@bongos/core 1.19.1075 → 1.19.1076

package/docs/adr/0046-sandbox-first-review-gate.md

@@ -2,7 +2,7 @@
 
 **Date:** 2026-06-11
 **Context:** GDS-V3, task [#927](https://example.com/builders#/task/927). Builds directly on [ADR 0044](0044-per-box-live-game-preview.md) (the per-box live game preview / "sandbox") and the three-state ship lifecycle in `scripts/gds/ship.js` (Phase 5). Companion to [ADR 0031](0031-cloud-dev-environments-for-builders.md) (dev boxes) and [ADR 0016](0016-trust-boundary-server-enforced-permissions.md) (the gate is a workflow aid, not an authority surface).
-**Status:** Accepted.
+**Status:** Superseded in part by [ADR 0346](0346-dev-boxes-are-retired.md) (the dev-box half; the local sandbox review survives). Was: Accepted.
 **Track:** `internal` (dev-system / builder experience).
 
 ## Problem

package/docs/adr/0052-sandbox-for-everyone-game-only-preview.md

@@ -2,7 +2,7 @@
 
 **Date:** 2026-06-13
 **Context:** GDS-V3, task [#1001](https://example.com/builders#/task/1001) (clone-scope + ungate) and task [#1002](https://example.com/builders#/task/1002) (hardware-verify). Builds on [ADR 0044](0044-per-box-live-game-preview.md) (the per-box live game preview / "sandbox") and [ADR 0031](0031-cloud-dev-environments-for-builders.md) (cloud dev boxes + rank-scoped source). Companion to [ADR 0046](0046-sandbox-first-review-gate.md) (sandbox-first review) and [ADR 0016](0016-trust-boundary-server-enforced-permissions.md) (authority is server-enforced — source visibility grants nothing). **Reverses the full-clone gate from task [#903](https://example.com/builders#/task/903).** Decision by Lars, 2026-06-13.
-**Status:** Accepted. Mechanism implemented under task [#1001](https://example.com/builders#/task/1001) (game-only entry `src/preview-server.js` + shared `registerGameRooms()` helper, `STARTER_SPARSE_PATHS` widened by `src/world`/`src/rooms`/`public`, `box-game-preview.service` repointed at the game-only entry, `box-source-fetch.sh` ungated); **hardware-verified under task [#1002](https://example.com/builders#/task/1002) (2026-06-14)** — a fresh **Xenos starter-scope** box (`LarsCode`) served the playable game over the public tunnel at `sandbox-<login>.example.com` (HTTP 200, Phaser client + `/game/*` assets) while **(b)** `/api/gds/*` returned 404 through that host (game-only entry does not mount the internal API) and **(c)** `migrations/` was absent on the box (the game paths `src/world`/`src/rooms`/`public` were present). Box deprovisioned after the run.
+**Status:** Superseded in part by [ADR 0346](0346-dev-boxes-are-retired.md) (the per-box half; the local game-only preview survives). Was: Accepted. Mechanism implemented under task [#1001](https://example.com/builders#/task/1001) (game-only entry `src/preview-server.js` + shared `registerGameRooms()` helper, `STARTER_SPARSE_PATHS` widened by `src/world`/`src/rooms`/`public`, `box-game-preview.service` repointed at the game-only entry, `box-source-fetch.sh` ungated); **hardware-verified under task [#1002](https://example.com/builders#/task/1002) (2026-06-14)** — a fresh **Xenos starter-scope** box (`LarsCode`) served the playable game over the public tunnel at `sandbox-<login>.example.com` (HTTP 200, Phaser client + `/game/*` assets) while **(b)** `/api/gds/*` returned 404 through that host (game-only entry does not mount the internal API) and **(c)** `migrations/` was absent on the box (the game paths `src/world`/`src/rooms`/`public` were present). Box deprovisioned after the run.
 **Track:** `internal` (dev boxes / builder experience).
 
 ## Problem

package/docs/adr/0053-scoped-dev-box-session.md

@@ -2,7 +2,7 @@
 
 **Date:** 2026-06-13
 **Context:** GDS, security reports SR[#2](https://example.com/builders#/task/2) (HIGH) + SR[#11](https://example.com/builders#/task/11) (HIGH) from the 2026-06-08 server audit ([#870](https://example.com/builders#/task/870)); task [#919](https://example.com/builders#/task/919). Owner decision 2026-06-09: do the proper redesign, not the interim named-tunnel disable. Governed by the trust-boundary rule in [ADR 0016](0016-trust-boundary-server-enforced-permissions.md) and the box subsystem in [ADR 0031](0031-cloud-dev-environments-for-builders.md) / [ADR 0038](0038-chromebook-ttyd-cloudflare-tunnel.md) / [ADR 0044](0044-per-box-live-game-preview.md).
-**Status:** Accepted.
+**Status:** Superseded by [ADR 0346](0346-dev-boxes-are-retired.md) — the dev box was removed (goal 1000120). Was: Accepted.
 **Track:** `internal` (development system / builder dev boxes + access control).
 
 ## Problem

package/docs/adr/0055-server-mediated-branch-publish.md

@@ -2,7 +2,7 @@
 
 **Date:** 2026-06-13
 **Context:** GDS, task [#1025](https://example.com/builders#/task/1025). A live "can I publish from a dev box?" test failed even after CI self-deploy ([#859](https://example.com/builders#/task/859) / [ADR 0042](0042-builder-self-deploy-ci-auto-merge.md)) went live. Sits at the intersection of [ADR 0042](0042-builder-self-deploy-ci-auto-merge.md) (ci deploy mode), [ADR 0053](0053-scoped-dev-box-session.md) (box-scoped session, [#919](https://example.com/builders#/task/919)), and the box on-ramp ([ADR 0038](0038-chromebook-ttyd-cloudflare-tunnel.md) browser-only builders, [ADR 0044](0044-per-box-live-game-preview.md), [ADR 0046](0046-sandbox-first-review-gate.md) sandbox-first ship gate / [#927](https://example.com/builders#/task/927), which expects `/builder-ship` to run *on* a box). Governed by the trust boundary in [ADR 0016](0016-trust-boundary-server-enforced-permissions.md).
-**Status:** Accepted.
+**Status:** Superseded in part by [ADR 0346](0346-dev-boxes-are-retired.md) (the dev box as its reason — the publish mechanism SURVIVES and now serves any checkout with no push credential). Was: Accepted.
 **Track:** `internal` (development system / builder dev boxes + ship pipeline).
 
 ## Problem

package/docs/adr/0057-container-cost-ledger.md

@@ -1,7 +1,7 @@
 # ADR 0057 — Per-builder container cost ledger (org-funded → self-fund tracking)
 
 **Date:** 2026-06-15
-**Status:** Accepted
+**Status:** Superseded by [ADR 0346](0346-dev-boxes-are-retired.md) — the dev box was removed (goal 1000120). Was: Accepted
 **Track:** `internal` (dev-system / cost oversight).
 **Context:** GDS-V3, task [#602](https://example.com/builders#/task/602), criterion C-cost. Implements the ledger half of ADR 0031 §5 (cost passthrough). Companion to [ADR 0031](0031-cloud-dev-environments-for-builders.md) (the dev box) and the early-stage billing policy ("tracked, not settled" — both example earnings and container costs are recorded but not actually paid/charged yet).
 

package/docs/adr/0059-single-approval-remove-devbox-approval-gate.md

@@ -1,6 +1,6 @@
 # ADR 0059 — Single approval: remove the dev-box (first-box) Archon approval gate
 
-- **Status:** Accepted
+- **Status:** Superseded by [ADR 0346](0346-dev-boxes-are-retired.md) — the dev box was removed (goal 1000120). Was: Accepted
 - **Date:** 2026-06-16
 - **Track:** internal
 - **Supersedes:** [ADR 0035](0035-builder-onboarding-three-paths.md) §2 (the first-box Archon approval gate, [#717](https://example.com/builders#/task/717) / migration 071) and the **box half** of [ADR 0057](0057-discord-archon-approval-channels.md) (the `#box-approvals` channel + the box-intent approve/deny wiring)

package/docs/adr/0071-box-confirm-before-destroyed-and-drift-reconcile.md

@@ -2,7 +2,7 @@
 
 **Date:** 2026-06-20
 **Context:** GDS / dev boxes, task [#1289](https://example.com/builders#/task/1289). Builds on [ADR 0031](0031-cloud-dev-environments-for-builders.md) (cloud dev environments) and [ADR 0053](0053-scoped-dev-box-session.md) (scoped dev-box session). Touches `scripts/gds/box.js`, `src/bongos/boxes.js`, `src/bongos/do-api.js`, `infra/box-drift-reconcile.{service,timer}`.
-**Status:** Accepted.
+**Status:** Superseded by [ADR 0346](0346-dev-boxes-are-retired.md) — the dev box was removed (goal 1000120). Was: Accepted.
 **Track:** `internal` (development system / builder dev boxes).
 
 ## Problem — the "zombie" box

package/docs/adr/0072-bongos-app-mac-signed-first-windows-deferred.md

@@ -2,7 +2,7 @@
 
 **Date:** 2026-06-20
 **Context:** Bongos App `BONGOS-V1` / criterion C1 (signed-installable), task [#1296](https://example.com/builders#/task/1296) (`BV1.R01`). Builds on [ADR 0045](0045-devbox-desktop-app.md) (the Dev Box desktop app) and [ADR 0004](0004-example-name-and-trademark-acceptance.md) (brand discipline). The bongos app forks the Dev Box app's Electron shell ([#1298](https://example.com/builders#/task/1298) `BV1.R03`), so it inherits that app's signing machinery; this ADR pins which parts it inherits now and which it defers.
-**Status:** Accepted.
+**Status:** Superseded in part by [ADR 0346](0346-dev-boxes-are-retired.md) (absorbing the Dev Box app, which was deleted). Was: Accepted.
 **Track:** `internal` (development system → the Cloud Bongos desktop app line; bongos succeeds the GDS after GDS-V4).
 
