@bongos/core 1.19.1073 → 1.19.1075

package/scripts/gds/push-path-brief.js

@@ -4,19 +4,19 @@
 // scripts/gds/push-path-brief.js — say out loud, at session start, that this machine
 // cannot push (task 1003259 / idea 1000838).
 //
-// THE GAP. On 2026-08-24 a dev-box agent hit auth failures on every raw git probe,
-// concluded "no push credential exists", and asked the owner to mint a fine-grained
-// PAT and store it in ~/.git-credentials on the box — the exact anti-pattern the
-// server-mediated publish path (ADR 0055) exists to avoid. The agent was not being
-// careless: from inside a box every direct GitHub probe fails BY DESIGN (the clone
-// token is one-shot and scrubbed from .git/config after each fetch — ADR 0031 §6),
+// THE GAP. On 2026-08-24 an agent on a credential-less checkout hit auth failures on
+// every raw git probe, concluded "no push credential exists", and asked the owner to
+// mint a fine-grained PAT and store it in ~/.git-credentials — the exact anti-pattern
+// the server-mediated publish path (ADR 0055) exists to avoid. The agent was not being
+// careless: on that checkout every direct GitHub probe failed BY DESIGN (the
+// clone token was one-shot and scrubbed from .git/config after each fetch — ADR 0031 §6),
 // so "missing credential" is the only story the local evidence supports, and the true
 // state at the time (branch already pushed, PR open, CI red) was invisible to it.
-// Nothing the box session loads says the model out loud. This says it out loud.
+// Nothing the session loads says the model out loud. This says it out loud.
 //
 // SO: the third SessionStart truth-teller, beside deploy-divergence.js and
 // strand-watch.js. On the server-publish path (pushVia() 'server' — no authenticated
-// gh, i.e. a dev box or any credential-less checkout) it prints ONE line stating the
+// gh, i.e. any credential-less checkout) it prints ONE line stating the
 // credential model and where the truth about published work lives
 // (GET /api/bongos/tasks/:id/publish-status). On a laptop that pushes locally
 // (pushVia() 'local') it prints NOTHING — a line that fires on every healthy laptop
@@ -58,7 +58,7 @@ function briefLine(via) {
 
 // Lazy require so a broken or partial checkout degrades to silence, not a stack
 // trace injected into the session. pushVia() honors <PREFIX>_PUSH_VIA_SERVER, else
-// probes for an authenticated gh (absent on every box → 'server' instantly).
+// probes for an authenticated gh (absent on a credential-less checkout → 'server' instantly).
 function detectVia() {
   return require('./ship-deploy-target.js').pushVia();
 }
@@ -70,7 +70,7 @@ function report(via) {
   console.log('  Publish path');
   console.log('  ──────────────────────────────────────────────────────────');
   if (via === 'server') {
-    console.log('  server-mediated (no authenticated gh — a dev box or credential-less checkout).');
+    console.log('  server-mediated (no authenticated gh — a credential-less checkout).');
     console.log(`  ${BRIEF}`);
     for (const line of plainCardLines('no_push_credential')) console.log(line);
   } else if (via === 'local') {

package/scripts/gds/regen-instance-docs.js

@@ -3,7 +3,7 @@
 // regen-instance-docs.js — regenerate a STANDALONE instance's live navigation docs (task 1002314).
 //
 // THE GAP. On the monorepo, the gitignored whole-file navigation docs are regenerated at deploy by
-// scripts/deploy/deploy-prod.sh + infra/box-source-fetch.sh (ADR 0110 §2/§3). STANDALONE instances
+// scripts/deploy/deploy-prod.sh (ADR 0110 §2/§3). STANDALONE instances
 // (ADR 0108 — their own lean repo with @bongos/core vendored) never got that step: their bespoke
 // pull-deploy regenerated NOTHING, so a fresh instance shipped with an empty docs/ and nothing kept
 // the session-log index live. This script is the STANDALONE analogue of deploy-prod.sh's regen block

package/scripts/gds/rename-history-check.js

@@ -45,7 +45,7 @@
 //      notices if a blanket find-replace rewrites them. This does.
 //
 //   4. ALIAS MOUNTS — '/api/gds' is a PERMANENT alias (src/bongos/api-prefix.js
-//      says never to remove it: shipped Dev Box binaries and live dev boxes
+//      says never to remove it: shipped binaries and live instances
 //      call it and cannot be force-updated). Asserted against the real exported
 //      mount list. The DISPATCH half — that the alias is a live mount and so
 //      gets no corrective 404 hint — is already covered by

