@bongos/core 1.19.1074 → 1.19.1076

package/docs/recipes/bongos-cli-release.md

@@ -2,8 +2,7 @@
 
 How the compiled `bongos` binaries get built, published, and installed — the
 "no Node, no repo" on-ramp (task [#1248](https://example.com/builders#/task/1248), V4.R81).
-Mirrors the release flow the retired Dev Box app used:
-**CI builds, the operator publishes to a public releases repo, the server serves
+The release flow: **CI builds, the operator publishes to a public releases repo, the server serves
 branded redirects.** There is no cross-repo write token in CI — publishing is a
 deliberate operator step.
 

package/docs/recipes/multi-builder-merge.md

@@ -1,6 +1,6 @@
 # Multi-builder merge safety — audit + serialization model
 
-> **Deploy-mode note (current state).** This recipe documents the **`laptop`** merge path (operator merges `main` + SSHes the droplet). Since the 2026-06-13 cutover `config/deploy.json` is **`mode: ci`** — the merge + deploy run **server-side** (PR auto-merge + `.github/workflows/deploy-prod.yml`), and credential-less dev boxes ship via server-mediated publish ([ADR 0055](../adr/0055-server-mediated-branch-publish.md)). The local-`main`-worktree + merge-lock model below applies only if `deploy.json` is reverted to `mode: laptop`.
+> **Deploy-mode note (current state).** This recipe documents the **`laptop`** merge path (operator merges `main` + SSHes the droplet). Since the 2026-06-13 cutover `config/deploy.json` is **`mode: ci`** — the merge + deploy run **server-side** (PR auto-merge + `.github/workflows/deploy-prod.yml`), and a checkout with no GitHub push credential ships via server-mediated publish ([ADR 0055](../adr/0055-server-mediated-branch-publish.md)). The local-`main`-worktree + merge-lock model below applies only if `deploy.json` is reverted to `mode: laptop`.
 
 > **Task:** V3.R50 / [#269](https://example.com/builders#/task/269) (criterion **C6 — parallel-safe-under-load**).
 > **Question it answers:** when N>1 builders ship and merge concurrently, where do `ship.js` and `/merge-mode` assume "I am the only builder," and what serializes the shared state so they don't collide?

package/docs/recipes/ops-gotchas.md

@@ -282,15 +282,6 @@ Inside the namespace the file lists as `---------- 1 root root 0`. The runner un
 
 ---
 
-## Dev box
-
-### `bypassPermissions` "still not available" even though the box was provisioned for it (task 2022)
-
-- **Symptom:** you reconnect to the browser terminal (or SSH) on a dev box and `claude` still stops for permission prompts, even though tasks [#1251](https://example.com/builders#/task/1251) and [#1314](https://example.com/builders#/task/1314) default every box to `bypassPermissions`.
-- **Root cause:** `otb-box-launch.sh` (behind `box-terminal.service`) only ever runs `claude` once — the first time it creates the tmux `otb` session. Every later connect just reattaches to that **same running process**. The `defaultMode=bypassPermissions` setting is written into `~/.claude/settings.json` by `box-source-fetch.sh`'s cron, on its own `*/10` schedule (and, on an already-provisioned box, only after that box's baked copy of the script has self-updated to even contain the fix). If the `otb` tmux session got created before that write landed — an older box, or a fresh box whose very first connect raced the first cron tick — `claude` started once in normal `auto` mode and is stuck there for the life of the box; reconnecting never re-launches it, so the fix never takes effect even once the setting is correct on disk. (Flagged as an open follow-up in [ADR 0104](../adr/0104-trust-gds-api-channel-in-auto-mode.md).)
-- **Fix:** `otb-box-launch.sh` now asserts `defaultMode=bypassPermissions` itself, synchronously, right before it creates a **new** `otb` tmux session — so a fresh session never depends on cron timing. This prevents the race going forward but does **not** repair a box whose `otb` session is already running in the wrong mode: for that, from an SSH/browser-terminal shell run `tmux kill-session -t otb` then reconnect (the launcher creates a fresh session and picks up the corrected setting immediately). Killing the session only drops the terminal pane — it does not touch `/workspace` or in-flight git state.
-- **Why it bites:** every layer *looks* fixed — `~/.claude/settings.json` has the right value, `IS_SANDBOX=1` is set — because you're inspecting the box's filesystem, not the already-running process that never re-read it.
-
 ## New-project scaffolds & the core pin (gap 13 · task 1002706 · ADR 0168)
 
 ### Do NOT set `PROVISION_CORE_FROM_REGISTRY=1` on the box until the core package goes public

package/docs/recipes/self-host.md

@@ -12,7 +12,7 @@ docker compose up
 
 That builds the image, starts Postgres, applies the build-system migrations (game-module migrations are skipped — this is a Bongos-only instance), and serves the builders' hall at **http://localhost:3000**.
 
