@bongos/core 1.19.1073 → 1.19.1075

package/scripts/gds/session-digest-build.js

@@ -155,7 +155,7 @@ function buildSessionDigest(entries, opts = {}) {
         mu.input += tin; mu.output += tout; mu.cache_read += tcr; mu.cache_creation += tcc;
       } else {
         // task 1676: a token-bearing turn with NO model id. Previously dropped
-        // from model_usage (→ total_tokens>0 but priced $0 on the dev-box/CI
+        // from model_usage (→ total_tokens>0 but priced $0 on the CI
         // path; ADR 0097). Accumulate the unlabeled tokens so the digest can
         // attribute them to a real, priceable family bucket after the loop.
         m._unlabeled.input += tin; m._unlabeled.output += tout;
@@ -233,7 +233,7 @@ function buildSessionDigest(entries, opts = {}) {
   m.total_tokens = m.tokens.input + m.tokens.output + m.tokens.cache_read + m.tokens.cache_creation;
   // task 1676 — cost-plus reward zero-out fix. The cost-plus session reward
   // (ADR 0054) prices `model_usage` server-side. model_usage is keyed on msg.model
-  // and SKIPS any token-bearing turn whose model id is missing. On the dev-box/CI
+  // and SKIPS any token-bearing turn whose model id is missing. On the CI
   // agent path that gap was the difference between total_tokens>0 (so the digest
   // passes the route's empty-session guard + gets stored) and model_usage={} (so
   // priceModelUsage returns $0 → 0 drachmae) — ADR 0097's "upload no priced model

package/scripts/gds/ship-deploy-target.js

@@ -32,7 +32,7 @@ const { REPO_ROOT } = require('./ship-state.js');
 //      `bongos upgrade` (pin-bump), NOT an SSH deploy (ADR 0108). When a target IS
 //      set it requires that host's SSH key, so only the operator can land.
 //
-//   'ci' — NO builder box holds the prod key. ship pushes the branch, opens a
+//   'ci' — NO builder machine holds the prod key. ship pushes the branch, opens a
 //      PR, and enables GitHub auto-merge; once required checks pass, GitHub
 //      merges to main and .github/workflows/deploy-prod.yml deploys from
 //      Actions. ship then CONFIRMS the deploy landed (PR merged + the
@@ -62,8 +62,8 @@ function parseDeployMode(envVal, configRaw) {
 // effectiveDeployMode — credential- and protection-aware adjustment of the parsed
 // mode (pure; exported for the regression test). The 'laptop' land path pushes
 // main + SSHes the droplet FROM THIS MACHINE, so it requires a local GitHub push
-// credential. A machine without one — a dev box, or a fresh/stale local clone that
-// can't even `git pull` (token-less origin, ADR 0053) — physically cannot run it;
+// credential. A machine without one — a fresh/stale local clone that can't
+// even `git pull` (token-less origin, ADR 0053) — physically cannot run it;
 // it must ship via the 'ci' server-mediated publish path instead
 // (pushVia()==='server', ADR 0055), which lets the GDS server push with its own
 // credential. So when the parsed mode is 'laptop' but the machine can't push
@@ -314,10 +314,10 @@ function fetchDeployedVersion(url = deployedVersionUrl()) {
 // pushVia — which publish path ship uses in 'ci' mode (ADR 0055 / task 1025):
 //   'local'  — this machine pushes the branch + opens the PR with git + gh
 //              (laptop: gh present + authenticated). Today's behaviour.
-//   'server' — this machine has NO GitHub push credential (a dev box: no gh, a
+//   'server' — this machine has NO GitHub push credential (no gh, a
 //              credential-less origin). ship uploads a thin branch bundle to the
 //              GDS, which pushes + opens the PR + auto-merges with the SERVER's
-//              credential. The box holds nothing (#919 model preserved).
+//              credential. This machine holds nothing (#919 model preserved).
 // Override with <PREFIX>_PUSH_VIA_SERVER=1 (force server) / =0 (force local) for tests.
 function ghAvailableAndAuthed() {
   try {
@@ -338,15 +338,15 @@ function pushVia() {
   if (o === '1') return 'server';
   if (o === '0') return 'local';
   // No explicit override: a machine that can run an authenticated gh (laptop)
-  // takes the local path; everything else (a dev box) goes server-mediated.
+  // takes the local path; everything else goes server-mediated.
   return ghAvailableAndAuthed() ? 'local' : 'server';
 }
 
 // broadcastHandledByServer — task 1045: on the server-mediated publish path the
 // SERVER posts the Discord ship-broadcast after it confirms the deploy (it holds
-// the webhook secrets; the box does NOT — ADR 0053). So ship.js must NOT also post
-// locally there, or the box would either double-post (impossible — no secret) or,
-// as before, fail silently. True only when the publish actually goes server-side:
+// the webhook secrets; the local machine does NOT — ADR 0053). So ship.js must NOT
+// also post locally there, or this machine would either double-post (impossible — no
+// secret) or, as before, fail silently. True only when the publish actually goes server-side:
 // ci deploy mode AND this machine has no GitHub push credential (pushVia 'server').
 // The laptop path (pushVia 'local') keeps posting locally, exactly as today. Pure
 // w.r.t. its inputs (env + committed deploy.json) + exported so the gate is tested.
@@ -355,12 +355,12 @@ function broadcastHandledByServer() {
 }
 
