@bongos/core 1.19.1074 → 1.19.1076

package/src/branding.js

@@ -1,9 +1,9 @@
 // src/branding.js — the branding contract (ADR 0062 §3, task 1192 / V4.R53).
 //
 // The single source for every instance-identity string the platform renders:
-// product/world name, company, domains/origins, cookie + OAuth + dev-box
+// product/world name, company, domains/origins, cookie + OAuth
 // hosts, currency label, the track set, theme, and the project name injected
-// into LLM prompts. Generalizes devbox-app/src/brand.js to the whole platform.
+// into LLM prompts.
 //
 // Resolution precedence (highest wins):
 //   env override  ->  instance config (config/branding.json)  ->  neutral

package/src/build-info.js

@@ -41,12 +41,10 @@ function readGitSha() {
   }
 }
 
-// The deployed commit's date (ISO 8601), for the dev-box staleness comparison
-// (boxes.computeCodeStaleness, idea 332). A box reports its own HEAD commit date;
-// if it's > 2 days behind THIS, the box is flagged stale. Best-effort: after a
-// `git reset --hard origin/main` deploy, HEAD is the deployed commit, so its
-// committer date is the right reference. Null when git is unavailable (then the
-// "behind" check is skipped and only never-reported boxes flag).
+// The deployed commit's date (ISO 8601), served on /version beside the commit.
+// Best-effort: after a `git reset --hard origin/main` deploy, HEAD is the
+// deployed commit, so its committer date is the right reference. Null when git
+// is unavailable.
 function readGitCommitDate() {
   try {
     return execSync('git show -s --format=%cI HEAD', {

package/src/instance-config.js

@@ -40,7 +40,7 @@ const LEGACY_DIRS = ['otb'];
 //
 // WHY THESE MUST OUTLIVE THIS TASK: these names are set OUTSIDE the repo —
 // /etc/cloudbongos/web.env on the droplet, systemd units, CI secrets, shipped
-// Dev Box binaries, live dev boxes. Deleting a spelling here is an outage the
+// CLI binaries, builders' own machines. Deleting a spelling here is an outage the
 // next time one of those restarts. Task 1003706 (C3d) retires them deliberately,
 // after evidence — and asserts their ABSENCE, which is why the fallback needs a
 // test that it FIRES rather than one that merely tolerates it.
@@ -140,7 +140,7 @@ function configPath(name, b = safeBrand()) {
 // Lives here, not in cli-lib.js which owns the session STORE, because this module
 // is the lowest one that has to read the file (resolveApiBase below) and cli-lib
 // imports this — so this is the only place both can share. A rename APPENDS a
-// name; dropping one signs out every builder machine and every live dev box at
+// name; dropping one signs out every builder machine at
 // once. Part 4 (task 1003706) retires the tail. (task 1003704)
 const SESSION_FILENAMES = Object.freeze([
   'bongos-session.json',

package/src/module-api.js

@@ -75,7 +75,7 @@ const { responsibilityFor, ROLE_RESPONSIBILITIES } = require('./role-responsibil
 // MAJOR (see allowBoxScope below): passes the request through untouched.
 function deprecatedNoopMiddleware(_req, _res, next) { next(); }
 
-const CORE_VERSION = '1.19.1074'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
+const CORE_VERSION = '1.19.1076'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('discord'); log.info('mounted');
@@ -137,8 +137,8 @@ module.exports = {
   get requireBfgPrincipal() { return require('./bongos/auth').requireBfgPrincipal; },
   // allowBoxScope — DEPRECATED no-op, kept so the doorway loses no export inside
   //     1.x (removing one is a MAJOR, and every module declares ^1). It used to opt
-  //     a route in to the narrowing box-scoped session; that scope and its tokens
-  //     were retired (task 1003894), so an undeclared session source is now denied
+  //     a route in to the narrowing machine-baked session scope; that scope and its
+  //     tokens were retired (goal 1000120, task 1003894), so an undeclared session source is now denied
   //     on every route whatever a route mounts. Passing it changes nothing. Drop it
   //     at the next MAJOR.
   get allowBoxScope() { return deprecatedNoopMiddleware; },

package/src/module-loader/manifest-schema.js

@@ -10,7 +10,7 @@
 // THE SCHEMA (module.json):
 //   {
 //     "key":          "art-pipeline",   // REQUIRED. ^[a-z][a-z0-9-]*$ ; must match the module's dir name.
-//     "title":        "Dev boxes",      // REQUIRED. Human label.
+//     "title":        "Art pipeline",   // REQUIRED. Human label.
 //     "description":  "…",              // REQUIRED. One sentence.
 //     "version":      "1.4.2",          // REQUIRED. The module's OWN exact version "X.Y.Z" (task 1003781) —
 //                                       //   what update, rollout channels and re-assessment name.

