@bongos/core 1.19.1074 → 1.19.1075

package/scripts/gds/context-pack.js

@@ -31,13 +31,11 @@ const path = require('node:path');
 // so importing it from a CLI is safe — same precedent as next-number.js reading
 // the repo tree directly. This is the "not hand-maintained" guarantee.
 //
-// OPTIONAL, because the file may not be ON DISK (task 1003085). A task-scoped box
-// (ADR 0148) materializes modules/<key> only for the modules the CLAIM puts in
-// scope, so on a box with NO active claim modules/lifecycle is absent and this
-// require threw MODULE_NOT_FOUND at import time. That killed /builder-start AND
-// /builder-claim — the exact two commands needed to escape the state, since the
-// claim is what would fetch the module. A deadlock, escapable only by calling
-// POST /claims with curl. The header's FAIL-OPEN promise ("must NEVER throw or
+// OPTIONAL, because the file may not be ON DISK (task 1003085). A sparse checkout
+// can lack modules/lifecycle, and when it did this require threw
+// MODULE_NOT_FOUND at import time. That killed /builder-start AND /builder-claim
+// — the two commands a builder needs to recover — leaving a deadlock escapable
+// only by calling POST /claims with curl. The header's FAIL-OPEN promise ("must NEVER throw or
 // block a claim") was already the right rule; this require was the line that did
 // not keep it.
 //

package/scripts/gds/doctor.js

@@ -371,7 +371,7 @@ function checkDeployTooling() {
   }
 
   // ADR 0055 / task 1025: in ci mode there are two publish paths. A machine with
-  // no GitHub push credential (a dev box) ships SERVER-MEDIATED — it uploads its
+  // no GitHub push credential ships SERVER-MEDIATED — it uploads its
   // branch to the GDS, which pushes + opens the PR with the server's credential —
   // so gh is NOT needed here. Resolve the same path ship.js will take and skip the
   // gh requirement when it's server-mediated.
@@ -382,7 +382,7 @@ function checkDeployTooling() {
     /* keep 'local'; the gh checks below are the safe, stricter default */
   }
   if (via === 'server') {
-    ok('deploy', `Deploy mode: ci (server-mediated publish) — this machine has no GitHub push credential, so the GDS pushes your branch + opens the PR for you. gh is not required here. NOTE: on a dev box, run /builder-reauth (browser) first so your session is a real cli session, not the box-scoped one.`);
+    ok('deploy', `Deploy mode: ci (server-mediated publish) — this machine has no GitHub push credential, so the GDS pushes your branch + opens the PR for you. gh is not required here.`);
     return;
   }
 
@@ -425,7 +425,7 @@ function checkDeployTooling() {
 
 // Intent-runner drift (task 1002722): a runner on a stale core once turned a domain-attach
 // into a teardown (task 1002716). Only a host with *intent-runner* units shows this section,
-// so a builder laptop or dev box sees nothing.
+// so a builder laptop sees nothing.
 function runnerDriftRows(results) {
   return (results || []).map((r) => {
     const msg = `${r.name}: ${r.reason}`;

package/scripts/gds/fitness-checks-packaging.js

@@ -24,7 +24,7 @@ const { CORE_ROOT, rel, walkJs, walkJsAllRoots } = require('./fitness-lib.js');
 // ============================================================================
 //
 // A vanilla self-host boot ships only the PUBLISHABLE tree (publish-manifest.js). An
-// instance-only config (config/devbox-app.json, config/bongos-cli.json, config/branding.json,
+// instance-only config (config/bongos-cli.json, config/branding.json,
 // config/modules.json, …) is boundary-EXCLUDED, so a bare `require('../../config/<excluded>.json')`
 // in core code throws MODULE_NOT_FOUND and CRASHES the boot on a fresh instance — the exact
 // class that shipped in R88 (two hard-requires in src/bongos/serve-internal.js; task 1824). The
@@ -81,9 +81,9 @@ function checkCoreRequiresExcludedConfig() {
 // require()s a boundary-EXCLUDED module (modules/game, modules/art-pipeline,
 // modules/character-anim, …) throws MODULE_NOT_FOUND once that module lives in the
 // consumer's instance repo rather than the core package (R89 split). The cure is
-// either to reclassify the module INTO core (if it belongs there — e.g. provisioning,
-// sibling of dev-box) or to exclude the requiring file with the feature it serves
-// (art tooling). Catches BOTH require forms: a direct literal
+// either to reclassify the module INTO core (if it belongs there — e.g. provisioning)
+// or to exclude the requiring file with the feature it serves (art tooling).
+// Catches BOTH require forms: a direct literal
 // require('../modules/<key>/…') AND a require(path.join(<root>, 'modules/<key>/…')).
 // Only an EXCLUDED module required from a PUBLISHABLE file is a violation; requiring a
 // publishable (core) module is fine, and the loader's DYNAMIC dispatch