 ## Problem — an unsigned mic + screen app reads as hostile

package/docs/adr/0072-dev-box-code-staleness-visibility.md

@@ -1,6 +1,6 @@
 # ADR 0072 — Dev-box code-staleness: make it visible, never auto-reset
 
-- **Status:** Accepted
+- **Status:** Superseded by [ADR 0346](0346-dev-boxes-are-retired.md) — the dev box was removed (goal 1000120). Was: Accepted
 - **Date:** 2026-06-20
 - **Track:** internal
 - **Builds on:** [ADR 0031](0031-cloud-dev-environments-for-builders.md) (per-builder dev boxes), the `box-source-fetch.sh` self-update machinery ([#600](https://example.com/builders#/task/600), [#985](https://example.com/builders#/task/985)), and task [#1187](https://example.com/builders#/task/1187) (the box host-key reporter — the report-up cron pattern this mirrors)

package/docs/adr/0104-trust-gds-api-channel-in-auto-mode.md

@@ -21,7 +21,7 @@ Two prior decisions were supposed to prevent this and don't fully:
 
 ## Decision
 
-**Pre-allow the generic GDS API channel.** Add `Bash(node scripts/gds/api.js:*)` to the project `.claude/settings.json` `permissions.allow`. It ships in the repo, so it reaches the box, laptops, and **every permission mode** at once, and it is locked against silent regression by [`tests/box_ship_permissions.mjs`](../../tests/box_ship_permissions.mjs).
+**Pre-allow the generic GDS API channel.** Add `Bash(node scripts/gds/api.js:*)` to the project `.claude/settings.json` `permissions.allow`. It ships in the repo, so it reaches the box, laptops, and **every permission mode** at once, and it is locked against silent regression by [`tests/box_ship_permissions.mjs`](../../tests/cli_allowlist_permissions.mjs).
 
 The owner chose **"trust the whole channel"** over a narrower "reads + a few specific write paths" split — the split is brittle (breaks when a skill uses a slightly different path or flag order) and buys only illusory least-privilege, because the server already gates every write by rank.
 

package/docs/adr/0123-box-idle-sweep-autosave-before-destroy.md

@@ -1,6 +1,6 @@
 # ADR 0123 — Idle-swept dev boxes lose uncommitted work: an on-box autosave-push, not a VM snapshot
 
-- **Status:** Accepted (the approach + rejected alternatives are decided; the cron script + operator credential wiring are task-pending — see §Consequences for the seeded follow-up). **No autosave code ships in this ADR — it is a SPIKE.**
+- **Status:** Superseded by [ADR 0346](0346-dev-boxes-are-retired.md) — the dev box was removed (goal 1000120). Was: Accepted (the approach + rejected alternatives are decided; the cron script + operator credential wiring are task-pending — see §Consequences for the seeded follow-up). **No autosave code ships in this ADR — it is a SPIKE.**
 - **Date:** 2026-07-05
 - **Track:** internal (dev-box lifecycle)
 - **Task:** [#837](https://example.com/builders#/task/837) — "SPIKE: don't lose uncommitted work when a dev box is reclaimed (idle sweep deprovisions, no snapshot)."

package/docs/adr/0144-devbox-rehome-onto-cloudbongos-plane.md

@@ -1,6 +1,6 @@
 # 0144 — Re-home the dev-box fleet onto the cloudbongos.com plane (native runners, local DB, isolated fleet tag)
 
-- **Status:** Accepted — Phases 1–3 built in task 1002239. **Phase 4 part (a) (stop legacy `cohost-box-*` runners) done in task 1002248** (2026-07-15); part (b) (disable dev-box on example.com) flagged to owner — not reachable from the cloudbongos control plane.
+- **Status:** Superseded by [ADR 0346](0346-dev-boxes-are-retired.md) — the dev box was removed (goal 1000120). Was: Accepted — Phases 1–3 built in task 1002239. **Phase 4 part (a) (stop legacy `cohost-box-*` runners) done in task 1002248** (2026-07-15); part (b) (disable dev-box on example.com) flagged to owner — not reachable from the cloudbongos control plane.
 - **Date:** 2026-07-15
 - **Deciders:** Lars (owner/Archon) chose "re-home properly, not a legacy band-aid" + pre-approved box spend; Claude designed + executed autonomously.
 - **Task:** [#1002239](https://cloudbongos.com/builders#/task/1002239) · supersedes stale incident [#1002031](https://cloudbongos.com/builders#/task/1002031) · **Goal:** 1000025 (builder experience — hall, dev box, skills).

package/docs/adr/0145-devbox-app-branding-driven-module.md

@@ -1,6 +1,6 @@
 # 0145 — The Dev Box app becomes a branding-driven module (one source, per-instance builds)
 
-- **Status:** Accepted — Phase 1 built in task [#1002255](https://cloudbongos.com/builders#/task/1002255). Downloads (1002257), CI + releases repo + signing (1002258), and end-to-end verify (1002256) follow.
+- **Status:** Superseded by [ADR 0346](0346-dev-boxes-are-retired.md) — the dev box was removed (goal 1000120). Was: Accepted — Phase 1 built in task [#1002255](https://cloudbongos.com/builders#/task/1002255). Downloads (1002257), CI + releases repo + signing (1002258), and end-to-end verify (1002256) follow.
 - **Date:** 2026-07-15
 - **Deciders:** Lars (owner) — "re-set up the dev box app so it's properly installable for cloudbongos; the design should not be linked to a specific project but to the Cloud Bongos design; it should live on cloudbongos and be maintained there as a module, and Example should borrow it."
 - **Extends:** ADR 0045 (the Dev Box desktop app), ADR 0072 (app signing posture), ADR 0083 (module system), ADR 0004/0062 (brand discipline — no hardcoded host identity), [branding contract](../branding-contract.md).

package/docs/adr/0148-task-scoped-box-source-access.md

@@ -1,9 +1,9 @@
 # 0148 — Task-scoped box source access (rank-scope → claim-scope)
 
-- **Status:** Accepted (spike R90 / task 1002378 — the architecture pass for goal 1000051). Confirms the build shape of R92–R95.
+- **Status:** Superseded by [ADR 0346](0346-dev-boxes-are-retired.md) — the dev box was removed (goal 1000120). Was: Accepted (spike R90 / task 1002378 — the architecture pass for goal 1000051). Confirms the build shape of R92–R95.
 - **Date:** 2026-07-18
 - **Deciders:** Lars (owner) — "claim a task → the box pulls only that module's code, on a base Bongos instance; the GitHub token stays on the server." Corrected the earlier "bring-your-own-GitHub" framing.
-- **Extends:** ADR 0031 §6 (box source-access, task 600), ADR 0086 (goals + `scope_modules` scope wall), ADR 0093 (the `lifecycle` port), ADR 0052 (sandbox-for-everyone starter scope). Spec: [`docs/specs/<redacted>.md`](../specs/<redacted>.md).
+- **Extends:** ADR 0031 §6 (box source-access, task 600), ADR 0086 (goals + `scope_modules` scope wall), ADR 0093 (the `lifecycle` port), ADR 0052 (sandbox-for-everyone starter scope). Spec: `docs/specs/<redacted>.md` (deleted with the dev box by task 1003898; read it in git history).
 
 ## Context
 

package/docs/adr/0151-governance-permissions-as-atom-ranks-as-roles.md

@@ -1,6 +1,6 @@
 # 0151 — Governance: permissions as the atom, ranks as seeded roles
 
-- **Status:** Accepted
+- **Status:** Superseded in part by [ADR 0346](0346-dev-boxes-are-retired.md) (§3 — the narrowing session scope was removed; the declared-source rule survives). Was: Accepted
 - **Date:** 2026-07-24
 - **Deciders:** Lars (owner / Archon), Claude
 - **Track:** `internal` (GDS / methodology — a Cloud Bongos platform capability)

package/docs/adr/0193-pause-task-scoped-box-slices.md

@@ -1,6 +1,6 @@
 # 0193 — Pause task-scoped box slices: a box serves its rank scope (the full repo for Metic+)
 
-- **Status:** Accepted
+- **Status:** Superseded by [ADR 0346](0346-dev-boxes-are-retired.md) — the dev box was removed (goal 1000120). Was: Accepted
 - **Date:** 2026-08-25
 - **Tasks:** [#1003285](https://cloudbongos.com/builders#/task/1003285) (the pause), from the owner's 2026-08-25 dev-box efficiency review; the review's other findings are [#1003286](https://cloudbongos.com/builders#/task/1003286)–[#1003291](https://cloudbongos.com/builders#/task/1003291) and shipped [#1003253](https://cloudbongos.com/builders#/task/1003253).
 - **Pauses, does not repeal:** [ADR 0148](0148-task-scoped-box-source-access.md) / goal 1000051 — the claim-driven slice. The machinery stays; the default flips.

package/docs/adr/0277-a-box-is-in-use-only-while-a-human-is-attached.md

@@ -1,6 +1,6 @@
 # ADR 0277 — A box is "in use" only while a human is attached, and the claim expires
 