package/tests/api_alias_caller_ratchet.mjs

@@ -66,7 +66,7 @@ test('the exclusions are real and each one is reachable', () => {
     'scripts/gds/fitness-ratchets.js',
     'scripts/gds/api-alias-caller-scan.js',
     'tests/api_alias_exceptions.mjs',      // 5 tests
-    'modules/dev-box/app/test/thing.mjs',
+    'modules/agents/app/test/thing.mjs',
     'docs/adr/0016-permissions.md',        // 6 the FROZEN RECORD under docs/ (narrowed, task 1004113)
     'docs/session-logs/2026-09-16-x.md',
     'docs/audits/2026-08-01-x.md',

package/tests/api_alias_exceptions.mjs

@@ -27,7 +27,7 @@ const ALIAS = '/api/gds';
 test('the alias is still mounted — everything below depends on it', () => {
   const { API_PREFIX, LEGACY_API_PREFIXES, ALL_API_PREFIXES } = require(path.join(ROOT, 'src', 'bongos', 'api-prefix.js'));
   assert.equal(API_PREFIX, '/api/bongos', 'the canonical prefix is what in-repo callers now ask for');
-  assert.ok(LEGACY_API_PREFIXES.includes(ALIAS), 'shipped Dev Box binaries and live dev boxes call the alias');
+  assert.ok(LEGACY_API_PREFIXES.includes(ALIAS), 'shipped binaries and live instances call the alias');
   assert.ok(ALL_API_PREFIXES.includes(ALIAS), 'and the router still mounts it');
 });
 

package/tests/api_client.mjs

@@ -208,7 +208,7 @@ test('generated .d.ts types success responses (task 2061)', () => {
 });
 
 // The CJS + browser-global builds are pure transforms of the ESM source (task
-// 1996 / R09). devbox (require) and classic <script> web pages consume them, so
+// 1996 / R09). CommonJS callers (require) and classic <script> web pages consume them, so
 // guard that they load and shape requests IDENTICALLY to the ESM build.
 test('CJS build behaves identically to the ESM build', async () => {
   const cjs = require('../clients/bongos-client/index.cjs');

package/tests/api_path_404.mjs

@@ -38,7 +38,7 @@ t('API-shaped: /api/*, /gds/*, and bare GDS roots (/tasks, /me, …) match', ()
 
 t('NOT API-shaped: game/hall/static paths fall through to HTML/static', () => {
   for (const p of ['/', '/index.html', '/builders', '/builders/work', '/atlas-ab12.png',
-                   '/vendor/phaser.min.js', '/downloads/devbox/mac', '/game', '/healthz', '/version']) {
+                   '/vendor/phaser.min.js', '/downloads/bongos/latest.json', '/game', '/healthz', '/version']) {
     assert.equal(isApiShapedPath(p), false, `${p} should NOT be API-shaped`);
   }
 });

package/tests/backfill_task_rewards.mjs

@@ -77,7 +77,7 @@ await test('computeTaskReward: 0 raw → 0 effective (a 0-mapping pays nothing)'
 
 await test('netForBuilder: would-be minus already-paid', () => {
   assert.equal(netForBuilder(100, 30), 70);
-  assert.equal(netForBuilder(100, 0), 100); // cost-plus paid nothing (dev-box/CI case)
+  assert.equal(netForBuilder(100, 0), 100); // cost-plus paid nothing (the CI case)
 });
 
 await test('netForBuilder: cost-plus over-paid → floored at 0 (never claws back)', () => {

package/tests/{box_ship_permissions.mjs → cli_allowlist_permissions.mjs}

@@ -1,7 +1,7 @@
-// tests/box_ship_permissions.mjs
+// tests/cli_allowlist_permissions.mjs
 //
 // task 1051 (D): the blessed methodology CLI scripts must stay pre-allowed in the
-// project .claude/settings.json so a dev-box Claude session (auto permission mode)
+// project .claude/settings.json so a Claude session in auto permission mode
 // does not hard-DENY the very command it exists to run. The #1027 nightmare
 // dead-ended on `node scripts/gds/ship.js` at the auto classifier; this guards
 // against that allow-rule being silently dropped.
@@ -12,7 +12,7 @@
 // on every routine read. The list of tools is `.claude/hooks/shell-tools.js`, the same
 // one the guards read: a rule may only exist for a tool git-guard and secret-gate see.
 //
-// Run:  node tests/box_ship_permissions.mjs
+// Run:  node tests/cli_allowlist_permissions.mjs
 