package/scripts/gds/fitness-ratchets.js

@@ -350,7 +350,7 @@ const METRIC_HINTS = {
   legacy_api_gds_callers:
     ' — a NEW in-repo caller was written against the permanent `/api/gds` alias (task 1004064, '
     + 'idea 1001030). Ask for `/api/bongos` instead: the alias exists for callers we CANNOT update '
-    + '(shipped Dev Box binaries, live dev boxes), not for code in this repo. Run '
+    + '(shipped binaries, live instances), not for code in this repo. Run '
     + '`node scripts/gds/api-alias-caller-scan.js --files` to see every counted line. The alias '
     + 'contract, the pinned OAuth callbacks, the uptime poller + smoke, the rename guardrails, '
     + 'tests/, docs/, migrations/ and captured fixtures are excluded by construction — and so is '

package/scripts/gds/gen-api-client.js

@@ -208,8 +208,8 @@ function stripEsmExports(esm) {
     .replace(/^export default createClient;\n?/m, '');
 }
 
-// index.cjs — for Node consumers that use require() (e.g. the devbox Electron
-// app, which is a zero-dep CJS subproject and vendors this file at package time).
+// index.cjs — for Node consumers that use require() (e.g. a zero-dep CJS subproject
+// that vendors this file at package time).
 function renderClientCjs(esm) {
   const header =
     '// @bongos/client (CommonJS build) — GENERATED from index.mjs by\n' +
@@ -394,8 +394,8 @@ function renderPackageJson(spec) {
     // updated while the API it is generated FROM moved 500+ core versions. It had zero consumers
     // the whole time: nothing across the core or any instance repo ever declared it as a
     // dependency — every consumer VENDORS a copy instead. That was two places when this was
-    // written; task 1003891 deleted the Dev Box Electron app and ADR 0324 retired
-    // @cloudbongos/cli, so there is now no vendoring consumer left at all. The
+    // written; both have since been deleted or retired (ADR 0324 retired
+    // @cloudbongos/cli), so there is now no vendoring consumer left at all. The
     // owner removed it from the registry on 2026-09-09.
     //
     // The manifest itself stays: `main`/`types`/`exports` are what make the vendored copy and a

package/scripts/gds/gen-api-docs.js

@@ -837,7 +837,7 @@ function buildOpenapi(model) {
       license: { name: 'AGPL-3.0-or-later', url: 'https://www.gnu.org/licenses/agpl-3.0.html' },
       description: [
         `The Bongos API — the build-methodology backend`,
-        `(builders, tasks, claims, credits, grading, memory, dev boxes).`,
+        `(builders, tasks, claims, credits, grading, memory).`,
         ``,
         `**API version:** \`${API_VERSION}\` — served at \`${VERSIONED_API_PREFIX}\`. The`,
         `unversioned \`${API_PREFIX}\` and legacy \`/api/gds\` are permanent aliases`,

package/scripts/gds/gen-repo-map.js

@@ -11,7 +11,7 @@
 //       interpretive prose stays put while the file list / signatures can't silently drift.
 //
 // Zero-dependency on purpose: the codebase is CommonJS JS, and a portable-core capability must
-// regenerate in CI and on every dev box with no native build / no node-gyp / no WASM grammar to
+// regenerate in CI and on any checkout with no native build / no node-gyp / no WASM grammar to
 // fetch (the whole point of Paths B+C is keeping every instance navigable cheaply). A line+regex
 // extractor is accurate enough for an *advisory* navigation aid (it is not a compiler input). A
 // richer tree-sitter/WASM backend can slot in behind extractFile() later for polyglot instances
@@ -25,9 +25,9 @@
 //   node scripts/gds/gen-repo-map.js --check-block # exit 2 only if a TRACKED nested block would change (the CI gate)
 //   node scripts/gds/gen-repo-map.js --check-whole # exit 2 only if docs/repo-map.md would change
 //   node scripts/gds/gen-repo-map.js --whole-only  # WRITE docs/repo-map.md only; never touch the
-//                                                  # tracked nested blocks (what a SPARSE dev-box
+//                                                  # tracked nested blocks (what a SPARSE
 //                                                  # checkout must use — task 1002962)
-// docs/repo-map.md is GITIGNORED + regenerated at deploy/box-fetch since ADR 0110 (task 1926);
+// docs/repo-map.md is GITIGNORED + regenerated at deploy since ADR 0110 (task 1926);
 // only the nested-doc symbol blocks stay tracked, so CI gates the block bucket, not the whole file.
 //   node scripts/gds/gen-repo-map.js --json       # print the extracted model as JSON (debug)
 
