@bongos/core 1.19.1073 → 1.19.1075

package/tests/modules.mjs

@@ -14,12 +14,11 @@ const {
 } = modulesMod;
 
 const VANILLA = {}; // no config at all
-const OTB = { modules: { game: true, 'art-pipeline': true, discord: true, 'dev-box': true } };
-// The post-extraction registry: built-ins (game, art-pipeline, discord) + every
-// discovered module. dev-box now lives in modules/dev-box/ (BV1.R43), so it is a
-// DISCOVERED key, not a built-in MODULE_REGISTRY one. The pure resolver tests
-// below pass this effective registry so 'dev-box' is a known key — exactly what
-// loadModules() does in production. Membership across the move is preserved here.
+const OTB = { modules: { game: true, 'art-pipeline': true, discord: true, 'npm-release': true } };
+// The post-extraction registry: every discovered module (npm-release lives in
+// modules/npm-release/, so it is a DISCOVERED key, not a built-in MODULE_REGISTRY
+// one). The pure resolver tests below pass this effective registry so 'npm-release'
+// is a known key — exactly what loadModules() does in production.
 const EFFECTIVE = modulesMod.effectiveRegistry();
 
 // Sample feature-module keys for the PURE resolver tests below. `game` and
@@ -43,7 +42,7 @@ test('every registry module has an explicit default of false', () => {
 test('instance config turns modules on', () => {
   const m = resolveModules({ neutral: VANILLA, instance: OTB, registry: SAMPLE_REG });
   assert.equal(m.game, true);
-  assert.equal(m['dev-box'], true);
+  assert.equal(m['npm-release'], true);
   assert.equal(isModuleEnabled('discord', m), true);
   // memory (BV1.R72), grading (BV1.R73), economy (BV1.R77), ideas (BV1.R78),
   // security (BV1.R79), builder-settings (BV1.R80), onboarding (BV1.R81),
@@ -70,7 +69,7 @@ test('instance config turns modules on', () => {
 });
 
 test('instance config overrides the neutral starter per-flag (deep merge of the modules map)', () => {
-  const neutral = { modules: { game: false, discord: false, 'dev-box': false, 'art-pipeline': false } };
+  const neutral = { modules: { game: false, discord: false, 'npm-release': false, 'art-pipeline': false } };
   const instance = { modules: { discord: true } }; // only flip one
   const m = resolveModules({ neutral, instance, registry: SAMPLE_REG });
   assert.equal(m.discord, true);
@@ -78,8 +77,8 @@ test('instance config overrides the neutral starter per-flag (deep merge of the
 });
 
 test('env override beats instance config (precedence), with prefix + snake-casing', () => {
-  const m = resolveModules({ instance: OTB, env: { OTB_MODULE_DEV_BOX: '0' }, envPrefix: 'OTB', registry: SAMPLE_REG });
-  assert.equal(m['dev-box'], false); // env off beat instance on
+  const m = resolveModules({ instance: OTB, env: { OTB_MODULE_NPM_RELEASE: '0' }, envPrefix: 'OTB', registry: SAMPLE_REG });
+  assert.equal(m['npm-release'], false); // env off beat instance on
   assert.equal(m.game, true);        // others untouched
 });
 
@@ -106,14 +105,14 @@ test('an unknown module key in config is rejected when ENABLED (typo guard)', ()
   assert.throws(() => resolveModules({ instance: { modules: { gaem: true } } }), /unknown module "gaem"/);
 });
 