-- The instance is **vanilla** by default: the neutral Cloud Bongos brand, every feature module (game, art pipeline, Discord, dev boxes) **off**. `.dockerignore` keeps the host's `config/branding.json` and `config/modules.json` out of the image, so it resolves to `config/branding.neutral.json` + `config/modules.neutral.json`.
+- The instance is **vanilla** by default: the neutral Cloud Bongos brand, every feature module (game, art pipeline, Discord) **off**. `.dockerignore` keeps the host's `config/branding.json` and `config/modules.json` out of the image, so it resolves to `config/branding.neutral.json` + `config/modules.neutral.json`.
 - **No OTB scope-truth is seeded.** OTB/product data (game versions, goals, done-when criteria) lives in opt-in seed migrations under `migrations/instance/` (plus a few guarded blocks in the mixed files 003/006). `scripts/migrate.sh` skips them unless `GDS_APPLY_INSTANCE_SEEDS=1`, so a fresh DB comes up with only the schema and platform-universal defaults (ranks, achievements) — no crash, no foreign-key failures, no leftover versions. Platform system principals (`bfg-system`, `discord-bot-system`) are generic and remain. See task 1704 / [ADR 0105](../adr/0105-instance-seed-migrations-out-of-core.md).
 - **No prod topology** is referenced: the database is a local container, the credentials are local demo values, and the app reaches Postgres over TCP via `PG*` env (see `docker-compose.yml`).
 

package/docs/recipes/windows-builders.md

@@ -227,7 +227,7 @@ here, suspect these before assuming the platform is at fault:
   is a short path (`C:\Users\RUNNER~1\…`), `os.tmpdir()` keeps the short form while git and the
   shell answer with the long one — so two spellings of one directory compare unequal. This alone
   explained failures in `ship_preflight`, `migrate_root_resolution` and `sandbox_stage`, and the
-  last of those was a genuine bug: the dev box would have git-synced a checkout onto itself.
+  last of those was a genuine bug: the since-retired dev box ([ADR 0346](../adr/0346-dev-boxes-are-retired.md)) would have git-synced a checkout onto itself.
 - **A REPO-relative path must be POSIX on every platform** — it goes into a task's `touches[]`, a
   version row, or a generated manifest. `path.join`/`path.relative` emit `\` here. Use
   `path.posix.*`, or the house spelling `.split(path.sep).join('/')`. This was the bug in

package/migrations/core_258_drop_dev_box_tables.sql

@@ -46,6 +46,9 @@ DROP TABLE IF EXISTS builder_boxes;
 DROP TABLE IF EXISTS box_intents;
 DROP TABLE IF EXISTS builder_ssh_keys;
 
+-- claims.creator_session_id REFERENCES builder_sessions with no ON DELETE, so unlink box sessions first (task 1004362).
+UPDATE claims SET creator_session_id = NULL
+  WHERE creator_session_id IN (SELECT id FROM builder_sessions WHERE source = 'box');
 DELETE FROM builder_sessions WHERE source = 'box';
 ALTER TABLE builder_sessions
   DROP CONSTRAINT IF EXISTS builder_sessions_source_check;

package/modules/copy-desk/routes/copy-desk.js

@@ -66,7 +66,7 @@ const { waitingRoundOrFail, refuseDecision, nextWaiting } = require('../page-dec
 const { validateOrRespond } = api;
 
 // The doorway's namespaced logger, not console.error (task 1003114). Same seam
-// builder-settings / dev-box / ideas / government already use: a module's log
+// builder-settings / ideas / government already use: a module's log
 // lines come out structured and attributable, and an error object logged as
 // `{ err }` keeps its stack instead of being stringified into one line.
 const log = api.logger('copy-desk');

package/modules/discord/ship-broadcast.js

@@ -8,9 +8,9 @@
 // either path. ship.js re-exports it so its existing regression test is unchanged.
 //
 // postShipBroadcast is the SERVER-SIDE poster (task 1045). On the server-mediated
-// publish path a dev box cannot post the broadcast — it holds no webhook secret
-// (ADR 0053 "box holds nothing"), which is exactly why a box ship was silently
-// skipping the public announcement. So when the GDS server confirms the deploy
+// publish path the uploading checkout cannot post the broadcast — it holds no
+// webhook secret, which is exactly why such a ship was silently skipping the
+// public announcement. So when the GDS server confirms the deploy
 // landed (publish-status reconcile, confirmed→shipped), the server — which holds
 // the webhook secrets and just deployed — fires the broadcast instead. Best-effort:
 // it never throws, so a Discord hiccup can never undo a ship.

package/modules/economy/credits.js

@@ -919,7 +919,7 @@ async function awardIdeaGovernancePassCredit(client, {
 //                  column the route's empty-session guard checks). Used ONLY as a
 //                  fallback: when modelUsage prices to $0 but the session carried
 //                  real tokens, the reward is priced from totalTokens at the opus
-//                  rate so the dev-box/CI agent path (which historically uploaded
+//                  rate so the CI agent path (which historically uploaded
 //                  empty/unpriceable model_usage → $0 reward; ADR 0097) still pays
 //                  the real cost-plus amount. This is NOT a fabricated dollar value
 //                  — it prices REAL token counts via the same locked PRICES table.
@@ -941,7 +941,7 @@ async function awardIdeaGovernancePassCredit(client, {
 // what actually paid.
 //
 // Cost-plus zero-out fallback (task 1676). priceModelUsage returns $0 when
-// model_usage is empty or carries no token counts — the exact dev-box/CI symptom
+// model_usage is empty or carries no token counts — the exact CI-agent symptom
 // ADR 0097 records ("upload no priced model usage"). When that happens but the
 // session DID carry real tokens, price the total at the opus rate so the reward
 // reflects the real spend instead of silently rounding to 0. The blend assumes a

