@bongos/core 1.19.1074 → 1.19.1075

package/scripts/gds/skill-preflight.js

@@ -4,12 +4,13 @@
 // 1000077; criterion guards-skill-declares-machine).
 //
 // THE INCIDENT. /merge-mode states in its own prose that it assumes the Archon's
-// Mac or the droplet. It was run on a dev box anyway. Worse, ship.js ALREADY knew:
-// strandNextStep() tells a box "/merge-mode is NOT available here — it needs gh +
-// a main checkout this machine doesn't have." So the knowledge existed in two
-// places and neither stopped the run, because prose cannot refuse and the one
-// executable copy was on a different code path. A capability a procedure needs
-// must be a declaration the machine can CHECK, not a sentence a reader can skim.
+// Mac or the droplet. It was run on a machine with no push credential anyway. Worse,
+// ship.js ALREADY knew: strandNextStep() tells such a machine "/merge-mode is NOT
+// available here — it needs gh + a main checkout this machine doesn't have." So the
+// knowledge existed in two places and neither stopped the run, because prose cannot
+// refuse and the one executable copy was on a different code path. A capability a
+// procedure needs must be a declaration the machine can CHECK, not a sentence a
+// reader can skim.
 //
 // THREE PARTS, matching that diagnosis:
 //   1. `requires:` in the skill's own YAML frontmatter — the declaration.
@@ -74,7 +75,7 @@ const CAPABILITIES = {
     what: 'an authenticated GitHub CLI',
     probe: () => ghAuthed(),
     missing: 'no authenticated `gh` on this machine. Run `gh auth login`, or use a machine that has it — '
-      + 'a dev box normally does not, by design (it publishes through the server instead, ADR 0055).',
+      + 'a machine with no push credential normally does not, by design (it publishes through the server instead, ADR 0055).',
   },
   'main-checkout': {
     what: 'the main checkout, not a linked worktree',
@@ -318,7 +319,7 @@ function checkOpsSkillsDeclareMachine({ dir = SKILLS_DIR, read = null, names: in
       violations.push(
         `${n} fences commands needing [${undeclared.join(', ')}] but does not declare them. `
         + 'Add them to `requires:` in the frontmatter so the preflight can refuse early — '
-        + 'prose cannot refuse, which is how /merge-mode came to be run on a dev box (task 1003167).'
+        + 'prose cannot refuse, which is how /merge-mode came to be run on a machine that could not run it (task 1003167).'
       );
     }
   }

package/src/bongos/api-prefix.js

@@ -9,10 +9,10 @@
 //
 // The URL rename (Part B / B1, task 1919) flipped the canonical here: the API is
 // now served at '/api/bongos', and '/api/gds' stays mounted FOREVER as a silent
-// alias (LEGACY_API_PREFIXES). "Forever" is deliberate — shipped Dev Box desktop
-// binaries, the separately-hosted status-dashboard mirror, and live dev boxes all
-// call '/api/gds' and can't be force-updated. serve-internal.js mounts the router
-// + discovery index at API_PREFIX and every LEGACY_API_PREFIXES entry.
+// alias (LEGACY_API_PREFIXES). "Forever" is deliberate — shipped older CLI
+// releases and the separately-hosted status-dashboard mirror all call '/api/gds'
+// and can't be force-updated. serve-internal.js mounts the router + discovery
+// index at API_PREFIX and every LEGACY_API_PREFIXES entry.
 const API_PREFIX = '/api/bongos';
 
 // Prefixes the server ALSO answers on, for callers pinned to the previous path.

package/src/bongos/platform-visibility-gate.js

@@ -65,7 +65,7 @@ const API = `(?:${ALL_API_PREFIXES.map(escRe).join('|')})`;
 //                        Caddy's on-demand-TLS `ask` and the provisioning probe —
 //                        server-to-server, cookie-less, and on a control plane a
 //                        refused ask means no project ever gets a certificate.
-//   /downloads/*         the installer script and the Dev Box updater — a
+//   /downloads/*         the installer script and the release downloads — a
 //                        cookie-less `curl … | sh`, and release redirects carry
 //                        no project data.
 //   /__prelaunch         the pre-launch gate's own submit, when both gates are on.

