@bongos/core 1.19.1074 → 1.19.1076

package/scripts/gds/gen-session-index.js

@@ -26,8 +26,8 @@
 //   node scripts/gds/gen-session-index.js --check-block # exit 2 only if the tracked CLAUDE.md §13 snippet drifts (CI gate)
 //   node scripts/gds/gen-session-index.js --check-whole # exit 2 only if docs/session-log-index.md drifts
 //   node scripts/gds/gen-session-index.js --whole-only  # WRITE the index only; never touch the tracked
-//                                                       # CLAUDE.md snippet (sparse dev-box use; task 1002962)
-// docs/session-log-index.md is GITIGNORED + regenerated at deploy/box-fetch since ADR 0110 (task 1926).
+//                                                       # CLAUDE.md snippet (sparse-checkout use; task 1002962)
+// docs/session-log-index.md is GITIGNORED + regenerated at deploy since ADR 0110 (task 1926).
 //   node scripts/gds/gen-session-index.js --json       # print the parsed entries as JSON (debug)
 
 const fs = require('node:fs');
@@ -164,7 +164,7 @@ function computeWrites() {
   const writes = [];
 
   // Two buckets (ADR 0110, task 1926): 'whole' = docs/session-log-index.md, now
-  // GITIGNORED + regenerated at deploy/box-fetch (no committed copy → no branch
+  // GITIGNORED + regenerated at deploy (no committed copy → no branch
   // collisions); 'block' = the bounded CLAUDE.md §13 snippet, still tracked, so it
   // stays a HARD CI gate. main() gates them separately (--check-block vs --check-whole).
   const idxNext = renderIndex(entries);
@@ -197,11 +197,11 @@ function main() {
     return;
   }
   // WRITE-side bucket selection — the sibling of the --check-* flags (task 1002962,
-  // the gen-repo-map --whole-only twin). A dev box is a SPARSE checkout, so writing
-  // the TRACKED bucket there dirties the tree and the next `git pull` in
-  // box-source-fetch.sh aborts on "local changes would be overwritten" — a silent,
-  // permanent sync deadlock. A box regenerates only the gitignored artifact; the
-  // tracked CLAUDE.md §13 snippet arrives with the pull, generated from the whole tree.
+  // the gen-repo-map --whole-only twin). On a SPARSE checkout, writing the TRACKED
+  // bucket dirties the tree and the next `git pull` aborts on "local changes would
+  // be overwritten" — a silent, permanent sync deadlock. A sparse checkout
+  // regenerates only the gitignored artifact; the tracked CLAUDE.md §13 snippet
+  // arrives with the pull, generated from the whole tree.
   const wholeOnly = process.argv.includes('--whole-only');
   const all = computeWrites().writes;
   const writes = wholeOnly ? all.filter((w) => w.bucket === 'whole') : all;

package/scripts/gds/leak-scan-allowlist.js

@@ -167,7 +167,7 @@ const FILE_ALLOWLIST = [
     path: 'tests/lib_sh_resolution.mjs',
     classes: ['token'],
     reason:
-      'Carries the host-identity scan pattern it runs over the baked box scripts — a detector '
+      'Carries the host-identity scan pattern it runs over the bash smoke scripts — a detector '
       + 'pattern, the same case as fitness-checks-identity.js.',
   },
   {

package/scripts/gds/plain-cards.js

@@ -8,7 +8,7 @@
 // what happened, what the agent will do next, whether a PERSON is needed (and who), and
 // whether this is a rule rather than a fault. That last one is the expensive mistake:
 // an agent that reads a deliberate restriction as breakage goes looking for a way round
-// it (the box session that asked the owner for a personal access token).
+// it (the agent that asked the owner for a personal access token).
 //
 // STATIC TEXT ONLY. A card interpolates nothing — no task title, no server message — so
 // printing it adds no prompt-injection surface (the strand-watch / push-path-brief rule).

package/scripts/gds/push-path-brief.js

@@ -4,19 +4,19 @@
 // scripts/gds/push-path-brief.js — say out loud, at session start, that this machine
 // cannot push (task 1003259 / idea 1000838).
 //
-// THE GAP. On 2026-08-24 a dev-box agent hit auth failures on every raw git probe,
-// concluded "no push credential exists", and asked the owner to mint a fine-grained
-// PAT and store it in ~/.git-credentials on the box — the exact anti-pattern the
-// server-mediated publish path (ADR 0055) exists to avoid. The agent was not being
-// careless: from inside a box every direct GitHub probe fails BY DESIGN (the clone
-// token is one-shot and scrubbed from .git/config after each fetch — ADR 0031 §6),
+// THE GAP. On 2026-08-24 an agent on a credential-less checkout hit auth failures on
+// every raw git probe, concluded "no push credential exists", and asked the owner to
+// mint a fine-grained PAT and store it in ~/.git-credentials — the exact anti-pattern
+// the server-mediated publish path (ADR 0055) exists to avoid. The agent was not being
+// careless: on that checkout every direct GitHub probe failed BY DESIGN (the
+// clone token was one-shot and scrubbed from .git/config after each fetch — ADR 0031 §6),
 // so "missing credential" is the only story the local evidence supports, and the true
 // state at the time (branch already pushed, PR open, CI red) was invisible to it.
-// Nothing the box session loads says the model out loud. This says it out loud.
+// Nothing the session loads says the model out loud. This says it out loud.
 //
 // SO: the third SessionStart truth-teller, beside deploy-divergence.js and
 // strand-watch.js. On the server-publish path (pushVia() 'server' — no authenticated
-// gh, i.e. a dev box or any credential-less checkout) it prints ONE line stating the
+// gh, i.e. any credential-less checkout) it prints ONE line stating the
 // credential model and where the truth about published work lives
 // (GET /api/bongos/tasks/:id/publish-status). On a laptop that pushes locally
 // (pushVia() 'local') it prints NOTHING — a line that fires on every healthy laptop
@@ -58,7 +58,7 @@ function briefLine(via) {
 