-// task 1824 — a stripped CORE has no game/art-pipeline/discord/dev-box, but the
+// task 1824 — a stripped CORE has no game/art-pipeline/discord, but the
 // config/modules.neutral.json that SHIPS with it names them (so the same file is valid
 // in the full repo). The loader must TOLERATE an unknown module when it is DISABLED, or
 // a vanilla self-host crashes on `unknown module "game"`.
 test('an unknown module key that is DISABLED is tolerated (a config may name a not-yet-installed module)', () => {
   const reg = { memory: { default: true }, grading: { default: true } }; // core-only registry (no feature modules)
   // The exact vanilla-core scenario: neutral names four absent feature modules, all off.
-  const neutral = { modules: { game: false, 'art-pipeline': false, discord: false, 'dev-box': false } };
+  const neutral = { modules: { game: false, 'art-pipeline': false, discord: false, 'npm-release': false } };
   let m;
   assert.doesNotThrow(() => { m = resolveModules({ neutral, registry: reg }); });
   assert.deepEqual(m, { memory: true, grading: true }); // core modules resolve; absent-disabled dropped
@@ -202,7 +201,38 @@ test('the committed config files resolve: OTB enables all four, on disk', () =>
   assert.equal(m.game, true);
   assert.equal(m['art-pipeline'], true);
   assert.equal(m.discord, true);
-  assert.equal(m['dev-box'], true);
+  assert.equal(m['npm-release'], true);
+});
+
+// task 1003892 — a RETIRED key (the module was deleted from the core) that a
+// committed instance pack still switches ON must NOT stop the process booting.
+// cloudbongos.com carried `"dev-box": true` when the module went; the typo guard
+// would have thrown `cannot enable unknown module` at the next restart.
+test('1003892: a retired module enabled in the instance pack is dropped with a warning, not thrown on', () => {
+  const warned = [];
+  const m = resolveModules({
+    instance: { modules: { 'dev-box': true, discord: true } },
+    registry: SAMPLE_REG,
+    warnRetired: (key, source) => warned.push(`${key}@${source}`),
+  });
+  assert.equal('dev-box' in m, false, 'a retired key never enters the resolved set');
+  assert.equal(m.discord, true, 'the rest of the pack still resolves');
+  assert.deepEqual(warned, ['dev-box@instance'], 'the stale line is named once, with its layer');
+  // disabled is the quiet no-op it always was
+  const quiet = [];
+  resolveModules({ neutral: { modules: { 'dev-box': false } }, registry: SAMPLE_REG, warnRetired: (k) => quiet.push(k) });
+  assert.deepEqual(quiet, [], 'a retired key switched OFF says nothing');
+});
+
+test('1003892: the retired list does not weaken the typo guard for any other unknown key', () => {
+  assert.throws(
+    () => resolveModules({ instance: { modules: { 'dev-boxes': true } }, registry: SAMPLE_REG, warnRetired: () => {} }),
+    /cannot enable unknown module "dev-boxes"/,
+  );
+  for (const [key, why] of Object.entries(modulesMod.RETIRED_MODULE_KEYS)) {
+    assert.ok(!(key in modulesMod.effectiveRegistry()), `${key} is retired, so no installed module may carry it`);
+    assert.ok(why && why.length > 20, `${key} must say why it left`);
+  }
 });
 
 test('GDS_MODULES_FILE selects the instance modules pack on disk (mirrors GDS_BRANDING_FILE)', () => {
@@ -235,8 +265,8 @@ test('a branded sibling (GDS_BRANDING_FILE set, no GDS_MODULES_FILE) defaults to
 test('1002857: an override outranks the committed instance pack', () => {
   // The whole point: the pack is what a deploy restores, so an override that sat
   // below it would be erased by the very event it exists to survive.
-  const m = resolveModules({ instance: OTB, override: { 'dev-box': false }, registry: SAMPLE_REG });
-  assert.equal(m['dev-box'], false, 'the override wins over the pack');
+  const m = resolveModules({ instance: OTB, override: { 'npm-release': false }, registry: SAMPLE_REG });
+  assert.equal(m['npm-release'], false, 'the override wins over the pack');
   assert.equal(m.discord, true, 'a module with no override still reads the pack');
 });
 