 // shouldBailOnFetchFailure — autoMerge's decision when `git fetch origin main`
-// fails. A credential-less dev box (private origin, scrubbed clone token —
+// fails. A credential-less checkout (private origin, no creds —
 // ADR 0053) CANNOT fetch origin, and that is FINE for the server-mediated
-// publish path (ADR 0055): ciLandServer bundles against the box's LOCAL
+// publish path (ADR 0055): ciLandServer bundles against this machine's LOCAL
 // origin/main and the SERVER tops up main with its own credential. So a fetch
-// failure is fatal ONLY when we are NOT taking that path — otherwise the box can
-// never reach ciLand and strands every ship at confirmed (the bug task 1027
+// failure is fatal ONLY when we are NOT taking that path — otherwise such a
+// machine can never reach ciLand and strands every ship at confirmed (the bug task 1027
 // surfaced: ADR 0055 shipped the server path but left this fetch guard in front
 // of it). Pure + exported for the regression test (no git, no network).
 // NOTE: callers must still guard the pushVia() gh-probe behind `!fetchedMain` so

package/scripts/gds/ship-flow.js

@@ -318,7 +318,7 @@ async function shipMain() {
 
   // ---- Module drift check (BV1.R53, task 1422) ----
   // If the task carries a module_key, verify the committed diff doesn't stray
-  // into a DIFFERENT module's territory. "You said game, you touched dev-box" is
+  // into a DIFFERENT module's territory. "You said game, you touched provisioning" is
   // the semantic violation this catches. Files no module owns are allowed —
   // they're cross-cutting — as is the territory of a CROSS-CUTTING module, which
   // every craft legitimately writes into. Only contact with a different OWNING
@@ -365,11 +365,11 @@ async function shipMain() {
   }
 
   // ---- Sandbox-first review gate (#927, ADR 0046) ----
-  // On a dev box, a diff that touches game surfaces must be STAGED on the
-  // builder's own live preview (sandbox-<login>.example.com, ADR 0044)
+  // On a clone that carries the game preview, a diff that touches game
+  // surfaces must be STAGED on the builder's own local preview (ADR 0044)
   // and reviewed in a browser before the claim resolves — see it running,
-  // get the chance to iterate, THEN decide to ship to the main game. Laptop
-  // sessions, non-game diffs, quick-tunnel boxes, and --skip-stage all pass
+  // get the chance to iterate, THEN decide to ship to the main game. A
+  // checkout with no game preview, non-game diffs, and --skip-stage all pass
   // through untouched. Interactive: stage + ask; declining aborts with the
   // claim intact. Non-TTY (agent-driven sessions): stage, then abort with the
   // review URL — the re-run after the human reviews passes on the fresh
@@ -425,8 +425,8 @@ async function shipMain() {
   }
   // #1048: the recorded sandbox self-approval (when the builder approved a
   // staged game change), threaded into the resolve call below so the server
-  // persists it on the task. null on laptop ships, non-game diffs, quick-tunnel
-  // boxes, --skip-stage, and bare fresh-marker re-runs without --approved.
+  // persists it on the task. null on a checkout with no game preview, non-game
+  // diffs, --skip-stage, and bare fresh-marker re-runs without --approved.
   const sandboxReview = sandboxGate.sandboxReview || null;
 
   // ---- Step 1+2: verify locally (smoke) — runs AFTER the review gate (#1061) ----

package/scripts/gds/ship-land.js

@@ -172,10 +172,9 @@ function formatPublishFailure(data, status, branch, opts = {}) {
   return out;
 }
 
-// ciLandServer — the dev-box path: no GitHub push credential on this machine, so
-// hand the branch to the GDS, which pushes it + opens the PR + auto-merges with
-// the server-side credential. Requires a RE-AUTHED (non-box) cli session — a
-// box-scoped session is 403'd by the endpoint (it must `/builder-reauth` first).
+// ciLandServer — the server-mediated path: no GitHub push credential on this
+// machine, so hand the branch to the GDS, which pushes it + opens the PR +
+// auto-merges with the server-side credential. Needs an ordinary cli session.
 async function ciLandServer(taskId, branch, valueSummary, { hold = false } = {}) {
   console.log('  ci-land: server-mediated publish (this machine has no GitHub push credential)');
   const headSha = gitOk('git rev-parse HEAD');
@@ -275,11 +274,11 @@ function reconciledCardStatus(liveStatus, preMergeStatus) {
   return liveStatus === 'shipped' ? 'shipped' : preMergeStatus;
 }
 