 // Lazy require so a broken or partial checkout degrades to silence, not a stack
 // trace injected into the session. pushVia() honors <PREFIX>_PUSH_VIA_SERVER, else
-// probes for an authenticated gh (absent on every box → 'server' instantly).
+// probes for an authenticated gh (absent on a credential-less checkout → 'server' instantly).
 function detectVia() {
   return require('./ship-deploy-target.js').pushVia();
 }
@@ -70,7 +70,7 @@ function report(via) {
   console.log('  Publish path');
   console.log('  ──────────────────────────────────────────────────────────');
   if (via === 'server') {
-    console.log('  server-mediated (no authenticated gh — a dev box or credential-less checkout).');
+    console.log('  server-mediated (no authenticated gh — a credential-less checkout).');
     console.log(`  ${BRIEF}`);
     for (const line of plainCardLines('no_push_credential')) console.log(line);
   } else if (via === 'local') {

package/scripts/gds/rename-history-check.js

@@ -45,7 +45,7 @@
 //      notices if a blanket find-replace rewrites them. This does.
 //
 //   4. ALIAS MOUNTS — '/api/gds' is a PERMANENT alias (src/bongos/api-prefix.js
-//      says never to remove it: shipped Dev Box binaries and live dev boxes
+//      says never to remove it: shipped binaries and live instances
 //      call it and cannot be force-updated). Asserted against the real exported
 //      mount list. The DISPATCH half — that the alias is a live mount and so
 //      gets no corrective 404 hint — is already covered by

package/scripts/gds/run-unit-tests.js

@@ -118,6 +118,10 @@ const INTEGRATION = new Set([
   // (Prose here avoids single-quoted tokens: the pairing guard below parses this
   // set out of the source, so a quoted word in a comment reads as an entry.)
   'copy_desk_flags_db',
+  // task 1004362: core_258 against a real Postgres holding a claim created from a
+  // dev box session. The claims foreign key that failed the live upgrade is a
+  // schema fact only a transaction engine enforces. Always rolled back.
+  'core_258_box_session_claims_db',
   'discord_autojoin', 'discord_oauth',
   // task 1003000 (IC6): the three ideator credit streams against a real Postgres.
   // The three DB-free sibling suites stub the client and SIMULATE the

package/scripts/gds/session-digest-build.js

@@ -155,7 +155,7 @@ function buildSessionDigest(entries, opts = {}) {
         mu.input += tin; mu.output += tout; mu.cache_read += tcr; mu.cache_creation += tcc;
       } else {
         // task 1676: a token-bearing turn with NO model id. Previously dropped
-        // from model_usage (→ total_tokens>0 but priced $0 on the dev-box/CI
+        // from model_usage (→ total_tokens>0 but priced $0 on the CI
         // path; ADR 0097). Accumulate the unlabeled tokens so the digest can
         // attribute them to a real, priceable family bucket after the loop.
         m._unlabeled.input += tin; m._unlabeled.output += tout;
@@ -233,7 +233,7 @@ function buildSessionDigest(entries, opts = {}) {
   m.total_tokens = m.tokens.input + m.tokens.output + m.tokens.cache_read + m.tokens.cache_creation;
   // task 1676 — cost-plus reward zero-out fix. The cost-plus session reward
   // (ADR 0054) prices `model_usage` server-side. model_usage is keyed on msg.model
-  // and SKIPS any token-bearing turn whose model id is missing. On the dev-box/CI
+  // and SKIPS any token-bearing turn whose model id is missing. On the CI
   // agent path that gap was the difference between total_tokens>0 (so the digest
   // passes the route's empty-session guard + gets stored) and model_usage={} (so
   // priceModelUsage returns $0 → 0 drachmae) — ADR 0097's "upload no priced model