@@ -248,12 +278,12 @@ test('1002857: an override turns a module ON as well as off', () => {
 test('1002857: env still outranks an override — the incident knob needs no database', () => {
   const m = resolveModules({
     instance: VANILLA,
-    override: { 'dev-box': true },
-    env: { OTB_MODULE_DEV_BOX: '0' },
+    override: { 'npm-release': true },
+    env: { OTB_MODULE_NPM_RELEASE: '0' },
     envPrefix: 'OTB',
     registry: SAMPLE_REG,
   });
-  assert.equal(m['dev-box'], false, 'env must be able to kill a module the DB turned on');
+  assert.equal(m['npm-release'], false, 'env must be able to kill a module the DB turned on');
 });
 
 test('1002857: an override for a module this build does not carry is inert, not fatal', () => {
@@ -279,12 +309,12 @@ test('1002857: each module reports the layer that produced its state', () => {
   const m = resolveModules({
     neutral: { modules: { discord: false } },
     instance: OTB,
-    override: { 'dev-box': false },
+    override: { 'npm-release': false },
     env: { OTB_MODULE_GAME: '0' },
     envPrefix: 'OTB',
     registry: SAMPLE_REG,
   });
-  assert.equal(m.sources['dev-box'], 'override');
+  assert.equal(m.sources['npm-release'], 'override');
   assert.equal(m.sources.game, 'env');
   assert.equal(m.sources.discord, 'instance', 'the instance pack outranks the neutral one');
   assert.equal(m.sources['art-pipeline'], 'instance');
@@ -316,18 +346,18 @@ test('1002857: setModuleOverrides installs the snapshot AND invalidates the cach
   // the exact class of bug this feature exists to remove.
   try {
     const before = modulesMod.modules();
-    assert.equal(before['dev-box'], false, 'precondition: off on a vanilla resolve');
-    const after = modulesMod.setModuleOverrides({ 'dev-box': true });
-    assert.equal(after['dev-box'], true, 'the returned set reflects the override');
-    assert.equal(modulesMod.modules()['dev-box'], true, 'and so does the live singleton');
-    assert.equal(moduleOverrides()['dev-box'], true);
+    assert.equal(before['npm-release'], false, 'precondition: off on a vanilla resolve');
+    const after = modulesMod.setModuleOverrides({ 'npm-release': true });
+    assert.equal(after['npm-release'], true, 'the returned set reflects the override');
+    assert.equal(modulesMod.modules()['npm-release'], true, 'and so does the live singleton');
+    assert.equal(moduleOverrides()['npm-release'], true);
   } finally {
     modulesMod._resetForTests();
   }
 });
 
 test('1002857: _resetForTests clears the override snapshot too', () => {
-  modulesMod.setModuleOverrides({ 'dev-box': true });
+  modulesMod.setModuleOverrides({ 'npm-release': true });
   modulesMod._resetForTests();
   assert.deepEqual(moduleOverrides(), {}, 'a leaked snapshot would cross-contaminate tests');
 });

package/tests/modules_route_wiring.mjs

@@ -79,7 +79,7 @@ test('1002857: POST /modules/:key/enable rejects a non-boolean before touching t
   // is why the next assertion matters more than this one.
   const router = buildModulesRouter();
   const res = await invoke(handlerFor(router, 'post', '/modules/:key/enable'), {
-    params: { key: 'dev-box' }, query: {}, body: { enabled: 'yes-please' }, builder: { id: 1 },
+    params: { key: 'discord' }, query: {}, body: { enabled: 'yes-please' }, builder: { id: 1 },
   });
   assert.equal(res.body.error, 'invalid_body');
 });