package/src/bongos/routes/me.js

@@ -510,7 +510,7 @@ module.exports = function buildMeRouter() {
     };
     // Module→core contribution seam (BV1.R42, ADR 0083). Let each enabled module
     // add its own profile slice instead of core hardcoding it — the strangler
-    // prerequisite that lets dev-box/discord/art leave this route. ADD-ONLY (core
+    // prerequisite that lets discord/art leave this route. ADD-ONLY (core
     // keys win); a collision means a move task took over a core key without
     // dropping the core copy. Empty until a module registers → byte-identical today.
     const slices = await seams.collectContributions('profile.fields', {

package/src/bongos/routes/security.js

@@ -113,9 +113,9 @@ module.exports = function buildSecurityRouter() {
   //
   // The DATED security engagement reports (exploit detail — full repro,
   // evidence, the attacker cookbook) are served from the DB, NOT committed to
-  // the git clone: the repo is cloned in full onto every Metic+ dev box
-  // (threat-model §6.3 / ADR 0020), so a committed exploit report is an
-  // attacker cookbook on every box. The SAFE conceptual docs (threat-model.md,
+  // the git clone: the repo is cloned in full onto every Metic+ builder's
+  // machine (threat-model §6.3 / ADR 0020), so a committed exploit report is an
+  // attacker cookbook on every machine. The SAFE conceptual docs (threat-model.md,
   // the README) stay in docs/security/; only the dated reports live here, and
   // ALL three routes gate on requirePermission('security.report.adjudicate')
   // — an archon-floored atom (BV1.R104; was requireRank('archon') and admits

package/src/bongos/routes.js

@@ -167,8 +167,8 @@ function buildGdsRouter() {
   // core to every instance, not an OTB feature.
   router.use(buildLiveRouter());
   // Feature-module-gated mounts (R54, task 1193, ADR 0062 §4). Off on a vanilla
-  // instance; ON for OTB via config/modules.json so prod is unchanged. dev-box,
-  // art-pipeline, and discord (with its bug-attachments route) have all graduated
+  // instance; ON for OTB via config/modules.json so prod is unchanged. art-pipeline
+  // and discord (with its bug-attachments route) have both graduated
   // into real modules (modules/<key>/) — they are discovered + mounted by
   // moduleLoader.mountModuleRoutes below, not here (BV1.R43 / R48 / R47 / R72).
   // gate-approvals likewise moved to the lifecycle module (BV1.R86).

package/src/bongos/serve-internal.js

@@ -622,8 +622,8 @@ function mountInternalSurfaces(app) {
   //
   // Dual-mount (task 1919): the router + this discovery index are mounted at the
   // canonical API_PREFIX (/api/bongos) AND every LEGACY_API_PREFIXES entry
-  // (/api/gds) — the legacy alias stays FOREVER so shipped Dev Box binaries, the
-  // cached status mirror, and live boxes keep working (src/bongos/api-prefix.js). The
+  // (/api/gds) — the legacy alias stays FOREVER so older CLI releases and the
+  // cached status mirror keep working (src/bongos/api-prefix.js). The
   // SAME router instance is mounted at each path. Each discovery GET is registered
   // BEFORE its router mount so the exact base-path GET wins; every other
   // method/subpath falls through to the router.
@@ -670,7 +670,7 @@ function mountInternalSurfaces(app) {
   // below only prefixes non-/api paths, so without this placement /downloads/*
   // would be rewritten to /builders/downloads/* and 404). The installer scripts are served with the
   // server's PINNED origin substituted for __GDS_API_BASE__ — never a request
-  // header, so a spoofed Host can't redirect a `curl | sh` (the box-connect.sh rule).
+  // header, so a spoofed Host can't redirect a `curl | sh`.
   const bongosCfg = tryLoadInstanceConfig('bongos-cli.json');
   if (bongosCfg) {
     const bongosDownloads = buildBongosDownloads(bongosCfg);
@@ -894,8 +894,7 @@ function mountInternalSurfaces(app) {
   // them to the hall, and an unauthenticated visitor into sign-in). The subdomain
   // shim above has already rewritten the bare /watch + /gate onto /builders/*.
   // (Defense in depth: every data endpoint these pages call carries its own
-  // server-side gate.) /harbor sat here too until task 1003890 removed the dev
-  // box: its page is gone, and a gate in front of nothing is a dead guard.
+  // server-side gate.)
   const WATCH_PAGE_RE = /^\/builders\/watch(?:\.html)?\/?$/;
   const GATE_PAGE_RE = /^\/builders\/gate(?:\.html)?\/?$/;
   // /sessions (the session-log ledger) belongs to that same Governance group and
@@ -1144,7 +1143,7 @@ function mountInternalSurfaces(app) {
   // the landing card + GitHub button render for a stranger.
   //
   // ONE tier of gate: ANY SIGNED-IN BUILDER — the Work Board, Roadmap, the Goals
-  // page, the task-detail page, the Repo Atlas, the Dev Box pair page, Settings
+  // page, the task-detail page, the Repo Atlas, Settings
   // (#748, #904, task 1293, task 1757, task 751) and, since task 1002710, the
   // orientation reading rooms (primer, diagrams). A Xenos IS allowed; an
   // unauthenticated visitor is bounced into sign-in rather than served the shell.