package/scripts/gds/ship-deploy-target.js

@@ -32,7 +32,7 @@ const { REPO_ROOT } = require('./ship-state.js');
 //      `bongos upgrade` (pin-bump), NOT an SSH deploy (ADR 0108). When a target IS
 //      set it requires that host's SSH key, so only the operator can land.
 //
-//   'ci' — NO builder box holds the prod key. ship pushes the branch, opens a
+//   'ci' — NO builder machine holds the prod key. ship pushes the branch, opens a
 //      PR, and enables GitHub auto-merge; once required checks pass, GitHub
 //      merges to main and .github/workflows/deploy-prod.yml deploys from
 //      Actions. ship then CONFIRMS the deploy landed (PR merged + the
@@ -62,8 +62,8 @@ function parseDeployMode(envVal, configRaw) {
 // effectiveDeployMode — credential- and protection-aware adjustment of the parsed
 // mode (pure; exported for the regression test). The 'laptop' land path pushes
 // main + SSHes the droplet FROM THIS MACHINE, so it requires a local GitHub push
-// credential. A machine without one — a dev box, or a fresh/stale local clone that
-// can't even `git pull` (token-less origin, ADR 0053) — physically cannot run it;
+// credential. A machine without one — a fresh/stale local clone that can't
+// even `git pull` (token-less origin, ADR 0053) — physically cannot run it;
 // it must ship via the 'ci' server-mediated publish path instead
 // (pushVia()==='server', ADR 0055), which lets the GDS server push with its own
 // credential. So when the parsed mode is 'laptop' but the machine can't push
@@ -314,10 +314,10 @@ function fetchDeployedVersion(url = deployedVersionUrl()) {
 // pushVia — which publish path ship uses in 'ci' mode (ADR 0055 / task 1025):
 //   'local'  — this machine pushes the branch + opens the PR with git + gh
 //              (laptop: gh present + authenticated). Today's behaviour.
-//   'server' — this machine has NO GitHub push credential (a dev box: no gh, a
+//   'server' — this machine has NO GitHub push credential (no gh, a
 //              credential-less origin). ship uploads a thin branch bundle to the
 //              GDS, which pushes + opens the PR + auto-merges with the SERVER's
-//              credential. The box holds nothing (#919 model preserved).
+//              credential. This machine holds nothing (#919 model preserved).
 // Override with <PREFIX>_PUSH_VIA_SERVER=1 (force server) / =0 (force local) for tests.
 function ghAvailableAndAuthed() {
   try {
@@ -338,15 +338,15 @@ function pushVia() {
   if (o === '1') return 'server';
   if (o === '0') return 'local';
   // No explicit override: a machine that can run an authenticated gh (laptop)
-  // takes the local path; everything else (a dev box) goes server-mediated.
+  // takes the local path; everything else goes server-mediated.
   return ghAvailableAndAuthed() ? 'local' : 'server';
 }
 
 // broadcastHandledByServer — task 1045: on the server-mediated publish path the
 // SERVER posts the Discord ship-broadcast after it confirms the deploy (it holds
-// the webhook secrets; the box does NOT — ADR 0053). So ship.js must NOT also post
-// locally there, or the box would either double-post (impossible — no secret) or,
-// as before, fail silently. True only when the publish actually goes server-side:
+// the webhook secrets; the local machine does NOT — ADR 0053). So ship.js must NOT
+// also post locally there, or this machine would either double-post (impossible — no
+// secret) or, as before, fail silently. True only when the publish actually goes server-side:
 // ci deploy mode AND this machine has no GitHub push credential (pushVia 'server').
 // The laptop path (pushVia 'local') keeps posting locally, exactly as today. Pure
 // w.r.t. its inputs (env + committed deploy.json) + exported so the gate is tested.
@@ -355,12 +355,12 @@ function broadcastHandledByServer() {
 }
 
 // shouldBailOnFetchFailure — autoMerge's decision when `git fetch origin main`
-// fails. A credential-less dev box (private origin, scrubbed clone token —
+// fails. A credential-less checkout (private origin, no creds —
 // ADR 0053) CANNOT fetch origin, and that is FINE for the server-mediated
-// publish path (ADR 0055): ciLandServer bundles against the box's LOCAL
+// publish path (ADR 0055): ciLandServer bundles against this machine's LOCAL
 // origin/main and the SERVER tops up main with its own credential. So a fetch
-// failure is fatal ONLY when we are NOT taking that path — otherwise the box can
-// never reach ciLand and strands every ship at confirmed (the bug task 1027
+// failure is fatal ONLY when we are NOT taking that path — otherwise such a
+// machine can never reach ciLand and strands every ship at confirmed (the bug task 1027
 // surfaced: ADR 0055 shipped the server path but left this fetch guard in front
 // of it). Pure + exported for the regression test (no git, no network).
 // NOTE: callers must still guard the pushVia() gh-probe behind `!fetchedMain` so

package/scripts/gds/ship-flow.js

@@ -318,7 +318,7 @@ async function shipMain() {
 
   // ---- Module drift check (BV1.R53, task 1422) ----
   // If the task carries a module_key, verify the committed diff doesn't stray
-  // into a DIFFERENT module's territory. "You said game, you touched dev-box" is
+  // into a DIFFERENT module's territory. "You said game, you touched provisioning" is
   // the semantic violation this catches. Files no module owns are allowed —
   // they're cross-cutting — as is the territory of a CROSS-CUTTING module, which
   // every craft legitimately writes into. Only contact with a different OWNING

package/scripts/gds/ship-land.js

@@ -274,11 +274,11 @@ function reconciledCardStatus(liveStatus, preMergeStatus) {
   return liveStatus === 'shipped' ? 'shipped' : preMergeStatus;
 }
 