package/scripts/gds/run-unit-tests.js

@@ -93,7 +93,7 @@ const INTEGRATION = new Set([
   // DB-free route test can only assert the shape of.
   'community_leaderboard_db',
   'asset_version', 'auth_flow_slice1', 'backfill_sessions', 'bfg', 'bfg_write',
-  'box_connect_e2e', 'box_onboard', 'boxes', 'cf_tunnel', 'cli_token_reissue',
+  'cli_token_reissue',
   // consumer_layout_boot builds the core .tgz, `npm install`s it, and boots a live
   // platform-server (task 2142), then installs the package from its own shipped lockfile,
   // migrates brand-new EMPTY databases and serves a database-backed route from one (task
@@ -398,20 +398,6 @@ function discoverModuleTests({ modulesDir = MODULES_DIR, isEnabled = isModuleEna
 // above, the real repair is for the test to establish the state it needs instead of
 // inheriting whatever ran before it.
 //
-// THE THREE DEV-BOX TESTS ARE PARKED, NOT DELETED, and that reverses a first pass
-// of this task. The owner ruled that dev-box work can go, and boxes / box_onboard /
-// box_connect_e2e were duly deleted — but modules/dev-box/ is still present, still
-// mounted and unmodified by that change, and those files carry the only regression
-// coverage for LIVE guards: the setBoxState column allowlist (SQL injection), the
-// rank/authz floors, the spoofed X-Forwarded-Host that must never reach the served
-// connect.sh, and the authorized_keys command= / embedded-newline rejections.
-// Deleting a security regression test for code that still runs is not retirement,
-// it is removing the alarm and leaving the door. modules/dev-box/CLAUDE.md also
-// still names boxes + box_onboard as that module's required suite, and
-// scripts/gds/smoke-box.sh still invokes all three by path — deleting the files
-// turned that script into an immediate MODULE_NOT_FOUND. They come out when the
-// module does, in the change that removes it.
-//
 // consumer_layout_boot LEFT THIS LIST under task 1002863. Its "missing core tarball" was
 // package-core's fail-closed leak gate reading the lane's throwaway database password (the
 // word postgres, present in hundreds of core files) as a leaked credential and refusing to
@@ -421,7 +407,7 @@ function discoverModuleTests({ modulesDir = MODULES_DIR, isEnabled = isModuleEna
 // now says out loud.
 const INTEGRATION_PARKED = new Set([
   'acclaim_feed_evidence_db',
-  'bfg', 'bfg_write', 'box_connect_e2e', 'box_onboard', 'boxes',
+  'bfg', 'bfg_write',
   'claim_gate_open_blocker', 'claim_gate_rebase',
   'clawback_confirmed_backlog', 'copy_desk_flags_db',
   'government_board_membership_db', 'handle_machinery', 'hub_profile_leak',

package/scripts/gds/sandbox-stage.js

@@ -4,21 +4,17 @@
 // REVIEWED in a browser before /builder-ship pushes it toward the main game.
 // (#927, ADR 0046 — the sandbox-first review step.)
 //
-// Two preview contexts (resolvePreviewContext picks one):
-//   - BOX (ADR 0031): box-game-preview.service serves the working tree at
-//     https://sandbox-<login>.example.com; "staging" restarts the service.
-//   - LOCAL (task 1056): a builder on a full local clone (laptop) runs the same
-//     ADR 0052 game-only entry privately at http://localhost:<port> via
-//     scripts/gds/local-preview.js; "staging" (re)starts that local process.
-// Either way staging = (re)start the preview to pick up the current working
-// tree, health-check it, record a marker of exactly WHAT tree state was staged,
-// and hand back the URL. ship.js consults the marker through runShipGate(): if
-// the tree changed since the last staging, the builder is asked to stage +
-// review again before the claim resolves. On approval (a TTY 'y' or an
-// --approved re-run on a fresh stage) the gate returns a durable self-approval
-// record that ship.js persists on the task (#1048) — box AND local alike.
+// The preview is LOCAL (task 1056): a builder on a full clone runs the ADR 0052
+// game-only entry privately at http://localhost:<port> via
+// scripts/gds/local-preview.js, and "staging" (re)starts that process to pick up
+// the current working tree, health-checks it, records a marker of exactly WHAT
+// tree state was staged, and hands back the URL. ship.js consults the marker
+// through runShipGate(): if the tree changed since the last staging, the builder
+// is asked to stage + review again before the claim resolves. On approval (a TTY
+// 'y' or an --approved re-run on a fresh stage) the gate returns a durable
+// self-approval record that ship.js persists on the task (#1048).
 //
-// Usage (a partial clone with no game has no sandbox; the script says so):
+// Usage (a checkout with no game has no sandbox; the script says so):
 //   node scripts/gds/sandbox-stage.js            # stage + print the review URL
 //   node scripts/gds/sandbox-stage.js status     # preview state + is the marker current?
 //   node scripts/gds/sandbox-stage.js url        # just print the sandbox URL
@@ -31,13 +27,10 @@ const path = require('node:path');
 const readline = require('node:readline');
 const localPreview = require('./local-preview-lib');
 