package/modules/hall-ui/public/palette.js

@@ -9,7 +9,7 @@
 // Progressive enhancement is the contract: a page that does not load palette.js
 // keeps a hidden slot and no key handler, and nothing in shell.js calls in here.
 //
-// The index is CLIENT-SIDE ONLY (no new server surface, task 2178 scope):
+// The index has three CLIENT-SIDE layers (task 2178 scope):
 //   1. Pages — read live from the sidebar shell.js rendered, so rank + module
 //      gating come for free and can never drift from the nav. A hidden nav item
 //      is a hidden destination. (Cosmetic only; the server still gates each page.)
@@ -17,12 +17,33 @@
 //      cannot be read from another page's DOM, so they are declared below and
 //      held to the real ids by tests/hall_palette.mjs.
 //   3. Records — id syntax: `1234`, `g 12`, `b 7`, `i 42`.
-// Full-text search over tasks/docs is phase 2 — it needs a server surface.
+// PLUS one server-backed layer (task 1003460): typing prose (3+ chars, debounced,
+// per-open memoized) asks POST /api/bongos/search { source_kind: 'db' } — the
+// rank/owner-scoped recall layer (ADR 0060) that already indexes every
+// task/idea/blocker/doc, and had zero hall consumers before this. Content hits
+// are merged in ON TOP of the synchronous local compute() — never replacing it —
+// which is what keeps this progressive enhancement: a slow, failed, or killed
+// endpoint just means the merge never happens, and nav-jump/id-resolution/
+// page-jump (all pure, all local) are completely unaffected. Only source_refs
+// this palette can actually ROUTE to are surfaced (task/idea/blocker today — see
+// contentEntry) — a doc/session-log/commit hit is real prose the endpoint found,
+// but the hall has no page to jump to for it, and a palette row that goes
+// nowhere on Enter is worse than not showing it.
 (function () {
   'use strict';
 
   var PALETTE_ID = 'jump-palette';
   var MAX_RESULTS = 40;
+  var SEARCH_MIN_LEN = 3;       // 1-2 chars is websearch_to_tsquery's least selective case (falls through
+                                 // to the unindexed trigram leg AND a zero-result corpusHealth() probe) —
+                                 // not worth a round trip on the palette's most common input length.
+  var SEARCH_DEBOUNCE_MS = 300; // paced against searchRateLimit (60/min/builder, modules/memory/routes/
+                                 // search.js) — a builder typing a phrase word-by-word still fires a
+                                 // handful of requests, not one per keystroke.
+  var SEARCH_LIMIT = 8;
+  var SEARCH_TITLE_MAX = 120;   // an indexed title is write-once ledger data — cap it before it's markup.
+  var SEARCH_CACHE_MAX = 30;    // per-open memo (cleared on open()) so retyping a prefix replays the
+                                 // last response instead of re-issuing an identical search.
 
   // Sub-destinations, grouped by the nav item that owns them. `gate` names the
   // element whose visibility decides whether the group is offered — the nav item
@@ -79,6 +100,10 @@
   var results = [];
   var cursor = 0;
   var lastFocus = null;
+  var searchSeq = 0;      // bumped on every keystroke/close — invalidates in-flight requests
+  var searchTimer = null;
+  var searchAbort = null; // the in-flight request's AbortController, if the runtime has one
+  var searchCache = {};   // query (trimmed+lowercased) -> raw hits[], this OPEN only
 
   function esc(s) {
     return String(s == null ? '' : s).replace(/[&<>"']/g, function (c) {
@@ -153,6 +178,116 @@
     return null;
   }
 