-// task 1052 (E): the box-appropriate next step when a ship lands the task at
-// 'confirmed' without finishing. A dev box (pushVia 'server' — no authed gh)
-// CANNOT run /merge-mode (it needs gh + a main checkout), so the old "for
-// /merge-mode" advice was a dead end ON A BOX (the #1027 retrospective: the agent
-// had to reverse-engineer recovery from source). Point a box at the resume
+// task 1052 (E): the machine-appropriate next step when a ship lands the task at
+// 'confirmed' without finishing. A machine with no push credential (pushVia 'server' —
+// no authed gh) CANNOT run /merge-mode (it needs gh + a main checkout), so the old
+// "for /merge-mode" advice was a dead end there (the #1027 retrospective: the agent
+// had to reverse-engineer recovery from source). Point such a machine at the resume
 // instead (task 941); a laptop keeps /merge-mode (with resume as the alternative).
 // Pure + exported for unit tests.
 function strandNextStep(taskId, via) {
@@ -372,7 +371,7 @@ function prAssigneeLine(login) {
 }
 
 // task 1003988 — what to tell a builder while their PR sits RED. The poll used to
-// wait out its nine minutes in silence, so a credential-less box learned only that
+// wait out its nine minutes in silence, so a credential-less checkout learned only that
 // the land was "pending" and pushed the same commit again (PR 922: nine red runs).
 // `md` is publish-status's merge_driver; null means nothing red to report. Pure +
 // exported so the wording is pinned by tests/unit_report_status.mjs.

package/scripts/gds/ship-merge.js

@@ -103,7 +103,7 @@ function regenerateShipArtifacts() {
   regenerateCopyInventory();
   // Refresh the generated OpenAPI spec + API reference from the shipped route tree (task 1918).
   regenerateApiDocs();
-  // ...then the typed client FROM that spec (+ the devbox vendored copy) on the same beat (task 2051).
+  // ...then the typed client FROM that spec on the same beat (task 2051).
   regenerateApiClient();
 }
 
@@ -168,10 +168,10 @@ async function mergeLocally(taskId, valueSummary, { dbOnly = false } = {}) {
   // nothing to push, merge, or deploy. Short-circuit so the caller's POST
   // /tasks/:id/ship still flips status to shipped instead of stranding the
   // task at confirmed forever.
-  // A credential-less dev box can't `git fetch origin main` (private origin, no
+  // A credential-less checkout can't `git fetch origin main` (private origin, no
   // creds — ADR 0053), but that's only fatal OFF the server-publish path: the
-  // box's ADR-0055 path bundles against its LOCAL origin/main and the server tops
-  // up main. Without this, the box dead-ends here and strands every ship at
+  // ADR-0055 path bundles against its LOCAL origin/main and the server tops
+  // up main. Without this, such a checkout dead-ends here and strands every ship at
   // confirmed (task 1027). The `!fetchedMain &&` short-circuit keeps the gh-probe
   // (pushVia) off the happy laptop path, so laptop behavior is byte-for-byte.
   const fetchedMain = shellOk('git fetch origin main');

package/scripts/gds/ship-preflight-steps.js

@@ -238,22 +238,22 @@ function decidePreMerge({ branch, behind, via }) {
   if (!branch || branch === 'main' || branch === 'HEAD') {
     return { action: 'skip', reason: `not on a feature branch (${branch})` };
   }
-  // Server-mediated publish (ADR 0055): a credential-less partial-clone dev box
+  // Server-mediated publish (ADR 0055): a credential-less partial-clone checkout
   // (blob:none, HTTPS origin, no gh/credential-helper — ADR 0053) CANNOT run a
   // local `git merge origin/main` — the ort merge lazily fetches main's blobs
   // from the promisor remote and there are no credentials to authenticate that
-  // fetch, so the box strands here and can never ship while behind main, i.e.
+  // fetch, so such a checkout strands here and can never ship while behind main, i.e.
   // ≈always (idea #364). It also does not NEED to: ciLandServer bundles
   // `origin/main..HEAD` and the SERVER reconciles the branch with the real main
   // when it pushes + opens + auto-merges the PR; a genuine conflict surfaces
   // server-side as merge_conflict (publish-reconciler / conflict-resolve,
   // ADR 0082). The local pre-merge (#1068) is a LAPTOP-path optimization (so the
   // sandbox-reviewed tree == the shipped tree); it stays exactly as-is there
-  // (via 'local'/undefined) and is simply skipped on the box.
+  // (via 'local'/undefined) and is simply skipped on the server path.
   if (via === 'server') {
     return {
       action: 'skip',
-      reason: 'server-mediated publish reconciles with origin/main server-side (credential-less partial-clone box cannot fetch main blobs locally — idea #364)',
+      reason: 'server-mediated publish reconciles with origin/main server-side (credential-less partial-clone checkout cannot fetch main blobs locally — idea #364)',
     };
   }
   if (!Number.isFinite(behind) || behind === 0) {

package/scripts/gds/ship-regen.js

@@ -8,7 +8,6 @@
 
 'use strict';
 