-// /etc/otb/box.env exists ONLY on a provisioned dev box (written by box.js
-// provision, #898) — the idiomatic "am I on a box?" marker in this codebase.
-const BOX_ENV_PATH = '/etc/otb/box.env';
-const PREVIEW_WRAPPER = '/usr/local/bin/box-preview';
-const PREVIEW_UNIT = 'box-game-preview.service';
+// The default health URL waitHealthy probes when a caller supplies none; the
+// local context always passes its own (localPreview.healthUrl).
 const HEALTH_URL = 'http://127.0.0.1:3000/';
-const HEALTH_TIMEOUT_MS = 90_000; // first start may run npm ci (ExecStartPre)
+const HEALTH_TIMEOUT_MS = 90_000; // a cold first start can be slow
 const HEALTH_POLL_MS = 2_000;
 
 // Game surfaces the sandbox can actually show. The sandbox host serves the
@@ -47,17 +40,10 @@ const HEALTH_POLL_MS = 2_000;
 // The GAME CLIENT directories the sandbox renders. These MOVED in the module
 // carve (ADR 0083, BV1.R49 / task 1418): public/ -> modules/game/public/,
 // src/world/ -> modules/game/world/, src/rooms/ -> modules/game/rooms/. The
-// pre-carve spelling sat here matching NOTHING, and staging still reported
-// success because the two entrypoints below kept syncing — so a builder staged,
-// saw 'synced previewable surfaces', and got a sandbox serving whatever client
-// was already on /workspace (task 1002062; found when a new /studio page 404'd).
+// pre-carve spelling sat here matching NOTHING for 69 days (task 1002062), so
+// tests/sandbox_stage.mjs pins the list against the real tree.
 const PREVIEWABLE_DIRS = ['modules/game/public', 'modules/game/world', 'modules/game/rooms'];
-// The single directory the preview serves AT THE URL ROOT: modules/game/public/x
-// is served as /x. pickVerifyTarget maps between the two, so it must be exactly
-// one dir — hence its own constant rather than PREVIEWABLE_DIRS[0].
-const PREVIEWABLE_STATIC_DIR = 'modules/game/public';
-// The entrypoints that render the game. A sparse box (STARTER_SPARSE_PATHS) may
-// legitimately lack these, which is why a miss here is not on its own an error.
+// The entrypoints that render the game.
 const PREVIEWABLE_ENTRYPOINTS = ['server.js', 'src/preview-server.js'];
 // DERIVED, all three of them. They used to be three hand-maintained copies of the
 // same list, and the carve updated none of them; deriving removes the drift class
@@ -66,40 +52,6 @@ const PREVIEWABLE_PREFIXES = PREVIEWABLE_DIRS.map((d) => `${d}/`);
 const PREVIEWABLE_FILES = new Set(PREVIEWABLE_ENTRYPOINTS);
 const PREVIEWABLE_PATHSPECS = [...PREVIEWABLE_DIRS, ...PREVIEWABLE_ENTRYPOINTS];
 
-// On a box, box-game-preview.service has WorkingDirectory=/workspace and serves
-// /workspace/public — the MAIN checkout. A Claude session, though, runs in a git
-// WORKTREE under /workspace/.claude/worktrees/<name>, so its edits never touch
-// /workspace and the sandbox re-served stale code (the #1068 "I don't feel them"
-// bug). We sync the previewable surfaces from the session's branch into this
-// served root before restarting. Kept as a constant so tests can point it at a
-// temp dir.
-const BOX_SERVED_ROOT = '/workspace';
-
-function isDevBox(deps = {}) {
-  const f = deps.fs || fs;
-  return f.existsSync(deps.boxEnvPath || BOX_ENV_PATH);
-}
-
-// Parse BOX_PREVIEW_HOSTNAME out of box.env text. Returns the hostname string
-// or null (a quick-tunnel box has no preview hostname — ADR 0044 §Consequences).
-function readPreviewHostname(envText) {
-  const m = /^\s*(?:export\s+)?BOX_PREVIEW_HOSTNAME=(.*)$/m.exec(String(envText || ''));
-  if (!m) return null;
-  const v = m[1].trim().replace(/^["']|["']$/g, '').trim();
-  return v || null;
-}
-
-function previewUrl(deps = {}) {
-  const f = deps.fs || fs;
-  const p = deps.boxEnvPath || BOX_ENV_PATH;
-  try {
-    const host = readPreviewHostname(f.readFileSync(p, 'utf8'));
-    return host ? `https://${host}` : null;
-  } catch {
-    return null;
-  }
-}
-
 function isPreviewableFile(file) {
   const fp = String(file || '').replace(/\\/g, '/');
   if (PREVIEWABLE_FILES.has(fp)) return true;
@@ -188,34 +140,17 @@ function writeMarker(marker, deps = {}) {
 //                 review URL. The agent relays the URL, the human reviews, and
 //                 the re-run passes on the now-fresh marker. Never hangs on
 //                 stdin; never silently skips the review.
-// gateActive = there IS a sandbox here to review on (a dev box OR a local game
-// preview). The decision is identical for both; only HOW we stage + the URL differ.
+// gateActive = there IS a sandbox here to review on (a local game preview).
 function decideShipGate({ gateActive, previewUrl: url, previewable, stagedFresh, tty, skipStage }) {
   if (skipStage) return { action: 'skip', reason: '--skip-stage' };
-  if (!gateActive) return { action: 'skip', reason: 'no sandbox here (not a dev box; no local game preview)' };
+  if (!gateActive) return { action: 'skip', reason: 'no sandbox here (no local game preview)' };
   if (!previewable) return { action: 'skip', reason: 'no previewable game surfaces in the diff' };
-  if (!url) return { action: 'skip', reason: 'preview has no URL (quick-tunnel box / local preview unavailable)' };
+  if (!url) return { action: 'skip', reason: 'preview has no URL (local preview unavailable)' };
   if (stagedFresh) return { action: 'pass', reason: 'working tree already staged' };
   return tty ? { action: 'review', reason: 'stage + review before ship' }
              : { action: 'stage_abort', reason: 'non-interactive: stage, then pause for review' };
 }
 