+  // V4 (docs/voice.md): a dash is banned in copy this project QUOTES, not copy it
+  // authors, enforced by normalising at render — never by editing the ledger. A
+  // task/idea/blocker title is exactly that quoted case. Same normalisation as
+  // modules/public-landing/public/index.html's cleanTitle() / goal-inbox.js's.
+  function cleanTitle(raw) {
+    return String(raw == null ? '' : raw)
+      .replace(/\s*[—–]\s*/g, ', ')
+      .replace(/,\s*,/g, ',')
+      .replace(/\s*\([^()]*\)\s*$/, '')
+      .replace(/[\s,]+$/, '')
+      .trim();
+  }
+
+  function truncate(s, max) {
+    s = String(s == null ? '' : s);
+    return s.length > max ? s.slice(0, max - 1).trim() + '…' : s;
+  }
+
+  // Map one POST /search hit to a palette entry, or null when this palette has
+  // nowhere to send the reader for that kind of hit (see the header note). Only
+  // source_kind='db' rows carry a source_ref this palette recognizes today —
+  // task/idea/blocker, the same three id-syntax already resolves in recordEntry.
+  // Scoping (rank + owner) is entirely the endpoint's (ADR 0016/0060) — this is
+  // presentation only, never a second filter.
+  function contentEntry(hit) {
+    if (!hit || hit.source_kind !== 'db') return null;
+    var ref = String(hit.source_ref || '');
+    var label = function (fallback) { return truncate(cleanTitle(hit.title) || fallback, SEARCH_TITLE_MAX); };
+    var m = ref.match(/^task:(\d+)$/);
+    if (m) return { label: label('Task ' + m[1]), group: 'Content', href: '/task/' + m[1] };
+    m = ref.match(/^idea:(\d+)$/);
+    if (m) return { label: label('Idea ' + m[1]), group: 'Content', href: '#/idea/' + m[1], overlay: true };
+    m = ref.match(/^blocker:(\d+)$/);
+    if (m) return { label: label('Blocker ' + m[1]), group: 'Content', href: '#/blocker/' + m[1], overlay: true };
+    return null;
+  }
+
+  // Merge raw /search hits into the rendered results, deduped by destination
+  // href against whatever's already showing (a local id-syntax match resolving
+  // the same task, or an earlier merge). MAX_RESULTS is the same ceiling the
+  // local pool is held to.
+  function mergeHits(hits) {
+    var seen = {};
+    results.forEach(function (e) { seen[e.href] = true; });
+    var added = [];
+    hits.forEach(function (hit) {
+      var e = contentEntry(hit);
+      if (e && !seen[e.href]) { seen[e.href] = true; added.push(e); }
+    });
+    if (!added.length) return;
+    results = results.concat(added).slice(0, MAX_RESULTS);
+    render();
+  }
+
+  // Debounced remote leg. Fires at most once per SEARCH_DEBOUNCE_MS of typing,
+  // and every keystroke invalidates whatever was scheduled/in-flight before it
+  // (searchSeq, plus actually aborting the request in flight so a superseded
+  // query doesn't keep FTS/trgm work running server-side) so a slow response
+  // for a stale query can never land after a newer one, or after the palette
+  // closed. A failed fetch (network error, a non-2xx, an abort, or `fetch` just
+  // not existing) resolves to nothing being appended — the synchronous local
+  // compute() already rendered, so the palette degrades to exactly today's
+  // behaviour, never an error state.
+  function scheduleSearch(query) {
+    if (searchTimer) { clearTimeout(searchTimer); searchTimer = null; }
+    if (searchAbort) { searchAbort.abort(); searchAbort = null; }
+    searchSeq++;
+    var mySeq = searchSeq;
+    var q = String(query || '').trim();
+    var key = q.toLowerCase();
+    if (q.length < SEARCH_MIN_LEN) return;
+    if (Object.prototype.hasOwnProperty.call(searchCache, key)) { mergeHits(searchCache[key]); return; }
+    if (typeof fetch !== 'function') return;
+    searchTimer = setTimeout(function () { runSearch(q, key, mySeq); }, SEARCH_DEBOUNCE_MS);
+  }
+
+  function cacheHits(key, hits) {
+    // Unbounded within one open() would leak for a palette left open a long
+    // time; this is a per-open convenience, not a durable cache, so just drop
+    // the oldest entry rather than a real LRU.
+    var keys = Object.keys(searchCache);
+    if (keys.length >= SEARCH_CACHE_MAX) delete searchCache[keys[0]];
+    searchCache[key] = hits;
+  }
+
+  function runSearch(q, key, mySeq) {
+    var controller = typeof AbortController === 'function' ? new AbortController() : null;
+    searchAbort = controller;
+    fetch('/api/bongos/search', {
+      method: 'POST',
+      credentials: 'same-origin',
+      headers: { 'Content-Type': 'application/json' },
+      body: JSON.stringify({ q: q, limit: SEARCH_LIMIT, source_kind: 'db' }),
+      signal: controller ? controller.signal : undefined,
+    }).then(function (r) {
+      return r && r.ok ? r.json() : null;
+    }).then(function (data) {
+      if (searchAbort === controller) searchAbort = null;
+      // Stale (a newer keystroke/search ran) or the palette closed meanwhile.
+      if (mySeq !== searchSeq || !isOpen()) return;
+      if (!data || !Array.isArray(data.results)) return;
+      cacheHits(key, data.results);
+      mergeHits(data.results);
+    }).catch(function () {
+      if (searchAbort === controller) searchAbort = null;
+      // Fail-open: killing the endpoint (or aborting a superseded request)
+      // leaves the palette exactly as useful as today.
+    });
+  }
+
   function compute(q) {
     var query = String(q || '').trim().toLowerCase();
     var rec = recordEntry(query);
@@ -227,6 +362,7 @@
       results = compute(input.value);
       cursor = 0;
       render();
+      scheduleSearch(input.value);
     });
     listEl.addEventListener('click', function (ev) {
       var li = ev.target.closest ? ev.target.closest('[data-i]') : null;
@@ -249,6 +385,7 @@
   function open() {
     if (!root) build();
     if (isOpen()) return;
+    searchCache = {}; // a fresh open may see DB state the last one didn't
     lastFocus = document.activeElement;
     root.hidden = false;
     document.documentElement.classList.add('palette-open');
@@ -261,6 +398,9 @@
 
   function close() {
     if (!isOpen()) return;
+    if (searchTimer) { clearTimeout(searchTimer); searchTimer = null; }
+    if (searchAbort) { searchAbort.abort(); searchAbort = null; }
+    searchSeq++; // invalidate any pending/in-flight search
     root.hidden = true;
     document.documentElement.classList.remove('palette-open');
     if (lastFocus && lastFocus.focus) lastFocus.focus();
@@ -297,5 +437,5 @@
     if (kbd) kbd.textContent = isMac ? '⌘K' : 'Ctrl K';
   }
 