-const fs = require('node:fs');
 const path = require('node:path');
 const { gitOk, shellOk } = require('./ship-git.js');
 const { pushVia } = require('./ship-deploy-target.js');
@@ -27,21 +26,21 @@ function currentBranch() {
 //
 // Returns a status string ('skipped-server' | 'regen-failed' | 'current' |
 // 'committed' | 'committed-nofatal') so the regression test (task 1046) can
-// prove the dev-box skip without git or a headless browser.
+// prove the server-publish skip without git or a headless browser.
 function regenerateDiagrams() {
-  // task 1046: on the server-mediated-publish path (a dev box — pushVia 'server'),
+  // task 1046: on the server-mediated-publish path (pushVia 'server'),
   // there is no headless browser, so render-diagrams.sh fails and gen-diagrams.js
   // exits non-zero AFTER writing the regenerated .mmd + assertions.json — which
   // shellOk() then treats as a failed regen and returns BEFORE the commit below,
   // leaving those files UNCOMMITTED in the builder's tree (had to be reverted by
-  // hand). The box must not attempt the regen at all: skip here and let a
+  // hand). That path must not attempt the regen at all: skip here and let a
   // render-capable ship (the laptop path, which CAN render the PNGs) refresh them
   // as a matched .mmd+.png+assertions set; the diagram-drift routine backstops any
   // staleness in the meantime. Skipping entirely (vs --no-render) avoids committing
   // a .mmd/.png mismatch to main. Mirrors gen-diagrams.js's own non-fatal skip when
   // bash itself is absent (ENOENT).
   if (pushVia() === 'server') {
-    console.log('  diagram regen skipped on the dev-box ship path (no GDS session for the conceptual diagrams) — a full-clone ship refreshes the .mmd; drift checker backstops staleness');
+    console.log('  diagram regen skipped on the server-publish ship path (no GDS session for the conceptual diagrams) — a full-clone ship refreshes the .mmd; drift checker backstops staleness');
     return 'skipped-server';
   }
   // ADR 0110 pt.3 (task 2027): the .svg/.png RENDERS are now gitignored and
@@ -75,7 +74,7 @@ function regenerateDiagrams() {
 
 // task 1224 (Path B / ADR 0063): refresh the generated symbol skeleton from the shipped tree so the
 // altitude map can't drift. Pure JS (no headless browser, no render) — unlike the diagrams it is safe
-// on EVERY ship path, including the dev-box server-publish path. Non-fatal: a hiccup must never block
+// on EVERY ship path, including the server-publish path. Non-fatal: a hiccup must never block
 // a ship. ADR 0110 (task 1926): docs/repo-map.md is now GITIGNORED + regenerated at deploy — the
 // generator still WRITES it (untracked, harmless), but ship commits ONLY the tracked nested-doc
 // blocks. It is deliberately absent from the git add/status lists below: `git add <ignored path>`
@@ -102,12 +101,12 @@ function regenerateRepoMap() {
 
 // Refresh the generated session-log index (docs/session-log-index.md) + the bounded CLAUDE.md §13
 // "recent sessions" snippet from the shipped tree's docs/session-logs/*.md (ADR 0062 §8, task 1226).
-// Pure JS (reads files, no DB, no headless browser) — safe on EVERY ship path including the dev-box
+// Pure JS (reads files, no DB, no headless browser) — safe on EVERY ship path including the
 // server-publish path. Non-fatal: a hiccup must never block a ship; the Path-C CI gate
 // (`gen-session-index --check`) backstops staleness on main.
 // Refresh the generated API docs (docs/api/openapi.json + docs/api-reference.md +
 // docs/routes-permissions.md) from the shipped route tree (task 1918). Pure JS (reads
-// route files, no DB, no headless browser) — safe on EVERY ship path incl. the dev-box
+// route files, no DB, no headless browser) — safe on EVERY ship path incl. the
 // server-publish path. Non-fatal: a hiccup must never block a ship; the fitness
 // `gen-api-docs --check` gate backstops staleness on main.
 function regenerateApiDocs() {
@@ -130,27 +129,14 @@ function regenerateApiDocs() {
 }
 
 // Refresh the generated typed client (clients/bongos-client) FROM the just-regenerated
-// spec, then keep the devbox vendored CJS copy in lockstep (task 2051). Runs right
-// after regenerateApiDocs so the client reflects the same route tree. Automatic here
+// spec (task 2051). Runs right after regenerateApiDocs so the client reflects the
+// same route tree. Automatic here
 // (not fail-if-forgotten): before this, ship regenerated the spec but not the client,
 // so a route change left the client stale until the api_client test caught it in CI.
 // Non-fatal + safe on every ship path; the api_client freshness test backstops main.
 