 import { strict as assert } from 'node:assert';
 import fs from 'node:fs';
@@ -62,7 +62,7 @@ perTool('permissions.allow pre-allows the generic GDS API channel api.js (auto-m
   // idea-triage promote, create-task, blocker-resolve, criterion ratify, goal
   // create, cost-via-API, security reports — rides the generic caller
   // `node scripts/gds/api.js <METHOD> /api/gds/...`. If it is not pre-allowed, a
-  // dev-box (or laptop) session in AUTO permission mode has the classifier
+  // session in AUTO permission mode has the classifier
   // hard-DENY those writes as "[External System Writes] ... beyond the user's
   // request" — mistaking a sanctioned idea-triage session for scope creep. The
   // GDS server enforces builders.rank on every request (ADR 0016), so this rule
@@ -309,5 +309,5 @@ test('the instance starter mirrors this list in verb form (claude-materialize.js
 });
 
 console.log('');
-console.log(`box_ship_permissions: ${passed} passed, ${failed} failed`);
+console.log(`cli_allowlist_permissions: ${passed} passed, ${failed} failed`);
 process.exit(failed === 0 ? 0 : 1);

package/tests/cli_sessions.mjs

@@ -201,7 +201,7 @@ test('signing into a second instance PRESERVES the first — including one writt
 });
 
 test('the ACTIVE pointer still lands exactly where every existing reader looks', () => {
-  // In-repo skills, hooks and the dev box all read the active session file in the configured dir. The
+  // In-repo skills and hooks all read the active session file in the configured dir. The
   // store is additive; if this moved, every one of them would silently stop finding a session.
   const { out } = inSandbox(`
     await lib.saveSession({ token:'T', api_base:'https://a.example.com', builder:{github_login:'x'} });

package/tests/context_pack.mjs

@@ -339,14 +339,14 @@ t('formatContextPackCompact: two lines, worktree + prefix, no undefined', () =>
   assert.ok(!/undefined/.test(out));
 });
 
-// ---- the task-scoped box with no claim (task 1003085) ----------------------
+// ---- a checkout with no modules/lifecycle on disk (task 1003085) ------------
 //
-// A box scoped to a claim materializes modules/<key> only for the modules that
-// claim put in scope (ADR 0148). With NO active claim, modules/lifecycle is not
-// on disk — and this file's hard `require` of task-classifier threw
-// MODULE_NOT_FOUND at IMPORT time, which killed /builder-start and
-// /builder-claim: the two commands needed to escape the state, because a claim
-// is what fetches the module. The live escape was POST /claims by curl.
+// When modules/lifecycle is not on disk (it was found on a checkout that held only
+// the modules an active claim put in scope, so with no claim it was absent), this
+// file's hard `require` of task-classifier threw MODULE_NOT_FOUND at IMPORT time,
+// which killed /builder-start and /builder-claim: the two commands needed to escape
+// the state, because a claim is what fetches the module. The live escape was
+// POST /claims by curl.
 //
 // This reproduces the condition for real rather than asserting on source text:
 // a temp tree holding context-pack.js and the one other thing it imports, with
@@ -357,7 +357,7 @@ const os = require('node:os');
 const path = require('node:path');
 const url = require('node:url');
 
-function boxWithoutLifecycle() {
+function checkoutWithoutLifecycle() {
   const here = path.dirname(url.fileURLToPath(import.meta.url));
   const root = fs.mkdtempSync(path.join(os.tmpdir(), 'ctxpack-nolifecycle-'));
   fs.mkdirSync(path.join(root, 'scripts', 'gds'), { recursive: true });
@@ -369,13 +369,13 @@ function boxWithoutLifecycle() {
   // coupling has to be looked at — which is the point.
   fs.copyFileSync(path.join(here, '..', 'src', 'bongos', 'api-prefix.js'),
     path.join(root, 'src', 'bongos', 'api-prefix.js'));
-  // No modules/ — that IS the box condition.
+  // No modules/ — that IS the condition.
   assert.ok(!fs.existsSync(path.join(root, 'modules')), 'the fixture must not carry modules/');
   return { root, mod: require(path.join(root, 'scripts', 'gds', 'context-pack.js')) };
 }
 
-t('a box with no modules/lifecycle can still LOAD the pack (the deadlock)', () => {
-  const { mod } = boxWithoutLifecycle();
+t('a checkout with no modules/lifecycle can still LOAD the pack (the deadlock)', () => {
+  const { mod } = checkoutWithoutLifecycle();
   const api = mod.apiContract();
   assert.equal(api.enums_available, false, 'it must say so, not pretend');
   assert.equal(api.api_prefix, '/api/bongos', 'everything not behind the module still works');
@@ -386,8 +386,8 @@ t('a box with no modules/lifecycle can still LOAD the pack (the deadlock)', () =
   assert.equal(api.manual_degree, null);
 });
 