-  window.OTBPalette = { open: open, close: close, isOpen: isOpen, compute: compute };
+  window.OTBPalette = { open: open, close: close, isOpen: isOpen, compute: compute, contentEntry: contentEntry };
 })();

package/modules/ideas/projection.js

@@ -50,7 +50,7 @@ const IDEA_COLS = IDEA_COL_NAMES.join(', ');
 //
 // THE DOOR IS READ OFF THE SESSION, not claimed in the body. A web cookie is the
 // hall (the ideas form, the sky's composer), a device-flow token is the CLI
-// (capture.js, spark.js), anything else (a box token, a program on the port) is
+// (capture.js, spark.js), anything else (a program on the port) is
 // the API — so a filer cannot say they came through a door they did not. The one
 // value a body may ADD is 'planning': a planning session's capture is a CLI
 // filing no session can tell apart, so capture.js --via planning names it. The

package/modules/lifecycle/db-ship.js

@@ -224,17 +224,17 @@ async function resolveClaim({ claimId, builderId, outcome, notesMd, valueSummary
     }
 
     // Task #1048 (ADR 0046 follow-up): record the builder's sandbox self-approval
-    // as a durable fact on the task. When a dev-box builder reviews a staged
+    // as a durable fact on the task. When a builder reviews a staged
     // game change on their sandbox and approves shipping it (TTY 'y', or an
     // explicit --approved re-run on the dominant non-TTY path), ship.js threads
     // { stamp, url, method } through this resolve call. We stamp `by` + `at`
     // SERVER-SIDE (never trust the client for identity or time) and persist the
     // blob to tasks.sandbox_review. Only on a 'shipped' resolve carrying a
-    // payload — laptop ships, non-game diffs, quick-tunnel boxes, --skip-stage,
+    // payload — laptop ships, non-game diffs, --skip-stage,
     // and un-approved re-runs send nothing, leaving the column NULL.
     if (outcome === 'shipped' && sandboxReview && typeof sandboxReview === 'object' && sandboxReview.stamp) {
       // Sanitize the client-supplied fields (defense in depth): the builder's
-      // box controls stamp/url/method, so clamp lengths, whitelist `method`, and
+      // machine controls stamp/url/method, so clamp lengths, whitelist `method`, and
       // accept only an https:// URL. This keeps a forged/oversized value — or a
       // future stored-XSS string like a `javascript:` URL rendered in the hall —
       // out of the persisted record. `by`/`at` stay SERVER-stamped (never
@@ -1098,7 +1098,7 @@ async function confirmTask({ taskId, builderId }, deps = {}) {
 // first-class way to KILL a task that is no longer relevant. The only routes to
 // status='abandoned' were offboarding a builder (offboardBuilder, which seals
 // each open claim) and a raw SQL UPDATE — so stale/moot tasks sat in 'ready' as
-// claimable noise (the box-teardown chores #819/#822/#827 and the dup tasks
+// claimable noise (the teardown chores #819/#822/#827 and the dup tasks
 // #907/#926 that other sessions had already shipped, all retired 2026-06-13).
 // This is the missing transition.
 //

package/modules/lifecycle/github-push.js

@@ -1,18 +1,16 @@
 // GDS server-mediated branch publish (ADR 0055 / task 1025).
 //
 // WHY THIS EXISTS
-// A builder on a cloud dev box cannot publish in `ci` deploy mode: the box has
-// NO GitHub push credential by design (credential-less HTTPS origin, no gh, no
-// GH_TOKEN — infra/builder-box-cloud-init.yaml scrubs the clone token), and its
-// baked GDS session is box-scoped (deny-by-default, #919/ADR 0053). CI self-
+// A checkout with NO GitHub push credential by design (credential-less HTTPS
+// origin, no gh, no GH_TOKEN) cannot publish in `ci` deploy mode. CI self-
 // deploy (#859/ADR 0042) fixed only the LAST leg (Actions deploys main->prod);
-// the box still can't get its branch onto GitHub to open the PR.
+// such a checkout still can't get its branch onto GitHub to open the PR.
 //
-// THE FIX (owner-chosen: "the box holds nothing"). The box uploads its branch as
-// a THIN git bundle to the GDS over a RE-AUTHED (non-box) cli session; the server
+// THE FIX (owner-chosen: "the checkout holds nothing"). The checkout uploads its
+// branch as a THIN git bundle to the GDS over a RE-AUTHED cli session; the server
 // pushes the branch to GitHub + opens the PR + enables auto-merge using a SERVER-
-// side push credential. The box never holds a GitHub push credential, so the #919
-// model is preserved. The credential is scoped to a single repo (Contents:write +
+// side push credential. The checkout never holds a GitHub push credential, so the
+// #919 model is preserved. The credential is scoped to a single repo (Contents:write +
 // Pull-requests:write + Actions:read) and CANNOT push to branch-protected `main`
 // nor bypass required checks — a leaked server credential can only land code on a
 // feature branch behind the same checks every PR faces.
@@ -30,8 +28,8 @@
 // This module is the server seam: push a bundle, open/find the PR, enable auto-
 // merge, report status. All git runs through execFile arg-arrays (shell:false,
 // the #681 injection discipline); the credentialed URL is built in-process and
-// NEVER persisted to a remote nor echoed on an error path (the box-source-fetch.sh
-// "one-shot URL, scrub the credential" pattern). The GitHub API calls are raw
+// NEVER persisted to a remote nor echoed on an error path (the "one-shot URL,
+// scrub the credential" pattern). The GitHub API calls are raw
 // global fetch (no Octokit — fetch is used throughout auth.js), header shape
 // mirrors auth.js fetchGithubUser.
 