-// Where the devbox Electron app vendors the CJS client (ADR 0045). It lives inside the
-// dev-box MODULE (ADR 0145) — an instance that ships without that module has no copy.
-const VENDORED_CLIENT_REL = 'modules/dev-box/app/src/vendor/bongos-client.cjs';
-
-// The git pathspec for the regenerated client. Pure + exported so the rule is unit-tested
-// with no git/fs (task 1002417). `git status` tolerates an unmatched pathspec (exit 0) but
-// `git add` aborts the ENTIRE staging step (exit 128), which leaves the regenerated client
-// unstaged and the worktree dirty — and a dirty worktree makes the ship's auto-merge bail,
-// stranding the task at `confirmed` with no PR. So the vendored copy is named ONLY when it
-// is actually on disk.
-function apiClientPathspec({ worktreeRoot, existsSync = fs.existsSync } = {}) {
-  const paths = ['clients/bongos-client'];
-  if (existsSync(path.join(worktreeRoot, VENDORED_CLIENT_REL))) paths.push(VENDORED_CLIENT_REL);
-  return paths;
-}
+// The regenerated client's git pathspec: the one directory the generator writes.
+const API_CLIENT_PATHSPEC = 'clients/bongos-client';
 
 function regenerateApiClient() {
   console.log('  regenerating typed API client (clients/bongos-client) from the OpenAPI spec...');
@@ -158,31 +144,13 @@ function regenerateApiClient() {
     console.log('  api-client regen failed (non-fatal) — CI api_client freshness test backstops staleness');
     return 'regen-failed';
   }
-  // The devbox Electron app can't require() clients/ at runtime, so it vendors the CJS
-  // build (ADR 0045); keep the copy byte-identical (the api_client test asserts it).
-  // Present only where the dev-box module ships — an instance without it has no vendored
-  // copy, so both the vendor step and the git pathspec below drop out (task 1002417: the
-  // app moved from top-level devbox-app/ to modules/dev-box/app/ per ADR 0145, and these
-  // paths were not updated, so the guard below silently never fired).
-  // Resolve it WORKTREE-LOCALLY (like the generator above, __dirname=scripts/gds), NOT
-  // via REPO_ROOT: on a ship from a linked worktree REPO_ROOT is the MAIN checkout, so a
-  // REPO_ROOT path would vendor the main tree while gen-api-client just wrote THIS tree,
-  // leaving this worktree's vendored copy stale → the api_client byte-identity test reds
-  // the PR (task 2060 fix). __dirname keeps the generator, the vendored file, and the
-  // git add all on the same tree.
-  const worktreeRoot = path.join(__dirname, '..', '..');
-  const vendorScript = path.join(worktreeRoot, 'modules', 'dev-box', 'app', 'scripts', 'vendor-client.js');
-  if (fs.existsSync(vendorScript)) {
-    shellOk(`"${process.execPath}" ${JSON.stringify(vendorScript)}`);
-  }
-  const clientPathspec = apiClientPathspec({ worktreeRoot }).join(' ');
-  const dirty = gitOk(`git status --porcelain ${clientPathspec}`);
+  const dirty = gitOk(`git status --porcelain ${API_CLIENT_PATHSPEC}`);
   if (!dirty) {
     console.log('  API client already current — nothing to commit');
     return 'current';
   }
-  shellOk(`git add ${clientPathspec}`);
-  if (shellOk('git commit -m "chore(api-client): auto-regenerate typed client + devbox vendor (task 2051)"')) {
+  shellOk(`git add ${API_CLIENT_PATHSPEC}`);
+  if (shellOk('git commit -m "chore(api-client): auto-regenerate typed client (task 2051)"')) {
     console.log('  committed auto-regenerated API client');
     return 'committed';
   }
@@ -215,7 +183,7 @@ function regenerateSessionIndex() {
 // Refresh the generated file-map sections (.claude/skills/ + .claude/scheduled-tasks/ trees in
 // docs/file-map.md) from what is on disk (ADR 0066, task 1276). Pure JS (reads dirs + the
 // docs/file-map.notes.json sidecar, no DB, no headless browser) — safe on EVERY ship path including
-// the dev-box server-publish path. Non-fatal: a hiccup must never block a ship; the Path-C CI gate
+// the server-publish path. Non-fatal: a hiccup must never block a ship; the Path-C CI gate
 // (`gen-file-map --check`, in fitness.js) backstops staleness on main. NB gen-file-map exits 2 when
 // a skill/routine has no note, so shellOk may report "failed" on a legit note-gap ship — that is
 // fine, we still commit whatever it wrote and CI surfaces the missing note.
@@ -333,8 +301,6 @@ function mainWorktreeBusy() {
 //                   (uncommitted work / wrong branch / empty touches[]); refuse.
 
 module.exports = {
-  VENDORED_CLIENT_REL,
-  apiClientPathspec,
   currentBranch,
   describeMainWorktreeBusy,
   mainWorktreeBusy,

package/scripts/gds/ship.js

@@ -46,10 +46,10 @@
 //                                                       # Archon). The cheap default after fixing grader
 //                                                       # findings — closes the task-595-regrade-gap (#678).
 //   node scripts/gds/ship.js <task-id> --skip-stage    # skip the sandbox-first review gate (#927,
-//                                                       # ADR 0046). On a dev box, game-surface diffs are
-//                                                       # otherwise staged to the builder's own live
-//                                                       # preview (sandbox-<login>, ADR 0044) for a
-//                                                       # browser review BEFORE the claim resolves.
+//                                                       # ADR 0046). On a clone with the game preview,
+//                                                       # game-surface diffs are otherwise staged to
+//                                                       # the builder's own local preview (ADR 0044) for
+//                                                       # a browser review BEFORE the claim resolves.
 //   node scripts/gds/ship.js <task-id> --approved      # record your sandbox sign-off (#1048): re-run with
 //                                                       # this AFTER reviewing the staged change at the
 //                                                       # sandbox URL. Persists a sandbox_review row on the
@@ -77,21 +77,6 @@
 