@@ -458,7 +458,7 @@ function injectBlock(existing, block) {
 function main() {
   // Two artifact BUCKETS, gated separately since ADR 0110 (task 1926):
   //   • 'whole' — docs/repo-map.md, which is now GITIGNORED and regenerated at
-  //     deploy / box-source-fetch (the gen-atlas.js model), so it carries no
+  //     deploy (the gen-atlas.js model), so it carries no
   //     committed copy and two parallel branches can never collide on it.
   //   • 'block' — the generated symbol BLOCK inside each nested CLAUDE.md, which
   //     stays hand-written prose + a tracked block, so it MUST stay fresh in git.
@@ -472,16 +472,15 @@ function main() {
   // 1002962). --whole-only regenerates the GITIGNORED docs/repo-map.md and leaves
   // the TRACKED nested blocks alone.
   //
-  // WHY a caller ever needs this: a dev box is a SPARSE checkout (box-access.js
-  // materializes only the claim's module cone). The block ordering is
-  // `b.refs - a.refs || name`, and `refs` counts references across the VISIBLE
-  // corpus — so a box with 7 of 20 modules computes different counts and emits a
-  // legitimately different block. Written into a tracked file that dirties the
-  // working tree, and box-source-fetch.sh's NEXT `git pull` aborts with "local
-  // changes would be overwritten" — a silent, permanent sync deadlock (one box sat
-  // 257 commits behind for three days). A box CONSUMES these blocks; they arrive
-  // correct with the pull, generated by CI from the whole tree. Only a full
-  // checkout may produce them.
+  // WHY a caller ever needs this: a SPARSE checkout materializes only part of the
+  // tree. The block ordering is `b.refs - a.refs || name`, and `refs` counts
+  // references across the VISIBLE corpus — so a checkout with 7 of 20 modules
+  // computes different counts and emits a legitimately different block. Written
+  // into a tracked file that dirties the working tree, and the NEXT `git pull`
+  // aborts with "local changes would be overwritten" — a silent, permanent sync
+  // deadlock (one checkout sat 257 commits behind for three days). A sparse
+  // checkout CONSUMES these blocks; they arrive correct with the pull, generated
+  // by CI from the whole tree. Only a full checkout may produce them.
   const wholeOnly = process.argv.includes('--whole-only');
   const model = buildModel();
 

package/scripts/gds/gen-session-index.js

@@ -26,8 +26,8 @@
 //   node scripts/gds/gen-session-index.js --check-block # exit 2 only if the tracked CLAUDE.md §13 snippet drifts (CI gate)
 //   node scripts/gds/gen-session-index.js --check-whole # exit 2 only if docs/session-log-index.md drifts
 //   node scripts/gds/gen-session-index.js --whole-only  # WRITE the index only; never touch the tracked
-//                                                       # CLAUDE.md snippet (sparse dev-box use; task 1002962)
-// docs/session-log-index.md is GITIGNORED + regenerated at deploy/box-fetch since ADR 0110 (task 1926).
+//                                                       # CLAUDE.md snippet (sparse-checkout use; task 1002962)
+// docs/session-log-index.md is GITIGNORED + regenerated at deploy since ADR 0110 (task 1926).
 //   node scripts/gds/gen-session-index.js --json       # print the parsed entries as JSON (debug)
 
 const fs = require('node:fs');
@@ -164,7 +164,7 @@ function computeWrites() {
   const writes = [];
 
   // Two buckets (ADR 0110, task 1926): 'whole' = docs/session-log-index.md, now
-  // GITIGNORED + regenerated at deploy/box-fetch (no committed copy → no branch
+  // GITIGNORED + regenerated at deploy (no committed copy → no branch
   // collisions); 'block' = the bounded CLAUDE.md §13 snippet, still tracked, so it
   // stays a HARD CI gate. main() gates them separately (--check-block vs --check-whole).
   const idxNext = renderIndex(entries);
@@ -197,11 +197,11 @@ function main() {
     return;
   }
   // WRITE-side bucket selection — the sibling of the --check-* flags (task 1002962,
-  // the gen-repo-map --whole-only twin). A dev box is a SPARSE checkout, so writing
-  // the TRACKED bucket there dirties the tree and the next `git pull` in
-  // box-source-fetch.sh aborts on "local changes would be overwritten" — a silent,
-  // permanent sync deadlock. A box regenerates only the gitignored artifact; the
-  // tracked CLAUDE.md §13 snippet arrives with the pull, generated from the whole tree.
+  // the gen-repo-map --whole-only twin). On a SPARSE checkout, writing the TRACKED
+  // bucket dirties the tree and the next `git pull` aborts on "local changes would
+  // be overwritten" — a silent, permanent sync deadlock. A sparse checkout
+  // regenerates only the gitignored artifact; the tracked CLAUDE.md §13 snippet
+  // arrives with the pull, generated from the whole tree.
   const wholeOnly = process.argv.includes('--whole-only');
   const all = computeWrites().writes;
   const writes = wholeOnly ? all.filter((w) => w.bucket === 'whole') : all;

package/scripts/gds/leak-scan-allowlist.js

@@ -167,7 +167,7 @@ const FILE_ALLOWLIST = [
     path: 'tests/lib_sh_resolution.mjs',
     classes: ['token'],
     reason:
-      'Carries the host-identity scan pattern it runs over the baked box scripts — a detector '
+      'Carries the host-identity scan pattern it runs over the bash smoke scripts — a detector '
       + 'pattern, the same case as fitness-checks-identity.js.',
   },
   {

package/scripts/gds/plain-cards.js

@@ -8,7 +8,7 @@
 // what happened, what the agent will do next, whether a PERSON is needed (and who), and
 // whether this is a rule rather than a fault. That last one is the expensive mistake:
 // an agent that reads a deliberate restriction as breakage goes looking for a way round
-// it (the box session that asked the owner for a personal access token).
+// it (the agent that asked the owner for a personal access token).
 //
 // STATIC TEXT ONLY. A card interpolates nothing — no task title, no server message — so
 // printing it adds no prompt-injection surface (the strand-watch / push-path-brief rule).