@@ -574,7 +572,7 @@ async function enableAutoMergeDetailed({ nodeId }, deps = {}) {
 }
 
 // getPublishStatus — report the PR + prod-deploy state so ship.js can poll
-// WITHOUT gh on the box. Returns:
+// WITHOUT gh on the checkout. Returns:
 //   { pr_state, merged, merge_sha, deploy_status, deploy_probe }  where
 //   pr_state ∈ open|closed|none,
 //   deploy_status ∈ pending|success|none|unconfigured|unavailable
@@ -811,7 +809,7 @@ function prReferencesTask(status, taskId) {
 
 // task 1002645 — locate a task's PR by the "task <id>: …" TITLE convention, for when
 // the reconciler cannot derive the branch. The sweep derives claude/<worktree_name>
-// (the dev-box convention), but a laptop/wave ship pushes its own branch name
+// (the conventional name), but a laptop/wave ship pushes its own branch name
 // (worktree-<worktree_name>), so the derived branch finds no PR and the sweep's whole
 // PR path — the mergeIfGreen nudge (the ONLY green-PR merger where native auto-merge
 // is repo-disallowed), conflict heal, land proof — never engages; the task strands at
@@ -972,7 +970,7 @@ function mergeBlockReason(s) {
     const bad = s.checks.filter(_BAD_CHECK);
     if (bad.length) return `failing_check:${bad[0].name}`;
     // Red, and the failing check is one of the nulled nodes: say the list is blind
-    // rather than guess "review or pending", which sent a box retrying (task 1003988).
+    // rather than guess "review or pending", which sent a ship retrying (task 1003988).
     if (s.checks_unreadable && ['FAILURE', 'ERROR'].includes(s.rollup_state)) return 'failing_check_unreadable';
     return 'blocked_required_review_or_pending_check';
   }

package/modules/lifecycle/publish-reconciler.js

@@ -4,18 +4,18 @@
 // "strands at confirmed" failure class.
 //
 // WHY THIS EXISTS
-// A server-mediated publish (ADR 0055) is ASYNCHRONOUS: a dev box uploads its
+// A server-mediated publish (ADR 0055) is ASYNCHRONOUS: a checkout uploads its
 // branch, the server pushes + opens the PR + arms auto-merge, then GitHub runs
-// the required checks, merges, and Actions deploys to prod. The box's ship.js
+// the required checks, merges, and Actions deploys to prod. The uploader's ship.js
 // only POLLS for ~9 min (pollServerPublish) and then EXITS, printing "it flips to
 // shipped on its own". But the confirmed→shipped transition lived in exactly ONE
 // place — the GET /tasks/:id/publish-status reconcile-on-read (routes/tasks.js).
 // That flip can ONLY happen while a client keeps issuing that GET. Real CI (check
-// queue + merge queue + deploy) routinely finishes AFTER the box has stopped
+// queue + merge queue + deploy) routinely finishes AFTER the client has stopped
 // polling, so nothing ever re-checks and the task row freezes at 'confirmed'
 // forever — even though prod is live. Every prior point-fix (1025/1027/1037/1041/
 // 1045/1046/1049/1050/1052/1068) compensated for a symptom of this one gap:
-// "the box must stay alive and keep polling to finish its OWN ship."
+// "the client must stay alive and keep polling to finish its OWN ship."
 //
 // THE FIX. Move the last mile to the SERVER, where it belongs. A periodic sweep
 // (this module) finds every 'confirmed' task, derives its branch from the latest
@@ -23,7 +23,7 @@
 // succeeded?), and on a confirmed land runs the EXACT db.shipTask +
 // ship-broadcast.postShipBroadcast the publish-status route already runs. The land
 // no longer depends on the shipper's CLI being alive — it works for EVERY builder,
-// on a box, a laptop, or a desktop session, and retroactively heals strands left
+// on a laptop or a desktop session, and retroactively heals strands left
 // by a session that exited early. Idempotent: shipTask throws TASK_NOT_CONFIRMED
 // if a client poll (or a prior sweep) already flipped it, so a sweep racing the
 // route never double-ships nor double-broadcasts.
@@ -333,7 +333,7 @@ async function runSweep(deps = {}) {
 