 'use strict';
 
-// TREE PREFLIGHT (task 1003098). A task-scoped dev box carries scripts/ and
-// src/bongos/ but not every modules/ directory, so the requires below can fail —
-// and Node's loader names only the FIRST missing one, which turned recovery into
-// guess-read-fix-repeat. This enumerates every missing requirement in one message
-// and exits before the first such require runs. It must stay ABOVE them.
-//
-// A PRE-REQUEST hard exit, like the usage banner and worktree guard: nothing has
-// been sent yet, so there is no in-flight request for cliExit to drain.
-const { action: _surfaceAction } = require('./surface.js');
-const { checkTree: _checkTree } = require('./tree-preflight.js');
-{
-  const _fault = _checkTree(__filename, { command: _surfaceAction("ship") });
-  if (_fault) { console.error(_fault); process.exit(1); }
-}
-
 const { buildMergeArgv, gitArgvOk, sanitizeGitHubRefs } = require('./ship-git.js');
 const { apiErrorLine, normalizeApiError, postLandShipOutcome } = require('./ship-io.js');
 const { deriveTagsFromPaths } = require('./ship-surprise.js');
@@ -137,8 +122,6 @@ const {
   strandNextStep,
 } = require('./ship-land.js');
 const {
-  VENDORED_CLIENT_REL,
-  apiClientPathspec,
   regenerateDiagrams,
   regenerateFileMap,
   regenerateRepoMap,
@@ -192,9 +175,6 @@ module.exports = {
   // resolveTranscriptPath itself runs path.resolve, which can't carry a Windows
   // path through a Linux CI run.
   encodeProjectPath,
-  // task 1002417: the regenerated-client pathspec rule, exported pure so the
-  // "never name a path git add cannot match" invariant is tested without git/fs.
-  apiClientPathspec, VENDORED_CLIENT_REL,
   // task 1003: transcript-grade scrubber internals, exported pure so the planted-
   // secret corpus test (tests/scrubber_corpus.mjs) can exercise each layer + tune.
   shannonEntropy, looksHighEntropySecret, redactHighEntropy, collectEnvSecrets,
@@ -293,8 +273,8 @@ module.exports = {
   // preflight's upstream-deletion warning — exported so it's unit-tested
   // without a live git repo.
   parseDeletedUpstreamPaths,
-  // task 1052 (E): box-aware "what to do next" for a confirmed-strand — a box
-  // (via 'server') is pointed at the resume, never at gh-only /merge-mode.
+  // task 1052 (E): path-aware "what to do next" for a confirmed-strand — a machine
+  // on the server path (via 'server') is pointed at the resume, never at gh-only /merge-mode.
   strandNextStep,
   // task 1002606: the success-pending banner lines, pure — pinned so the strand
   // detection story ("NOT a failure" + how you WILL find out if it fails) can't drift.
@@ -313,20 +293,20 @@ module.exports = {
   // #858: commit-pinned deploy confirmation via the /version endpoint.
   deployedCommitStatus,
   // ADR 0055 / task 1025: which ci-mode publish path this machine uses
-  // ('local' = git+gh here; 'server' = server-mediated, e.g. a dev box) — so
+  // ('local' = git+gh here; 'server' = server-mediated, no local push credential) — so
   // doctor.js reports the same path ship will take instead of failing on
   // missing gh where gh isn't needed.
   pushVia,
-  // task 1046: diagram regen returns a status string and SKIPS on the dev-box
-  // (server-publish) path so a box never leaves uncommitted .mmd/assertions in
-  // its tree — exported so the regression test proves the skip without git.
+  // task 1046: diagram regen returns a status string and SKIPS on the server-publish
+  // path so such a checkout never leaves uncommitted .mmd/assertions in its tree —
+  // exported so the regression test proves the skip without git.
   regenerateDiagrams,
   regenerateRepoMap,
   regenerateSessionIndex,
   // ADR 0066 / task 1276: regenerate docs/file-map.md's skills + scheduled-tasks sections from disk.
   regenerateFileMap,
   // task 1037: autoMerge's fetch-failure decision — fatal only OFF the server-
-  // publish path (a credential-less dev box can't fetch but ships via ADR 0055).
+  // publish path (a credential-less checkout can't fetch but ships via ADR 0055).
   // Exported pure so the regression test proves the truth table without git.
   shouldBailOnFetchFailure,
   // task 391 (idea #37): autoMerge's zero-commit verdict — refuse a zero-commit
@@ -362,8 +342,8 @@ module.exports = {
 if (require.main === module) {
   // --print-deploy-mode (task 1003221): the EFFECTIVE mode, one word, no session or
   // network. The /merge-mode skill used to probe parseDeployMode directly, which
-  // defaults to 'laptop' when config/deploy.json is absent — as it is on every dev
-  // box (ADR 0148) — sending the builder down a push path they had no credential for.
+  // defaults to 'laptop' when config/deploy.json is absent — sending the
+  // builder down a push path they had no credential for.
   if (process.argv.slice(2).includes('--print-deploy-mode')) {
     console.log(require('./ship-deploy-target.js').resolveDeployMode());
     process.exit(0);