-- **Status:** accepted
+- **Status:** Superseded by [ADR 0346](0346-dev-boxes-are-retired.md) — the dev box was removed (goal 1000120). Was: accepted
 - **Date:** 2026-09-10
 - **Task:** [1003507](https://cloudbongos.com/builders#/task/1003507) (goal 1000095 — *Working area 6*, criterion `wa6-role-experience`)
 - **Supersedes the "never touch a box with a claude process" rule** in [ADR 0031](0031-cloud-dev-environments-for-builders.md) §5(a); the park/preserve guarantee of tasks 1002726/1002727 is unchanged and is what makes this safe.

package/docs/adr/0346-dev-boxes-are-retired.md

@@ -0,0 +1,69 @@
+# ADR 0346 — Dev boxes are retired; a builder builds from their own checkout
+
+- **Status:** accepted
+- **Date:** 2026-09-28
+- **Task:** [task 1003898](https://cloudbongos.com/builders#/task/1003898) (goal 1000120 — Dev-box removal)
+- **Deciders:** Lars (Archon) decided the removal and its three rulings on 2026-09-13. Claude carried out the removal and wrote the record.
+- **Supersedes:** [0031](0031-cloud-dev-environments-for-builders.md) · [0044](0044-per-box-live-game-preview.md) · [0045](0045-devbox-desktop-app.md) · [0053](0053-scoped-dev-box-session.md) · [0057](0057-container-cost-ledger.md) · [0059](0059-single-approval-remove-devbox-approval-gate.md) · [0071](0071-box-confirm-before-destroyed-and-drift-reconcile.md) · [0072 (code staleness)](0072-dev-box-code-staleness-visibility.md) · [0123](0123-box-idle-sweep-autosave-before-destroy.md) · [0144](0144-devbox-rehome-onto-cloudbongos-plane.md) · [0145 (desktop-app branding)](0145-devbox-app-branding-driven-module.md) · [0148](0148-task-scoped-box-source-access.md) · [0193](0193-pause-task-scoped-box-slices.md) · [0277](0277-a-box-is-in-use-only-while-a-human-is-attached.md)
+- **Supersedes in part:** [0035](0035-builder-onboarding-three-paths.md) (the DO-box path) · [0046](0046-sandbox-first-review-gate.md) (the box half) · [0052](0052-sandbox-for-everyone-game-only-preview.md) (the box half) · [0055](0055-server-mediated-branch-publish.md) (the box as its reason; the mechanism survives) · [0072 (Bongos app)](0072-bongos-app-mac-signed-first-windows-deferred.md) (absorbing the Dev Box app) · [0151](0151-governance-permissions-as-atom-ranks-as-roles.md) §3 (the narrowing session scope)
+
+## Context
+
+ADR 0031 gave every builder a hosted cloud machine, the **dev box**: a DigitalOcean droplet built from `.devcontainer/`, switched on and off by a desktop app (0045), reached over SSH or a browser terminal, holding a box-scoped session (0053) and a task-scoped sparse checkout (0148), swept when idle (0123), and landing its work through the server because it held no push credential (0055). It grew to roughly 22,000 lines, and about a third of it lived in the core rather than in `modules/dev-box/`.
+
+By 2026-09-13 it had no users. The fleet was cold: 0 live droplets, 4 destroyed, 1 parked. `/downloads/devbox/*` already answered 404, because cloudbongos.com had no `config/devbox-app.json`. Every live builder builds from a checkout of the project repo on their own machine. The owner decided to remove it outright rather than keep maintaining it.
+
+## Decision
+
+We removed the dev box and everything that existed only for it. What a builder does instead is the path that already worked for everyone: **clone the project repo, sign the CLI in with `/builder-setup`, and build locally** (`/builder-stage` for a local preview). A cloud replacement, such as Claude's own cloud sessions working from a clone, is separate later work and is deliberately not designed here.
+
+**The owner's three rulings (2026-09-13):**
+
+1. **Drop the box's stored data now.** The historic box compute spend is not worth preserving as box state.
+2. **Delete `.devcontainer/`** with the rest. It was the box as code; a later cloud plan defines its own environment.
+3. **Remove `bongos box`, `bongos shell` and `bongos code` entirely**, including their Metic-only `--local` modes.
+
+**What was removed** (goal 1000120, one linear chain, each link leaving `main` green):
+
+| Task | Removed |
+|---|---|
+| [1003889](https://cloudbongos.com/builders#/task/1003889) | the three CLI verbs |
+| [1003890](https://cloudbongos.com/builders#/task/1003890) | the Harbor page, the box panel and the pair page |
+| [1003891](https://cloudbongos.com/builders#/task/1003891) | the Electron desktop app, its CI workflow and download route |
+| [1003896](https://cloudbongos.com/builders#/task/1003896) | `.devcontainer/` |
+| [1003893](https://cloudbongos.com/builders#/task/1003893) | the box control-plane and bring-up scripts (`scripts/gds/box*`, `infra/box-*`), with the last box recipe |
+| [1003892](https://cloudbongos.com/builders#/task/1003892) | `modules/dev-box/` and its registrations |
+| [1004310](https://cloudbongos.com/builders#/task/1004310) | desktop-app pairing, the onboarding box step, and box fields in the core API |
+| [1004311](https://cloudbongos.com/builders#/task/1004311) | the hall's box surfaces, preview fixtures, and the DEV BOX subgraph of the architecture diagram |
+| [1003894](https://cloudbongos.com/builders#/task/1003894) | the box session scope and `box.source.full` / `box.fleet.manage` / `box.manage.own` (migration `government_019`) |
+| [1003895](https://cloudbongos.com/builders#/task/1003895) | `builder_boxes`, `box_events`, `box_intents`, `builder_ssh_keys` and the `'box'` session source (migration `core_258`) |
+| [1003897](https://cloudbongos.com/builders#/task/1003897) | the residual mentions in code, tests and fixtures |
+| [1003899](https://cloudbongos.com/builders#/task/1003899) | (the fitness check that keeps it out) |
+
+**Kept on purpose.** These were born for the box and are now load-bearing for everyone:
+
+- **Server-mediated publish** (0055: `modules/lifecycle/github-push.js`, `publish-reconciler.js`, `POST /tasks/:id/publish-branch`, `ship-land.js`'s `ciLandServer`). It serves any checkout with no GitHub push credential. Only its reason changed.
+- **`src/bongos-downloads.js`**, the `bongos` CLI binary downloads (the Dev Box app's own downloads were removed).
+- **`src/bongos/secret-box.js`**, the AES secret store. It is unrelated to dev boxes despite the name.
+- **`scripts/gds/do-api.js`**, which instance provisioning still uses.
+- **The session-source registry** (`modules/government/session-scopes.json`). Its narrowing form had no user left and was removed (task 1003894). Its fail-closed rule, that a session whose source the registry does not declare is refused on every route and page, is what kept the leftover box tokens out until `core_258` deleted them.
+
+**Deliberate retirement guards.** These still name the box, and that is correct:
+
+- `RETIRED_MODULE_KEYS` in `src/modules.js`: an instance whose config still says `"dev-box": true` boots with a one-line warning instead of failing.
+- `allowBoxScope` stays on the module doorway as a no-op until the next MAJOR. Removing an export is a MAJOR, and modules declare `^1`.
+- `config/devbox-app.json` stays in the publish manifest's instance-exclude list, because instance repos still carry the file.
+
+## Alternatives considered
+
+- **Keep the module, switched off.** Rejected: a third of it lived in the core (auth, migrations, the ship path, the hall), so "off" still cost maintenance and review attention on every change near it, for zero users.
+- **Replace it with a cloud-session product in the same goal.** Rejected by the owner: the replacement is its own design question, and coupling it would have held the removal hostage to it.
+- **One big deletion.** Rejected in the 2026-09-27 re-scope: each link deletes its own tests and regenerates its own artifacts, so `main` stays green at every step and any one link can be reverted alone.
+- **Drop the four `builders.box_blocked*` columns with the tables.** Deferred to [task 1004360](https://cloudbongos.com/builders#/task/1004360). A deploy migrates while the previous server is still up, and a failed upgrade rolls back code but never schema. Every previous core reads those columns in `getBuilderById`.
+
+## Consequences
+
+- A builder's only setup is a local checkout. The hall's welcome panel, the primer and the architecture diagram now describe that path. The welcome panel's own-machine steps had been hidden by a stylesheet rule written for the box's Desktop/Online toggle; they now show.
+- Nothing user-facing regressed: the fleet was cold and the downloads already 404'd.
+- Owner follow-ups outside the code: reclaim or verify absent the DigitalOcean and Cloudflare resources (task [1003887](https://cloudbongos.com/builders#/task/1003887), blocker 1000159, including the one parked droplet snapshot). Remove `"dev-box"` from each instance repo's `config/modules.json` and `config/devbox-app.json` when convenient; the retirement guard makes both harmless meanwhile.
+- The historical ADRs above keep their bodies; each carries a status line pointing here.