package/src/bongos-downloads.js

@@ -4,8 +4,7 @@
 // The compiled per-platform binaries can't ride the git-based deploy (private
 // repo, no LFS, GitHub's 100MB cap), so CI publishes them as release assets on a
 // PUBLIC releases repo (config/bongos-cli.json — the same off-repo pattern as the
-// Dev Box app, src/devbox-downloads.js, and the ADR 0029 status mirror). This
-// module turns that committed config into:
+// ADR 0029 status mirror). This module turns that committed config into:
 //
 //   GET /downloads/bongos/latest.json   → { version, assets: { target: {file,url} } }
 //   GET /downloads/bongos/version       → { version, assets: { target: url } }
@@ -14,10 +13,6 @@
 // so every URL a user sees or the installer fetches stays on the instance apex,
 // and a release bump is a one-file config change that rides the normal ship flow.
 // Pure (config in, urls out) so tests need no server.
-//
-// (A near-twin of src/devbox-downloads.js by design — same off-repo release
-// pattern, different artifact. Kept as its own module for a clear name + its own
-// config pointer; the two are independent instance features.)
 
 function buildBongosDownloads(cfg) {
   if (!cfg || typeof cfg !== 'object') throw new Error('bongos-downloads: missing config');

package/src/branding.js

@@ -1,9 +1,9 @@
 // src/branding.js — the branding contract (ADR 0062 §3, task 1192 / V4.R53).
 //
 // The single source for every instance-identity string the platform renders:
-// product/world name, company, domains/origins, cookie + OAuth + dev-box
+// product/world name, company, domains/origins, cookie + OAuth
 // hosts, currency label, the track set, theme, and the project name injected
-// into LLM prompts. Generalizes devbox-app/src/brand.js to the whole platform.
+// into LLM prompts.
 //
 // Resolution precedence (highest wins):
 //   env override  ->  instance config (config/branding.json)  ->  neutral

package/src/build-info.js

@@ -41,12 +41,10 @@ function readGitSha() {
   }
 }
 
-// The deployed commit's date (ISO 8601), for the dev-box staleness comparison
-// (boxes.computeCodeStaleness, idea 332). A box reports its own HEAD commit date;
-// if it's > 2 days behind THIS, the box is flagged stale. Best-effort: after a
-// `git reset --hard origin/main` deploy, HEAD is the deployed commit, so its
-// committer date is the right reference. Null when git is unavailable (then the
-// "behind" check is skipped and only never-reported boxes flag).
+// The deployed commit's date (ISO 8601), served on /version beside the commit.
+// Best-effort: after a `git reset --hard origin/main` deploy, HEAD is the
+// deployed commit, so its committer date is the right reference. Null when git
+// is unavailable.
 function readGitCommitDate() {
   try {
     return execSync('git show -s --format=%cI HEAD', {

package/src/instance-config.js

@@ -40,7 +40,7 @@ const LEGACY_DIRS = ['otb'];
 //
 // WHY THESE MUST OUTLIVE THIS TASK: these names are set OUTSIDE the repo —
 // /etc/cloudbongos/web.env on the droplet, systemd units, CI secrets, shipped
-// Dev Box binaries, live dev boxes. Deleting a spelling here is an outage the
+// CLI binaries, builders' own machines. Deleting a spelling here is an outage the
 // next time one of those restarts. Task 1003706 (C3d) retires them deliberately,
 // after evidence — and asserts their ABSENCE, which is why the fallback needs a
 // test that it FIRES rather than one that merely tolerates it.
@@ -140,7 +140,7 @@ function configPath(name, b = safeBrand()) {
 // Lives here, not in cli-lib.js which owns the session STORE, because this module
 // is the lowest one that has to read the file (resolveApiBase below) and cli-lib
 // imports this — so this is the only place both can share. A rename APPENDS a
-// name; dropping one signs out every builder machine and every live dev box at
+// name; dropping one signs out every builder machine at
 // once. Part 4 (task 1003706) retires the tail. (task 1003704)
 const SESSION_FILENAMES = Object.freeze([
   'bongos-session.json',

package/src/module-api.js

@@ -75,7 +75,7 @@ const { responsibilityFor, ROLE_RESPONSIBILITIES } = require('./role-responsibil
 // MAJOR (see allowBoxScope below): passes the request through untouched.
 function deprecatedNoopMiddleware(_req, _res, next) { next(); }
 