   // task 1002645 — the per-branch PR path (merge nudge → conflict/stale heal →
   // publish-status), extracted so it can run TWICE for one task: first on the
-  // derived claude/<worktree_name> branch (the dev-box convention), then — when
+  // derived claude/<worktree_name> branch (the conventional name), then — when
   // that finds no PR — on the REAL branch adopted from the task's own PR
   // (findTaskPullRequest). Mutates the sweep counters via closure; returns
   // { status, prNotLanded }.
@@ -605,7 +605,7 @@ async function runSweep(deps = {}) {
       }
     }
 
-    // task 1002645 — the claude/<worktree_name> derivation is the DEV-BOX convention;
+    // task 1002645 — the claude/<worktree_name> derivation is only ONE convention;
     // a laptop/wave ship pushes its own branch name (worktree-<worktree_name>), so the
     // derived branch finds no PR and the merge nudge / conflict heal / land proof all
     // sat idle while the task stranded at 'confirmed' (wave PRs 34/35/36 — native
@@ -768,8 +768,8 @@ async function runSweep(deps = {}) {
       logFn(
         `[publish-reconciler] task ${r.task_id} (${landNote}) landed → shipped`
       );
-      // The box that published could not post the Discord broadcast (no webhook
-      // secret — ADR 0053). The server holds the secrets, so it fires it here,
+      // The checkout that published cannot post the Discord broadcast (no webhook
+      // secret). The server holds the secrets, so it fires it here,
       // exactly ONCE on the confirmed→shipped transition. Best-effort: never let
       // a broadcast hiccup turn a successful reconcile into a failure.
       try {
@@ -827,7 +827,7 @@ async function runSweep(deps = {}) {
 
 // task 1366 — server-side session-cost reconcile, piggybacked on the same 5-min
 // sweep. System 1's client cost hook silently skips the MAJORITY of sessions (a
-// cloud box / cowork VM / overnight agent runs with no GDS token, so the
+// cowork VM / overnight agent runs with no GDS token, so the
 // SessionEnd hook quiet-skips), so a server pass re-prices the model_usage we
 // ALREADY stored on session_records into a cost_log row — keyed on the SAME
 // (source, source_ref) the client would use, so logCost's ON CONFLICT DO NOTHING

package/modules/lifecycle/routes/tasks.js

@@ -624,7 +624,7 @@ module.exports = function buildTasksRouter() {
       // confirmed→shipped flip and throws TASK_NOT_CONFIRMED on a repeat, so
       // whichever entry point wins the transition is the only one that reaches
       // this line — the emit fires exactly ONCE per ship across all three
-      // paths. The server is thus the SINGLE ship broadcaster (the box/laptop
+      // paths. The server is thus the SINGLE ship broadcaster (the laptop
       // local post in scripts/gds/ship.js was removed as a duplicate, task
       // 1749). Best-effort: emitAsync isolates listener errors so a broadcast
       // hiccup can never turn a successful ship into a 500.
@@ -1108,9 +1108,9 @@ module.exports = function buildTasksRouter() {
   // ==========================================================================
   // Server-mediated branch publish (ADR 0055 / task 1025)
   // --------------------------------------------------------------------------
-  // A builder on a cloud dev box has NO GitHub push credential (#919/ADR 0053
-  // box-scope + credential-less origin), so in `ci` deploy mode ship.js cannot
-  // `git push` + `gh pr create`. Instead the box uploads its branch as a THIN
+  // A checkout with NO GitHub push credential (credential-less origin, #919)
+  // cannot `git push` + `gh pr create`, so in `ci` deploy mode ship.js uploads
+  // its branch as a THIN
   // git bundle here; the server pushes it + opens the PR + enables auto-merge
   // using its own push credential — a GitHub App installation token (preferred,
   // task 1028) or the GITHUB_PUSH_TOKEN PAT fallback; single repo, Contents:write
@@ -1255,7 +1255,7 @@ module.exports = function buildTasksRouter() {
 
   // GET /tasks/:id/publish-status?branch=<branch> — poll the PR + prod-deploy
   // state for a server-mediated publish so ship.js can confirm the land WITHOUT
-  // gh on the box. Ownership-gated like the POST. Derives state live from GitHub.
+  // gh on the checkout. Ownership-gated like the POST. Derives state live from GitHub.
   // `branch` is optional (task 1003764): without it the server finds the task's own PR
   // (both publish paths title it "task <id>: …") and the answer names the `branch` it
   // used and its `branch_source`, so the check agents are sent to instead of git probes
@@ -1302,9 +1302,9 @@ module.exports = function buildTasksRouter() {
         try {
           const shipped = await db.shipTask({ taskId: id, builderId: req.builder.id, landAssurance: RECONCILE_PROOF }); // ADR 0184
           reconciled = true;
-          // task 1045: the box that published can't post the Discord broadcast —
-          // it holds no webhook secret (ADR 0053 "box holds nothing"), so a box
-          // ship was silently skipping the public announcement. The server holds
+          // task 1045: the checkout that published can't post the Discord
+          // broadcast — it holds no webhook secret, so such a ship was silently
+          // skipping the public announcement. The server holds
           // the secrets and just confirmed the deploy, so it fires the broadcast
           // here — exactly ONCE, on the confirmed→shipped transition. shipTask
           // throws TASK_NOT_CONFIRMED on a repeat poll, so this never re-posts.

