@bongos/core 1.19.1075 → 1.19.1076

package/docs/design/modular-architecture/02-module-map.md

@@ -95,7 +95,6 @@ graph TD
     GA[game] --> K
     AR[art-pipeline] --> K
     DC[discord] --> K
-    DB[dev-box] --> K
 ```
 
 | Module | Owns |
@@ -111,6 +110,6 @@ graph TD
 | autonomy/MAS | conductor dispatch · architect audits · autonomy-gate · scheduled routines |
 | security | red-team reports · bounty (rank-gated Metic+) |
 | hall-UI · status-UI | the two web surfaces |
-| game · art-pipeline · discord · dev-box | feature modules |
+| game · art-pipeline · discord | feature modules |
 
 > **~16 is the target ceiling, not a day-one requirement.** Start coarser; split as the coupling scan + fitness demand. Every one is a real cohesive cluster (the scan proved it), but a small team should be "as modular as the evidence supports, no finer." Merging two modules is cheap; the fitness ratchet makes splitting them safe — you're never locked into the first cut.

package/docs/design/modular-architecture/03-builder-flows.md

@@ -4,26 +4,26 @@ How a person works once the code is in modules. **Nothing you do is blocked —
 
 ## The one idea: two kinds of "access"
 
-- **Platform capabilities** — claim, start, ship, file an idea, recall, see your box. These are **kernel endpoints over HTTP, gated only by your rank.** The module structure never touches them. Available everywhere, always.
-- **Code-write scope** — which files a *single claimed task* may change. The **only** thing the structure bounds; it lives at the **worktree** level (not you, not your box); escaped by seeding a new task (itself a kernel capability).
+- **Platform capabilities** — claim, start, ship, file an idea, recall. These are **kernel endpoints over HTTP, gated only by your rank.** The module structure never touches them. Available everywhere, always.
+- **Code-write scope** — which files a *single claimed task* may change. The **only** thing the structure bounds; it lives at the **worktree** level (not you, not your checkout); escaped by seeding a new task (itself a kernel capability).
 
-**The wall is around each task's worktree — not around you, and not around your dev box.**
+**The wall is around each task's worktree — not around you, and not around your checkout.**
 
-## 1. What the dev box has access to
+## 1. What your checkout has access to
 
-The dev box is your machine — a persistent environment, **not** module-scoped. Scoping happens one level down, per claim.
+Your checkout is your own copy of the project repo on your own machine — a persistent environment, **not** module-scoped. Scoping happens one level down, per claim.
 
 | Layer | Scope | Governed by |
 |---|---|---|
-| Dev box (your environment) | full repo, all modules readable, whole CLI, the API, the preview | nothing — it's yours |
+| Your checkout (your machine) | full repo, all modules readable, whole CLI, the API, the preview | nothing — it's yours |
 | Kernel capabilities (claim/ship/capture/…) | everything the platform can do | **your rank** (server-enforced) — never a module |
 | A claim's worktree | write = its one module; read = that module + the kernel doorway | the task's **module label** + the ship-time diff check |
 
-## 2. Flow: open a dev box → ship a task
+## 2. Flow: open your checkout → ship a task
 
 ```mermaid
 graph LR
-    A["Open dev box<br/>(box)"] --> B["/builder-start<br/>lists ALL modules<br/>(kernel)"]
+    A["Open your checkout<br/>(local)"] --> B["/builder-start<br/>lists ALL modules<br/>(kernel)"]
     B --> C["/builder-claim N<br/>a game task<br/>(kernel)"]
     C --> D["worktree spun:<br/>modules/game + RO kernel<br/>(module-scoped)"]
     D --> E["agent edits game only<br/>(module-scoped)"]
@@ -31,7 +31,7 @@ graph LR
     F --> G["live ✓<br/>worktree reaped"]
 ```
 
-Five of seven steps are kernel/box capabilities; only the worktree + the edits are module-scoped. The only *new* thing is a silent check inside `/builder-ship` (diff ⊆ declared module) that in-scope work never notices.
+Five of seven steps are kernel/local capabilities; only the worktree + the edits are module-scoped. The only *new* thing is a silent check inside `/builder-ship` (diff ⊆ declared module) that in-scope work never notices.
 
 ## 3. Flow: claim a task in a different module
 
@@ -39,14 +39,14 @@ You're never "in" a module — each *claim* is. A second claim just makes a seco
 
 ## 4. Flow: see an idea — and seed a cross-module task
 
-Browsing ideas, filing an idea, and **seeding a task for another module** are all kernel operations — they need no access to the other module's code, so they work from anywhere. An agent in a game worktree can't *write* dev-box code, but it can always *file the task* for it (one command), then continue or hand off; a dependency link orders them if needed.
+Browsing ideas, filing an idea, and **seeding a task for another module** are all kernel operations — they need no access to the other module's code, so they work from anywhere. An agent in a game worktree can't *write* discord code, but it can always *file the task* for it (one command), then continue or hand off; a dependency link orders them if needed.
 
 ## 5. "Could this block me?" — every worry
 
 | Worry | Why it isn't a block |
 |---|---|
 | Claim a task in a module I'm not "in"? | You're never "in" a module. Claiming is kernel; each claim makes its own scoped worktree. |
-| Does my box only have one module's code? | No — the box has the full repo. Only each per-claim worktree is scoped. |
+| Does my checkout only have one module's code? | No — the checkout has the full repo. Only each per-claim worktree is scoped. |
 | Agent needs another module mid-task — stuck? | No — it seeds a task for it (kernel op, needs no access to that code); a dep orders them. |
 | Filing an idea about module X needs X access? | No — capture/inbox is kernel; file from anywhere. |
 | Is shipping gated by my module? | No — ship is kernel; the only module check is "diff ⊆ module," which passes for normal work. |
@@ -60,7 +60,7 @@ A Claude Code session is **not** welded to one worktree. The session is a **cond
 graph TD
     S["long autonomous SESSION = <redacted> repo · full mobility · no module binding"]
     S --> A["task A (game) → worktree A → its own PR → ship"]
-    S --> B["task B (dev-box) → worktree B → its own PR → ship"]
+    S --> B["task B (discord) → worktree B → its own PR → ship"]
     S --> C["task C (memory) → worktree C → its own PR → ship"]
 ```
 