-t('both formatters render on that box instead of throwing', () => {
-  const { mod } = boxWithoutLifecycle();
+t('both formatters render on that checkout instead of throwing', () => {
+  const { mod } = checkoutWithoutLifecycle();
   const pack = mod.buildContextPack({
     activeClaims: [], cwd: '/fallback', platform: 'linux',
     runGit: () => '/work/tree\n', runWhich: () => '',

package/tests/copy_inventory.mjs

@@ -29,11 +29,11 @@ const ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
 const inv = require(path.join(ROOT, 'scripts', 'gds', 'copy-inventory.js'));
 
 test('stable ids survive a move and change with the text', () => {
-  const a = inv.stableId('builders-hall', 'Close your box');
-  assert.equal(a, inv.stableId('builders-hall', 'Close your box'), 'same surface + text → same id, whatever the file/line');
-  assert.equal(a, inv.stableId('builders-hall', '  Close   your box  '), 'whitespace is normalized before hashing');
-  assert.notEqual(a, inv.stableId('builders-hall', 'Close your dev box'), 'a text change must break the id — that is the signal a flag is stale');
-  assert.notEqual(a, inv.stableId('status-dashboard', 'Close your box'), 'the same words on another surface are a different piece of copy');
+  const a = inv.stableId('builders-hall', 'Close your tab');
+  assert.equal(a, inv.stableId('builders-hall', 'Close your tab'), 'same surface + text → same id, whatever the file/line');
+  assert.equal(a, inv.stableId('builders-hall', '  Close   your tab  '), 'whitespace is normalized before hashing');
+  assert.notEqual(a, inv.stableId('builders-hall', 'Close your browser tab'), 'a text change must break the id — that is the signal a flag is stale');
+  assert.notEqual(a, inv.stableId('status-dashboard', 'Close your tab'), 'the same words on another surface are a different piece of copy');
 });
 
 test('the JS extractor refuses code — the 2144-row failure mode cannot come back', () => {
@@ -55,14 +55,14 @@ test('the JS extractor keeps copy, and names how a person sees it', () => {
   const src = [
     "toast('Priority order saved.');",
     "el.textContent = 'How the whole build is doing.';",
-    "box.innerHTML = `<p class=\"setup__box-msg\">Closing your box… (a few seconds)</p>`;",
+    "panel.innerHTML = `<p class=\"setup__msg\">Closing your session… (a few seconds)</p>`;",
     "row.innerHTML = `<span class=\"pill\">Release task ${id}</span>`;",
   ].join('\n');
   const rows = inv.fromJs({ source: src, rel: 'x.js' });
   const byOrigin = Object.fromEntries(rows.map((r) => [r.origin, r.text]));
   assert.equal(byOrigin['js-notice'], 'Priority order saved.');
   assert.equal(byOrigin['js-text-assign'], 'How the whole build is doing.');
-  assert.ok(rows.some((r) => r.origin === 'js-markup' && r.text === 'Closing your box… (a few seconds)'),
+  assert.ok(rows.some((r) => r.origin === 'js-markup' && r.text === 'Closing your session… (a few seconds)'),
     'text inside script-built markup is copy; the tags around it are not');
   assert.ok(rows.some((r) => r.text === 'Release task {…}'),
     'a template interpolation becomes a placeholder so the sentence stays readable and the hole stays visible');