-// task 1052 (E): the box-appropriate next step when a ship lands the task at
-// 'confirmed' without finishing. A dev box (pushVia 'server' — no authed gh)
-// CANNOT run /merge-mode (it needs gh + a main checkout), so the old "for
-// /merge-mode" advice was a dead end ON A BOX (the #1027 retrospective: the agent
-// had to reverse-engineer recovery from source). Point a box at the resume
+// task 1052 (E): the machine-appropriate next step when a ship lands the task at
+// 'confirmed' without finishing. A machine with no push credential (pushVia 'server' —
+// no authed gh) CANNOT run /merge-mode (it needs gh + a main checkout), so the old
+// "for /merge-mode" advice was a dead end there (the #1027 retrospective: the agent
+// had to reverse-engineer recovery from source). Point such a machine at the resume
 // instead (task 941); a laptop keeps /merge-mode (with resume as the alternative).
 // Pure + exported for unit tests.
 function strandNextStep(taskId, via) {
@@ -371,7 +371,7 @@ function prAssigneeLine(login) {
 }
 
 // task 1003988 — what to tell a builder while their PR sits RED. The poll used to
-// wait out its nine minutes in silence, so a credential-less box learned only that
+// wait out its nine minutes in silence, so a credential-less checkout learned only that
 // the land was "pending" and pushed the same commit again (PR 922: nine red runs).
 // `md` is publish-status's merge_driver; null means nothing red to report. Pure +
 // exported so the wording is pinned by tests/unit_report_status.mjs.

package/scripts/gds/ship-merge.js

@@ -103,7 +103,7 @@ function regenerateShipArtifacts() {
   regenerateCopyInventory();
   // Refresh the generated OpenAPI spec + API reference from the shipped route tree (task 1918).
   regenerateApiDocs();
-  // ...then the typed client FROM that spec (+ the devbox vendored copy) on the same beat (task 2051).
+  // ...then the typed client FROM that spec on the same beat (task 2051).
   regenerateApiClient();
 }
 
@@ -168,10 +168,10 @@ async function mergeLocally(taskId, valueSummary, { dbOnly = false } = {}) {
   // nothing to push, merge, or deploy. Short-circuit so the caller's POST
   // /tasks/:id/ship still flips status to shipped instead of stranding the
   // task at confirmed forever.
-  // A credential-less dev box can't `git fetch origin main` (private origin, no
+  // A credential-less checkout can't `git fetch origin main` (private origin, no
   // creds — ADR 0053), but that's only fatal OFF the server-publish path: the
-  // box's ADR-0055 path bundles against its LOCAL origin/main and the server tops
-  // up main. Without this, the box dead-ends here and strands every ship at
+  // ADR-0055 path bundles against its LOCAL origin/main and the server tops
+  // up main. Without this, such a checkout dead-ends here and strands every ship at
   // confirmed (task 1027). The `!fetchedMain &&` short-circuit keeps the gh-probe
   // (pushVia) off the happy laptop path, so laptop behavior is byte-for-byte.
   const fetchedMain = shellOk('git fetch origin main');

package/scripts/gds/ship-preflight-steps.js

@@ -238,22 +238,22 @@ function decidePreMerge({ branch, behind, via }) {
   if (!branch || branch === 'main' || branch === 'HEAD') {
     return { action: 'skip', reason: `not on a feature branch (${branch})` };
   }
-  // Server-mediated publish (ADR 0055): a credential-less partial-clone dev box
+  // Server-mediated publish (ADR 0055): a credential-less partial-clone checkout
   // (blob:none, HTTPS origin, no gh/credential-helper — ADR 0053) CANNOT run a
   // local `git merge origin/main` — the ort merge lazily fetches main's blobs
   // from the promisor remote and there are no credentials to authenticate that
-  // fetch, so the box strands here and can never ship while behind main, i.e.
+  // fetch, so such a checkout strands here and can never ship while behind main, i.e.
   // ≈always (idea #364). It also does not NEED to: ciLandServer bundles
   // `origin/main..HEAD` and the SERVER reconciles the branch with the real main
   // when it pushes + opens + auto-merges the PR; a genuine conflict surfaces
   // server-side as merge_conflict (publish-reconciler / conflict-resolve,
   // ADR 0082). The local pre-merge (#1068) is a LAPTOP-path optimization (so the
   // sandbox-reviewed tree == the shipped tree); it stays exactly as-is there
-  // (via 'local'/undefined) and is simply skipped on the box.
+  // (via 'local'/undefined) and is simply skipped on the server path.
   if (via === 'server') {
     return {
       action: 'skip',
-      reason: 'server-mediated publish reconciles with origin/main server-side (credential-less partial-clone box cannot fetch main blobs locally — idea #364)',
+      reason: 'server-mediated publish reconciles with origin/main server-side (credential-less partial-clone checkout cannot fetch main blobs locally — idea #364)',
     };
   }
   if (!Number.isFinite(behind) || behind === 0) {

