-testable with a fake `{ query }`. The route factory passes the doorway pool.
 'use strict';
 

package/modules/provisioning/starter-bundles.js

@@ -75,21 +75,6 @@ const ALWAYS_ON_CORE = Object.freeze([
 // own npm package is a later, deliberate removal from this list — with picker copy.
 const HUB_ONLY_MODULES = Object.freeze(['platform-identity', 'provisioning', 'npm-release']);
 
-// Modules that were once offered and are being WITHDRAWN. A retired key is still
-// a module on disk — its manifest, routes and tables are deleted by later tasks —
-// but it must stop being OFFERED the moment the withdrawal starts, or an owner
-// creating a project today opts into something that is on its way out.
-//
-// WHY A LIST AND NOT JUST DELETING THE ROW. The integrity test below pins
-// OPTIONAL_MODULES against the on-disk `default: false` manifests, so that a new
-// opt-in module cannot ship without owner-facing copy. Dropping a row while its
-// manifest is still on disk would trip exactly that guard. Naming the withdrawal
-// keeps the guard honest in both directions: the catalog may omit a RETIRED
-// module and may omit nothing else. The entry is deleted when the module is
-// (goal 1000091, task 1003892) — at which point the manifest is gone and the
-// plain drift check covers it again.
-const RETIRED_MODULES = Object.freeze(['dev-box']);
-
 // The OPT-IN catalog as the creation picker renders it (BV1.R20, task 1002339):
 // every module an owner may actually choose, in the order the picker lists them,
 // with copy written for someone who has met none of them.
@@ -159,9 +144,7 @@ const OPTIONAL_MODULE_KEYS = Object.freeze(OPTIONAL_MODULES.map((m) => m.key));
 //
 // Deliberately tiny: ADR 0237 already made the per-type preset the opinion, and
 // today's opt-in catalog is two modules wide — so this table's job is to correct
-// a preset the owner's answer contradicts, not to re-derive it. The two rules that
-// added and removed `dev-box` by team shape went with the module (task 1003886):
-// a rule about a module nobody can select adjusts nothing.
+// a preset the owner's answer contradicts, not to re-derive it.
 //
 // A rule may only ever name an OPT-IN module. Adding or removing an always-on one
 // would be a toggle that toggles nothing (ADR 0237 §3's argument, and
@@ -193,10 +176,8 @@ const RULED_TEAM_SHAPES = Object.freeze([...new Set(TEAM_SHAPE_RULES.map((r) =>
 // The lists are SHORT on purpose. A preselect an owner has to audit is worse than
 // none, and today's opt-in catalog is genuinely small (`agents`, `discord`); a
 // bundle grows as the catalog does, which is exactly why this is a declaration and
-// not a rule engine. `dev-box` was preselected by the game and business bundles
-// until it was retired (goal 1000091, task 1003886) — withdrawing it left both
-// bundles one module wide, which is the floor working as intended, not a gap to
-// backfill with a module an owner did not ask for.
+// not a rule engine. A bundle one module wide is the floor working as intended,
+// not a gap to backfill with a module an owner did not ask for.
 const STARTER_BUNDLES = Object.freeze({
   game: Object.freeze({
     label: 'Game starter',
@@ -287,8 +268,8 @@ function adjustBundle(bundle, teamShape) {
   for (const rule of TEAM_SHAPE_RULES) {
     if (rule.teamShape !== teamShape) continue;
     if (rule.effect === 'add' && !held.has(rule.module)) held.add(rule.module);
-    // `remove` is declared but named by no live rule since dev-box was retired
-    // (task 1003886). Kept for the next rule that needs it, not exercised today.
+    // `remove` is declared but named by no live rule today. Kept for the next
+    // rule that needs it.
     else if (rule.effect === 'remove' && held.has(rule.module)) held.delete(rule.module);
     else continue;
     adjustments.push({ rule: rule.id, effect: rule.effect, module: rule.module, reason: rule.reason });
@@ -404,7 +385,6 @@ function effectiveModules(row) {
 module.exports = {
   ALWAYS_ON_CORE,
   HUB_ONLY_MODULES,
-  RETIRED_MODULES,
   OPTIONAL_MODULES,
   STARTER_BUNDLES,
   TEAM_SHAPE_RULES,