package/tests/onboarding_route_signals.mjs

@@ -3,16 +3,15 @@
 // Regression for task 1444 (scootermack's bug).
 //
 // GET /builders/:id/onboarding shapes the SAME displayed checklist as GET /me,
-// but three of its steps clear from LIVE signals rather than the onboarding_state
-// row: box_connect (boxes.hasEverConnected), join_discord (db.getDiscordLink),
-// cli_setup (db.hasCliSession). The route originally called
-// shapeForApi(state, { shipCount }) and omitted those signals — so they defaulted
-// to false and the route rendered all three steps perpetually UNCHECKED even after
-// the builder cleared them. This locks in that the route passes the live signals
-// through, exactly as /me does.
+// but two of its steps clear from LIVE signals rather than the onboarding_state
+// row: join_discord (the discord.isLinked port) and cli_setup (db.hasCliSession).
+// The route originally called shapeForApi(state, { shipCount }) and omitted those
+// signals — so they defaulted to false and the route rendered the steps
+// perpetually UNCHECKED even after the builder cleared them. This locks in that
+// the route passes the live signals through, exactly as /me does.
 //
-// We stub auth + db and patch onboarding-state.getState / boxes.hasEverConnected,
-// but exercise the REAL shapeForApi. No network, no Postgres.
+// We stub auth + db and patch onboarding-state.getState, but exercise the REAL
+// shapeForApi. No network, no Postgres.
 //
 // Run:  node tests/onboarding_route_signals.mjs
 
@@ -66,16 +65,12 @@ const onboardingState = require('../modules/onboarding/onboarding-state.js');
 let fakeState = null;
 onboardingState.getState = async () => fakeState;
 
-// box_connect's live signal now reaches builders.js through the kernel seam (the
-// `box.hasEverConnected` port the dev-box module provides, BV1.R43) — not a direct
-// boxes import. join_discord's signal reaches it the same way through the
-// `discord.isLinked` port the discord module provides (BV1.R47) — not db.getDiscordLink.
-// So we register providers instead of monkey-patching; the route resolves them via
-// resolveOptional exactly as in production.
+// join_discord's live signal reaches builders.js through the kernel seam (the
+// `discord.isLinked` port the discord module provides, BV1.R47) — not
+// db.getDiscordLink. So we register a provider instead of monkey-patching; the
+// route resolves it via resolveOptional exactly as in production.
 const seams = require('../src/module-seams.js');
-let fakeBoxConnected = false;
 seams._reset();
-seams.registerProvider('box.hasEverConnected', async () => fakeBoxConnected);
 seams.registerProvider('discord.isLinked', async () => dbSignals.discordLinked);
 
 // The onboarding state machine carved into modules/onboarding/ (BV1.R81): the
@@ -83,7 +78,7 @@ seams.registerProvider('discord.isLinked', async () => dbSignals.discordLinked);
 // (resolveOptional('onboarding')), not a direct require. Register the real port
 // provider — its getState delegates to the (patched-above) onboarding-state, so
 // the genuine shapeForApi is still exercised. (Mirrors how this test already
-// registers the box/discord providers instead of monkey-patching.)
+// registers the discord provider instead of monkey-patching.)
 seams.registerProvider('onboarding', require('../modules/onboarding/port.js'));
 
 // The lifecycle (tasks · claims · ship) carved to modules/lifecycle/ (BV1.R86):
@@ -129,45 +124,40 @@ const stepCleared = (body, id) => {
 };
 
 // A mid-onboarding row (mirrors a real newcomer who's signed in, picked a craft,
-// and run /builder-start) — so the box/discord/cli steps are decided purely by
+// and run /builder-start) — so the discord/cli steps are decided purely by
 // the LIVE signals, which is exactly what regressed.
 const MID_STATE = { current_stage: 'first_claim', completed_stages: ['auth_complete', 'pick_disciplines', 'first_start'] };
 
 const { server, port } = await listen(buildApp());
 
-await t('no live signals → box/discord/cli all uncleared', async () => {
+await t('no live signals → discord/cli both uncleared, and no retired box step is rendered', async () => {
   fakeState = MID_STATE;
-  fakeBoxConnected = false;
   dbSignals.discordLinked = false; dbSignals.cliAuthed = false;
   const r = await get(port, '/api/gds/builders/94/onboarding');
   assert.equal(r.status, 200);
-  assert.equal(stepCleared(r.json, 'box_connect'), false);
   assert.equal(stepCleared(r.json, 'join_discord'), false);
   assert.equal(stepCleared(r.json, 'cli_setup'), false);
+  assert.equal(stepCleared(r.json, 'box_connect'), undefined, 'the retired box_connect step is no longer on the checklist (task 1004310)');
 });
 