-const CORE_VERSION = '1.19.1074'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
+const CORE_VERSION = '1.19.1075'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('discord'); log.info('mounted');
@@ -137,8 +137,8 @@ module.exports = {
   get requireBfgPrincipal() { return require('./bongos/auth').requireBfgPrincipal; },
   // allowBoxScope — DEPRECATED no-op, kept so the doorway loses no export inside
   //     1.x (removing one is a MAJOR, and every module declares ^1). It used to opt
-  //     a route in to the narrowing box-scoped session; that scope and its tokens
-  //     were retired (task 1003894), so an undeclared session source is now denied
+  //     a route in to the narrowing machine-baked session scope; that scope and its
+  //     tokens were retired (goal 1000120, task 1003894), so an undeclared session source is now denied
   //     on every route whatever a route mounts. Passing it changes nothing. Drop it
   //     at the next MAJOR.
   get allowBoxScope() { return deprecatedNoopMiddleware; },

package/src/module-loader/manifest-schema.js

@@ -10,7 +10,7 @@
 // THE SCHEMA (module.json):
 //   {
 //     "key":          "art-pipeline",   // REQUIRED. ^[a-z][a-z0-9-]*$ ; must match the module's dir name.
-//     "title":        "Dev boxes",      // REQUIRED. Human label.
+//     "title":        "Art pipeline",   // REQUIRED. Human label.
 //     "description":  "…",              // REQUIRED. One sentence.
 //     "version":      "1.4.2",          // REQUIRED. The module's OWN exact version "X.Y.Z" (task 1003781) —
 //                                       //   what update, rollout channels and re-assessment name.

package/tests/api_alias_caller_ratchet.mjs

@@ -66,7 +66,7 @@ test('the exclusions are real and each one is reachable', () => {
     'scripts/gds/fitness-ratchets.js',
     'scripts/gds/api-alias-caller-scan.js',
     'tests/api_alias_exceptions.mjs',      // 5 tests
-    'modules/dev-box/app/test/thing.mjs',
+    'modules/agents/app/test/thing.mjs',
     'docs/adr/0016-permissions.md',        // 6 the FROZEN RECORD under docs/ (narrowed, task 1004113)
     'docs/session-logs/2026-09-16-x.md',
     'docs/audits/2026-08-01-x.md',

package/tests/api_alias_exceptions.mjs

@@ -27,7 +27,7 @@ const ALIAS = '/api/gds';
 test('the alias is still mounted — everything below depends on it', () => {
   const { API_PREFIX, LEGACY_API_PREFIXES, ALL_API_PREFIXES } = require(path.join(ROOT, 'src', 'bongos', 'api-prefix.js'));
   assert.equal(API_PREFIX, '/api/bongos', 'the canonical prefix is what in-repo callers now ask for');
-  assert.ok(LEGACY_API_PREFIXES.includes(ALIAS), 'shipped Dev Box binaries and live dev boxes call the alias');
+  assert.ok(LEGACY_API_PREFIXES.includes(ALIAS), 'shipped binaries and live instances call the alias');
   assert.ok(ALL_API_PREFIXES.includes(ALIAS), 'and the router still mounts it');
 });
 

package/tests/api_client.mjs

@@ -208,7 +208,7 @@ test('generated .d.ts types success responses (task 2061)', () => {
 });
 
 // The CJS + browser-global builds are pure transforms of the ESM source (task
-// 1996 / R09). devbox (require) and classic <script> web pages consume them, so
+// 1996 / R09). CommonJS callers (require) and classic <script> web pages consume them, so
 // guard that they load and shape requests IDENTICALLY to the ESM build.
 test('CJS build behaves identically to the ESM build', async () => {
   const cjs = require('../clients/bongos-client/index.cjs');

package/tests/api_path_404.mjs

@@ -38,7 +38,7 @@ t('API-shaped: /api/*, /gds/*, and bare GDS roots (/tasks, /me, …) match', ()
 
 t('NOT API-shaped: game/hall/static paths fall through to HTML/static', () => {
   for (const p of ['/', '/index.html', '/builders', '/builders/work', '/atlas-ab12.png',
-                   '/vendor/phaser.min.js', '/downloads/devbox/mac', '/game', '/healthz', '/version']) {
+                   '/vendor/phaser.min.js', '/downloads/bongos/latest.json', '/game', '/healthz', '/version']) {
     assert.equal(isApiShapedPath(p), false, `${p} should NOT be API-shaped`);
   }
 });

package/tests/backfill_task_rewards.mjs

@@ -77,7 +77,7 @@ await test('computeTaskReward: 0 raw → 0 effective (a 0-mapping pays nothing)'
 
 await test('netForBuilder: would-be minus already-paid', () => {
   assert.equal(netForBuilder(100, 30), 70);
-  assert.equal(netForBuilder(100, 0), 100); // cost-plus paid nothing (dev-box/CI case)
+  assert.equal(netForBuilder(100, 0), 100); // cost-plus paid nothing (the CI case)
 });
 
 await test('netForBuilder: cost-plus over-paid → floored at 0 (never claws back)', () => {