package/scripts/gds/skill-preflight.js

@@ -4,12 +4,13 @@
 // 1000077; criterion guards-skill-declares-machine).
 //
 // THE INCIDENT. /merge-mode states in its own prose that it assumes the Archon's
-// Mac or the droplet. It was run on a dev box anyway. Worse, ship.js ALREADY knew:
-// strandNextStep() tells a box "/merge-mode is NOT available here — it needs gh +
-// a main checkout this machine doesn't have." So the knowledge existed in two
-// places and neither stopped the run, because prose cannot refuse and the one
-// executable copy was on a different code path. A capability a procedure needs
-// must be a declaration the machine can CHECK, not a sentence a reader can skim.
+// Mac or the droplet. It was run on a machine with no push credential anyway. Worse,
+// ship.js ALREADY knew: strandNextStep() tells such a machine "/merge-mode is NOT
+// available here — it needs gh + a main checkout this machine doesn't have." So the
+// knowledge existed in two places and neither stopped the run, because prose cannot
+// refuse and the one executable copy was on a different code path. A capability a
+// procedure needs must be a declaration the machine can CHECK, not a sentence a
+// reader can skim.
 //
 // THREE PARTS, matching that diagnosis:
 //   1. `requires:` in the skill's own YAML frontmatter — the declaration.
@@ -74,7 +75,7 @@ const CAPABILITIES = {
     what: 'an authenticated GitHub CLI',
     probe: () => ghAuthed(),
     missing: 'no authenticated `gh` on this machine. Run `gh auth login`, or use a machine that has it — '
-      + 'a dev box normally does not, by design (it publishes through the server instead, ADR 0055).',
+      + 'a machine with no push credential normally does not, by design (it publishes through the server instead, ADR 0055).',
   },
   'main-checkout': {
     what: 'the main checkout, not a linked worktree',
@@ -318,7 +319,7 @@ function checkOpsSkillsDeclareMachine({ dir = SKILLS_DIR, read = null, names: in
       violations.push(
         `${n} fences commands needing [${undeclared.join(', ')}] but does not declare them. `
         + 'Add them to `requires:` in the frontmatter so the preflight can refuse early — '
-        + 'prose cannot refuse, which is how /merge-mode came to be run on a dev box (task 1003167).'
+        + 'prose cannot refuse, which is how /merge-mode came to be run on a machine that could not run it (task 1003167).'
       );
     }
   }

package/scripts/gds/start.js

@@ -52,21 +52,6 @@
 //
 // Returns JSON if --json is passed (for the slash command to parse cleanly).
 
-// TREE PREFLIGHT (task 1003098). A task-scoped dev box carries scripts/ and
-// src/bongos/ but not every modules/ directory, so the requires below can fail —
-// and Node's loader names only the FIRST missing one, which turned recovery into
-// guess-read-fix-repeat. This enumerates every missing requirement in one message
-// and exits before the first such require runs. It must stay ABOVE them.
-//
-// A PRE-REQUEST hard exit, like the usage banner and worktree guard: nothing has
-// been sent yet, so there is no in-flight request for cliExit to drain.
-const { action: _surfaceAction } = require('./surface.js');
-const { checkTree: _checkTree } = require('./tree-preflight.js');
-{
-  const _fault = _checkTree(__filename, { command: _surfaceAction("start") });
-  if (_fault) { console.error(_fault); process.exit(1); }
-}
-
 const { cliClient, errCode, errDetails, requireSession, fmtUsd, printOnboardingNudge, printCostWarning, printNeedsNudge, hallBase, API_BASE, rewardPolicy, costPlusOnlyNote, isDispatcherIncompatError, cardFlagsFromMe } = require('./cli-lib');
 const { plainCardLines } = require('./plain-cards');
 const { contextPack, formatContextPackCompact } = require('./context-pack');

package/scripts/hall-preview/README.md

@@ -1,6 +1,6 @@
 # Hall preview harness
 
-The dev-box sandbox previews the **game only** — `/builders` 404s there (idea 490) — so
+`/builder-stage` previews the **game only** — `/builders` 404s there (idea 490) — so
 hall-ui changes are reviewed here: a DB-less fixture server that serves the **real**
 `modules/hall-ui/public` files through the **real** serving seams (boot-time `?v=`
 content-hash stamping, `{{token}}` replacement, `window.__BRANDING__`/`__MODULES__`
@@ -19,7 +19,7 @@ node scripts/hall-preview/server.js                 # neutral pack, port 4600
 |---|---|
 | `--port 4600` | listen port |
 | `--brand config/branding.json` | serve the instance pack (default: `config/branding.neutral.json`, the vanilla skin) |
-| `--modules-off dev-box,provisioning` | report those modules disabled in `window.__MODULES__` — verifies `moduleOn()` gating (Harbor nav item, Instances/Start-a-project widgets must vanish) |
+| `--modules-off discord,provisioning` | report those modules disabled in `window.__MODULES__` — verifies `moduleOn()` gating (the Discord links, Instances/Start-a-project widgets must vanish) |
 | `--empty` | drain every array in every fixture — the empty-state screenshot pass |
 | `--fixture-me` | don't read your own account live — serve the checked-in `me.json` snapshot (see below) |
 