package/modules/lifecycle/ship-card.js

@@ -9,7 +9,7 @@
 //
 // ONE generator, two render paths, both PURE:
 //   renderMonospaceCard(model) — alignment-proof left-rule text. The CLIs ALWAYS
-//     print this, so headless / cron / dev-box runs and feeds without the in-feed
+//     print this, so headless / cron runs and feeds without the in-feed
 //     visualization tool still get a consistent summary.
 //   renderCardHtml(model)      — the populated, branded HTML the skills render in
 //     the chat feed via the visualization tool (show_widget). Brand tokens come

package/modules/lifecycle/task-visuals.js

@@ -181,8 +181,8 @@ function isPubliclyViewable(task) {
 // The CANONICAL prefix (src/bongos/api-prefix.js) is hard-coded rather than
 // imported: this lib is deliberately core-free so it unit-tests with a Buffer and
 // a temp dir, and the doorway does not publish the prefix. It is safe to hard-code
-// because BOTH prefixes are permanent — '/api/gds' is a forever alias for shipped
-// Dev Box binaries and the off-box status mirror — so a URL stored under either
+// because BOTH prefixes are permanent — '/api/gds' is a forever alias for older
+// CLIs and the off-box status mirror — so a URL stored under either
 // keeps resolving, and every renderer's guard accepts both.
 const SERVE_PREFIX = '/api/bongos/task-visuals';
 function urlForName(name) {

package/modules/memory/routes/memory.js

@@ -32,8 +32,8 @@
 //
 // RENDER / STORED-XSS (#575, audit 2026-06-19) — memory content is stored RAW
 // and is NEVER emitted as HTML. Every endpoint here returns it as JSON
-// (res.json — content as a string field), and the only consumers are the CLI /
-// dev-box memory sync (it writes the strings to the local filesystem) and the
+// (res.json — content as a string field), and the only consumers are the CLI
+// memory sync (it writes the strings to the local filesystem) and the
 // Archon-only forensic reads (also JSON). An audit of every web surface
 // (modules/hall-ui/public/, modules/status-ui/public/) found NO code path that interpolates
 // memory content into the DOM: there is no markdown→HTML renderer in the client

package/modules/platform-identity/routes/sso.js

@@ -249,8 +249,9 @@ module.exports = function ssoRoutes() {
     //
     // resolveSession is the RAW resolver (so we can redirect rather than 401), so it
     // does NOT apply requireBuilder's deny gates — we must. sessionUsableForFederation
-    // rejects a deactivated account, a dev-box-scoped token (outside the ADR 0016
-    // trust boundary), and service principals: none may mint a federated identity code.
+    // rejects a deactivated account, a session of an undeclared source (outside
+    // the ADR 0016 trust boundary), and service principals: none may mint a
+    // federated identity code.
     let session;
     try {
       session = await resolveSession(req);

package/modules/provisioning/capacity.js

@@ -137,7 +137,7 @@ async function countPlaced(db, shapes, { excludeId = null } = {}) {
 }
 
 // readLocalMeminfo — THIS host's /proc/meminfo, for the surfaces that run on the
-// control plane itself. Null (not a throw) where it does not exist, e.g. a dev box
+// control plane itself. Null (not a throw) where it does not exist, e.g. a laptop
 // that is not Linux — the summary then reads 'default' and says so.
 function readLocalMeminfo() {
   try { return fs.readFileSync('/proc/meminfo', 'utf8'); } catch { return null; }

package/modules/provisioning/provisioning.js

@@ -351,8 +351,9 @@ function defaultDomainForSlug(slug, apex) {
 }
 
 // Labels the platform itself occupies (or has planned) directly under the instance
-// apex, plus the dev-box hostname prefixes. The runner's DNS write is an UPSERT,
-// so a project claiming one of these would overwrite platform records — refuse at
+// apex, plus the `term-` / `sandbox-` hostname prefixes older per-builder machines
+// took. The runner's DNS write is an UPSERT, so a project claiming one of these
+// would overwrite platform records — refuse at
 // the API layer instead (task 1002704; the guard applies to auto-assigned AND
 // bring-your-own hostnames, on create and on attach). Anything deeper than one
 // label under the apex is also refused: it breaks the wildcard-cert rule (one
@@ -1133,7 +1134,7 @@ async function setInstanceStatus(db, id, status, patch = {}) {
 
 // Enqueue a provision/teardown intent. Idempotent: the partial unique index
 // ux_provisioning_intents_open makes a second open enqueue collide (23505); we
-// then return the already-open intent with created:false (mirrors boxes.enqueueIntent).
+// then return the already-open intent with created:false.
 async function enqueueIntent(db, instanceId, action, requestedBy, targetVersion = null) {
   await require('./control-plane-guard').assertIntentAllowed(db, instanceId, action); // ADR 0293 D2; required HERE because this file is at the size ratchet
   try {