-function restartPreview(deps = {}) {
-  const run = deps.execFileSync || execFileSync;
-  const f = deps.fs || fs;
-  // The baked wrapper is the expected path on every box (cloud-init +
-  // box-source-fetch self-heal bake it to /usr/local/bin, and it handles its
-  // own sudo). The raw systemctl branch is only a degraded fallback.
-  if (f.existsSync(deps.previewWrapper || PREVIEW_WRAPPER)) {
-    run(deps.previewWrapper || PREVIEW_WRAPPER, ['restart'], { stdio: 'inherit' });
-    return;
-  }
-  const needSudo = typeof process.getuid === 'function' && process.getuid() !== 0;
-  const cmd = needSudo ? 'sudo' : 'systemctl';
-  const argv = needSudo ? ['-n', 'systemctl', 'restart', PREVIEW_UNIT] : ['restart', PREVIEW_UNIT];
-  run(cmd, argv, { stdio: 'inherit' });
-}
-
 // task 1002607: the discriminator probe URL — same origin as the health URL, at
 // the API healthz path only the FULL server mounts. Pure + exported for tests.
 function apiHealthzProbeUrl(healthUrl) {
@@ -224,9 +159,9 @@ function apiHealthzProbeUrl(healthUrl) {
 
 // task 1002607: is the thing answering the health URL actually the MAIN server?
 // The game-only preview entry (ADR 0052) mounts no /api/bongos, so a 200 from the
-// API healthz proves the answerer is the full server — whose default bind is the
-// SAME 127.0.0.1:3000 the box health check probes — not the preview. A probe
-// error/404 means "not the main server", which is the expected preview answer.
+// API healthz proves the answerer is the full server — which can hold the very
+// port the preview was asked to bind — not the preview. A probe error/404 means
+// "not the main server", which is the expected preview answer.
 async function answeredByMainServer(healthUrl, fetchImpl) {
   const probe = apiHealthzProbeUrl(healthUrl);
   if (!probe) return false;
@@ -268,187 +203,13 @@ async function waitHealthy(deps = {}) {
   return { ok: false, reason: lastErr };
 }
 