package/docs/adr/README.md

@@ -437,3 +437,4 @@ This keeps the decision history honest and traceable.
 | 0343 | [**A module's score is a security gate, then an average of parts every buyer can see** ([task 1003790](https://cloudbongos.com/builders#/task/1003790), goal 1000091 — working area 5, owner Will). No module score existed; the floor, ranking and cap all derive from this one. **D1:** five parts, each 0–100 per version — Security and Tests day one; Install, Reliability (from real installs) and Tester feedback later. **D2 (owner):** failing Security means not listed, never averaged in. **D3 (owner):** overall = unweighted average of the other parts that have data; a missing part is left out, not zero. **D4 (owner):** every part's score is shown to buyers beside the overall, so they can pick the module strongest where they care (tasks 1003798/1003799). **D5:** a version without real-world data is labelled "New". **D6:** price is never an input; the Metic+ override/delist sits on top and is audited. Rejected: security in the average, day-one weights, a single number, missing-as-zero.](0343-a-module-score-is-a-security-gate-then-an-average-of-visible-parts.md) | modules / store / quality |
 | 0344 | [**A tester is a project that opts in once; an untested version reaches everyone after seven days** ([task 1003801](https://cloudbongos.com/builders#/task/1003801), goal 1000091 — working area 5, owner Will). Settles "willing user" for criterion `wa5-staged-rollout`. **D1 (owner):** a project's own admin switches on "tester" once and gets tester versions of every module it has, with a per-module "general only" override; never on by default; a builder cannot opt in someone else's project. **D2:** first releases and updates alike go to testers first. **D3 (owner):** a version moves to general after seven days if it still passes the security gate and tests, tested or not; the promotion gate may promote earlier or hold on evidence, never forever. **D4:** testers pay the normal price; any tester discount is area 8's call, named not decided. **D5:** tester installs, errors and crashes feed the score (ADR 0343). Rejected: per-module-only opt-in, one all-or-nothing switch, waiting for a tester, releasing at once.](0344-a-tester-is-a-project-that-opts-in-once.md) | modules / store / rollout |
 | 0345 | [**We host every project's hall, and its app deploys where the owner chooses** ([task 1004349](https://cloudbongos.com/builders#/task/1004349), goal 1000106 — working area 1, owner Lars). Reverses ADR 0323 §2 and the hall half of ADR 0327. **D1 (owner):** every project's Builders Hall runs on our shared server; `cloud-host` now means "hosted by us". **D2 (owner):** the hall's address is ours or the owner's own domain. **D3 (owner):** the setup wizard asks where the APP deploys; Render only at launch; choosing it creates the app on the owner's own Render account with ADR 0327's borrowed key. **D4 (owner):** "decide later" is allowed. **D5 (owner):** no project is moved. **D6 (measured):** ADR 0145 Finding 1 is live — the hub cookie is `Domain=.cloudbongos.com` and a hall loads modules from its own repo — so our-address halls need task 1004357; an owner domain is safe. **D7 (measured):** at the ceiling the create route refuses `box_full` up front, and the resize is not a prerequisite. Task 1004184 re-scoped, task 1004185 on hold.](0345-we-host-every-projects-hall-and-its-app-deploys-where-the-owner-chooses.md) | hosting / provisioning / security |
+| 0346 | [**Dev boxes are retired; a builder builds from their own checkout** ([task 1003898](https://cloudbongos.com/builders#/task/1003898), goal 1000120 — owner Lars). Records the whole removal, link by link, the owner's three rulings of 2026-09-13 (drop the data, delete `.devcontainer/`, remove `bongos box`/`shell`/`code`), what was kept on purpose (server-mediated publish, the CLI downloads, `secret-box`, `do-api`, the declared-source rule), and the retirement guards that still name the box. Supersedes 0031, 0044, 0045, 0053, 0057, 0059, 0071, 0072 (code staleness), 0123, 0144, 0145 (desktop-app branding), 0148, 0193, 0277; supersedes in part 0035, 0046, 0052, 0055, 0072 (Bongos app), 0151 §3.](0346-dev-boxes-are-retired.md) | builder environment / removal |

package/docs/architecture.md

@@ -11,7 +11,7 @@
 
 - **Domain:** `example.com` — registered at Cloudflare Registrar. DNS A records (apex + `www`) point to the droplet at `REDACTED_IP`. Cloudflare proxy is **ON (orange cloud)**. CF terminates TLS at the edge; the **Cloudflare Origin Certificate** handles the CF↔origin leg (valid through 2041-05-04). A `status` subdomain is added at PMS-V1 deploy time (see `docs/pms-v1-deploy.md` (instance-side)) with the same proxy/cert posture; Origin Cert needs `*.example.com` SAN. Real client IPs come in via `CF-Connecting-IP` / `X-Forwarded-For`, wired into Caddy's `trusted_proxies static` (the Cloudflare IP ranges) in the `infra/Caddyfile` global options block.
 - **Production droplet (co-hosting box):** DigitalOcean, hostname `example`, IPv4 `REDACTED_IP`, IPv6 `REDACTED_IP`. NYC3, Premium Intel 2 GB / 1 vCPU / 60 GB NVMe. Ubuntu 24.04 LTS. ~$14/mo. Hosts the OTB game + co-hosted project instances (`emersonian-circles.`, `staging.`).
-- **Cloud Bongos control-plane droplet (NEW 2026-07-05, [ADR 0126](adr/0126-dedicated-cloudbongos-control-plane-droplet.md), task [#2063](https://example.com/builders#/task/2063)):** DigitalOcean, hostname `cloudbongos`, IPv4 `REDACTED_IP`, NYC3, `s-1vcpu-2gb` (2 GB / 1 vCPU), Ubuntu 24.04, ~$12/mo, tag `cloudbongos-control`. Runs **cloudbongos.com + `builders.` + `status.`** (`src/platform-server.js`, Cloud Bongos brand, port 3002, own `cloudbongos` DB, checkout `/home/lars/cloudbongos-instance`, the root subscribed to the nightly core-patch sweep) and is the **sole token-holding control plane** — a SECOND root, `/home/lars/cloudbongos`, survives only to vendor `infra/` (the box cloud-init the core package does not ship, ADR 0150); it is not subscribed, so nothing may resolve core code from it (task 1002738, [ADR 0144](adr/0144-devbox-rehome-onto-cloudbongos-plane.md) follow-up 5) — `/etc/cloudbongos/box.env` holds the account-wide Cloudflare token (IP-locked to this box) + the DigitalOcean token; this is where `provision.js` provisions instance subdomains. **Structurally separate SSH** (own `cloudbongos_ed25519` key). IPv6 egress disabled so the IPv4-locked CF token can't be spuriously rejected. cloudbongos.com was previously a co-tenant on the co-hosting box; that unit was decommissioned at cutover. **Follow-ups:** deploy automation (task [#2064](https://example.com/builders#/task/2064)) + fully stripping cloud tokens off the co-hosting box (task [#2065](https://example.com/builders#/task/2065)).
+- **Cloud Bongos control-plane droplet (NEW 2026-07-05, [ADR 0126](adr/0126-dedicated-cloudbongos-control-plane-droplet.md), task [#2063](https://example.com/builders#/task/2063)):** DigitalOcean, hostname `cloudbongos`, IPv4 `REDACTED_IP`, NYC3, `s-1vcpu-2gb` (2 GB / 1 vCPU), Ubuntu 24.04, ~$12/mo, tag `cloudbongos-control`. Runs **cloudbongos.com + `builders.` + `status.`** (`src/platform-server.js`, Cloud Bongos brand, port 3002, own `cloudbongos` DB, checkout `/home/lars/cloudbongos-instance`, the root subscribed to the nightly core-patch sweep) and is the **sole token-holding control plane** — a SECOND root, `/home/lars/cloudbongos`, is left over from the retired dev-box bring-up, which vendored `infra/` from it ([ADR 0346](adr/0346-dev-boxes-are-retired.md)); it is not subscribed, so nothing may resolve core code from it (task 1002738) — `/etc/cloudbongos/box.env` holds the account-wide Cloudflare token (IP-locked to this box) + the DigitalOcean token; this is where `provision.js` provisions instance subdomains. **Structurally separate SSH** (own `cloudbongos_ed25519` key). IPv6 egress disabled so the IPv4-locked CF token can't be spuriously rejected. cloudbongos.com was previously a co-tenant on the co-hosting box; that unit was decommissioned at cutover. **Follow-ups:** deploy automation (task [#2064](https://example.com/builders#/task/2064)) + fully stripping cloud tokens off the co-hosting box (task [#2065](https://example.com/builders#/task/2065)).
 - **Where projects run ([ADR 0345](adr/0345-we-host-every-projects-hall-and-its-app-deploys-where-the-owner-chooses.md), 2026-09-28):** every project's **Builders Hall** is hosted by us on the shared control-plane box (`hosting_shape='cloud-host'`, labelled "hosted by us"), at one of our addresses or the owner's own domain. The project's **app** deploys wherever its owner chooses; the setup wizard offers Render first, creating the app on the owner's own Render account with a borrowed, never-stored key (ADR 0327 §2). ADR 0323's plan to move the halls to Render is reversed. Halls at our addresses receive the hub cookie until task 1004357 ships.
 - **Server stack:** Node.js 22 LTS · PostgreSQL 16 · Caddy 2.11.2. `example.service` (systemd) runs `node server.js` as user `lars` on `127.0.0.1:3000`; restart-on-failure.
 - **Hardening:** `lars` user with passwordless sudo; SSH key-only (root login disabled, password auth disabled); ufw allows 22/80/443; fail2ban active; unattended-upgrades enabled; timezone `America/New_York`.
@@ -35,7 +35,6 @@ The product is organized as a small kernel (`src/`) + **19 modules** under `modu
 - **The loader** (`src/module-loader/loader.js`) — discovers `modules/*/module.json` at boot, validates manifests, checks `coreVersion` compatibility, and mounts each enabled module's routes behind kernel-composed auth. No core file changes to add or remove a module.
 - **Enablement** — `config/modules.json` (instance config) or `<PREFIX>_MODULE_<KEY>=1` (env override). Vanilla = all off.
 - **Feature modules** (optional — off on a vanilla instance, enabled per-instance via `config/modules.json`):
-  - `dev-box` — per-builder cloud dev environments; ports: `box.hasEverConnected`
   - `game` — Phaser client + Colyseus rooms + world/terrain; ports: `game.staticRoot`, `game.registerRooms`, `game.precreateWorldRoom`
   - `discord` — ship broadcast + inbound bot + role-sync; port: `discord.isLinked`
   - `art-pipeline` — pixel-art generation + artist discipline; port: `art.sharedKeyConfigured`
@@ -67,7 +66,7 @@ The product is organized as a small kernel (`src/`) + **19 modules** under `modu
 **Code & deploy:**
 