-await t('box connected (first_connected_at set) → box_connect clears [the scootermack regression]', async () => {
+await t('discord linked → join_discord clears from ITS OWN signal [the scootermack regression]', async () => {
   fakeState = MID_STATE;
-  fakeBoxConnected = true;
-  dbSignals.discordLinked = false; dbSignals.cliAuthed = false;
+  dbSignals.discordLinked = true; dbSignals.cliAuthed = false;
   const r = await get(port, '/api/gds/builders/94/onboarding');
   assert.equal(r.status, 200);
-  assert.equal(stepCleared(r.json, 'box_connect'), true, 'box_connect must clear once the box has connected');
-  // The other two stay false — proving box_connect cleared from ITS OWN signal,
+  assert.equal(stepCleared(r.json, 'join_discord'), true, 'join_discord must clear once the account is linked');
+  // cli_setup stays false — proving join_discord cleared from its own signal,
   // not because every step got force-cleared.
-  assert.equal(stepCleared(r.json, 'join_discord'), false);
   assert.equal(stepCleared(r.json, 'cli_setup'), false);
 });
 
-await t('discord linked + cli authed → those two clear independently', async () => {
+await t('discord linked + cli authed → both clear', async () => {
   fakeState = MID_STATE;
-  fakeBoxConnected = false;
   dbSignals.discordLinked = true; dbSignals.cliAuthed = true;
   const r = await get(port, '/api/gds/builders/94/onboarding');
   assert.equal(r.status, 200);
   assert.equal(stepCleared(r.json, 'join_discord'), true);
   assert.equal(stepCleared(r.json, 'cli_setup'), true);
-  assert.equal(stepCleared(r.json, 'box_connect'), false);
 });
 
 server.close();

package/tests/onboarding_state.mjs

@@ -77,29 +77,27 @@ test('isKnownStage: typo rejected', () => {
 
 // ---- shapeForApi (displayed checklist, #777) ------------------------------
 //
-// shapeForApi returns the DISPLAYED 5-step "Path into the City"
-// (box_connect, join_discord, pick_disciplines, cli_setup, ship_three) — split
-// from the engine STAGES so NONE of the displayed steps affect graduation.
-// `graduated` and `current_stage` still reflect the engine. box_connect/
-// join_discord/cli_setup are auto-derived from `boxConnected`/`discordLinked`/
-// `cliAuthed` (no manual ticks, #823/#777).
+// shapeForApi returns the DISPLAYED 4-step "Path into the City"
+// (join_discord, pick_disciplines, cli_setup, ship_three) — split from the
+// engine STAGES so NONE of the displayed steps affect graduation. `graduated`
+// and `current_stage` still reflect the engine. join_discord/cli_setup are
+// auto-derived from `discordLinked`/`cliAuthed` (no manual ticks, #777).
 
-const DISPLAY_ORDER = ['box_connect', 'join_discord', 'pick_disciplines', 'cli_setup', 'ship_three'];
+const DISPLAY_ORDER = ['join_discord', 'pick_disciplines', 'cli_setup', 'ship_three'];
 