-// The git checkout the session is editing. On a box this is a linked worktree
-// under /workspace/.claude/worktrees/<name>; on a laptop it's the clone root.
-// Returns the toplevel path or null (not a repo).
-function sessionCheckoutRoot(deps = {}) {
-  const run = deps.execFileSync || execFileSync;
-  const cwd = deps.cwd || process.cwd();
-  try {
-    return run('git', ['rev-parse', '--show-toplevel'], { cwd, encoding: 'utf8' }).trim() || null;
-  } catch {
-    return null;
-  }
-}
-
-// Box-only (#1068 gap 1): materialize the session worktree's previewable game
-// surfaces into the served checkout (/workspace) so the box preview shows the
-// SESSION's edits, not stale main. The served root and the worktree share one
-// object store (linked worktree), so `git -C /workspace checkout <branch> -- <paths>`
-// brings the branch's committed content for exactly the previewable pathspecs.
-// ship.js preflight already proved the worktree is clean (committed == working
-// tree), so committed content is what the builder means. No-op when the session
-// checkout IS the served root (a box where the builder edits /workspace directly,
-// or a laptop). Returns { ok, synced, reason?, branch? }.
-// Canonicalize a path through symlinks for a same-directory comparison. Needed
-// because `git rev-parse --show-toplevel` (sessionCheckoutRoot) returns the REAL
-// path, while servedRoot may be a symlink — on macOS `/tmp` -> `/private/var`
-// (idea #278), or any symlinked served root. path.resolve does NOT resolve
-// symlinks, so the raw comparison false-negatives "same dir" and the code would
-// wrongly try to git-sync a checkout onto itself. Falls back to path.resolve when
-// the path doesn't exist yet (realpathSync throws ENOENT).
-// On Windows the two sides arrive in different spellings of the same directory:
-// `git rev-parse --show-toplevel` answers with forward slashes and the LONG filename,
-// while a configured servedRoot may be backslashed and 8.3-short (C:\Users\RUNNER~1\…).
-// path.resolve folds the separators and realpathSync.native — unlike realpathSync —
-// expands 8.3, so the comparison is about directories rather than renderings of them.
-// Without both, the same-dir check false-negatived and the box git-synced a checkout
-// onto itself, the very thing this function exists to avoid (task 1003529).
-function realPathOr(p) {
-  try { return fs.realpathSync.native(path.resolve(p)); } catch { return path.resolve(p); }
-}
-
-function syncWorktreeToServed(deps = {}) {
-  const run = deps.execFileSync || execFileSync;
-  const servedRoot = deps.servedRoot || BOX_SERVED_ROOT;
-  const sessionRoot = sessionCheckoutRoot(deps);
-  if (!sessionRoot || realPathOr(sessionRoot) === realPathOr(servedRoot)) {
-    return { ok: true, synced: false, reason: 'session checkout is the served checkout' };
-  }
-  let branch;
-  try {
-    branch = run('git', ['rev-parse', '--abbrev-ref', 'HEAD'], { cwd: sessionRoot, encoding: 'utf8' }).trim();
-  } catch {
-    branch = null;
-  }
-  if (!branch || branch === 'HEAD') {
-    return { ok: false, synced: false, reason: 'could not resolve the session branch (detached HEAD?)' };
-  }
-  // Check out each previewable pathspec INDEPENDENTLY: `git checkout <ref> -- a b c`
-  // fails ENTIRELY if any single pathspec is absent from the ref, and a sparse
-  // box (STARTER_SPARSE_PATHS) may legitimately lack server.js / src/preview-server.js.
-  // Per-pathspec lets us sync what exists and skip what doesn't; verifyServedFresh
-  // is the safety net that catches a sync that didn't actually land. First restore
-  // each path from the served checkout's own HEAD (undo any prior ship's leftovers),
-  // then overlay the session branch's content.
-  let synced = false;
-  let lastErr = null;
-  // task 1002062: this collapsed to a single boolean, so a run that synced ONLY
-  // the entrypoints and missed every client directory reported plain success.
-  // Track them by name — the caller warns on a missed DIRECTORY, which is the
-  // shape a stale pathspec list takes.
-  const missed = [];
-  for (const ps of PREVIEWABLE_PATHSPECS) {
-    try {
-      run('git', ['-C', servedRoot, 'checkout', '--', ps], { stdio: 'ignore' });
-    } catch {
-      /* pathspec absent in the served HEAD — nothing to restore, fine */
-    }
-    try {
-      run('git', ['-C', servedRoot, 'checkout', branch, '--', ps], { stdio: 'ignore' });
-      synced = true;
-    } catch (e) {
-      lastErr = e; // pathspec absent in the branch (sparse/missing) — skip it
-      missed.push(ps);
-    }
-  }
-  if (!synced) {
-    return { ok: false, synced: false, missed, reason: `git checkout ${branch} -- <previewable> in ${servedRoot} synced nothing${lastErr ? ` (${lastErr.message})` : ''}` };
-  }
-  // A missed ENTRYPOINT is normal on a sparse box. A missed client DIRECTORY means
-  // the sandbox is about to serve a client this stage never touched.
-  const missedDirs = missed.filter((m) => PREVIEWABLE_DIRS.includes(m));
-  return { ok: true, synced: true, branch, missed, missedDirs };
-}
-
-// Pick the smallest cheap-to-compare changed previewable static file to verify,
-// and the URL path the preview serves it at (public/game/x.js -> /game/x.js).
-// Returns { relPath, urlPath } or null when there's no served static change.
-function pickVerifyTarget(deps = {}) {
-  const run = deps.execFileSync || execFileSync;
-  const cwd = deps.cwd || process.cwd();
-  const f = deps.fs || fs;
-  try {
-    // task 1002062: this hardcoded 'public' three times, independently of the
-    // constants above, so it kept the pre-carve spelling even after they moved.
-    // Derived from PREVIEWABLE_STATIC_DIR now, so there is one place to change.
-    const staticDir = deps.staticDir || PREVIEWABLE_STATIC_DIR;
-    const prefix = `${staticDir}/`;
-    const out = run('git', ['status', '--porcelain', '--', staticDir], { cwd, encoding: 'utf8' });
-    let chosen = out
-      .split('\n')
-      .map((line) => line.slice(3).replace(/^"|"$/g, '').trim())
-      .find((rel) => rel && rel.startsWith(prefix) && f.existsSync(path.join(cwd, rel)));
-    if (!chosen) {
-      // committed-only change: fall back to the diff vs the frozen origin/main
-      const diff = run('git', ['diff', '--name-only', 'origin/main...HEAD', '--', staticDir], { cwd, encoding: 'utf8' });
-      chosen = diff
-        .split('\n')
-        .map((s) => s.trim())
-        .find((p) => p.startsWith(prefix) && f.existsSync(path.join(cwd, p)));
-    }
-    if (!chosen) return null;
-    return { relPath: chosen, urlPath: '/' + chosen.slice(prefix.length) };
-  } catch {
-    return null;
-  }
-}
-
-// Box-only (#1068 gap 1b): after staging, fetch one changed static file from the
-// RUNNING preview over loopback (bypasses Cloudflare + browser cache, so it
-// proves the SERVER is fresh) and confirm it byte-matches the worktree. Returns
-// { ok, verified?|skipped?, reason? }. A mismatch means the sandbox is serving
-// stale code despite the restart — fail loudly.
-async function verifyServedFresh(deps = {}) {
-  const fetchImpl = deps.fetchImpl || fetch;
-  const f = deps.fs || fs;
-  const cwd = deps.cwd || process.cwd();
-  const base = (deps.healthUrl || HEALTH_URL).replace(/\/$/, '');
-  const target = pickVerifyTarget(deps);
-  if (!target) return { ok: true, skipped: true, reason: `no served static change to verify (e.g. only ${PREVIEWABLE_DIRS.filter((d) => d !== PREVIEWABLE_STATIC_DIR).join(' or ')} changed)` };