package/scripts/gds/push-path-brief.js

@@ -4,19 +4,19 @@
 // scripts/gds/push-path-brief.js — say out loud, at session start, that this machine
 // cannot push (task 1003259 / idea 1000838).
 //
-// THE GAP. On 2026-08-24 a dev-box agent hit auth failures on every raw git probe,
-// concluded "no push credential exists", and asked the owner to mint a fine-grained
-// PAT and store it in ~/.git-credentials on the box — the exact anti-pattern the
-// server-mediated publish path (ADR 0055) exists to avoid. The agent was not being
-// careless: from inside a box every direct GitHub probe fails BY DESIGN (the clone
-// token is one-shot and scrubbed from .git/config after each fetch — ADR 0031 §6),
+// THE GAP. On 2026-08-24 an agent on a credential-less checkout hit auth failures on
+// every raw git probe, concluded "no push credential exists", and asked the owner to
+// mint a fine-grained PAT and store it in ~/.git-credentials — the exact anti-pattern
+// the server-mediated publish path (ADR 0055) exists to avoid. The agent was not being
+// careless: on that checkout every direct GitHub probe failed BY DESIGN (the
+// clone token was one-shot and scrubbed from .git/config after each fetch — ADR 0031 §6),
 // so "missing credential" is the only story the local evidence supports, and the true
 // state at the time (branch already pushed, PR open, CI red) was invisible to it.
-// Nothing the box session loads says the model out loud. This says it out loud.
+// Nothing the session loads says the model out loud. This says it out loud.
 //
 // SO: the third SessionStart truth-teller, beside deploy-divergence.js and
 // strand-watch.js. On the server-publish path (pushVia() 'server' — no authenticated
-// gh, i.e. a dev box or any credential-less checkout) it prints ONE line stating the
+// gh, i.e. any credential-less checkout) it prints ONE line stating the
 // credential model and where the truth about published work lives
 // (GET /api/bongos/tasks/:id/publish-status). On a laptop that pushes locally
 // (pushVia() 'local') it prints NOTHING — a line that fires on every healthy laptop
@@ -58,7 +58,7 @@ function briefLine(via) {
 
 // Lazy require so a broken or partial checkout degrades to silence, not a stack
 // trace injected into the session. pushVia() honors <PREFIX>_PUSH_VIA_SERVER, else
-// probes for an authenticated gh (absent on every box → 'server' instantly).
+// probes for an authenticated gh (absent on a credential-less checkout → 'server' instantly).
 function detectVia() {
   return require('./ship-deploy-target.js').pushVia();
 }
@@ -70,7 +70,7 @@ function report(via) {
   console.log('  Publish path');
   console.log('  ──────────────────────────────────────────────────────────');
   if (via === 'server') {
-    console.log('  server-mediated (no authenticated gh — a dev box or credential-less checkout).');
+    console.log('  server-mediated (no authenticated gh — a credential-less checkout).');
     console.log(`  ${BRIEF}`);
     for (const line of plainCardLines('no_push_credential')) console.log(line);
   } else if (via === 'local') {

package/scripts/gds/rename-history-check.js

@@ -45,7 +45,7 @@
 //      notices if a blanket find-replace rewrites them. This does.
 //
 //   4. ALIAS MOUNTS — '/api/gds' is a PERMANENT alias (src/bongos/api-prefix.js
-//      says never to remove it: shipped Dev Box binaries and live dev boxes
+//      says never to remove it: shipped binaries and live instances
 //      call it and cannot be force-updated). Asserted against the real exported
 //      mount list. The DISPATCH half — that the alias is a live mount and so
 //      gets no corrective 404 hint — is already covered by