-test('shapeForApi: null row → 5-step displayed shape in order', () => {
+test('shapeForApi: null row → 4-step displayed shape in order', () => {
   const out = onboarding.shapeForApi(null);
   assert.equal(out.current_stage, 'auth_complete'); // engine stage still surfaced
   assert.deepEqual(out.completed_stages, []);
   assert.equal(out.graduated, false);
   assert.equal(out.progress.cleared, 0);
-  assert.equal(out.progress.total, 5);
+  assert.equal(out.progress.total, 4);
   assert.deepEqual(out.stages.map((s) => s.id), DISPLAY_ORDER);
-  assert.equal(out.stages[0].is_current, true); // box_connect, first gap
+  assert.equal(out.stages[0].is_current, true); // join_discord, first gap
   assert.equal(out.stages[0].cleared, false);
-  assert.equal(out.stages[0].source, 'box');
-  assert.equal(out.stages[1].source, 'discord'); // join_discord
-  assert.equal(out.stages[2].source, 'stage'); // pick_disciplines is a real stage
-  assert.equal(out.stages[3].source, 'cli'); // cli_setup
+  assert.equal(out.stages[0].source, 'discord'); // join_discord
+  assert.equal(out.stages[1].source, 'stage'); // pick_disciplines is a real stage
+  assert.equal(out.stages[2].source, 'cli'); // cli_setup
 });
 
 test('shapeForApi: partial row → cleared flags + is_current points at first displayed gap', () => {
@@ -113,62 +111,50 @@ test('shapeForApi: partial row → cleared flags + is_current points at first di
   const byId = Object.fromEntries(out.stages.map((s) => [s.id, s]));
   // pick_disciplines is the only displayed step the engine has cleared.
   assert.equal(byId.pick_disciplines.cleared, true);
-  assert.equal(byId.box_connect.cleared, false);   // no box connection
   assert.equal(byId.cli_setup.cleared, false);     // no cli auth
   assert.equal(byId.join_discord.cleared, false);  // no link
   assert.equal(byId.ship_three.cleared, false);
-  // First displayed gap is box_connect (it sorts before the cleared craft step).
-  assert.equal(byId.box_connect.is_current, true);
+  // First displayed gap is join_discord (it sorts before the cleared craft step).
+  assert.equal(byId.join_discord.is_current, true);
   assert.equal(byId.pick_disciplines.is_current, false);
   assert.equal(out.progress.cleared, 1);
 });
 
-test('shapeForApi: box_connect clears from boxConnected; is_current advances to join_discord', () => {
+test('shapeForApi: a legacy caller passing boxConnected changes nothing (the step is gone)', () => {
+  // Removed with the dev box (task 1004310): an unknown option must be inert,
+  // never a fifth step or a thrown error.
   const out = onboarding.shapeForApi(
     { current_stage: 'auth_complete', completed_stages: ['auth_complete'] },
     { boxConnected: true }
   );
-  const byId = Object.fromEntries(out.stages.map((s) => [s.id, s]));
-  assert.equal(byId.box_connect.cleared, true);
-  // Next gap is now join_discord (no link supplied).
-  assert.equal(byId.join_discord.is_current, true);
+  assert.deepEqual(out.stages.map((s) => s.id), DISPLAY_ORDER);
+  assert.equal(out.progress.cleared, 0);
 });
 
-test('shapeForApi: cli_setup (step 4) clears from cliAuthed; box_connect stays first gap without a connection', () => {
+test('shapeForApi: cli_setup (step 3) clears from cliAuthed; join_discord stays first gap without a link', () => {
   const out = onboarding.shapeForApi(
     { current_stage: 'auth_complete', completed_stages: ['auth_complete'] },
     { cliAuthed: true }
   );
   const byId = Object.fromEntries(out.stages.map((s) => [s.id, s]));
   assert.equal(byId.cli_setup.cleared, true);
-  assert.equal(byId.box_connect.cleared, false);
-  // box_connect is still the first gap (it precedes the cleared cli step).
-  assert.equal(byId.box_connect.is_current, true);
-});
-
-test('shapeForApi: box_connect and cli_setup are independent signals', () => {
-  // Connected to the box but CLI not yet authenticated — only box_connect ticks.
-  const out = onboarding.shapeForApi(
-    { current_stage: 'auth_complete', completed_stages: ['auth_complete'] },
-    { boxConnected: true, cliAuthed: false }
-  );
-  const byId = Object.fromEntries(out.stages.map((s) => [s.id, s]));
-  assert.equal(byId.box_connect.cleared, true);
-  assert.equal(byId.cli_setup.cleared, false);
-  // box_connect clears, but cli_setup (step 4) stays open on its own signal.
-  assert.equal(byId.box_connect.is_current, false);
+  assert.equal(byId.join_discord.cleared, false);
+  // join_discord is still the first gap (it precedes the cleared cli step).
+  assert.equal(byId.join_discord.is_current, true);
 });
 