-  let want;
-  try {
-    want = f.readFileSync(path.join(cwd, target.relPath), 'utf8');
-  } catch {
-    return { ok: true, skipped: true, reason: 'could not read the worktree file to compare' };
-  }
-  try {
-    const res = await fetchImpl(`${base}${target.urlPath}`, {
-      headers: { 'Cache-Control': 'no-cache' },
-      signal: AbortSignal.timeout(5_000),
-    });
-    if (res.status >= 400) return { ok: false, reason: `preview returned HTTP ${res.status} for ${target.urlPath}` };
-    const got = await res.text();
-    if (got === want) return { ok: true, verified: target.relPath };
-    return { ok: false, reason: `served ${target.urlPath} does NOT match your worktree ${target.relPath} — the sandbox is serving stale code` };
-  } catch (e) {
-    return { ok: false, reason: `could not fetch ${target.urlPath} from the running preview to verify freshness: ${e.message}` };
-  }
-}
-
-// Which sandbox does this machine have? A box (ADR 0044) is keyed by ANY box
-// marker (localPreview.onBox: box.env, the box-preview wrapper, or the
-// box-game-preview.service unit — broader than box.env alone so a box with a
-// lost/unreadable box.env is STILL routed to the box branch, never to localhost
-// — task 1443); a full LOCAL clone (task 1056) is keyed by the presence of the
-// game-only entry (src/preview-server.js). Returns a uniform context
-// { kind, url, healthUrl, restart(deps) } — or null when there is NO sandbox
-// here (a partial clone with no game). On a box the url comes from box.env's
-// BOX_PREVIEW_HOSTNAME; if that's missing the url is null and stage() returns a
-// clear "no sandbox hostname" message — but it is NEVER a localhost URL the
-// builder's browser can't reach. deps.previewContext short-circuits for
-// hermetic tests. The box branch is checked FIRST: a box also has the game
-// entry, so order is what keeps onBox from being shadowed by hasGameEntry.
+// Which sandbox does this machine have? A full LOCAL clone (task 1056) is keyed by
+// the presence of the game-only entry (src/preview-server.js). Returns a uniform
+// context { kind, url, healthUrl, restart(deps) } — or null when there is NO
+// sandbox here (a checkout with no game). deps.previewContext short-circuits for
+// hermetic tests.
 function resolvePreviewContext(deps = {}) {
   if (deps.previewContext !== undefined) return deps.previewContext;
-  if (localPreview.onBox(deps)) {
-    return {
-      kind: 'box',
-      url: previewUrl(deps),
-      healthUrl: HEALTH_URL,
-      restart: (d) => restartPreview(d),
-    };
-  }
   if (localPreview.hasGameEntry(deps)) {
     return {
       kind: 'local',
@@ -466,37 +227,9 @@ function resolvePreviewContext(deps = {}) {
 // answer, write the staged marker. Returns { ok, url, kind, reason? }.
 async function stage({ taskId } = {}, deps = {}) {
   const ctx = resolvePreviewContext(deps);
-  if (!ctx) return { ok: false, reason: 'no sandbox here (not a dev box, and this clone has no local game preview)' };
-  if (!ctx.url) {
-    return { ok: false, reason: ctx.kind === 'box'
-      ? 'no sandbox hostname on this box — box.env has no BOX_PREVIEW_HOSTNAME (a quick-tunnel box, or box.env is missing/unreadable). Run `box-preview status` for your URL, or ask the operator to re-provision with BOX_NAMED_TUNNEL=1 (ADR 0044). NOT a localhost link — that is unreachable from your browser on a box.'
-      : 'local preview URL unavailable' };
-  }
-  console.log(ctx.kind === 'local'
-    ? 'Staging your working tree on your local sandbox (starting the game preview)...'
-    : 'Staging your working tree on the sandbox (syncing your worktree, then restarting the game preview)...');
-  // #1068 gap 1: a box serves /workspace, not the session worktree. Sync the
-  // previewable surfaces from the branch into /workspace BEFORE the restart so
-  // the preview picks up the SESSION's edits. hard:true → the ship gate aborts
-  // (a stale sandbox review is worse than no review). Local already serves the
-  // worktree, so this is box-only.
-  if (ctx.kind === 'box') {
-    const sync = (deps.syncWorktreeToServed || syncWorktreeToServed)(deps);
-    if (!sync.ok) {
-      return { ok: false, hard: true, reason: `could not sync your worktree to the served checkout (${sync.reason}); the sandbox would show stale ${deps.servedRoot || BOX_SERVED_ROOT} code` };
-    }
-    if (sync.synced) console.log(`  synced previewable surfaces from ${sync.branch} into ${deps.servedRoot || BOX_SERVED_ROOT}`);
-    // task 1002062 — the tell that went unsaid for 69 days. Staging "succeeded"
-    // while every game-client directory matched nothing, so the sandbox served a
-    // client the stage never touched and the only hint was a freshness-verify skip.
-    if (sync.missedDirs && sync.missedDirs.length) {
-      console.warn(
-        `  ⚠ these previewable directories matched NOTHING in ${sync.branch}: ${sync.missedDirs.join(', ')}`
-        + ' — the sandbox will serve whatever client is already on the served checkout.'
-        + ' If this repo carved or renamed them, PREVIEWABLE_DIRS in sandbox-stage.js is stale.'
-      );
-    }
-  }
+  if (!ctx) return { ok: false, reason: 'no sandbox here (this checkout has no local game preview)' };
+  if (!ctx.url) return { ok: false, reason: 'local preview URL unavailable' };
+  console.log('Staging your working tree on your local sandbox (starting the game preview)...');
   try {
     ctx.restart(deps);
   } catch (e) {
@@ -504,19 +237,7 @@ async function stage({ taskId } = {}, deps = {}) {
   }
   const health = await waitHealthy({ ...deps, healthUrl: ctx.healthUrl });
   if (!health.ok) {
-    const where = ctx.kind === 'local' ? 'node scripts/gds/local-preview.js logs' : 'box-preview logs';
-    return { ok: false, reason: `preview did not come up healthy (${health.reason}) — check '${where}'` };
-  }
-  // #1068 gap 1b: confirm the restarted box preview is actually serving the
-  // synced bytes (loopback fetch, cache-bypassed). A mismatch is a hard fail —
-  // claiming "staged" when the sandbox shows stale code is the bug we're killing.
-  if (ctx.kind === 'box') {
-    const v = await (deps.verifyServedFresh || verifyServedFresh)({ ...deps, healthUrl: ctx.healthUrl });
-    if (!v.ok) {
-      return { ok: false, hard: true, reason: `staged but FAILED freshness verification: ${v.reason}` };
-    }
-    if (v.verified) console.log(`  verified the sandbox is serving your edits (${v.verified} matches)`);
-    else if (v.skipped) console.log(`  freshness verify skipped (${v.reason})`);
+    return { ok: false, reason: `preview did not come up healthy (${health.reason}) — check 'node scripts/gds/local-preview.js logs'` };
   }
   writeMarker({
     stamp: computeTreeStamp(deps),
@@ -544,8 +265,8 @@ function promptYesNo(question) {
 // to present the URL as its own callout in chat. Keep the URL ALONE on its own
 // line, framed by a rule, so it stands out from the surrounding log noise and
 // stays clickable. This is the moment the change is "ready to review", so the
-// link has to be impossible to miss. Works for a box (sandbox-<login>) or a
-// local clone (http://localhost:<port>) — the URL is passed in.
+// link has to be impossible to miss. The URL (http://localhost:<port>) is
+// passed in.
 function printReviewBlock(url, taskId) {
   const bar = '─'.repeat(64);
   console.log('');
@@ -563,8 +284,7 @@ function printReviewBlock(url, taskId) {
 