 - **Code repo:** [github.com/example-owner/example](https://github.com/example-owner/example) — **private**. Clone URL: `git@github.com:example-owner/example.git`. Default branch: `main`. GitHub user: `example-owner`.
-- **Deploy:** two modes, selected by `config/deploy.json` `mode` (env `<PREFIX>_DEPLOY_MODE` overrides — `BONGOS_DEPLOY_MODE` on a vanilla instance; the legacy `OTB_DEPLOY_MODE` is still read), currently **`ci`** (flipped from `laptop` 2026-06-13, [#859](https://example.com/builders#/task/859)) — see [ADR 0042](adr/0042-builder-self-deploy-ci-auto-merge.md). **`laptop`** (legacy): `git push origin main` from the Mac → `ssh lars@REDACTED_IP ~/deploy.sh`. The droplet has a read-only deploy key at `~/.ssh/github_deploy` registered on the repo. `~/deploy.sh` does: `git fetch + reset --hard origin/main` → `npm ci --omit=dev` if `package-lock.json` changed → `./scripts/migrate.sh` → `sudo systemctl restart example` → `curl /healthz` smoke (**retried up to 15× @ 1s** — `systemctl` reports "active" before the Node process binds the port, so a single curl raced the bind and false-failed healthy deploys: [ADR 0056](adr/0056-prod-deploy-script-mirror-and-healthcheck-retry.md) / [#1026](https://example.com/builders#/task/1026)). Droplet checkout: `/home/lars/example/`. `~/deploy.sh` is hand-maintained on the droplet but now has a byte-faithful, reviewable repo mirror at `scripts/deploy/deploy-prod.sh` (instance-side) — **not** auto-installed (the ci deploy key is forced-command-locked, ADR 0042/0043; reinstall by hand on change: `scp scripts/deploy/deploy-prod.sh lars@…:deploy.sh`). **`ci`** (current, armed via [#679](https://example.com/builders#/task/679)): no builder box holds the droplet key — `ship.js` opens a PR + enables GitHub auto-merge, and `.github/workflows/deploy-prod.yml` (instance-side) runs the same `~/deploy.sh` from Actions on merge to `main`. Cutover preconditions (incl. a server-recorded **CI grade-gate**) are in ADR 0042.
+- **Deploy:** two modes, selected by `config/deploy.json` `mode` (env `<PREFIX>_DEPLOY_MODE` overrides — `BONGOS_DEPLOY_MODE` on a vanilla instance; the legacy `OTB_DEPLOY_MODE` is still read), currently **`ci`** (flipped from `laptop` 2026-06-13, [#859](https://example.com/builders#/task/859)) — see [ADR 0042](adr/0042-builder-self-deploy-ci-auto-merge.md). **`laptop`** (legacy): `git push origin main` from the Mac → `ssh lars@REDACTED_IP ~/deploy.sh`. The droplet has a read-only deploy key at `~/.ssh/github_deploy` registered on the repo. `~/deploy.sh` does: `git fetch + reset --hard origin/main` → `npm ci --omit=dev` if `package-lock.json` changed → `./scripts/migrate.sh` → `sudo systemctl restart example` → `curl /healthz` smoke (**retried up to 15× @ 1s** — `systemctl` reports "active" before the Node process binds the port, so a single curl raced the bind and false-failed healthy deploys: [ADR 0056](adr/0056-prod-deploy-script-mirror-and-healthcheck-retry.md) / [#1026](https://example.com/builders#/task/1026)). Droplet checkout: `/home/lars/example/`. `~/deploy.sh` is hand-maintained on the droplet but now has a byte-faithful, reviewable repo mirror at `scripts/deploy/deploy-prod.sh` (instance-side) — **not** auto-installed (the ci deploy key is forced-command-locked, ADR 0042/0043; reinstall by hand on change: `scp scripts/deploy/deploy-prod.sh lars@…:deploy.sh`). **`ci`** (current, armed via [#679](https://example.com/builders#/task/679)): no builder machine holds the droplet key — `ship.js` opens a PR + enables GitHub auto-merge, and `.github/workflows/deploy-prod.yml` (instance-side) runs the same `~/deploy.sh` from Actions on merge to `main`. Cutover preconditions (incl. a server-recorded **CI grade-gate**) are in ADR 0042.
 - **Post-merge branch cleanup (standard practice):** Every feature branch that lands on main via `--no-ff` merge gets deleted on origin once the deploy succeeds. The merge commit itself preserves the branch's history in main, so the named ref isn't carrying any signal — keeping it just clutters GitHub's branch list and tricks the UI into offering empty PRs against zero-diff branches. The auto-merge in [`scripts/gds/ship.js`](../scripts/gds/ship.js) does this automatically after `~/deploy.sh` returns 0; the manual [`/merge-mode`](../.claude/skills/merge-mode/SKILL.md) flow follows the same step 5b. Local refs and worktree directories stay — only the origin branch and the local tracking ref (cleaned on next `git fetch --prune`) go.
 - **Local dev machine:** Lars's MacBook Air (Apple Silicon, macOS Sequoia). Tooling installed via Homebrew at `/opt/homebrew/`. Node v26.0.0 locally; `package.json` declares `"engines": { "node": ">=22" }`. Single ed25519 SSH key (`~/.ssh/id_ed25519`) authenticates to GitHub and droplet.
 - **Smoke tests:** lightweight scripts in `/tmp/colyseus-*-smoketest.js` verify joinOrCreate, move protocol, interact, identity, queue. Run any after deploy with `node /tmp/colyseus-<name>-smoketest.js`.
@@ -238,7 +237,7 @@ Bongos views: `claimable_tasks` (rebuilt in 006 to use SELECT t.*; rebuilt again
 
 **Bongos API (`/api/bongos/*`, mounted in the same Node process):**
 
-- **Canonical path is `/api/bongos` (task 1919); `/api/gds` is a PERMANENT alias.** The router + the discovery index are dual-mounted at both by `serve-internal.js`, driven by the single `src/bongos/api-prefix.js` constant (`API_PREFIX` + `LEGACY_API_PREFIXES`). The legacy `/api/gds` alias never goes away — shipped Dev Box binaries, the cached status mirror, and live boxes call it. **Exception:** the GitHub OAuth callback stays pinned to `/api/gds/auth/web/callback` (registered on the OAuth app; `src/bongos/routes/auth.js`). Not yet flipped (still ride the permanent alias): `src/**` internal callers + the deeper internal names (folders, `GDS_*` env, `gds_session` cookie) — the deferred internal-rename pass.
+- **Canonical path is `/api/bongos` (task 1919); `/api/gds` is a PERMANENT alias.** The router + the discovery index are dual-mounted at both by `serve-internal.js`, driven by the single `src/bongos/api-prefix.js` constant (`API_PREFIX` + `LEGACY_API_PREFIXES`). The legacy `/api/gds` alias never goes away — shipped older CLI binaries, the cached status mirror, and older instances call it. **Exception:** the GitHub OAuth callback stays pinned to `/api/gds/auth/web/callback` (registered on the OAuth app; `src/bongos/routes/auth.js`). Not yet flipped (still ride the permanent alias): `src/**` internal callers + the deeper internal names (folders, `GDS_*` env, `gds_session` cookie) — the deferred internal-rename pass.
 - **Self-describing (task 1918, [ADR 0109](adr/0109-self-describing-openapi-and-hosted-docs.md)).** The whole surface is documented in the standard **OpenAPI 3.1** format at [`docs/api/openapi.json`](api/openapi.json), **generated from the live route files** by `scripts/gds/gen-api-docs.js` (reusing the same `route-rank-check.js` introspection the ship-time rank gate uses — so it can't drift; a fitness `--check` + ship-time regen enforce freshness). A rendered docs site (vendored Redoc) is served at **`/docs`** on the apex of every instance (`cloudbongos.com/docs` canonical); `GET /api/bongos` returns a machine-discovery index pointing at it. The generated [`docs/api-reference.md`](api-reference.md) supersedes the old hand-maintained `routes-permissions.md`. The mount prefix is the single `src/bongos/api-prefix.js` constant.
 