package/tests/core_258_box_session_claims_db.mjs

@@ -0,0 +1,180 @@
+// tests/core_258_box_session_claims_db.mjs
+//
+// task 1004362 — core_258 must apply on a database holding a claim created from a
+// dev-box session.
+//
+// WHAT BROKE. core_258 (task 1003895) deletes every builder_sessions row with source
+// 'box'. claims.creator_session_id (migration 013) references builder_sessions with no
+// ON DELETE, so on the live database, which had one such claim, the DELETE failed the
+// foreign key, the whole migration rolled back, and so did every core upgrade carrying
+// it. The fix nulls the link first; NULL is what a web claim already carries.
+//
+// HOW THIS PROVES IT. The lane database is already migrated, so core_258 has run and the
+// source CHECK no longer admits 'box'. Inside ONE transaction that is ALWAYS rolled back,
+// the test widens the CHECK back the way migration 090 had it, seeds a box session and a
+// claim created from it, then runs core_258's own statements (its BEGIN and COMMIT
+// stripped so they join this transaction). Every table core_258 drops is already gone,
+// and each DROP is IF EXISTS, so they are no-ops here. Nothing is committed or truncated.
+//
+// Real-DB (self-skips without Postgres; belongs in the INTEGRATION set).
+//
+// Run:  DATABASE_URL=postgres://... node tests/core_258_box_session_claims_db.mjs
+
+import { strict as assert } from 'node:assert';
+import { createRequire } from 'node:module';
+import { readFileSync } from 'node:fs';
+import { fileURLToPath } from 'node:url';
+import { dirname, join } from 'node:path';
+
+const require = createRequire(import.meta.url);
+const { Pool } = require('pg');
+
+const root = join(dirname(fileURLToPath(import.meta.url)), '..');
+const migrationText = readFileSync(join(root, 'migrations/core_258_drop_dev_box_tables.sql'), 'utf8');
+
+// The migration's own statements, minus its transaction wrapper. The count check keeps
+// the strip honest: if the file stopped using BEGIN/COMMIT this would silently be a
+// different migration, so say so instead.
+const wrapper = /^\s*(BEGIN|COMMIT);\s*$/gm;
+assert.equal((migrationText.match(wrapper) || []).length, 2, 'core_258 is expected to carry exactly one BEGIN and one COMMIT');
+const migrationBody = migrationText.replace(wrapper, '');
+// The pre-fix body: the same statements without the unlinking UPDATE, so the bug stays
+// executable rather than described.
+const preFixBody = migrationBody.replace(/UPDATE claims SET creator_session_id = NULL[\s\S]*?;/, '');
+assert.notEqual(preFixBody, migrationBody, 'core_258 no longer unlinks claims before deleting box sessions');
+
+const pool = new Pool({ connectionString: process.env.DATABASE_URL || undefined });
+
+let passed = 0;
+let failed = 0;
+let client;
+async function test(name, fn) {
+  await client.query('SAVEPOINT t');
+  try {
+    await fn();
+    passed++; console.log(`  ok  ${name}`);
+    await client.query('RELEASE SAVEPOINT t');
+  } catch (err) {
+    failed++; console.error(`  FAIL ${name}\n    ${err.message}`);
+    await client.query('ROLLBACK TO SAVEPOINT t');
+  }
+}
+
+// Schema-driven insert (the helper of tests/session_earnings_mirror_db.mjs): fills any
+// NOT NULL column with no default. Identifiers come from this file or information_schema.
+const schemaCache = new Map();
+async function insertRow(table, explicit = {}) {
+  if (!schemaCache.has(table)) {
+    const { rows } = await client.query(
+      `SELECT column_name, data_type, is_nullable, column_default, is_identity
+         FROM information_schema.columns WHERE table_schema = 'public' AND table_name = $1`, [table]);
+    schemaCache.set(table, rows);
+  }
+  const cols = schemaCache.get(table);
+  if (cols.length === 0) throw new Error(`table ${table} not found — is this database migrated?`);
+  const values = { ...explicit };
+  for (const c of cols) {
+    if (c.column_name in values || c.is_nullable === 'YES' || c.column_default !== null || c.is_identity === 'YES') continue;
+    switch (c.data_type) {
+      case 'integer': case 'bigint': case 'smallint': case 'numeric': case 'real': case 'double precision':
+        values[c.column_name] = 0; break;
+      case 'boolean': values[c.column_name] = false; break;
+      case 'timestamp with time zone': case 'timestamp without time zone': case 'date':
+        values[c.column_name] = new Date(); break;
+      case 'json': case 'jsonb': values[c.column_name] = {}; break;
+      case 'ARRAY': values[c.column_name] = []; break;
+      default: values[c.column_name] = `c258-${c.column_name}`;
+    }
+  }
+  const names = Object.keys(values);
+  const { rows } = await client.query(
+    `INSERT INTO ${table} (${names.map((n) => `"${n}"`).join(', ')})
+     VALUES (${names.map((_, i) => `$${i + 1}`).join(', ')}) RETURNING *`,
+    names.map((n) => values[n]));