package/scripts/gds/session-digest-build.js

@@ -155,7 +155,7 @@ function buildSessionDigest(entries, opts = {}) {
         mu.input += tin; mu.output += tout; mu.cache_read += tcr; mu.cache_creation += tcc;
       } else {
         // task 1676: a token-bearing turn with NO model id. Previously dropped
-        // from model_usage (→ total_tokens>0 but priced $0 on the dev-box/CI
+        // from model_usage (→ total_tokens>0 but priced $0 on the CI
         // path; ADR 0097). Accumulate the unlabeled tokens so the digest can
         // attribute them to a real, priceable family bucket after the loop.
         m._unlabeled.input += tin; m._unlabeled.output += tout;
@@ -233,7 +233,7 @@ function buildSessionDigest(entries, opts = {}) {
   m.total_tokens = m.tokens.input + m.tokens.output + m.tokens.cache_read + m.tokens.cache_creation;
   // task 1676 — cost-plus reward zero-out fix. The cost-plus session reward
   // (ADR 0054) prices `model_usage` server-side. model_usage is keyed on msg.model
-  // and SKIPS any token-bearing turn whose model id is missing. On the dev-box/CI
+  // and SKIPS any token-bearing turn whose model id is missing. On the CI
   // agent path that gap was the difference between total_tokens>0 (so the digest
   // passes the route's empty-session guard + gets stored) and model_usage={} (so
   // priceModelUsage returns $0 → 0 drachmae) — ADR 0097's "upload no priced model

package/scripts/gds/ship-deploy-target.js

@@ -32,7 +32,7 @@ const { REPO_ROOT } = require('./ship-state.js');
 //      `bongos upgrade` (pin-bump), NOT an SSH deploy (ADR 0108). When a target IS
 //      set it requires that host's SSH key, so only the operator can land.
 //
-//   'ci' — NO builder box holds the prod key. ship pushes the branch, opens a
+//   'ci' — NO builder machine holds the prod key. ship pushes the branch, opens a
 //      PR, and enables GitHub auto-merge; once required checks pass, GitHub
 //      merges to main and .github/workflows/deploy-prod.yml deploys from
 //      Actions. ship then CONFIRMS the deploy landed (PR merged + the
@@ -62,8 +62,8 @@ function parseDeployMode(envVal, configRaw) {
 // effectiveDeployMode — credential- and protection-aware adjustment of the parsed
 // mode (pure; exported for the regression test). The 'laptop' land path pushes
 // main + SSHes the droplet FROM THIS MACHINE, so it requires a local GitHub push
-// credential. A machine without one — a dev box, or a fresh/stale local clone that
-// can't even `git pull` (token-less origin, ADR 0053) — physically cannot run it;
+// credential. A machine without one — a fresh/stale local clone that can't
+// even `git pull` (token-less origin, ADR 0053) — physically cannot run it;
 // it must ship via the 'ci' server-mediated publish path instead
 // (pushVia()==='server', ADR 0055), which lets the GDS server push with its own
 // credential. So when the parsed mode is 'laptop' but the machine can't push
@@ -314,10 +314,10 @@ function fetchDeployedVersion(url = deployedVersionUrl()) {
 // pushVia — which publish path ship uses in 'ci' mode (ADR 0055 / task 1025):
 //   'local'  — this machine pushes the branch + opens the PR with git + gh
 //              (laptop: gh present + authenticated). Today's behaviour.
-//   'server' — this machine has NO GitHub push credential (a dev box: no gh, a
+//   'server' — this machine has NO GitHub push credential (no gh, a
 //              credential-less origin). ship uploads a thin branch bundle to the
 //              GDS, which pushes + opens the PR + auto-merges with the SERVER's
-//              credential. The box holds nothing (#919 model preserved).
+//              credential. This machine holds nothing (#919 model preserved).
 // Override with <PREFIX>_PUSH_VIA_SERVER=1 (force server) / =0 (force local) for tests.
 function ghAvailableAndAuthed() {
   try {
@@ -338,15 +338,15 @@ function pushVia() {
   if (o === '1') return 'server';
   if (o === '0') return 'local';
   // No explicit override: a machine that can run an authenticated gh (laptop)
-  // takes the local path; everything else (a dev box) goes server-mediated.
+  // takes the local path; everything else goes server-mediated.
   return ghAvailableAndAuthed() ? 'local' : 'server';
 }
 
 // broadcastHandledByServer — task 1045: on the server-mediated publish path the
 // SERVER posts the Discord ship-broadcast after it confirms the deploy (it holds
-// the webhook secrets; the box does NOT — ADR 0053). So ship.js must NOT also post
-// locally there, or the box would either double-post (impossible — no secret) or,
-// as before, fail silently. True only when the publish actually goes server-side:
+// the webhook secrets; the local machine does NOT — ADR 0053). So ship.js must NOT
+// also post locally there, or this machine would either double-post (impossible — no
+// secret) or, as before, fail silently. True only when the publish actually goes server-side:
 // ci deploy mode AND this machine has no GitHub push credential (pushVia 'server').
 // The laptop path (pushVia 'local') keeps posting locally, exactly as today. Pure
 // w.r.t. its inputs (env + committed deploy.json) + exported so the gate is tested.
@@ -355,12 +355,12 @@ function broadcastHandledByServer() {
 }
 