-test('shapeForApi: join_discord clears from a live Discord link; box_connect stays first gap without a connection', () => {
+test('shapeForApi: join_discord and cli_setup are independent signals', () => {
+  // Discord linked but CLI not yet authenticated — only join_discord ticks.
   const out = onboarding.shapeForApi(
     { current_stage: 'auth_complete', completed_stages: ['auth_complete'] },
-    { discordLinked: true }
+    { discordLinked: true, cliAuthed: false }
   );
   const byId = Object.fromEntries(out.stages.map((s) => [s.id, s]));
   assert.equal(byId.join_discord.cleared, true);
-  assert.equal(byId.box_connect.cleared, false);
-  // box_connect is still the first gap (it precedes the cleared discord step).
-  assert.equal(byId.box_connect.is_current, true);
+  assert.equal(byId.cli_setup.cleared, false);
+  // join_discord clears, and the next gap is the craft picker.
+  assert.equal(byId.join_discord.is_current, false);
+  assert.equal(byId.pick_disciplines.is_current, true);
 });
 
 test('shapeForApi: graduated row → all displayed steps cleared, none current (regardless of derived signals)', () => {
@@ -177,10 +163,10 @@ test('shapeForApi: graduated row → all displayed steps cleared, none current (
     completed_stages: onboarding.STAGES,
     started_at: '2026-05-01T00:00:00Z',
     completed_at: '2026-05-05T00:00:00Z',
-  }, { discordLinked: false, boxConnected: false, cliAuthed: false }); // proves display steps don't gate graduation
+  }, { discordLinked: false, cliAuthed: false }); // proves display steps don't gate graduation
   assert.equal(out.graduated, true);
-  assert.equal(out.progress.cleared, 5);
-  assert.equal(out.progress.total, 5);
+  assert.equal(out.progress.cleared, 4);
+  assert.equal(out.progress.total, 4);
   assert.ok(out.stages.every((s) => s.cleared === true));
   assert.ok(out.stages.every((s) => s.is_current === false));
 });
@@ -329,9 +315,9 @@ test('graduation is engine-only (display signals never gate it)', async () => {
   }
   const state = await onboarding.getState(c, 60);
   assert.equal(state.current_stage, 'graduated');
-  // graduated:true even with discordLinked/boxConnected/cliAuthed false — proves
+  // graduated:true even with discordLinked/cliAuthed false — proves
   // the display-only steps never gate the xenos→thetes promotion (#692).
-  const shaped = onboarding.shapeForApi(state, { discordLinked: false, boxConnected: false, cliAuthed: false });
+  const shaped = onboarding.shapeForApi(state, { discordLinked: false, cliAuthed: false });
   assert.equal(shaped.graduated, true);
   assert.ok(shaped.stages.every((s) => s.cleared === true));
 });

package/tests/paste_token_session_store.mjs

@@ -139,7 +139,7 @@ test('pasting a token for instance B PRESERVES instance A — the bug this close
       assert.equal(stored.token, 'B'.repeat(64));
 