package/modules/public-landing/module.json

@@ -2,6 +2,7 @@
   "key": "public-landing",
   "title": "The front door",
   "description": "The instance's public front door served at the APEX ROOT — the landing page (/), the projects hub (/projects, and the /create redirect into its ?view=new wizard), the three footer doors (/privacy, /terms, /contact) and every asset behind them. The third WEB-SURFACE core-domain module after status-ui (BV1.R84) and hall-ui (BV1.R85), carved in task 1003322 (ADR 0218; named in ADR 0197 §8 — the front door keeps its own key, because a customer of the ui-design capability is not part of it). default-on: an instance ships its front door like it ships its hall. Registers no port and contributes no routes — it declares a webSurface, and where hall-ui and status-ui name a Host PREFIX this one declares apexRoot:true, since the apex is whatever host is left once the subdomains are taken (ADR 0218 §2; host:\"\" is rejected, because every host string startsWith \"\"). Like the hall, the declaration is the discovery + scope-map + window.__MODULES__ record: the bytes are served by platform-server.js's dedicated landing block, which keeps the apex-only sentinel strip, the branding-token stamp and the ?v= content stamp and only re-points its root at this module's public/ dir. Disabling the module removes the front door outright — the apex then answers the game-less 404 tail. The world it renders (DESIGN.md, the token contract, the direction records) is the INSTANCE's; the method for building one stays in modules/ui-design/.",
+  "version": "1.0.0",
   "coreVersion": "^1.19.0",
   "default": true,
   "maintenance": { "status": "core-maintained" },

package/modules/public-landing/public/assets/cosmos.css

@@ -1598,7 +1598,7 @@ p.sec-p{font-size:var(--fs-lede);font-weight:500;color:var(--ink-soft);line-heig
 /* the six-step strip as the rail: six hairlines, a 7px dot, one lit step on the
    accent with its halo, the number in the display voice, the name in the label
    face; a step already answered (role=button) stays a way back */
-#view-new .steps{display:grid;grid-template-columns:repeat(7,1fr);gap:0 10px;align-items:start;margin:0 0 40px;}
+#view-new .steps{display:grid;grid-template-columns:repeat(8,1fr);gap:0 10px;align-items:start;margin:0 0 40px;}
 #view-new .steps li{display:block;position:relative;border-top:1px solid var(--rule);padding:12px 0 0;gap:0;}
 #view-new .steps li::before{content:"";position:absolute;top:-4px;left:0;right:auto;width:7px;height:7px;margin:0;border-radius:50%;border:1px solid var(--rule);background:var(--bg);}
 #view-new .steps .snum{display:block;width:auto;height:auto;border:0;border-radius:0;background:none;font-family:var(--font-display);font-weight:300;font-size:22px;letter-spacing:-.02em;line-height:1.1;color:var(--ink-faint);margin-bottom:2px;}

package/modules/public-landing/public/contact.html

@@ -5,7 +5,7 @@
 <meta name="viewport" content="width=device-width, initial-scale=1">
 <!-- Server-stamped like index.html and projects.html (task 1003251): the {{…}}
      tokens are filled by landingPage() (src/platform-server.js) from the
-     instance's own branding, and every <!--apex-only--> region is REMOVED off
+     instance's own branding, and every apex-only:start/end region is REMOVED off
      the hub — a claim about the platform must not ship in a child project's
      page (task 1002748). The baked values are the NEUTRAL pack's.
      Both doors here are token-stamped: a pack that names no repository loses

package/modules/public-landing/public/privacy.html

@@ -5,7 +5,7 @@
 <meta name="viewport" content="width=device-width, initial-scale=1">
 <!-- Server-stamped like index.html and projects.html (task 1003251): the {{…}}
      tokens are filled by landingPage() (src/platform-server.js) from the
-     instance's own branding, and every <!--apex-only--> region is REMOVED off
+     instance's own branding, and every apex-only:start/end region is REMOVED off
      the hub — a claim about the platform must not ship in a child project's
      page (task 1002748). The baked values are the NEUTRAL pack's. -->
 <title>{{productName}} — Privacy</title>