 - Auth: `POST /auth/device/start`, `/poll` (CLI Device Flow); `GET /auth/web/start`, `/web/callback` (browser); `POST /auth/logout`.
@@ -246,9 +245,9 @@ Bongos views: `claimable_tasks` (rebuilt in 006 to use SELECT t.*; rebuilt again
 - Authenticated CLI/web: `GET /me` (returns `rank`), `GET /versions[/progress]`, `GET /tasks[?version=&status=&kind=&discipline=]`, `GET /tasks/claimable[?version=&discipline=]`, `GET /tasks/:id`, `POST /tasks` (accepts `discipline` + `criterion_ids`; **metic+** — [ADR 0090](adr/0090-metic-task-authoring.md)), `PATCH /tasks/:id` (supports `parent_task_id`, `kind`, `discipline`, `goal_id` — (re)assign the task's goal; must be a goal in the task's own version, task 1763; **metic+**), `POST /tasks/:id/promote` (**metic+**), `POST /claims`, `POST /claims/:id/resolve`, `POST /cost`.
 - Criterion rollup + task↔criterion links ([ADR 0025](adr/0025-structured-criterion-task-link.md), [#435](https://example.com/builders#/task/435)/[#438](https://example.com/builders#/task/438)): `GET /versions/:id/progress` rolls up each done-when criterion → its gating tasks (via `task_criteria`) → live status counts + the not-yet-shipped `remaining[]` + `unattributed_tasks` (the read behind the `/status` skill, in `src/bongos/done-when.js criterionProgress`). The link CRUD mirrors the dependency endpoints: `GET /tasks/:id/criteria`, `POST /tasks/:id/criteria` (**metic+** — [ADR 0090](adr/0090-metic-task-authoring.md)) and `DELETE /tasks/:id/criteria/:criterionId` (**metic+**). A criterion ref is a numeric `done_when_criteria.id`, a positional `"Cn"` token, or a `criterion_id` slug, resolved against the task's version (`POST /tasks` links at create time so `/status` counts the task with no backfill).
 - Module store publish (ADR 0338 D1, task 1004271): `POST /store/modules/:key/versions` (`requireBuilder` + `requirePermission('module.submit')`, Metic floor). The body is the raw gzip tarball `bongos module publish` builds (own `express.raw` parser, 5 MB cap; 16 MB / 2000 files unpacked). `scripts/gds/module-artifact.js` re-verifies every hash and the publish gate, then `src/bongos/module-store.js` keeps the file under `var/module-store/` and inserts the `store_module_versions` row in one transaction. The first publish makes the caller the author; later versions are author-only, newer than the last and never overwritten; a delisted key takes none.
-- Server-mediated branch publish (ADR 0055 / [#1025](https://example.com/builders#/task/1025) — lets a dev box with no GitHub push credential ship). Owner-gated like ship: `POST /tasks/:id/publish-branch` (`requireBuilder` + `gateTaskOwnership`, **NOT** `allowBoxScope` → a box-scoped session is `403 box_scope`, so the builder must `/builder-reauth` first; own 32 MB json parser for the base64 thin-bundle body, 20 MB decoded cap; the server pushes the branch + opens the PR + auto-merges with a server-side push credential — a **GitHub App** installation token (short-lived, repo-scoped; preferred, [ADR 0055](adr/0055-server-mediated-branch-publish.md) update / task 1028) or the `GITHUB_PUSH_TOKEN` PAT fallback; `503 push_unconfigured` when neither is set; `400 tip_mismatch` if the bundle tip ≠ the claimed `head_sha`) and `GET /tasks/:id/publish-status?branch=…` (polls PR + deploy-prod state derived live from GitHub). `branch` is optional: without it the server finds the task's own PR by its `task <id>: …` title, and the answer names the `branch` it used and its `branch_source` (`query` / `task_pr`, or `null` with a `branch_hint` when there is no such PR) — never a `400` (task 1003764). When the PR is still open it also carries `merge_driver`, whose `reason` says why it has not merged; on a red PR `failing_tests` names the failing unit tests (read from the `unit-report` commit status the `unit` workflow posts) and `checks_unreadable: true` says the check list is blind because the App lacks `Checks: read` — so an empty `checks[]` is never read as "nothing failed" (task 1003988, ADR 0301). Because the server's credential is the PR's AUTHOR, publish also **assigns the PR to the task's claim holder** and names them in the body (`modules/lifecycle/pr-assign.js`, task 1003991) — best-effort: the 201 carries `pr_assignee` (the login, or `null` when GitHub would not assign it) and a failed assignment never fails the publish. `ship.js` uses these in `ci` mode only when `pushVia()` resolves to server (a box, or `<PREFIX>_PUSH_VIA_SERVER=1`); a laptop with `gh` keeps the local push path unchanged. Implementation in `src/bongos/github-push.js`.
+- Server-mediated branch publish (ADR 0055 / [#1025](https://example.com/builders#/task/1025) — lets a checkout with no GitHub push credential ship). Owner-gated like ship: `POST /tasks/:id/publish-branch` (`requireBuilder` + `gateTaskOwnership`; own 32 MB json parser for the base64 thin-bundle body, 20 MB decoded cap; the server pushes the branch + opens the PR + auto-merges with a server-side push credential — a **GitHub App** installation token (short-lived, repo-scoped; preferred, [ADR 0055](adr/0055-server-mediated-branch-publish.md) update / task 1028) or the `GITHUB_PUSH_TOKEN` PAT fallback; `503 push_unconfigured` when neither is set; `400 tip_mismatch` if the bundle tip ≠ the claimed `head_sha`) and `GET /tasks/:id/publish-status?branch=…` (polls PR + deploy-prod state derived live from GitHub). `branch` is optional: without it the server finds the task's own PR by its `task <id>: …` title, and the answer names the `branch` it used and its `branch_source` (`query` / `task_pr`, or `null` with a `branch_hint` when there is no such PR) — never a `400` (task 1003764). When the PR is still open it also carries `merge_driver`, whose `reason` says why it has not merged; on a red PR `failing_tests` names the failing unit tests (read from the `unit-report` commit status the `unit` workflow posts) and `checks_unreadable: true` says the check list is blind because the App lacks `Checks: read` — so an empty `checks[]` is never read as "nothing failed" (task 1003988, ADR 0301). Because the server's credential is the PR's AUTHOR, publish also **assigns the PR to the task's claim holder** and names them in the body (`modules/lifecycle/pr-assign.js`, task 1003991) — best-effort: the 201 carries `pr_assignee` (the login, or `null` when GitHub would not assign it) and a failed assignment never fails the publish. `ship.js` uses these in `ci` mode only when `pushVia()` resolves to server (no authenticated `gh` on the machine, or `<PREFIX>_PUSH_VIA_SERVER=1`); a machine with `gh` keeps the local push path unchanged. Implementation in `src/bongos/github-push.js`.
 - Archon monitoring reads backing the `/watch` page (ADR 0036): `GET /builders/roster`, `GET /grades/by-builder[?days=N]` (**archon-only**, [#726](https://example.com/builders#/task/726) — per-builder grade breakdown for the MARKS section; the project-wide aggregate stays public at `/public/grades`), `GET /audit-log`, `GET /override-requests`, `GET /access-requests`, `GET /security/reports`. Personal-prefs writes backing `/settings`: `GET/PATCH /me/skill-prefs`, `PATCH /me/disciplines`.
-- Per-builder "needs" + own Gemini key ([ADR 0073](adr/0073-builder-needs-signal-and-byok-gemini-key.md), [#1013](https://example.com/builders#/task/1013)): `GET /me` now also carries `needs` ({items, action_needed_count} — the consistent "the system needs an input from you" signal; `modules/builder-settings/builder-needs.js` is the SSOT — carved out in BV1.R80, resolved by `GET /me` via the `builder-settings` kernel port — rendered by the hall Standing card + the CLI `printNeedsNudge`). The own-key (pragmatic BYOK) endpoints, all own-scoped: `GET /me/art-key/own` (masked meta — last4 only), `PUT /me/art-key/own` (validate-on-save via a Google list-models call → encrypt with `src/bongos/secret-box.js` → store; `503 storage_not_configured` until `BUILDER_SECRET_KEY` is set, `422 invalid_key` on a bad key), `DELETE /me/art-key/own`. The existing `GET /me/art-key` (shared-key box-sync delivery) is extended to also deliver the decrypted own key, which `scripts/gds/fetch-art-key.js` syncs into the local `gemini_api_key` slot (own key wins in the `gen_api.py` cascade).
+- Per-builder "needs" + own Gemini key ([ADR 0073](adr/0073-builder-needs-signal-and-byok-gemini-key.md), [#1013](https://example.com/builders#/task/1013)): `GET /me` now also carries `needs` ({items, action_needed_count} — the consistent "the system needs an input from you" signal; `modules/builder-settings/builder-needs.js` is the SSOT — carved out in BV1.R80, resolved by `GET /me` via the `builder-settings` kernel port — rendered by the hall Standing card + the CLI `printNeedsNudge`). The own-key (pragmatic BYOK) endpoints, all own-scoped: `GET /me/art-key/own` (masked meta — last4 only), `PUT /me/art-key/own` (validate-on-save via a Google list-models call → encrypt with `src/bongos/secret-box.js` → store; `503 storage_not_configured` until `BUILDER_SECRET_KEY` is set, `422 invalid_key` on a bad key), `DELETE /me/art-key/own`. The existing `GET /me/art-key` (shared-key delivery) is extended to also deliver the decrypted own key, which `scripts/gds/fetch-art-key.js` syncs into the local `gemini_api_key` slot (own key wins in the `gen_api.py` cascade).
 - Builder memory (ADR 0024 cloneable memory + ADR 0026 BFG). Self-scoped (owner is always `req.builder.id`, never input): `POST /memory/sync` (push own memory; own 64 MB parser, vs the global 64 KB), `GET /memory/files`, `GET /memory/file`, `DELETE /memory/file` (the BFG delete affordance, 6C.2). Cross-builder (input-owner) endpoints — all privileged + audit-logged fail-closed: `GET /memory/builders/:id/files`+`/file` (**archon forensic** read), `GET /memory/bfg/builders/:id/files`+`/file` (**BFG-principal only**, 6B.1 read), and the one cross-builder WRITE `POST /memory/builders/:id/bfg-write` (**BFG-principal only**, kill-switched `BFG_WRITE_ENABLED` default-OFF, namespaced `bfg/`, attributed `author: BFG`, write+audit in one tx — dreams + transparent corrections, 6C.1/6C.2).
 - Session corpus (BFG evaluator — 6D, ADR 0027): `POST /sessions` (upload own session digest; own **4 MB** json parser — capped, vs the global 64 KB — and the digest is per-turn metadata + short scrubbed snippets, never raw transcript content), `GET /sessions/mine` (self-serve), `GET /sessions/search` (cross-builder, **archon-gated** — the BFG-principal stand-in; the principal now exists (6C.1) and the *memory* cross-reads moved to it (6B.1), but these *session* reads still use the archon stand-in pending a retrofit, + audit_log row per read), `GET /sessions/:id` (own self-serve; cross-builder needs archon + audit; non-owner → 404).
 - Public (no auth, `Cache-Control: max-age=60`): `/public/versions`, `/public/progress`, `/public/cost-summary`, `/public/recent-shipped`, `/public/leaderboard`, `/public/grades[?days=N]`, `/public/tasks/:id` ([#604](https://example.com/builders#/task/604) — single-task resolver for `#NNN` doc deep-links; `title`/`value_summary`/`visual_url` returned **only** for `shipped`|`confirmed` work and withheld for in-flight tasks so unshipped/security task names can't leak; the status dashboard renders it at `#/task/:id`), `/public/ref-ids` ([#653](https://example.com/builders#/task/653) — `{tasks:[ids]}`, ids only, token-free; the doc-ref linkifier + its CI gate consult it to decide which bare `#NNN` are real task refs). These power `status.example.com`.