 // Build the recorded-approval payload ship.js threads into the resolve call
 // (#1048). The server stamps `by`/`at` authoritatively — we only supply the
-// content stamp of what was reviewed, the sandbox URL (box OR local), and HOW
-// it was approved.
+// content stamp of what was reviewed, the sandbox URL, and HOW it was approved.
 function approvalRecord(method, url, deps) {
   return { stamp: computeTreeStamp(deps), url, method };
 }
@@ -573,8 +293,7 @@ function approvalRecord(method, url, deps) {
 // Returns { ok: true } to proceed or { ok: false, reason } to abort the ship
 // with the claim still active so the builder can iterate. On a recorded
 // approval it also returns { sandboxReview } so ship.js can persist the
-// self-approval as a durable fact on the task (#1048) — for a box or a local
-// clone (task 1056).
+// self-approval as a durable fact on the task (#1048).
 //
 // `approved` (the --approved flag) records the builder's sign-off, but ONLY
 // when the current game state is already staged-fresh (decideShipGate → 'pass')
@@ -616,18 +335,7 @@ async function runShipGate({ taskId, files, skipStage, tty, approved }, deps = {
   // Reuse the already-resolved context so we don't resolve it twice.
   const staged = await stage({ taskId }, { ...deps, previewContext: ctx });
   if (!staged.ok) {
-    // #1068: a HARD failure (couldn't sync the worktree to the served checkout,
-    // or the preview verifiably served stale code) means a review here would be
-    // a LIE — abort with the claim intact so the builder fixes it.
-    if (staged.hard) {
-      return {
-        ok: false,
-        review: true,
-        url: staged.url,
-        reason: `sandbox staging could not be trusted (${staged.reason}) — fix it, then re-run /builder-ship (or --skip-stage to bypass the review). Your claim is still active`,
-      };
-    }
-    // task 1002607 (§4.4 station 9): a SOFT failure (the preview didn't come up)
+    // task 1002607 (§4.4 station 9): a staging failure (the preview didn't come up)
     // used to WARN one stderr line and return ok — the review gate silently
     // turned itself off and the ship went on as if the review had happened.
     // Fail closed like the smoke gate (task 1002605): abort with the claim
@@ -672,7 +380,7 @@ async function runShipGate({ taskId, files, skipStage, tty, approved }, deps = {
 // (the ADR 0052 game-only server); the core repo does not ship one. Name what is
 // actually missing and both real causes. Exported so the wording is pinned.
 const NO_SANDBOX_MSG =
-  'No sandbox here: this machine is not a dev box, and this checkout has no game preview entry (src/preview-server.js — the ADR 0052 game-only server).';
+  'No sandbox here: this checkout has no game preview entry (src/preview-server.js — the ADR 0052 game-only server).';
 const NO_SANDBOX_DETAIL =
   'That entry file comes from an instance\'s product layer. This repo does not ship one, and a partial/sparse clone of an instance that has one also lacks it — nothing here can be staged or previewed.';
 