package/tests/{box_ship_permissions.mjs → cli_allowlist_permissions.mjs}

@@ -1,7 +1,7 @@
-// tests/box_ship_permissions.mjs
+// tests/cli_allowlist_permissions.mjs
 //
 // task 1051 (D): the blessed methodology CLI scripts must stay pre-allowed in the
-// project .claude/settings.json so a dev-box Claude session (auto permission mode)
+// project .claude/settings.json so a Claude session in auto permission mode
 // does not hard-DENY the very command it exists to run. The #1027 nightmare
 // dead-ended on `node scripts/gds/ship.js` at the auto classifier; this guards
 // against that allow-rule being silently dropped.
@@ -12,7 +12,7 @@
 // on every routine read. The list of tools is `.claude/hooks/shell-tools.js`, the same
 // one the guards read: a rule may only exist for a tool git-guard and secret-gate see.
 //
-// Run:  node tests/box_ship_permissions.mjs
+// Run:  node tests/cli_allowlist_permissions.mjs
 
 import { strict as assert } from 'node:assert';
 import fs from 'node:fs';
@@ -62,7 +62,7 @@ perTool('permissions.allow pre-allows the generic GDS API channel api.js (auto-m
   // idea-triage promote, create-task, blocker-resolve, criterion ratify, goal
   // create, cost-via-API, security reports — rides the generic caller
   // `node scripts/gds/api.js <METHOD> /api/gds/...`. If it is not pre-allowed, a
-  // dev-box (or laptop) session in AUTO permission mode has the classifier
+  // session in AUTO permission mode has the classifier
   // hard-DENY those writes as "[External System Writes] ... beyond the user's
   // request" — mistaking a sanctioned idea-triage session for scope creep. The
   // GDS server enforces builders.rank on every request (ADR 0016), so this rule
@@ -309,5 +309,5 @@ test('the instance starter mirrors this list in verb form (claude-materialize.js
 });
 
 console.log('');
-console.log(`box_ship_permissions: ${passed} passed, ${failed} failed`);
+console.log(`cli_allowlist_permissions: ${passed} passed, ${failed} failed`);
 process.exit(failed === 0 ? 0 : 1);

package/tests/cli_sessions.mjs

@@ -201,7 +201,7 @@ test('signing into a second instance PRESERVES the first — including one writt
 });
 
 test('the ACTIVE pointer still lands exactly where every existing reader looks', () => {
-  // In-repo skills, hooks and the dev box all read the active session file in the configured dir. The
+  // In-repo skills and hooks all read the active session file in the configured dir. The
   // store is additive; if this moved, every one of them would silently stop finding a session.
   const { out } = inSandbox(`
     await lib.saveSession({ token:'T', api_base:'https://a.example.com', builder:{github_login:'x'} });

package/tests/context_pack.mjs

@@ -339,14 +339,14 @@ t('formatContextPackCompact: two lines, worktree + prefix, no undefined', () =>
   assert.ok(!/undefined/.test(out));
 });
 
-// ---- the task-scoped box with no claim (task 1003085) ----------------------
+// ---- a checkout with no modules/lifecycle on disk (task 1003085) ------------
 //
-// A box scoped to a claim materializes modules/<key> only for the modules that
-// claim put in scope (ADR 0148). With NO active claim, modules/lifecycle is not
-// on disk — and this file's hard `require` of task-classifier threw
-// MODULE_NOT_FOUND at IMPORT time, which killed /builder-start and
-// /builder-claim: the two commands needed to escape the state, because a claim
-// is what fetches the module. The live escape was POST /claims by curl.
+// When modules/lifecycle is not on disk (it was found on a checkout that held only
+// the modules an active claim put in scope, so with no claim it was absent), this
+// file's hard `require` of task-classifier threw MODULE_NOT_FOUND at IMPORT time,
+// which killed /builder-start and /builder-claim: the two commands needed to escape
+// the state, because a claim is what fetches the module. The live escape was
+// POST /claims by curl.
 //
 // This reproduces the condition for real rather than asserting on source text:
 // a temp tree holding context-pack.js and the one other thing it imports, with
@@ -357,7 +357,7 @@ const os = require('node:os');
 const path = require('node:path');
 const url = require('node:url');
 
-function boxWithoutLifecycle() {
+function checkoutWithoutLifecycle() {
   const here = path.dirname(url.fileURLToPath(import.meta.url));
   const root = fs.mkdtempSync(path.join(os.tmpdir(), 'ctxpack-nolifecycle-'));
   fs.mkdirSync(path.join(root, 'scripts', 'gds'), { recursive: true });
@@ -369,13 +369,13 @@ function boxWithoutLifecycle() {
   // coupling has to be looked at — which is the point.
   fs.copyFileSync(path.join(here, '..', 'src', 'bongos', 'api-prefix.js'),
     path.join(root, 'src', 'bongos', 'api-prefix.js'));
-  // No modules/ — that IS the box condition.
+  // No modules/ — that IS the condition.
   assert.ok(!fs.existsSync(path.join(root, 'modules')), 'the fixture must not carry modules/');
   return { root, mod: require(path.join(root, 'scripts', 'gds', 'context-pack.js')) };
 }
 