package/docs/branding-contract.md

@@ -29,7 +29,7 @@ env override   →   instance config (config/branding.json)   →   neutral star
 | `domains.cookieDomain` | Session cookie domain (`""` = host-only — the safe default; never widen to a parent domain by accident). |
 | `domains.oauthOrigin` | Canonical sign-in origin. |
 | `domains.provisioningOrigin` | **Optional.** Control-plane front-door origin the [provisioning module](../modules/provisioning/CLAUDE.md) uses to build a new customer's GitHub-App `redirect_url`. Set it when the control plane co-hosts a game whose `publicOrigin` is the game's own domain (OTB = customer 0) so the customer's App carries the PLATFORM brand (e.g. `https://get.cloudbongos.com`), not the game's. **Falls back to `publicOrigin` when unset** — an instance whose `publicOrigin` is already the platform needs no override. Env-overridable: `<PREFIX>_PROVISIONING_ORIGIN`. ([#2101](https://example.com/builders#/task/2101)) |
-| `domains.instanceBase` | Apex zone new projects get their **auto-assigned** address under (`<slug>.<instanceBase>`, task 1002704 — every project's hall reachable day one; `no_address: true` on the create call opts out). Same one-label-under-apex/edge-TLS constraint as `devBoxBase`. Deliberately NOT derived from `publicOrigin` (on a co-hosting control plane that is the game's domain). Empty ⇒ no auto-assign — creates are domainless unless the caller brings a domain. |
+| `domains.instanceBase` | Apex zone new projects get their **auto-assigned** address under (`<slug>.<instanceBase>`, task 1002704 — every project's hall reachable day one; `no_address: true` on the create call opts out). One label under the apex only, so the edge wildcard certificate covers it. Deliberately NOT derived from `publicOrigin` (on a co-hosting control plane that is the game's domain). Empty ⇒ no auto-assign — creates are domainless unless the caller brings a domain. |
 | `repo` | `{ owner, name }` GitHub binding. |
 | `db.database` | DB name Bongos pool connects to when neither `DATABASE_URL` nor `PGHOST`/`PGDATABASE` is set (`src/bongos/pool.js`, ADR 0062 §5). `null` in the neutral starter = **fail loud** rather than silently target a host DB. |
 | `currency` | `{ label, symbol }` — the reward unit label (e.g. "example"). Display only. |
@@ -41,7 +41,7 @@ env override   →   instance config (config/branding.json)   →   neutral star
 | `landing.postLogin` | Where a successful web sign-in lands when it carried no explicit `?return=` / same-apex `Referer` (`src/bongos/routes/auth.js` `postLoginLanding`). **Portable default `/builders`** — the hall always exists. A platform-home instance points this at its OWN front door so a visitor who signs in from there returns there instead of being auto-redirected into the hall (cloudbongos.com → `/gate/`, the orbs). Validated through the same open-redirect allowlist as `?return=` (a misconfigured value falls back to `/builders`). Env-overridable: `<PREFIX>_POST_LOGIN_LANDING`. (task [#1002240](https://cloudbongos.com/builders#/task/1002240)) |
 | `envPrefix` | Env-var namespace for overrides (`BONGOS` for vanilla, `OTB`, …). Legacy `CLOUDBONGOS_`, `OTB_`, `GDS_` and `PMS_` spellings still resolve, with one deprecation warning per name, until core 1.21 (task 1003703). |
 
-**Not here:** feature-module on/off flags (game, art, discord, dev-box) are a sibling config owned by R54 (task [#1193](https://example.com/builders#/task/1193)).
+**Not here:** feature-module on/off flags (game, art, discord) are a sibling config owned by R54 (task [#1193](https://example.com/builders#/task/1193)).
 
 ## Using it
 

package/docs/canonical-permissions.md

@@ -222,12 +222,11 @@ or missing ranks fail closed.
   of its grants (ADR 0034); `archon` and the divine tiers above it do.
 
   **[ADR 0157](adr/0157-archon-is-rank-and-identity-only.md) added the whole operational block here** —
-  20 permissions that had been Archon-gated only by ADR 0016's fail-closed default, never by a decision:
-  the government/monitoring **pages** (`/watch`, `/harbor`, `/gate` — `page.view.government`) and
+  20 permissions (19 today: the dev-box fleet one went with the box, [ADR 0346](adr/0346-dev-boxes-are-retired.md)) that had been Archon-gated only by ADR 0016's fail-closed default, never by a decision:
+  the government/monitoring **pages** (`/watch`, `/gate` — `page.view.government`) and
   `GET /api/bongos/sessions/search` (whose own `/sessions` page had no server gate at all until
   task 1002710 put it behind `page.view.government` alongside its three group-mates); the
-  **dev-box + provisioning fleets** (`GET /boxes[/cost-ledger]`,
-  `POST /boxes/:b/close`, `PATCH .../block`, `GET /provisioning/fleet[/cost-ledger]`,
+  **provisioning fleet** (`GET /provisioning/fleet[/cost-ledger]`,
   `POST .../force-teardown`); **security adjudication** (`GET /security/reports`,
   `POST /security/reports/:id/{confirm,dispute,fix,link-fix}`, `/security/docs` CRUD);
   `GET /api/bongos/audit-log`; the **roster reads** (`GET /builders/roster`, `/grades/by-builder`,
@@ -276,22 +275,15 @@ nothing set it, so every task sat at the `'xenos'` default and the claim gate ab
   still at the `'xenos'` default to `metic` where sensitive (raise-only, idempotent).
 - The builders-hall card shows a rank pill when a task's floor is above `xenos`.
 
-### Source access is rank-gated too (ADR 0031 §9.2, ADR 0035 §1)
+### Source access (ADR 0035 §1)
 
-Authority over *the code itself* rides the same ladder, enforced server-side from the live DB rank
-(never from anything the builder's machine can write):
+Reading the code is not rank-gated today; what a builder can LAND is (next section):
 
-- **Local clone onto your own disk = Metic and up.** Below Metic (`xenos`, `thetes`), there is **no
-  permanent local copy** — the collaborator-invite path is a Metic+ affordance. New builders work
-  inside the org-controlled cloud box, where access is revocable and audited.
-- **Box source is scoped by rank** (`boxScopeForRank`, decided live inside `GET /api/bongos/box/source-access`):
-  `xenos`/`thetes` get a sparse `starter` surface; `metic`/`archon` get `full`. A demotion cuts a box
-  off on its very next fetch (instant credential-layer revocation; the droplet teardown is the slower
-  control-plane half via `box.js reconcile`).
-
-> **Rollout note (ADR 0035 §4):** until the box lane is verified end-to-end on real hardware, the
-> collaborator-invite/local-clone path stays open to all admitted ranks as the interim on-ramp — the
-> Metic+ tightening lands once the box gives newcomers a working alternative. Never leave zero working paths.
+- **A local clone onto your own disk is how every builder works**, and the collaborator-invite /
+  local-clone path is open to every admitted rank. `source.clone.local` still names the Metic+ floor
+  ADR 0035 planned, but that tightening was to land once a cloud box gave newcomers another way in;
+  the box is retired ([ADR 0346](adr/0346-dev-boxes-are-retired.md)), so it does not land as designed.
+  What bounds a checkout is what it can land, as the next section describes.
 