 // shouldBailOnFetchFailure — autoMerge's decision when `git fetch origin main`
-// fails. A credential-less dev box (private origin, scrubbed clone token —
+// fails. A credential-less checkout (private origin, no creds —
 // ADR 0053) CANNOT fetch origin, and that is FINE for the server-mediated
-// publish path (ADR 0055): ciLandServer bundles against the box's LOCAL
+// publish path (ADR 0055): ciLandServer bundles against this machine's LOCAL
 // origin/main and the SERVER tops up main with its own credential. So a fetch
-// failure is fatal ONLY when we are NOT taking that path — otherwise the box can
-// never reach ciLand and strands every ship at confirmed (the bug task 1027
+// failure is fatal ONLY when we are NOT taking that path — otherwise such a
+// machine can never reach ciLand and strands every ship at confirmed (the bug task 1027
 // surfaced: ADR 0055 shipped the server path but left this fetch guard in front
 // of it). Pure + exported for the regression test (no git, no network).
 // NOTE: callers must still guard the pushVia() gh-probe behind `!fetchedMain` so

package/scripts/gds/ship-flow.js

@@ -318,7 +318,7 @@ async function shipMain() {
 
   // ---- Module drift check (BV1.R53, task 1422) ----
   // If the task carries a module_key, verify the committed diff doesn't stray
-  // into a DIFFERENT module's territory. "You said game, you touched dev-box" is
+  // into a DIFFERENT module's territory. "You said game, you touched provisioning" is
   // the semantic violation this catches. Files no module owns are allowed —
   // they're cross-cutting — as is the territory of a CROSS-CUTTING module, which
   // every craft legitimately writes into. Only contact with a different OWNING

package/scripts/gds/ship-land.js

@@ -274,11 +274,11 @@ function reconciledCardStatus(liveStatus, preMergeStatus) {
   return liveStatus === 'shipped' ? 'shipped' : preMergeStatus;
 }
 
-// task 1052 (E): the box-appropriate next step when a ship lands the task at
-// 'confirmed' without finishing. A dev box (pushVia 'server' — no authed gh)
-// CANNOT run /merge-mode (it needs gh + a main checkout), so the old "for
-// /merge-mode" advice was a dead end ON A BOX (the #1027 retrospective: the agent
-// had to reverse-engineer recovery from source). Point a box at the resume
+// task 1052 (E): the machine-appropriate next step when a ship lands the task at
+// 'confirmed' without finishing. A machine with no push credential (pushVia 'server' —
+// no authed gh) CANNOT run /merge-mode (it needs gh + a main checkout), so the old
+// "for /merge-mode" advice was a dead end there (the #1027 retrospective: the agent
+// had to reverse-engineer recovery from source). Point such a machine at the resume
 // instead (task 941); a laptop keeps /merge-mode (with resume as the alternative).
 // Pure + exported for unit tests.
 function strandNextStep(taskId, via) {
@@ -371,7 +371,7 @@ function prAssigneeLine(login) {
 }
 
 // task 1003988 — what to tell a builder while their PR sits RED. The poll used to
-// wait out its nine minutes in silence, so a credential-less box learned only that
+// wait out its nine minutes in silence, so a credential-less checkout learned only that
 // the land was "pending" and pushed the same commit again (PR 922: nine red runs).
 // `md` is publish-status's merge_driver; null means nothing red to report. Pure +
 // exported so the wording is pinned by tests/unit_report_status.mjs.

package/scripts/gds/ship-merge.js

@@ -103,7 +103,7 @@ function regenerateShipArtifacts() {
   regenerateCopyInventory();
   // Refresh the generated OpenAPI spec + API reference from the shipped route tree (task 1918).
   regenerateApiDocs();
-  // ...then the typed client FROM that spec (+ the devbox vendored copy) on the same beat (task 2051).
+  // ...then the typed client FROM that spec on the same beat (task 2051).
   regenerateApiClient();
 }
 
@@ -168,10 +168,10 @@ async function mergeLocally(taskId, valueSummary, { dbOnly = false } = {}) {
   // nothing to push, merge, or deploy. Short-circuit so the caller's POST
   // /tasks/:id/ship still flips status to shipped instead of stranding the
   // task at confirmed forever.
-  // A credential-less dev box can't `git fetch origin main` (private origin, no
+  // A credential-less checkout can't `git fetch origin main` (private origin, no
   // creds — ADR 0053), but that's only fatal OFF the server-publish path: the
-  // box's ADR-0055 path bundles against its LOCAL origin/main and the server tops
-  // up main. Without this, the box dead-ends here and strands every ship at
+  // ADR-0055 path bundles against its LOCAL origin/main and the server tops
+  // up main. Without this, such a checkout dead-ends here and strands every ship at
   // confirmed (task 1027). The `!fetchedMain &&` short-circuit keeps the gh-probe
   // (pushVia) off the happy laptop path, so laptop behavior is byte-for-byte.
   const fetchedMain = shellOk('git fetch origin main');