-t('a box with no modules/lifecycle can still LOAD the pack (the deadlock)', () => {
-  const { mod } = boxWithoutLifecycle();
+t('a checkout with no modules/lifecycle can still LOAD the pack (the deadlock)', () => {
+  const { mod } = checkoutWithoutLifecycle();
   const api = mod.apiContract();
   assert.equal(api.enums_available, false, 'it must say so, not pretend');
   assert.equal(api.api_prefix, '/api/bongos', 'everything not behind the module still works');
@@ -386,8 +386,8 @@ t('a box with no modules/lifecycle can still LOAD the pack (the deadlock)', () =
   assert.equal(api.manual_degree, null);
 });
 
-t('both formatters render on that box instead of throwing', () => {
-  const { mod } = boxWithoutLifecycle();
+t('both formatters render on that checkout instead of throwing', () => {
+  const { mod } = checkoutWithoutLifecycle();
   const pack = mod.buildContextPack({
     activeClaims: [], cwd: '/fallback', platform: 'linux',
     runGit: () => '/work/tree\n', runWhich: () => '',

package/tests/copy_inventory.mjs

@@ -29,11 +29,11 @@ const ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
 const inv = require(path.join(ROOT, 'scripts', 'gds', 'copy-inventory.js'));
 
 test('stable ids survive a move and change with the text', () => {
-  const a = inv.stableId('builders-hall', 'Close your box');
-  assert.equal(a, inv.stableId('builders-hall', 'Close your box'), 'same surface + text → same id, whatever the file/line');
-  assert.equal(a, inv.stableId('builders-hall', '  Close   your box  '), 'whitespace is normalized before hashing');
-  assert.notEqual(a, inv.stableId('builders-hall', 'Close your dev box'), 'a text change must break the id — that is the signal a flag is stale');
-  assert.notEqual(a, inv.stableId('status-dashboard', 'Close your box'), 'the same words on another surface are a different piece of copy');
+  const a = inv.stableId('builders-hall', 'Close your tab');
+  assert.equal(a, inv.stableId('builders-hall', 'Close your tab'), 'same surface + text → same id, whatever the file/line');
+  assert.equal(a, inv.stableId('builders-hall', '  Close   your tab  '), 'whitespace is normalized before hashing');
+  assert.notEqual(a, inv.stableId('builders-hall', 'Close your browser tab'), 'a text change must break the id — that is the signal a flag is stale');
+  assert.notEqual(a, inv.stableId('status-dashboard', 'Close your tab'), 'the same words on another surface are a different piece of copy');
 });
 
 test('the JS extractor refuses code — the 2144-row failure mode cannot come back', () => {
@@ -55,14 +55,14 @@ test('the JS extractor keeps copy, and names how a person sees it', () => {
   const src = [
     "toast('Priority order saved.');",
     "el.textContent = 'How the whole build is doing.';",
-    "box.innerHTML = `<p class=\"setup__box-msg\">Closing your box… (a few seconds)</p>`;",
+    "panel.innerHTML = `<p class=\"setup__msg\">Closing your session… (a few seconds)</p>`;",
     "row.innerHTML = `<span class=\"pill\">Release task ${id}</span>`;",
   ].join('\n');
   const rows = inv.fromJs({ source: src, rel: 'x.js' });
   const byOrigin = Object.fromEntries(rows.map((r) => [r.origin, r.text]));
   assert.equal(byOrigin['js-notice'], 'Priority order saved.');
   assert.equal(byOrigin['js-text-assign'], 'How the whole build is doing.');
-  assert.ok(rows.some((r) => r.origin === 'js-markup' && r.text === 'Closing your box… (a few seconds)'),
+  assert.ok(rows.some((r) => r.origin === 'js-markup' && r.text === 'Closing your session… (a few seconds)'),
     'text inside script-built markup is copy; the tags around it are not');
   assert.ok(rows.some((r) => r.text === 'Release task {…}'),
     'a template interpolation becomes a placeholder so the sentence stays readable and the hole stays visible');

package/tests/credit_grant.mjs

@@ -435,7 +435,7 @@ await test('1002474 the INSERT still carries a DB-level double-pay backstop', as
   assert.match(insert.sql, /reward_basis/, 'and it must be keyed on (session_id, reward_basis)');
 });
 