@@ -69,34 +69,36 @@ graph TD
 
 The session has full mobility across modules; only each *task's worker* is module-isolated. This is the orchestrator-worker pattern (ADR 0024), and Bongos already assigns a per-claim worktree.
 
-## 7. Limiting what the box holds — the jailbreak blast radius
+## 7. Limiting what a sandbox holds — the jailbreak blast radius
 
-The split lets the box hold **far less**: only the claimed module (read/write) + the kernel's **safe contract** (signatures, read-only) + client plumbing + a scoped token. The kernel **implementation** (auth, rank, ship, grade) never leaves the server.
+*This section was written for the dev box, which has since been retired ([ADR 0346](../../adr/0346-dev-boxes-are-retired.md)). The reasoning holds for any sandboxed environment a session might run in, such as a future cloud session. Today's path, a local checkout, holds the full repo by design (§1).*
+
+The split lets a sandbox hold **far less**: only the claimed module (read/write) + the kernel's **safe contract** (signatures, read-only) + client plumbing + a scoped token. The kernel **implementation** (auth, rank, ship, grade) never leaves the server.
 
 ```mermaid
 graph LR
-    subgraph Box["DEV BOX · one claim (= jailbreak blast radius)"]
+    subgraph Sbx["SANDBOX · one claim (= jailbreak blast radius)"]
         M["modules/&lt;key&gt;/ — read/write"]
         KC["kernel CONTRACT — signatures + docs only (RO)"]
         CLI["CLI plumbing (cli-lib)"]
         TOK["scoped, claim-scoped token (not full-repo)"]
     end
     subgraph Server["SERVER · the trusted side"]
-        KI["KERNEL IMPL — auth · rank · ship · grade<br/>(never on the box)"]
+        KI["KERNEL IMPL — auth · rank · ship · grade<br/>(never in the sandbox)"]
         OM[every other module's source]
         FR[full repo + history]
         EN["ENFORCES the rank ladder, live per request (ADR 0016)"]
     end
-    Box -->|"privileged ops = HTTP call<br/>(box can't push main)"| Server
+    Sbx -->|"privileged ops = HTTP call<br/>(sandbox can't push main)"| Server
 ```
 
-**The trap to avoid:** reducing what's *on disk* is not reducing *access* — a box holding a full-repo credential re-fetches. The real lever is **scoping the box's credential + fetch to the claimed module** (and module access can be **rank-gated** too, since the server mediates every fetch). The primary boundary always remains the **server-enforced rank ladder**; on-disk minimization is defense-in-depth on top.
+**The trap to avoid:** reducing what's *on disk* is not reducing *access* — a sandbox holding a full-repo credential re-fetches. The real lever is **scoping the sandbox's credential + fetch to the claimed module** (and module access can be **rank-gated** too, since the server mediates every fetch). The primary boundary always remains the **server-enforced rank ladder**; on-disk minimization is defense-in-depth on top.
 
 | Approach | Efficiency | Real confidentiality boundary? |
 |---|---|---|
 | Sparse-checkout only | ✓ smaller tree | ✗ — `.git` still has everything |
-| Partial clone + sparse | ✓✓ | ~ — box can lazily re-fetch with its token |
-| **Server-mediated, claim-scoped fetch** | ✓✓ | **✓ — box never holds a full-repo remote or kernel source** |
+| Partial clone + sparse | ✓✓ | ~ — sandbox can lazily re-fetch with its token |
+| **Server-mediated, claim-scoped fetch** | ✓✓ | **✓ — sandbox never holds a full-repo remote or kernel source** |
 | Per-module repos | ✓✓ | ✓✓ strongest — but contradicts single-repo (ADR 0080 rejected package-modules for v1) |
 
 ## 8. Two boundaries that compose (no new friction)

package/docs/design/modular-architecture/04-module-lifecycle.md

@@ -8,7 +8,7 @@ The one-way rule forbids a module importing another. But the **lifecycle** (whic
 