       // 3. The active pointer still follows the paste, in the same place every existing
-      //    reader (skills, hooks, the dev box) looks. The fix is additive or it is a
+      //    reader (skills, hooks) looks. The fix is additive or it is a
       //    different, quieter outage.
       const pointer = readJson(active);
       assert.equal(pointer.api_base, base, 'the active pointer must follow the paste');

package/tests/permission_path.mjs

@@ -73,9 +73,6 @@ t('#863-followup: newly-added protected surfaces are covered (findings #3/#9/#10
     '.husky/pre-push',
     '.husky/pre-commit',
     'modules/grading/grader-workers/hacker.js',
-    'modules/dev-box/boxes.js',
-    'modules/dev-box/box-access.js',
-    'modules/dev-box/box-credential.js',
   ];
   for (const f of newlyProtected) {
     const hits = ppc.matchProtected([f]);

package/tests/platform_boot.mjs

@@ -178,7 +178,7 @@ test('R56: the served hall injects window.__BRANDING__ synchronously', async ()
 });
 
 test('R60: the served hall injects window.__MODULES__ (feature-module flags) synchronously', async () => {
-  // The hall's dev-box/discord UI gating (R60, task 1199) reads
+  // The hall's discord UI gating (R60, task 1199) reads
   // window.__MODULES__.enabled[...]; serve-internal must inject it the same
   // synchronous way as __BRANDING__, or the frontend gate has nothing to read.
   const res = await request('/', 'builders.test.local');
@@ -189,7 +189,6 @@ test('R60: the served hall injects window.__MODULES__ (feature-module flags) syn
   assert.ok(m, 'a __MODULES__ assignment is present');
   const parsed = JSON.parse(m[1]);
   assert.equal(typeof parsed.enabled, 'object');
-  assert.equal(typeof parsed.enabled['dev-box'], 'boolean');
   assert.equal(typeof parsed.enabled.discord, 'boolean');
 });
 

package/tests/platform_visibility_gate.mjs

@@ -162,7 +162,7 @@ test('the exempt list: the door, the manifest, the probes, the downloads — on
     '/api/gds/instance', '/api/bongos/instance', '/api/gds/healthz',
     '/api/bongos/provisioning/tls-check', '/api/gds/provisioning/health',
     '/healthz', '/version', '/metrics', '/__stealth',
-    '/downloads/bongos/install.sh', '/downloads/devbox/latest.json',
+    '/downloads/bongos/install.sh', '/downloads/bongos/latest.json',
     // Express routes case-insensitively and with a trailing slash — the list sees what the router sees
     '/API/GDS/INSTANCE', '/api/gds/instance/', '/HEALTHZ', '/api/bongos/auth/',
   ]) assert.equal(isExempt(p), true, `${p} must answer a stranger`);

package/tests/profile_route.mjs

@@ -4,7 +4,7 @@
 // goal 25 "bx-identity"). The route is intentionally UNAUTHENTICATED, so its one
 // load-bearing invariant is that it must NEVER leak the private columns that
 // db.getBuilderById also returns (anthropic_email / anthropic_user_id /
-// monthly_budget_usd / system_role / box_blocked* / deactivated_reason). It
+// monthly_budget_usd / system_role / deactivated_reason). It
 // whitelists a public subset off the row; this test proves the whitelist holds,
 // that the shape is right, and that unknown/invalid ids answer 404/400.
 //
@@ -74,17 +74,12 @@ const FULL_ROW = {
   anthropic_email: SECRET_EMAIL,
   anthropic_user_id: SECRET_USER,
   monthly_budget_usd: 500,
-  box_blocked: true,
-  box_blocked_reason: SECRET_REASON,
-  box_blocked_at: '2026-01-01T00:00:00.000Z',
-  box_blocked_by: 7,
 };
 
 // The columns that must NEVER appear on the returned builder object.
 const PRIVATE_KEYS = [
   'github_id', 'status', 'deactivated_at', 'reactivated_at', 'deactivated_reason',
   'system_role', 'anthropic_email', 'anthropic_user_id', 'monthly_budget_usd',
-  'box_blocked', 'box_blocked_reason', 'box_blocked_at', 'box_blocked_by',
 ];
 // The public subset the route DOES return.
 const PUBLIC_KEYS = [