-// task 1676 — the cost-plus zero-out fix for the dev-box/CI agent ship path.
+// task 1676 — the cost-plus zero-out fix for the CI agent ship path.
 // Symptom (ADR 0097): those sessions uploaded empty/unpriceable model_usage, so
 // priceModelUsage returned $0 and the reward rounded to 0 — even though real
 // token spend happened. The fix prices the session's real total_tokens at the
@@ -444,7 +444,7 @@ await test('awardSessionTokenReward (task 1676): empty model_usage + real total_
   const client = fakeClient();
   client.enqueue([]);          // idempotency SELECT → no prior row
   client.enqueue([{ id: 9 }]); // INSERT ... RETURNING id
-  // The exact dev-box/CI shape: no priceable per-model usage, but the digest
+  // The exact CI shape: no priceable per-model usage, but the digest
   // carried a real total token count (here 73M, an opus-marathon session).
   const res = await awardSessionTokenReward(client, 7, 'sess-ci', {}, 73_000_000);
   assert.equal(res.awarded, true, 'reward awarded despite empty model_usage');

package/tests/criterion_suggest.mjs

@@ -30,7 +30,7 @@ const CRITERIA = [
   crit(138, 'bx-hall', 'Core task actions work in the builders hall without invoking the LLM.'),
   crit(139, 'bx-identity', 'A builder can view and edit their own profile and read a leaderboard.'),
   crit(140, 'bx-onramp', 'Newcomers never dead-end: auth and re-auth are browser-clickable.'),
-  crit(141, 'bx-box', 'A builder dev box and sandbox is robust: uncommitted work is not lost.'),
+  crit(141, 'bx-recovery', 'A builder can resume after a crash: uncommitted work is not lost.'),
 ];
 
 test('ranks the most lexically-relevant criterion first', () => {

package/tests/design_tokens_sync.mjs

@@ -7,7 +7,8 @@
 // Claude Design round-trip). Nothing tied them together, so the design file kept
 // the pre-1002749 palette — including the exact accents removed for failing WCAG
 // AA — and every prototype started from colours the product no longer paints.
-// Model: the fallback-equals-pack assertions in tests/devbox_dmg_backdrop.mjs.
+// Model: fallback-equals-pack assertions — a copy of the pack's values is asserted
+// equal to the pack, never trusted.
 //
 // Run:  node tests/design_tokens_sync.mjs
 
@@ -25,7 +26,7 @@ const tokens = readJson('config', 'design-tokens.neutral.json');
 
 // Strip comments so rationale prose — which must be free to name a removed
 // colour — never trips a scan of the CODE (the stripCommentsForIdentity
-// contract, as applied in tests/devbox_dmg_backdrop.mjs).
+// contract).
 function codeOnly(text) {
   return text
     .replace(/\/\*[\s\S]*?\*\//g, '')

package/tests/fitness_ratchets.mjs

@@ -161,8 +161,8 @@ test('the committed baseline file parses and covers every hermetic metric', () =
 // `floor === undefined`, which compareToBaselines classifies as a WARNING — so a
 // checkout with no config/ reported the ratchet PASSED. Measured before the fix: a
 // planted 5,000-line + 94-cycle regression produced ZERO violations. That was not a
-// hypothetical checkout — config/ is absent from every dev box's sparse slice, so the
-// builders who most needed the gate were the ones silently exempt from it.
+// hypothetical checkout — a sparse checkout without config/ once left the builders
+// who most needed the gate silently exempt from it.
 //
 // checkQualityRatchets() reads the real repo, so these tests drive compareToBaselines
 // (pure) for the metric-level rules and exercise the file-level rule by pointing at a

package/tests/github_push_land_proof.mjs

@@ -154,7 +154,7 @@ test('landProvenForTask: a non-sha published tip ("HEAD") falls back to the PR c
 
 // --- task 1002645: findTaskPullRequest — the PR-title fallback locator --------
 //
-// The reconciler derives claude/<worktree_name> (dev-box convention); a laptop/wave
+// The reconciler derives claude/<worktree_name> first; a laptop/wave
 // ship pushes worktree-<worktree_name>, so the derived branch finds no PR and the
 // sweep never engaged (wave PRs 34/35/36 stranded at 'confirmed'). This locates the
 // task's PR by the "task <id>: …" TITLE-PREFIX convention — deliberately TIGHTER

package/tests/goal_advisory.mjs

@@ -72,16 +72,16 @@ await test("kind='bug' with no goal at all is quiet too — a fix needs no home
 });
 
 await test('a REAL goal is silent — null, not an empty object', () => {
-  assert.equal(adviseGoal({ versionId: V, goalId: 1000025, goalTitle: 'Builder experience — hall, dev box, and skills' }), null);
+  assert.equal(adviseGoal({ versionId: V, goalId: 1000025, goalTitle: 'Builder experience — hall, onboarding, and skills' }), null);
 });
 
 await test("kind='bug' under a real goal is silent too — already silent, kind changes nothing", () => {
-  assert.equal(adviseGoal({ versionId: V, goalId: 1000025, goalTitle: 'Builder experience — hall, dev box, and skills', kind: 'bug' }), null);
+  assert.equal(adviseGoal({ versionId: V, goalId: 1000025, goalTitle: 'Builder experience — hall, onboarding, and skills', kind: 'bug' }), null);
 });
 