+  return rows[0];
+}
+
+// A builder with one box session and one cli session, and a released claim from each.
+async function fixture() {
+  const tag = `c258-${Date.now()}-${Math.random().toString(36).slice(2, 8)}`;
+  const builder = await insertRow('builders', { github_id: `${tag}-gh`, github_login: tag, display_name: tag, total_credits: 0 });
+  const version = await insertRow('versions', { id: `${tag}-v`, status: 'building' });
+  const claimFrom = async (source) => {
+    const session = await insertRow('builder_sessions', { builder_id: builder.id, token_hash: `${tag}-${source}`, source });
+    // discipline + kind: core_247's CHECK refuses the column default (task 1004363).
+    const task = await insertRow('tasks', { title: `${tag} ${source} task`, status: 'shipped', version_id: version.id, discipline: 'engineer', kind: 'feature' });
+    const claim = await insertRow('claims', {
+      task_id: task.id, builder_id: builder.id, creator_session_id: session.id,
+      worktree_name: `${tag}-${source}`, released_at: new Date(), outcome: 'shipped',
+    });
+    return { session, claim };
+  };
+  return { box: await claimFrom('box'), cli: await claimFrom('cli') };
+}
+
+async function main() {
+  try {
+    client = await pool.connect();
+  } catch {
+    console.log('core_258_box_session_claims_db: no Postgres (DATABASE_URL unset/unreachable) — skipping');
+    process.exit(0);
+  }
+
+  await client.query('BEGIN');
+  try {
+    // The source CHECK as migration 090 left it, so a box session can be seeded.
+    await client.query('ALTER TABLE builder_sessions DROP CONSTRAINT IF EXISTS builder_sessions_source_check');
+    await client.query(`ALTER TABLE builder_sessions ADD CONSTRAINT builder_sessions_source_check CHECK (source IN ('cli', 'web', 'box'))`);
+
+    await test('without the unlink, the box-session DELETE fails the claims foreign key (the bug)', async () => {
+      await fixture();
+      await client.query('SAVEPOINT pre');
+      let err = null;
+      try { await client.query(preFixBody); } catch (e) { err = e; }
+      await client.query('ROLLBACK TO SAVEPOINT pre');
+      assert.ok(err, 'the pre-fix body should have failed');
+      assert.equal(err.code, '23503', `expected a foreign-key violation, got ${err.code}: ${err.message}`);
+      assert.match(err.message, /claims_creator_session_id_fkey/);
+    });
+
+    await test('core_258 applies, unlinks the box claim, keeps it, and leaves the cli claim alone', async () => {
+      const { box, cli } = await fixture();
+      // Case 1 passed and released its savepoint, so its box session and claim are still
+      // here too; this run unlinks and deletes those as well. That is harmless and even
+      // realistic (more than one box claim), and every assertion below is scoped by id.
+      await client.query(migrationBody);
+
+      const { rows: claims } = await client.query(
+        'SELECT id, creator_session_id, worktree_name, outcome FROM claims WHERE id = ANY($1::bigint[]) ORDER BY id',
+        [[box.claim.id, cli.claim.id]]);
+      assert.equal(claims.length, 2, 'both claims must survive the migration');
+      const boxClaim = claims.find((c) => String(c.id) === String(box.claim.id));
+      const cliClaim = claims.find((c) => String(c.id) === String(cli.claim.id));
+      assert.equal(boxClaim.creator_session_id, null, 'the box claim must be unlinked');
+      assert.equal(boxClaim.outcome, 'shipped', 'the box claim keeps its history');
+      assert.equal(String(cliClaim.creator_session_id), String(cli.session.id), 'a cli claim must keep its session');
+
+      const { rows: boxSessions } = await client.query(`SELECT count(*)::int AS n FROM builder_sessions WHERE source = 'box'`);
+      assert.equal(boxSessions[0].n, 0, 'every box session must be deleted');
+      const { rows: cliSession } = await client.query('SELECT id FROM builder_sessions WHERE id = $1', [cli.session.id]);
+      assert.equal(cliSession.length, 1, 'a cli session must survive');
+
+      await client.query('SAVEPOINT chk');
+      let err = null;
+      try { await insertRow('builder_sessions', { builder_id: cli.session.builder_id, token_hash: `${cli.session.token_hash}-again`, source: 'box' }); } catch (e) { err = e; }
+      await client.query('ROLLBACK TO SAVEPOINT chk');
+      assert.equal(err && err.code, '23514', 'the narrowed CHECK must refuse a new box session');
+    });
+  } finally {
+    await client.query('ROLLBACK');
+    client.release();
+    await pool.end();
+  }
+
+  console.log(`\ncore_258_box_session_claims_db: ${passed} passed, ${failed} failed`);
+  // Let the socket close before exiting (a libuv abort otherwise on some boxes).
+  await new Promise((r) => setTimeout(r, 100));
+  process.exit(failed === 0 ? 0 : 1);
+}
+
+main().catch((err) => { console.error(err); process.exit(1); });