package/scripts/gds/ship-regen.js

@@ -26,21 +26,21 @@ function currentBranch() {
 //
 // Returns a status string ('skipped-server' | 'regen-failed' | 'current' |
 // 'committed' | 'committed-nofatal') so the regression test (task 1046) can
-// prove the dev-box skip without git or a headless browser.
+// prove the server-publish skip without git or a headless browser.
 function regenerateDiagrams() {
-  // task 1046: on the server-mediated-publish path (a dev box — pushVia 'server'),
+  // task 1046: on the server-mediated-publish path (pushVia 'server'),
   // there is no headless browser, so render-diagrams.sh fails and gen-diagrams.js
   // exits non-zero AFTER writing the regenerated .mmd + assertions.json — which
   // shellOk() then treats as a failed regen and returns BEFORE the commit below,
   // leaving those files UNCOMMITTED in the builder's tree (had to be reverted by
-  // hand). The box must not attempt the regen at all: skip here and let a
+  // hand). That path must not attempt the regen at all: skip here and let a
   // render-capable ship (the laptop path, which CAN render the PNGs) refresh them
   // as a matched .mmd+.png+assertions set; the diagram-drift routine backstops any
   // staleness in the meantime. Skipping entirely (vs --no-render) avoids committing
   // a .mmd/.png mismatch to main. Mirrors gen-diagrams.js's own non-fatal skip when
   // bash itself is absent (ENOENT).
   if (pushVia() === 'server') {
-    console.log('  diagram regen skipped on the dev-box ship path (no GDS session for the conceptual diagrams) — a full-clone ship refreshes the .mmd; drift checker backstops staleness');
+    console.log('  diagram regen skipped on the server-publish ship path (no GDS session for the conceptual diagrams) — a full-clone ship refreshes the .mmd; drift checker backstops staleness');
     return 'skipped-server';
   }
   // ADR 0110 pt.3 (task 2027): the .svg/.png RENDERS are now gitignored and
@@ -74,7 +74,7 @@ function regenerateDiagrams() {
 
 // task 1224 (Path B / ADR 0063): refresh the generated symbol skeleton from the shipped tree so the
 // altitude map can't drift. Pure JS (no headless browser, no render) — unlike the diagrams it is safe
-// on EVERY ship path, including the dev-box server-publish path. Non-fatal: a hiccup must never block
+// on EVERY ship path, including the server-publish path. Non-fatal: a hiccup must never block
 // a ship. ADR 0110 (task 1926): docs/repo-map.md is now GITIGNORED + regenerated at deploy — the
 // generator still WRITES it (untracked, harmless), but ship commits ONLY the tracked nested-doc
 // blocks. It is deliberately absent from the git add/status lists below: `git add <ignored path>`
@@ -101,12 +101,12 @@ function regenerateRepoMap() {
 
 // Refresh the generated session-log index (docs/session-log-index.md) + the bounded CLAUDE.md §13
 // "recent sessions" snippet from the shipped tree's docs/session-logs/*.md (ADR 0062 §8, task 1226).
-// Pure JS (reads files, no DB, no headless browser) — safe on EVERY ship path including the dev-box
+// Pure JS (reads files, no DB, no headless browser) — safe on EVERY ship path including the
 // server-publish path. Non-fatal: a hiccup must never block a ship; the Path-C CI gate
 // (`gen-session-index --check`) backstops staleness on main.
 // Refresh the generated API docs (docs/api/openapi.json + docs/api-reference.md +
 // docs/routes-permissions.md) from the shipped route tree (task 1918). Pure JS (reads
-// route files, no DB, no headless browser) — safe on EVERY ship path incl. the dev-box
+// route files, no DB, no headless browser) — safe on EVERY ship path incl. the
 // server-publish path. Non-fatal: a hiccup must never block a ship; the fitness
 // `gen-api-docs --check` gate backstops staleness on main.
 function regenerateApiDocs() {
@@ -135,10 +135,7 @@ function regenerateApiDocs() {
 // so a route change left the client stale until the api_client test caught it in CI.
 // Non-fatal + safe on every ship path; the api_client freshness test backstops main.
 