 // ---- adviseGoal: the third reason — no_criterion_link (task 1003157) ----
 
-const REAL_GOAL_TITLE = 'Builder experience — hall, dev box, and skills';
+const REAL_GOAL_TITLE = 'Builder experience — hall, onboarding, and skills';
 const SOME_CRITERIA = [
   { id: 11, criterion_md: 'Every onboarding page renders under 2s' },
   { id: 12, criterion_md: 'The hall shows a builder their own karma trend' },

package/tests/goal_suggest.mjs

@@ -30,7 +30,7 @@ const { test, summary } = makeRunner();
 const V = 'BONGOS-V1';
 const GOALS = [
   { id: 1000024, title: 'Build-pipeline integrity', scope_modules: ['lifecycle', 'grading'] },
-  { id: 1000025, title: 'Builder experience — hall, dev box, and skills', scope_modules: ['hall-ui', 'dev-box'] },
+  { id: 1000025, title: 'Builder experience — hall, tool box, and skills', scope_modules: ['hall-ui', 'specialities'] },
   { id: 1000071, title: 'Idea routing — work that has a home lands in it', scope_modules: ['ideas', 'discord'] },
   { id: 1000003, title: `${V} — general`, scope_modules: [] },
 ];
@@ -76,8 +76,8 @@ await test('RANKS: ties break by ascending id so a picker renders stably', () =>
 
 await test('LIMIT (known + accepted): token overlap can match on an incidental word', () => {
   // Real example found while building this: "the goals page search BOX is broken"
-  // scores the DEV BOX goal, because both contain the token 'box'. Bag-of-words
-  // matching cannot tell "search box" from "dev box".
+  // scores the "tool box" goal, because both contain the token 'box'. Bag-of-words
+  // matching cannot tell "search box" from "tool box".
   //
   // This is NOT hidden — it is why every suggestion carries `score` and
   // `matched_terms`: a caller can show WHY it matched and a human decides. A

package/tests/government_abuse_matrix.mjs

@@ -365,9 +365,10 @@ test('V8: a forced principal grant resolves to nothing (structurally dropped)',
 });
 
 test('V9: an undeclared session source is refused outright, never treated as "full"', () => {
-  // Rows with source 'box' stay in builder_sessions until task 1003895 deletes them.
-  // They must be undeclared to BOTH loaders, which is what makes requireBuilder and
-  // the page gate refuse them (tests/government_session_scope.mjs runs the gate).
+  // core_258 (task 1003895) deleted the rows with source 'box' and narrowed the source
+  // CHECK to cli/web. 'box' must still be undeclared to BOTH loaders, so a stray row of
+  // that source is refused by requireBuilder and the page gate rather than honoured
+  // (tests/government_session_scope.mjs runs the gate).
   for (const source of ['box', 'not-a-source']) {
     assert.equal(sessionScopes.scopeFor(source), null, `"${source}" must not be a declared session source`);
   }

package/tests/hall_audit.mjs

@@ -464,7 +464,7 @@ test('the colour-literal guard CATCHES a reintroduction, and tolerates a task re
   assert.ok('a { color: #a04040; }'.match(re), 'a bare hex in a colour value is caught');
   assert.ok('x = \'<span style="color:var(--olive,#5b7a4d)">\''.match(colourLiteralRe()),
     'a hex FALLBACK behind a var() is caught — that is how --olive hid');
-  assert.equal('// #807: the dev-box panel'.match(colourLiteralRe()), null,
+  assert.equal('// #807: the ship panel'.match(colourLiteralRe()), null,
     'a task reference in a comment is not a colour');
   assert.equal('a { color: var(--ok); }'.match(colourLiteralRe()), null,
     'a token is exactly what this rule wants');

package/tests/helpers.mjs

@@ -58,7 +58,7 @@ export function makeSqlAwareClient(handler) {
 // tests/ is PUBLISHABLE, but the paths some tests assert are on
 // publish-manifest.js's PROTECTED_TOPOLOGY_EXCLUDE list (`.claude/hooks/`,
 // `.claude/settings.json`, `infra/`, `.github/`, `scripts/deploy/`) or are
-// instance-only content (`devbox-app/`, `config/<instance>.json`). A neutral
+// instance-only content (`config/<instance>.json`). A neutral
 // core checkout carries none of it, so an unconditional load CRASHED the file
 // at import and red-X'd the unit gate for every consumer.
 //