package/tests/credit_grant.mjs

@@ -435,7 +435,7 @@ await test('1002474 the INSERT still carries a DB-level double-pay backstop', as
   assert.match(insert.sql, /reward_basis/, 'and it must be keyed on (session_id, reward_basis)');
 });
 
-// task 1676 — the cost-plus zero-out fix for the dev-box/CI agent ship path.
+// task 1676 — the cost-plus zero-out fix for the CI agent ship path.
 // Symptom (ADR 0097): those sessions uploaded empty/unpriceable model_usage, so
 // priceModelUsage returned $0 and the reward rounded to 0 — even though real
 // token spend happened. The fix prices the session's real total_tokens at the
@@ -444,7 +444,7 @@ await test('awardSessionTokenReward (task 1676): empty model_usage + real total_
   const client = fakeClient();
   client.enqueue([]);          // idempotency SELECT → no prior row
   client.enqueue([{ id: 9 }]); // INSERT ... RETURNING id
-  // The exact dev-box/CI shape: no priceable per-model usage, but the digest
+  // The exact CI shape: no priceable per-model usage, but the digest
   // carried a real total token count (here 73M, an opus-marathon session).
   const res = await awardSessionTokenReward(client, 7, 'sess-ci', {}, 73_000_000);
   assert.equal(res.awarded, true, 'reward awarded despite empty model_usage');

package/tests/criterion_suggest.mjs

@@ -30,7 +30,7 @@ const CRITERIA = [
   crit(138, 'bx-hall', 'Core task actions work in the builders hall without invoking the LLM.'),
   crit(139, 'bx-identity', 'A builder can view and edit their own profile and read a leaderboard.'),
   crit(140, 'bx-onramp', 'Newcomers never dead-end: auth and re-auth are browser-clickable.'),
-  crit(141, 'bx-box', 'A builder dev box and sandbox is robust: uncommitted work is not lost.'),
+  crit(141, 'bx-recovery', 'A builder can resume after a crash: uncommitted work is not lost.'),
 ];
 
 test('ranks the most lexically-relevant criterion first', () => {

package/tests/design_tokens_sync.mjs

@@ -7,7 +7,8 @@
 // Claude Design round-trip). Nothing tied them together, so the design file kept
 // the pre-1002749 palette — including the exact accents removed for failing WCAG
 // AA — and every prototype started from colours the product no longer paints.
-// Model: the fallback-equals-pack assertions in tests/devbox_dmg_backdrop.mjs.
+// Model: fallback-equals-pack assertions — a copy of the pack's values is asserted
+// equal to the pack, never trusted.
 //
 // Run:  node tests/design_tokens_sync.mjs
 
@@ -25,7 +26,7 @@ const tokens = readJson('config', 'design-tokens.neutral.json');
 
 // Strip comments so rationale prose — which must be free to name a removed
 // colour — never trips a scan of the CODE (the stripCommentsForIdentity
-// contract, as applied in tests/devbox_dmg_backdrop.mjs).
+// contract).
 function codeOnly(text) {
   return text
     .replace(/\/\*[\s\S]*?\*\//g, '')