package/scripts/gds/ship-preflight-steps.js

@@ -238,22 +238,22 @@ function decidePreMerge({ branch, behind, via }) {
   if (!branch || branch === 'main' || branch === 'HEAD') {
     return { action: 'skip', reason: `not on a feature branch (${branch})` };
   }
-  // Server-mediated publish (ADR 0055): a credential-less partial-clone dev box
+  // Server-mediated publish (ADR 0055): a credential-less partial-clone checkout
   // (blob:none, HTTPS origin, no gh/credential-helper — ADR 0053) CANNOT run a
   // local `git merge origin/main` — the ort merge lazily fetches main's blobs
   // from the promisor remote and there are no credentials to authenticate that
-  // fetch, so the box strands here and can never ship while behind main, i.e.
+  // fetch, so such a checkout strands here and can never ship while behind main, i.e.
   // ≈always (idea #364). It also does not NEED to: ciLandServer bundles
   // `origin/main..HEAD` and the SERVER reconciles the branch with the real main
   // when it pushes + opens + auto-merges the PR; a genuine conflict surfaces
   // server-side as merge_conflict (publish-reconciler / conflict-resolve,
   // ADR 0082). The local pre-merge (#1068) is a LAPTOP-path optimization (so the
   // sandbox-reviewed tree == the shipped tree); it stays exactly as-is there
-  // (via 'local'/undefined) and is simply skipped on the box.
+  // (via 'local'/undefined) and is simply skipped on the server path.
   if (via === 'server') {
     return {
       action: 'skip',
-      reason: 'server-mediated publish reconciles with origin/main server-side (credential-less partial-clone box cannot fetch main blobs locally — idea #364)',
+      reason: 'server-mediated publish reconciles with origin/main server-side (credential-less partial-clone checkout cannot fetch main blobs locally — idea #364)',
     };
   }
   if (!Number.isFinite(behind) || behind === 0) {

package/scripts/gds/ship-regen.js

@@ -26,21 +26,21 @@ function currentBranch() {
 //
 // Returns a status string ('skipped-server' | 'regen-failed' | 'current' |
 // 'committed' | 'committed-nofatal') so the regression test (task 1046) can
-// prove the dev-box skip without git or a headless browser.
+// prove the server-publish skip without git or a headless browser.
 function regenerateDiagrams() {
-  // task 1046: on the server-mediated-publish path (a dev box — pushVia 'server'),
+  // task 1046: on the server-mediated-publish path (pushVia 'server'),
   // there is no headless browser, so render-diagrams.sh fails and gen-diagrams.js
   // exits non-zero AFTER writing the regenerated .mmd + assertions.json — which
   // shellOk() then treats as a failed regen and returns BEFORE the commit below,
   // leaving those files UNCOMMITTED in the builder's tree (had to be reverted by
-  // hand). The box must not attempt the regen at all: skip here and let a
+  // hand). That path must not attempt the regen at all: skip here and let a
   // render-capable ship (the laptop path, which CAN render the PNGs) refresh them
   // as a matched .mmd+.png+assertions set; the diagram-drift routine backstops any
   // staleness in the meantime. Skipping entirely (vs --no-render) avoids committing
   // a .mmd/.png mismatch to main. Mirrors gen-diagrams.js's own non-fatal skip when
   // bash itself is absent (ENOENT).
   if (pushVia() === 'server') {
-    console.log('  diagram regen skipped on the dev-box ship path (no GDS session for the conceptual diagrams) — a full-clone ship refreshes the .mmd; drift checker backstops staleness');
+    console.log('  diagram regen skipped on the server-publish ship path (no GDS session for the conceptual diagrams) — a full-clone ship refreshes the .mmd; drift checker backstops staleness');
     return 'skipped-server';
   }
   // ADR 0110 pt.3 (task 2027): the .svg/.png RENDERS are now gitignored and
@@ -74,7 +74,7 @@ function regenerateDiagrams() {
 
 // task 1224 (Path B / ADR 0063): refresh the generated symbol skeleton from the shipped tree so the
 // altitude map can't drift. Pure JS (no headless browser, no render) — unlike the diagrams it is safe
-// on EVERY ship path, including the dev-box server-publish path. Non-fatal: a hiccup must never block
+// on EVERY ship path, including the server-publish path. Non-fatal: a hiccup must never block
 // a ship. ADR 0110 (task 1926): docs/repo-map.md is now GITIGNORED + regenerated at deploy — the
 // generator still WRITES it (untracked, harmless), but ship commits ONLY the tracked nested-doc
 // blocks. It is deliberately absent from the git add/status lists below: `git add <ignored path>`
@@ -101,12 +101,12 @@ function regenerateRepoMap() {
 
 // Refresh the generated session-log index (docs/session-log-index.md) + the bounded CLAUDE.md §13
 // "recent sessions" snippet from the shipped tree's docs/session-logs/*.md (ADR 0062 §8, task 1226).
-// Pure JS (reads files, no DB, no headless browser) — safe on EVERY ship path including the dev-box
+// Pure JS (reads files, no DB, no headless browser) — safe on EVERY ship path including the
 // server-publish path. Non-fatal: a hiccup must never block a ship; the Path-C CI gate
 // (`gen-session-index --check`) backstops staleness on main.
 // Refresh the generated API docs (docs/api/openapi.json + docs/api-reference.md +
 // docs/routes-permissions.md) from the shipped route tree (task 1918). Pure JS (reads
-// route files, no DB, no headless browser) — safe on EVERY ship path incl. the dev-box
+// route files, no DB, no headless browser) — safe on EVERY ship path incl. the
 // server-publish path. Non-fatal: a hiccup must never block a ship; the fitness
 // `gen-api-docs --check` gate backstops staleness on main.
 function regenerateApiDocs() {
@@ -135,10 +135,7 @@ function regenerateApiDocs() {
 // so a route change left the client stale until the api_client test caught it in CI.
 // Non-fatal + safe on every ship path; the api_client freshness test backstops main.
 