 ### Git and SSH are OUTSIDE the HTTP boundary — covered by a separate rank floor (ADR 0043, SEC [#863](https://example.com/builders#/task/863))
 

package/docs/copy-inventory.md

@@ -589,7 +589,7 @@ Identical copy within one surface. Sometimes right (a repeated button), sometime
 | `9f9424a5100b` | certain | Join our Discord | `modules/hall-ui/public/hall-render.js:804` |
 | `7ee76a958445` | certain | Join requests | `modules/hall-ui/public/goals-render.js:1411` |
 | `b7ab5922126b` | certain | Join-requests to approve | `modules/hall-ui/public/goal-inbox.js:154` |
-| `d305f0df6f25` | certain | Jump to | `modules/hall-ui/public/palette.js:216` |
+| `d305f0df6f25` | certain | Jump to | `modules/hall-ui/public/palette.js:351` |
 | `01176c156112` | certain | Jump to a goal or a thought | `modules/hall-ui/public/goal-map.html:75` |
 | `01176c156112` | certain | Jump to a goal or a thought | `modules/hall-ui/public/thinking.html:92` |
 | `2bfc5a50ce88` | certain | Jump to a page or record | `modules/hall-ui/public/shell.js:485` |
@@ -696,7 +696,7 @@ Identical copy within one surface. Sometimes right (a repeated button), sometime
 | `abc64639b134` | certain | No goals seeded yet. | `modules/hall-ui/public/roadmap.js:205` |
 | `139ec3636c22` | certain | No introductions right now. One appears here when a pairing round runs. | `modules/hall-ui/public/collab.html:99` |
 | `3b9823dd4579` | certain | No maintenance declared — nobody is on the hook for this module as the core advances. | `modules/hall-ui/public/modules.js:92` |
-| `64a4281934d1` | certain | No match. Try a page name, or an id like | `modules/hall-ui/public/palette.js:172` |
+| `64a4281934d1` | certain | No match. Try a page name, or an id like | `modules/hall-ui/public/palette.js:307` |
 | `f52552a6afcd` | certain | No notes were packed for this version. | `modules/hall-ui/public/settings-software-update.js:102` |
 | `4f89817b92e5` | certain | No onboarding steps recorded yet. | `modules/hall-ui/public/hall-render.js:880` |
 | `421ae031594e` | certain | No open goals in this version | `modules/hall-ui/public/task.js:589` |
@@ -1443,7 +1443,7 @@ Identical copy within one surface. Sometimes right (a repeated button), sometime
 | `af3a8e0fe6a8` | certain | open your goals | `modules/hall-ui/public/goal-inbox.js:158` |
 | `9a803563c948` | certain | open {…} | `modules/hall-ui/public/approval-queue.js:156` |
 | `4f279d68175f` | certain | open, on the Security tab | `modules/hall-ui/public/watch.html:47` |
-| `7b85e6494596` | certain | opens a new tab | `modules/hall-ui/public/palette.js:180` |
+| `7b85e6494596` | certain | opens a new tab | `modules/hall-ui/public/palette.js:315` |
 | `c38db02adb61` | certain | or above | `modules/hall-ui/public/government.js:564` |
 | `271de72308a4` | certain | pages tweaked | `modules/hall-ui/public/studio.html:83` |
 | `884948925fcb` | certain | paste command | `modules/hall-ui/public/settings.js:914` |

package/docs/copy-registry.json

@@ -6727,7 +6727,7 @@
       "surface": "builders-hall",
       "text": "Jump to",
       "file": "modules/hall-ui/public/palette.js",
-      "line": 216,
+      "line": 351,
       "origin": "js-markup",
       "confidence": "certain"
     },
@@ -7690,7 +7690,7 @@
       "surface": "builders-hall",
       "text": "No match. Try a page name, or an id like",
       "file": "modules/hall-ui/public/palette.js",
-      "line": 172,
+      "line": 307,
       "origin": "js-markup",
       "confidence": "certain"
     },
@@ -14413,7 +14413,7 @@
       "surface": "builders-hall",
       "text": "opens a new tab",
       "file": "modules/hall-ui/public/palette.js",
-      "line": 180,
+      "line": 315,
       "origin": "js-markup",
       "confidence": "certain"
     },

package/docs/design/gate-navigation-direction.md

@@ -62,7 +62,7 @@ the apex redirects straight past it into the walled gate.
 `src/platform-server.js:115-121`, conditional only on `isApexHost(req)` and the gate file existing,
 with no session check and no query bypass.
 
-**The live Caddyfile is not mirrored in this repo** (`infra/` holds only `box-*.sh`); ADR 0152 gives
+**The live Caddyfile is not mirrored in this repo** (`infra/` held only `box-*.sh` and has since been removed with the dev box); ADR 0152 gives
 the intended shape as prose and marks the lock *"optional pre-launch"*, and several references to
 `infra/Caddyfile` elsewhere in the tree are dead. Treat the host config as the source of truth.
 

package/docs/design/hall-direction-v2.md

@@ -28,7 +28,7 @@ Five pages carry the whole hall, and every other page inherits from one of them:
 | **board** (`index.html` + `work.html`) | the home view and the work board: the densest surface in the hall |
 | **task** (`task.html`) | one record read end to end; `idea` and `ideas` inherit |
 | **reading** (`primer.html`) | long markdown with a table of contents; Ranks, Economy, Diagrams, Repo Atlas and Modules inherit |
-| **goals** (`goals.html`) | the governance lists; Government, Modules, Watch, Harbor, Gate, Sessions, People and the rest inherit |
+| **goals** (`goals.html`) | the governance lists; Government, Modules, Watch, Gate, Sessions, People and the rest inherit |
 | **settings** (`settings.html` + `profile.html`) | every form, switch, secret field and status line in the hall |
 
 ---
@@ -125,11 +125,11 @@ Five things were reconciled **between** the archetypes, since the builders ran i
 
 **A fixture rule the round had to learn, flagged by the grader's security worker.** The settings mocks compose the
 CLI re-issue flow, which means they have to show a token in a `<pre>`, and they were seeded with a realistic
-64-character hex string beside the real paste command, plus the live dev box's actual `ssh <account>@<ip>` line.
+64-character hex string beside the real paste command, plus a hosted machine's actual `ssh <account>@<ip>` line.
 Neither belonged in a committed artifact: the hex was invented (verified against this machine's real session files,
 so nothing needed rotating) but a credential-shaped literal is treated as a secret regardless of intent and would
 trip every future scanner, and the SSH host and account are real internal topology that no public API justifies.
-Both are now unmistakable placeholders. **The rule for any mock that composes a secret or a connection string: the
+Both were made unmistakable placeholders (the SSH line has since left the mocks with the retired dev-box settings group). **The rule for any mock that composes a secret or a connection string: the
 fixture must be self-evidently fake at a glance while keeping the real string's LENGTH and SHAPE**, because the
 length is the composition problem being solved. "Real data, invent nothing" governs ledger figures; it does not
 extend to credentials or infrastructure.

package/docs/design/modular-architecture/00-research-report.md

@@ -77,7 +77,7 @@ The "boundary rots back together" problem is universal; the cure is **architectu
 - 📄 **Dependency-graph-scoped context** (`nx affected` / `turbo --filter`; [Nx AI agent skills](https://nx.dev/blog/nx-ai-agent-skills) exposes the project graph to agents).
 - 📄 **Ticket↔component mapping is established**: Jira/Linear "Components", conventional-commit scopes, CODEOWNERS, `nx affected --files`.
 
-🔧 **The synthesis:** `touches[]` is a file-path list (the lowest-altitude form). The industry moves the unit of affinity *up* from files to components/packages. Once modules are first-class, a task should declare **module affinity**; the agent loads only that module + the core API (small context, higher quality), parallel-safety becomes module-disjointness (cleaner than path overlap), and drift detection becomes semantic ("you said dev-box, you touched game"). *(Refined later: see [02](02-module-map.md)/[04](04-module-lifecycle.md) — in a fully modular world the file-path `touches[]` retires entirely in favor of the module label.)*
+🔧 **The synthesis:** `touches[]` is a file-path list (the lowest-altitude form). The industry moves the unit of affinity *up* from files to components/packages. Once modules are first-class, a task should declare **module affinity**; the agent loads only that module + the core API (small context, higher quality), parallel-safety becomes module-disjointness (cleaner than path overlap), and drift detection becomes semantic ("you said discord, you touched game"). *(Refined later: see [02](02-module-map.md)/[04](04-module-lifecycle.md) — in a fully modular world the file-path `touches[]` retires entirely in favor of the module label.)*
 
 ## 7. Thread 6 — How companies manage AI-assisted dev at scale
 

package/docs/design/modular-architecture/01-architecture.md

@@ -38,7 +38,7 @@ The whole product becomes **core + modules**. A module is a **vertical slice** (
 graph TD
     subgraph Modules["Modules (each a vertical slice: routes · db · ui · skills · manifest)"]
         G[game]
-        D[dev-box]
+        D[provisioning]
         DC[discord]
         Y["your module<br/>(no fork!)"]
     end
@@ -94,7 +94,7 @@ graph LR
         R1["long dark window — nothing ships —<br/>re-deriving the SAME core (auth, tasks, grading, ~111 migrations)"] --> R2["risky big-bang cutover ⚠"]
     end
     subgraph ST["Strangler migration (recommended)"]
-        S1[loader] --> S2[dev-box→module] --> S3["discord · art"] --> S4[game] --> S5["carve core + task→module"] --> S6[theming]
+        S1[loader] --> S2[first module→module] --> S3["discord · art"] --> S4[game] --> S5["carve core + task→module"] --> S6[theming]
     end
 ```
 
@@ -110,7 +110,7 @@ Each phase ships independently, guarded by the fitness functions; easiest/most-i
 |---|---|---|
 | 0 | Draw the doorway | define `core/module-api.js` + teach `fitness.js` the one-way rule (mostly exists) |
 | 1 | Build the loader | discover `modules/*/module.json`, validate, compose routes behind auth, apply module migrations, start/stop pollers |
-| 2 | Move dev-box first | most self-contained + half flag-gated; the template every other move copies; prove OTB behaves identically |
+| 2 | Move the most self-contained module first | the template every other move copies; prove OTB behaves identically (the original pick, dev-box, has since been retired, ADR 0346) |
 | 3 | Move discord, then art-pipeline | same recipe |
 | 4 | Move game (the hard one) | Colyseus rooms + world tables + `public/`; "realtime capability" seam |
 | 5 | Carve the core + rewire the task model | split `db.js` per-module; add `task.module`; **retire `touches[]`**; extend fitness to verify diff-in-module |