package/tests/fitness.mjs

@@ -973,3 +973,92 @@ test('KERNEL_FILES is exported exactly ONCE and still resolves (task 1002795)',
   assert.ok(Array.isArray(fitness.KERNEL_FILES), 'and it still resolves to an array');
   assert.ok(fitness.KERNEL_FILES.length > 0, 'with the real kernel roster in it');
 });
+
+// ---- the dev box stays retired (task 1003899, ADR 0346) ---------------------
+//
+// scripts/gds/dev-box-guard.js fails CI when a retired dev-box name reappears.
+// Each rule is proven by PLANTING a violation through the injectable files/read
+// seam, never by assuming the regex is right. The retired names are assembled at
+// runtime (KEY = 'dev' + '-box', …) so this file never contains them literally and
+// needs no exemption of its own.
+const devBoxGuard = require(path.join(ROOT, 'scripts', 'gds', 'dev-box-guard.js'));
+const KEY = 'dev' + '-box';
+const TABLE = 'builder' + '_boxes';
+const COLUMN = 'box' + '_blocked_reason';
+const PERM = 'box' + '.fleet.manage';
+const BOX = 'b' + 'ox';
+
+function plant(rel, text) {
+  return devBoxGuard.checkNoDevBox({ files: [rel], read: () => text });
+}
+
+test('dev-box guard: the clean tree passes, and it scans the real tracked files', () => {
+  const r = devBoxGuard.checkNoDevBox();
+  assert.equal(r.hardFail, false, r.violations.join('\n'));
+  assert.match(r.note, /(\d{4,}) tracked file/, 'a real enumeration, not an empty one');
+});
+
+test('dev-box guard: it is wired into the fitness CHECKS that CI runs', () => {
+  const src = fs.readFileSync(path.join(ROOT, 'scripts', 'gds', 'fitness.js'), 'utf8');
+  assert.match(src, /require\('\.\/dev-box-guard\.js'\)\.checkNoDevBox/);
+  const names = fitness.runAll().map((r) => r.name);
+  assert.ok(names.includes('the dev box stays retired (ADR 0346)'), 'runAll() includes the guard');
+});
+
+test('dev-box guard: each rule FAILS on a planted violation', () => {
+  const cases = [
+    ['module-key (quoted)', 'src/x.js', `enable('${KEY}');`],
+    ['module-key (path)', 'src/y.js', `require('../modules/${KEY}/boxes.js');`],
+    ['module-key (json key)', 'config/modules.neutral.json', `{ "modules": { "${KEY}": true } }`],
+    ['identifier (table)', 'src/z.js', `await q('SELECT * FROM ${TABLE}');`],
+    ['identifier (column)', 'src/w.js', `SELECT ${COLUMN} FROM builders`],
+    ['permission', 'modules/government/catalog.js', `{ key: '${PERM}', floor: 'metic' },`],
+    ['session-source', 'src/bongos/auth.js', `if (session.source === '${BOX}') return;`],
+  ];
+  for (const [label, rel, text] of cases) {
+    const r = plant(rel, text);
+    assert.equal(r.hardFail, true, `${label}: a planted violation must fail the check`);
+    assert.match(r.violations[0], /ADR 0346/, `${label}: the failure names the ADR`);
+    assert.match(r.note, /DEV_BOX_EXEMPT in scripts\/gds\/dev-box-guard\.js/, `${label}: and the one exemption list`);
+  }
+});
+
+test('dev-box guard: a retired PATH fails even with harmless contents', () => {
+  for (const rel of [`scripts/gds/${BOX}.js`, `infra/${BOX}-provision.sh`, `modules/${KEY}/module.json`, '.devcontainer/devcontainer.json']) {
+    const r = plant(rel, '{}');
+    assert.equal(r.hardFail, true, `${rel} must fail`);
+    assert.match(r.violations.join('\n'), /path: a retired dev-box location/);
+  }
+});
+
+test('dev-box guard: near misses do NOT fire (plurals, filenames, prose, a server box)', () => {
+  const clean = [
+    `resolveModules({ modules: { '${KEY}es': true } })`, // the typo guard's test input
+    `see docs/adr/0072-${KEY}-code-staleness-visibility.md`, // an ADR filename
+    `the ${KEY} removal is recorded in ADR 0346`, // prose, not a key
+    `ENV_FILE=/etc/cloudbongos/${BOX}.env`, // box.env is the control-plane runner's env file
+    `ssh into the co-hosting ${BOX}`, // a server
+    `const secret = require('./secret-${BOX}.js');`, // crypto, unrelated
+    `if (session.source === 'cli') return;`,
+  ];
+  for (const text of clean) {
+    const r = plant('src/near-miss.js', text);
+    assert.equal(r.hardFail, false, `should not fire: ${text}\n${r.violations.join('\n')}`);
+  }
+});
+
+test('dev-box guard: the exemption list is honoured, and it is the only way out', () => {
+  const text = `const RETIRED = { '${KEY}': 'gone' };`;
+  assert.equal(plant('src/modules.js', text).hardFail, false, 'the retirement guard file is exempt');
+  assert.equal(plant('docs/adr/0999-anything.md', text).hardFail, false, 'the historical record is exempt by prefix');
+  assert.equal(plant('src/other.js', text).hardFail, true, 'the same text anywhere else fails');
+  for (const [entry, why] of devBoxGuard.DEV_BOX_EXEMPT) {
+    assert.ok(typeof why === 'string' && why.length >= 12, `${entry} carries a reason`);
+  }
+});
+
+test('dev-box guard: an empty enumeration is a scan defect, not a pass', () => {
+  const r = devBoxGuard.checkNoDevBox({ files: [], read: () => '' });
+  assert.equal(r.hardFail, true);
+  assert.match(r.violations[0], /scan defect/);
+});

package/tests/fitness_ratchets.mjs

@@ -161,8 +161,8 @@ test('the committed baseline file parses and covers every hermetic metric', () =
 // `floor === undefined`, which compareToBaselines classifies as a WARNING — so a
 // checkout with no config/ reported the ratchet PASSED. Measured before the fix: a
 // planted 5,000-line + 94-cycle regression produced ZERO violations. That was not a
-// hypothetical checkout — config/ is absent from every dev box's sparse slice, so the
-// builders who most needed the gate were the ones silently exempt from it.
+// hypothetical checkout — a sparse checkout without config/ once left the builders
+// who most needed the gate silently exempt from it.
 //
 // checkQualityRatchets() reads the real repo, so these tests drive compareToBaselines
 // (pure) for the metric-level rules and exercise the file-level rule by pointing at a

package/tests/github_push_land_proof.mjs

@@ -154,7 +154,7 @@ test('landProvenForTask: a non-sha published tip ("HEAD") falls back to the PR c
 
 // --- task 1002645: findTaskPullRequest — the PR-title fallback locator --------
 //
-// The reconciler derives claude/<worktree_name> (dev-box convention); a laptop/wave
+// The reconciler derives claude/<worktree_name> first; a laptop/wave
 // ship pushes worktree-<worktree_name>, so the derived branch finds no PR and the
 // sweep never engaged (wave PRs 34/35/36 stranded at 'confirmed'). This locates the
 // task's PR by the "task <id>: …" TITLE-PREFIX convention — deliberately TIGHTER