@@ -32,7 +32,7 @@ A GET with no fixture answers 404 and logs
 The fixtures are one particular builder's snapshot, so the harness used to greet
 everyone as that builder — their name, credits, achievements, goals and **rank**.
 A metic snapshot also sealed the Archon-gated pages, so a UI change to Watch /
-Harbor / Gate / Permissions could not be reviewed at all.
+Gate / Permissions could not be reviewed at all.
 
 So at boot the harness reads **your** account: if this machine holds a GDS CLI
 session, the me-scoped endpoints (`/me`, `/me/*`, `/builders/<you>/…`,
@@ -136,8 +136,8 @@ The hard seams every redesign must keep. Run on each changed page:
 // after connect): watch the network panel, or count via a fixture hit log line.
 ```
 
-Module gating: rerun the page with `--modules-off dev-box,provisioning` — the
-Harbor nav item and the Instances/Start-a-project widgets must be absent, with
+Module gating: rerun the page with `--modules-off discord,provisioning` — the
+Discord links and the Instances/Start-a-project widgets must be absent, with
 zero console errors.
 
 ## Gotchas

package/scripts/hall-preview/server.js

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 // scripts/hall-preview/server.js — the hall preview harness (task 2167).
 //
-// The dev-box sandbox previews the GAME only (/builders 404s there, idea 490),
+// /builder-stage previews the GAME only (/builders 404s there, idea 490),
 // so hall-ui changes are reviewed HERE: a tiny express app that serves the real
 // modules/hall-ui/public files through the REAL serving seams (boot-time ?v=
 // stamping, {{token}} replacement, __BRANDING__/__MODULES__ injection, theme
@@ -10,7 +10,7 @@
 // finally checked in.
 //
 //   node scripts/hall-preview/server.js [--port 4600] [--brand <file>]
-//        [--modules-off dev-box,provisioning] [--empty]
+//        [--modules-off discord,provisioning] [--empty]
 //
 //   --port         listen port (default 4600)
 //   --brand        branding pack file — default config/branding.neutral.json
@@ -20,7 +20,7 @@
 //   --empty        serve every fixture with its arrays emptied — the
 //                  empty-state screenshot pass
 //   --rank archon  override the served /me builder.rank (live or fixture) so the
-//                  Archon-gated pages (watch, harbor, gate) render in preview
+//                  Archon-gated pages (watch, gate) render in preview
 //   --fixture-me   do NOT read your own account live; serve the checked-in
 //                  fixtures/me.json snapshot (deterministic screenshot passes,
 //                  and the offline/signed-out path) — task 1003315
@@ -50,15 +50,15 @@ function arg(name) {
 const PORT = Number(arg('--port')) || 4600;
 const EMPTY = process.argv.includes('--empty');
 // --rank: view the hall as a different rank — the served /me builder.rank is
-// overridden in the response, so the Archon-gated pages (watch, harbor, gate)
+// overridden in the response, so the Archon-gated pages (watch, gate)
 // render their real content instead of the sealed notice. Since task 1003315 the
 // served /me is normally your OWN account, so this is now only needed to view
 // the hall as a rank you are not. Preview-only theatre:
 // the real pages are server-gated (requireGovernmentPage / ADR 0016).
 const RANK_OVERRIDE = arg('--rank');
 const MODULES_OFF = String(arg('--modules-off') || '').split(',').map((s) => s.trim()).filter(Boolean);
-// --modules-on: force-report modules as enabled — a dev box's local config
-// often lacks prod's instance modules (provisioning, dev-box), and their
+// --modules-on: force-report modules as enabled — a local checkout's config
+// often lacks prod's instance modules (provisioning, discord), and their
 // widgets can't be reviewed without it (task 2169).
 const MODULES_ON = String(arg('--modules-on') || '').split(',').map((s) => s.trim()).filter(Boolean);
 // --fixture-me: pin the checked-in /me snapshot instead of reading the caller's

package/scripts/render-diagrams.sh

@@ -19,7 +19,7 @@
 # already-installed browser and forbids the download when it finds one; it only
 # falls back to puppeteer's own download where nothing is installed (a dev
 # laptop, where that fetch works fine). This is what makes render-at-deploy
-# viable (deploy-prod.sh + infra/box-source-fetch.sh call this).
+# viable (deploy-prod.sh calls this).
 set -euo pipefail
 
 REPO_ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"