-// The regenerated client's git pathspec. It used to carry a second, conditional path —
-// a vendored copy inside a desktop app, named only when on disk because `git add` of an
-// unmatched pathspec aborts the whole stage (task 1002417). The app is gone (task
-// 1003891), so the pathspec is the one directory the generator writes.
+// The regenerated client's git pathspec: the one directory the generator writes.
 const API_CLIENT_PATHSPEC = 'clients/bongos-client';
 
 function regenerateApiClient() {
@@ -186,7 +183,7 @@ function regenerateSessionIndex() {
 // Refresh the generated file-map sections (.claude/skills/ + .claude/scheduled-tasks/ trees in
 // docs/file-map.md) from what is on disk (ADR 0066, task 1276). Pure JS (reads dirs + the
 // docs/file-map.notes.json sidecar, no DB, no headless browser) — safe on EVERY ship path including
-// the dev-box server-publish path. Non-fatal: a hiccup must never block a ship; the Path-C CI gate
+// the server-publish path. Non-fatal: a hiccup must never block a ship; the Path-C CI gate
 // (`gen-file-map --check`, in fitness.js) backstops staleness on main. NB gen-file-map exits 2 when
 // a skill/routine has no note, so shellOk may report "failed" on a legit note-gap ship — that is
 // fine, we still commit whatever it wrote and CI surfaces the missing note.

package/scripts/gds/ship.js

@@ -273,8 +273,8 @@ module.exports = {
   // preflight's upstream-deletion warning — exported so it's unit-tested
   // without a live git repo.
   parseDeletedUpstreamPaths,
-  // task 1052 (E): box-aware "what to do next" for a confirmed-strand — a box
-  // (via 'server') is pointed at the resume, never at gh-only /merge-mode.
+  // task 1052 (E): path-aware "what to do next" for a confirmed-strand — a machine
+  // on the server path (via 'server') is pointed at the resume, never at gh-only /merge-mode.
   strandNextStep,
   // task 1002606: the success-pending banner lines, pure — pinned so the strand
   // detection story ("NOT a failure" + how you WILL find out if it fails) can't drift.
@@ -293,20 +293,20 @@ module.exports = {
   // #858: commit-pinned deploy confirmation via the /version endpoint.
   deployedCommitStatus,
   // ADR 0055 / task 1025: which ci-mode publish path this machine uses
-  // ('local' = git+gh here; 'server' = server-mediated, e.g. a dev box) — so
+  // ('local' = git+gh here; 'server' = server-mediated, no local push credential) — so
   // doctor.js reports the same path ship will take instead of failing on
   // missing gh where gh isn't needed.
   pushVia,
-  // task 1046: diagram regen returns a status string and SKIPS on the dev-box
-  // (server-publish) path so a box never leaves uncommitted .mmd/assertions in
-  // its tree — exported so the regression test proves the skip without git.
+  // task 1046: diagram regen returns a status string and SKIPS on the server-publish
+  // path so such a checkout never leaves uncommitted .mmd/assertions in its tree —
+  // exported so the regression test proves the skip without git.
   regenerateDiagrams,
   regenerateRepoMap,
   regenerateSessionIndex,
   // ADR 0066 / task 1276: regenerate docs/file-map.md's skills + scheduled-tasks sections from disk.
   regenerateFileMap,
   // task 1037: autoMerge's fetch-failure decision — fatal only OFF the server-
-  // publish path (a credential-less dev box can't fetch but ships via ADR 0055).
+  // publish path (a credential-less checkout can't fetch but ships via ADR 0055).
   // Exported pure so the regression test proves the truth table without git.
   shouldBailOnFetchFailure,
   // task 391 (idea #37): autoMerge's zero-commit verdict — refuse a zero-commit
@@ -342,8 +342,8 @@ module.exports = {
 if (require.main === module) {
   // --print-deploy-mode (task 1003221): the EFFECTIVE mode, one word, no session or
   // network. The /merge-mode skill used to probe parseDeployMode directly, which
-  // defaults to 'laptop' when config/deploy.json is absent — as it is on every dev
-  // box (ADR 0148) — sending the builder down a push path they had no credential for.
+  // defaults to 'laptop' when config/deploy.json is absent — sending the
+  // builder down a push path they had no credential for.
   if (process.argv.slice(2).includes('--print-deploy-mode')) {
     console.log(require('./ship-deploy-target.js').resolveDeployMode());
     process.exit(0);

package/scripts/gds/skill-preflight.js

@@ -4,12 +4,13 @@
 // 1000077; criterion guards-skill-declares-machine).
 //
 // THE INCIDENT. /merge-mode states in its own prose that it assumes the Archon's
-// Mac or the droplet. It was run on a dev box anyway. Worse, ship.js ALREADY knew:
-// strandNextStep() tells a box "/merge-mode is NOT available here — it needs gh +
-// a main checkout this machine doesn't have." So the knowledge existed in two
-// places and neither stopped the run, because prose cannot refuse and the one
-// executable copy was on a different code path. A capability a procedure needs
-// must be a declaration the machine can CHECK, not a sentence a reader can skim.
+// Mac or the droplet. It was run on a machine with no push credential anyway. Worse,
+// ship.js ALREADY knew: strandNextStep() tells such a machine "/merge-mode is NOT
+// available here — it needs gh + a main checkout this machine doesn't have." So the
+// knowledge existed in two places and neither stopped the run, because prose cannot
+// refuse and the one executable copy was on a different code path. A capability a
+// procedure needs must be a declaration the machine can CHECK, not a sentence a
+// reader can skim.
 //
 // THREE PARTS, matching that diagnosis:
 //   1. `requires:` in the skill's own YAML frontmatter — the declaration.
@@ -74,7 +75,7 @@ const CAPABILITIES = {
     what: 'an authenticated GitHub CLI',
     probe: () => ghAuthed(),
     missing: 'no authenticated `gh` on this machine. Run `gh auth login`, or use a machine that has it — '
-      + 'a dev box normally does not, by design (it publishes through the server instead, ADR 0055).',
+      + 'a machine with no push credential normally does not, by design (it publishes through the server instead, ADR 0055).',
   },
   'main-checkout': {
     what: 'the main checkout, not a linked worktree',
@@ -318,7 +319,7 @@ function checkOpsSkillsDeclareMachine({ dir = SKILLS_DIR, read = null, names: in
       violations.push(
         `${n} fences commands needing [${undeclared.join(', ')}] but does not declare them. `
         + 'Add them to `requires:` in the frontmatter so the preflight can refuse early — '
-        + 'prose cannot refuse, which is how /merge-mode came to be run on a dev box (task 1003167).'
+        + 'prose cannot refuse, which is how /merge-mode came to be run on a machine that could not run it (task 1003167).'
       );
     }
   }