@@ -682,7 +390,7 @@ async function cliMain() {
   const NO_SANDBOX = NO_SANDBOX_MSG;
 
   if (cmd === 'url') {
-    console.log(ctx && ctx.url ? ctx.url : '(no sandbox here — not a dev box, and no local game preview in this clone)');
+    console.log(ctx && ctx.url ? ctx.url : '(no sandbox here — no local game preview in this checkout)');
     return;
   }
   if (cmd === 'status') {
@@ -691,7 +399,7 @@ async function cliMain() {
     const stamp = computeTreeStamp();
     const fresh = Boolean(stamp && marker && marker.stamp === stamp);
     console.log(`sandbox kind:   ${ctx.kind}`);
-    console.log(`sandbox URL:    ${ctx.url || '(none — quick-tunnel box)'}`);
+    console.log(`sandbox URL:    ${ctx.url || '(none)'}`);
     if (ctx.kind === 'local') {
       console.log(`local preview:  ${localPreview.isRunning() ? `running (pid ${localPreview.readPid()})` : 'stopped — staging will start it'}`);
     }
@@ -723,9 +431,6 @@ async function cliMain() {
 }
 
 module.exports = {
-  isDevBox,
-  readPreviewHostname,
-  previewUrl,
   isPreviewableFile,
   anyPreviewable,
   computeTreeStamp,
@@ -737,16 +442,9 @@ module.exports = {
   resolvePreviewContext,
   stage,
   runShipGate,
-  BOX_ENV_PATH,
-  BOX_SERVED_ROOT,
   PREVIEWABLE_PATHSPECS,
   PREVIEWABLE_DIRS,
   PREVIEWABLE_ENTRYPOINTS,
-  PREVIEWABLE_STATIC_DIR,
-  sessionCheckoutRoot,
-  syncWorktreeToServed,
-  pickVerifyTarget,
-  verifyServedFresh,
   // task 1002607: the health truth table + the honest no-sandbox wording, pinned.
   waitHealthy,
   apiHealthzProbeUrl,