-// The regenerated client's git pathspec. It used to carry a second, conditional path —
-// a vendored copy inside a desktop app, named only when on disk because `git add` of an
-// unmatched pathspec aborts the whole stage (task 1002417). The app is gone (task
-// 1003891), so the pathspec is the one directory the generator writes.
+// The regenerated client's git pathspec: the one directory the generator writes.
 const API_CLIENT_PATHSPEC = 'clients/bongos-client';
 
 function regenerateApiClient() {
@@ -186,7 +183,7 @@ function regenerateSessionIndex() {
 // Refresh the generated file-map sections (.claude/skills/ + .claude/scheduled-tasks/ trees in
 // docs/file-map.md) from what is on disk (ADR 0066, task 1276). Pure JS (reads dirs + the
 // docs/file-map.notes.json sidecar, no DB, no headless browser) — safe on EVERY ship path including
-// the dev-box server-publish path. Non-fatal: a hiccup must never block a ship; the Path-C CI gate
+// the server-publish path. Non-fatal: a hiccup must never block a ship; the Path-C CI gate
 // (`gen-file-map --check`, in fitness.js) backstops staleness on main. NB gen-file-map exits 2 when
 // a skill/routine has no note, so shellOk may report "failed" on a legit note-gap ship — that is
 // fine, we still commit whatever it wrote and CI surfaces the missing note.

package/scripts/gds/ship.js

@@ -273,8 +273,8 @@ module.exports = {
   // preflight's upstream-deletion warning — exported so it's unit-tested
   // without a live git repo.
   parseDeletedUpstreamPaths,
-  // task 1052 (E): box-aware "what to do next" for a confirmed-strand — a box
-  // (via 'server') is pointed at the resume, never at gh-only /merge-mode.
+  // task 1052 (E): path-aware "what to do next" for a confirmed-strand — a machine
+  // on the server path (via 'server') is pointed at the resume, never at gh-only /merge-mode.
   strandNextStep,
   // task 1002606: the success-pending banner lines, pure — pinned so the strand
   // detection story ("NOT a failure" + how you WILL find out if it fails) can't drift.
@@ -293,20 +293,20 @@ module.exports = {
   // #858: commit-pinned deploy confirmation via the /version endpoint.
   deployedCommitStatus,
   // ADR 0055 / task 1025: which ci-mode publish path this machine uses
-  // ('local' = git+gh here; 'server' = server-mediated, e.g. a dev box) — so
+  // ('local' = git+gh here; 'server' = server-mediated, no local push credential) — so
   // doctor.js reports the same path ship will take instead of failing on
   // missing gh where gh isn't needed.
   pushVia,
-  // task 1046: diagram regen returns a status string and SKIPS on the dev-box
-  // (server-publish) path so a box never leaves uncommitted .mmd/assertions in
-  // its tree — exported so the regression test proves the skip without git.
+  // task 1046: diagram regen returns a status string and SKIPS on the server-publish
+  // path so such a checkout never leaves uncommitted .mmd/assertions in its tree —
+  // exported so the regression test proves the skip without git.
   regenerateDiagrams,
   regenerateRepoMap,
   regenerateSessionIndex,
   // ADR 0066 / task 1276: regenerate docs/file-map.md's skills + scheduled-tasks sections from disk.
   regenerateFileMap,
   // task 1037: autoMerge's fetch-failure decision — fatal only OFF the server-
-  // publish path (a credential-less dev box can't fetch but ships via ADR 0055).
+  // publish path (a credential-less checkout can't fetch but ships via ADR 0055).
   // Exported pure so the regression test proves the truth table without git.
   shouldBailOnFetchFailure,
   // task 391 (idea #37): autoMerge's zero-commit verdict — refuse a zero-commit
@@ -342,8 +342,8 @@ module.exports = {
 if (require.main === module) {
   // --print-deploy-mode (task 1003221): the EFFECTIVE mode, one word, no session or
   // network. The /merge-mode skill used to probe parseDeployMode directly, which
-  // defaults to 'laptop' when config/deploy.json is absent — as it is on every dev
-  // box (ADR 0148) — sending the builder down a push path they had no credential for.
+  // defaults to 'laptop' when config/deploy.json is absent — sending the
+  // builder down a push path they had no credential for.
   if (process.argv.slice(2).includes('--print-deploy-mode')) {
     console.log(require('./ship-deploy-target.js').resolveDeployMode());
     process.exit(0);