package/src/bongos/api-prefix.js

@@ -9,10 +9,10 @@
 //
 // The URL rename (Part B / B1, task 1919) flipped the canonical here: the API is
 // now served at '/api/bongos', and '/api/gds' stays mounted FOREVER as a silent
-// alias (LEGACY_API_PREFIXES). "Forever" is deliberate — shipped Dev Box desktop
-// binaries, the separately-hosted status-dashboard mirror, and live dev boxes all
-// call '/api/gds' and can't be force-updated. serve-internal.js mounts the router
-// + discovery index at API_PREFIX and every LEGACY_API_PREFIXES entry.
+// alias (LEGACY_API_PREFIXES). "Forever" is deliberate — shipped older CLI
+// releases and the separately-hosted status-dashboard mirror all call '/api/gds'
+// and can't be force-updated. serve-internal.js mounts the router + discovery
+// index at API_PREFIX and every LEGACY_API_PREFIXES entry.
 const API_PREFIX = '/api/bongos';
 
 // Prefixes the server ALSO answers on, for callers pinned to the previous path.

package/src/bongos/module-scope-map.js

@@ -431,7 +431,7 @@ const MODULE_GLOBS = {
     'scripts/gds/scope-roster-guard.js',
     'scripts/gds/route-shadow-guard.js', 'scripts/gds/routine-schedule.js',
     'scripts/gds/seam-wiring-guard.js', 'scripts/gds/skill-preflight.js',
-    'scripts/gds/test-path-guard.js', 'scripts/gds/version-literal-guard.js',
+    'scripts/gds/test-path-guard.js', 'scripts/gds/version-literal-guard.js', 'scripts/gds/dev-box-guard.js',
   
     // ADOPTED (task 1004111): the enforcement surfaces this module already IS.
     // install-git-hooks.js + scripts/gds/hooks/ are the pre-push hook beside the

package/src/bongos/platform-visibility-gate.js

@@ -65,7 +65,7 @@ const API = `(?:${ALL_API_PREFIXES.map(escRe).join('|')})`;
 //                        Caddy's on-demand-TLS `ask` and the provisioning probe —
 //                        server-to-server, cookie-less, and on a control plane a
 //                        refused ask means no project ever gets a certificate.
-//   /downloads/*         the installer script and the Dev Box updater — a
+//   /downloads/*         the installer script and the release downloads — a
 //                        cookie-less `curl … | sh`, and release redirects carry
 //                        no project data.
 //   /__prelaunch         the pre-launch gate's own submit, when both gates are on.

package/src/bongos/routes/me.js

@@ -510,7 +510,7 @@ module.exports = function buildMeRouter() {
     };
     // Module→core contribution seam (BV1.R42, ADR 0083). Let each enabled module
     // add its own profile slice instead of core hardcoding it — the strangler
-    // prerequisite that lets dev-box/discord/art leave this route. ADD-ONLY (core
+    // prerequisite that lets discord/art leave this route. ADD-ONLY (core
     // keys win); a collision means a move task took over a core key without
     // dropping the core copy. Empty until a module registers → byte-identical today.
     const slices = await seams.collectContributions('profile.fields', {

package/src/bongos/routes/security.js

@@ -113,9 +113,9 @@ module.exports = function buildSecurityRouter() {
   //
   // The DATED security engagement reports (exploit detail — full repro,
   // evidence, the attacker cookbook) are served from the DB, NOT committed to
-  // the git clone: the repo is cloned in full onto every Metic+ dev box
-  // (threat-model §6.3 / ADR 0020), so a committed exploit report is an
-  // attacker cookbook on every box. The SAFE conceptual docs (threat-model.md,
+  // the git clone: the repo is cloned in full onto every Metic+ builder's
+  // machine (threat-model §6.3 / ADR 0020), so a committed exploit report is an
+  // attacker cookbook on every machine. The SAFE conceptual docs (threat-model.md,
   // the README) stay in docs/security/; only the dated reports live here, and
   // ALL three routes gate on requirePermission('security.report.adjudicate')
   // — an archon-floored atom (BV1.R104; was requireRank('archon') and admits

package/src/bongos/routes.js

@@ -167,8 +167,8 @@ function buildGdsRouter() {
   // core to every instance, not an OTB feature.
   router.use(buildLiveRouter());
   // Feature-module-gated mounts (R54, task 1193, ADR 0062 §4). Off on a vanilla
-  // instance; ON for OTB via config/modules.json so prod is unchanged. dev-box,
-  // art-pipeline, and discord (with its bug-attachments route) have all graduated
+  // instance; ON for OTB via config/modules.json so prod is unchanged. art-pipeline
+  // and discord (with its bug-attachments route) have both graduated
   // into real modules (modules/<key>/) — they are discovered + mounted by
   // moduleLoader.mountModuleRoutes below, not here (BV1.R43 / R48 / R47 / R72).
   // gate-approvals likewise moved to the lifecycle module (BV1.R86).

package/src/bongos/serve-internal.js

@@ -622,8 +622,8 @@ function mountInternalSurfaces(app) {
   //
   // Dual-mount (task 1919): the router + this discovery index are mounted at the
   // canonical API_PREFIX (/api/bongos) AND every LEGACY_API_PREFIXES entry
-  // (/api/gds) — the legacy alias stays FOREVER so shipped Dev Box binaries, the
-  // cached status mirror, and live boxes keep working (src/bongos/api-prefix.js). The
+  // (/api/gds) — the legacy alias stays FOREVER so older CLI releases and the
+  // cached status mirror keep working (src/bongos/api-prefix.js). The
   // SAME router instance is mounted at each path. Each discovery GET is registered
   // BEFORE its router mount so the exact base-path GET wins; every other
   // method/subpath falls through to the router.
@@ -670,7 +670,7 @@ function mountInternalSurfaces(app) {
   // below only prefixes non-/api paths, so without this placement /downloads/*
   // would be rewritten to /builders/downloads/* and 404). The installer scripts are served with the
   // server's PINNED origin substituted for __GDS_API_BASE__ — never a request
-  // header, so a spoofed Host can't redirect a `curl | sh` (the box-connect.sh rule).
+  // header, so a spoofed Host can't redirect a `curl | sh`.
   const bongosCfg = tryLoadInstanceConfig('bongos-cli.json');
   if (bongosCfg) {
     const bongosDownloads = buildBongosDownloads(bongosCfg);
@@ -894,8 +894,7 @@ function mountInternalSurfaces(app) {
   // them to the hall, and an unauthenticated visitor into sign-in). The subdomain
   // shim above has already rewritten the bare /watch + /gate onto /builders/*.
   // (Defense in depth: every data endpoint these pages call carries its own
-  // server-side gate.) /harbor sat here too until task 1003890 removed the dev
-  // box: its page is gone, and a gate in front of nothing is a dead guard.
+  // server-side gate.)
   const WATCH_PAGE_RE = /^\/builders\/watch(?:\.html)?\/?$/;
   const GATE_PAGE_RE = /^\/builders\/gate(?:\.html)?\/?$/;
   // /sessions (the session-log ledger) belongs to that same Governance group and
@@ -1144,7 +1143,7 @@ function mountInternalSurfaces(app) {
   // the landing card + GitHub button render for a stranger.
   //
   // ONE tier of gate: ANY SIGNED-IN BUILDER — the Work Board, Roadmap, the Goals
-  // page, the task-detail page, the Repo Atlas, the Dev Box pair page, Settings
+  // page, the task-detail page, the Repo Atlas, Settings
   // (#748, #904, task 1293, task 1757, task 751) and, since task 1002710, the
   // orientation reading rooms (primer, diagrams). A Xenos IS allowed; an
   // unauthenticated visitor is bounced into sign-in rather than served the shell.

package/src/bongos-downloads.js

@@ -4,8 +4,7 @@
 // The compiled per-platform binaries can't ride the git-based deploy (private
 // repo, no LFS, GitHub's 100MB cap), so CI publishes them as release assets on a
 // PUBLIC releases repo (config/bongos-cli.json — the same off-repo pattern as the
-// Dev Box app, src/devbox-downloads.js, and the ADR 0029 status mirror). This
-// module turns that committed config into:
+// ADR 0029 status mirror). This module turns that committed config into:
 //
 //   GET /downloads/bongos/latest.json   → { version, assets: { target: {file,url} } }
 //   GET /downloads/bongos/version       → { version, assets: { target: url } }
@@ -14,10 +13,6 @@
 // so every URL a user sees or the installer fetches stays on the instance apex,
 // and a release bump is a one-file config change that rides the normal ship flow.
 // Pure (config in, urls out) so tests need no server.
-//
-// (A near-twin of src/devbox-downloads.js by design — same off-repo release
-// pattern, different artifact. Kept as its own module for a clear name + its own
-// config pointer; the two are independent instance features.)
 
 function buildBongosDownloads(cfg) {
   if (!cfg || typeof cfg !== 'object') throw new Error('bongos-downloads: missing config');