 - **Ports** (a *required, single-provider* capability): the economy module registers a `reward` provider; at ship, the lifecycle asks the kernel to resolve `reward` and calls it. **Economy owns the formula *and* the ledger**; the lifecycle only supplies the session and delivers the result.
 - **Events** (an *optional* reaction): the lifecycle emits `task.shipped`; the discord module reacts if it cares.
-- **Contributions** (an *accumulating extension point*): zero-or-more modules each add a piece to a named point and the kernel hands the whole set to a core consumer — how a module adds its own slice to a shared core surface without core hardcoding it. The `profile.fields` point lets dev-box/discord/art add their slice to the `GET /me` payload (and its browser twin, `window.OTB.contributeSettingsPanel`, adds a Settings panel) instead of those being baked into `routes/me.js` + `settings.js` (BV1.R42 / task 1411 — the strangler prerequisite for those three moves; game has no such coupling). Add-only: a contribution may introduce keys, never overwrite a core one.
+- **Contributions** (an *accumulating extension point*): zero-or-more modules each add a piece to a named point and the kernel hands the whole set to a core consumer — how a module adds its own slice to a shared core surface without core hardcoding it. The `profile.fields` point lets discord/art add their slice to the `GET /me` payload (and its browser twin, `window.OTB.contributeSettingsPanel`, adds a Settings panel) instead of those being baked into `routes/me.js` + `settings.js` (BV1.R42 / task 1411 — the strangler prerequisite for those moves; game has no such coupling). Add-only: a contribution may introduce keys, never overwrite a core one.
 
 ```mermaid
 graph LR

package/docs/design/modular-architecture/README.md

@@ -4,17 +4,19 @@ Five reports from the **2026-06-21 modular-architecture design session**, filed
 
 > **Status: pre-red-team draft.** These are research/design reports, not a decision record. A formal numbered ADR follows once they've been red-teamed. Filed under `docs/design/` (not `docs/adr/`) on purpose — the ADR numbering is in flux (0079→0081 collisions), so the number is assigned later on an up-to-date worktree.
 
+> **Since filing:** the dev box module that these reports use as their first example was retired on 2026-09-28 ([ADR 0346](../../adr/0346-dev-boxes-are-retired.md)). Where a report still names it (the code-size table, the import-graph findings, the migration plan), that is the tree as it stood at filing.
+
 | # | Doc | What it answers |
 |---|-----|-----------------|
 | 00 | [Research report](00-research-report.md) | Industry best practice on packaging, plugins, theming, and AI-agent scoping (cited) |
 | 01 | [Architecture](01-architecture.md) | The concrete core+modules design; why not a rewrite; the migration path |
 | 02 | [Module map](02-module-map.md) | Where the ~95k LOC live; how finely to cut the core; the decided roster |
-| 03 | [Builder flows](03-builder-flows.md) | What the dev box can access; why the structure never blocks a builder |
+| 03 | [Builder flows](03-builder-flows.md) | What a builder's checkout can access; why the structure never blocks a builder |
 | 04 | [Module lifecycle & maintenance](04-module-lifecycle.md) | How modules interact (seams) and stay healthy as code grows |
 
 ## The decided model (one paragraph)
 
-A small **kernel** (auth, rank, db-pool, the loader, the seam registry, trust primitives, config/identity, analytics, the trusted publish path) plus **~16 modules** (lifecycle, economy, grading, memory, onboarding, ideas, builder-settings, sessions/BFG, autonomy/MAS, security, hall-UI, status-UI + game/art-pipeline/discord/dev-box). Modules **never import each other** — they interact through **kernel-mediated seams** (ports + events). Boundaries are held by **CI fitness functions** so the structure can't rot as it grows. It stays **single-package, single-process, no-bundler** — modularity is a separate axis from packaging/runtime/build. It is built via an incremental **strangler migration**, not a ground-up rewrite.
+A small **kernel** (auth, rank, db-pool, the loader, the seam registry, trust primitives, config/identity, analytics, the trusted publish path) plus **~16 modules** (lifecycle, economy, grading, memory, onboarding, ideas, builder-settings, sessions/BFG, autonomy/MAS, security, hall-UI, status-UI + game/art-pipeline/discord). Modules **never import each other** — they interact through **kernel-mediated seams** (ports + events). Boundaries are held by **CI fitness functions** so the structure can't rot as it grows. It stays **single-package, single-process, no-bundler** — modularity is a separate axis from packaging/runtime/build. It is built via an incremental **strangler migration**, not a ground-up rewrite.
 
 ## How the boundaries were drawn
 

package/docs/design/reviews/hall-v2/README.md

@@ -19,6 +19,8 @@ The 26 pages that carry a `*.states.json` (`modules/hall-ui/public/`), each rend
 
 Sheets: `<page>--<rank>.webp`, one per page-lane — dark rows above light, 1440 → 390 → 320 left to right, one tile per state. (The atlas sheets are from the second run, with `atlas.json` generated.)
 
+The `harbor` and `pair` sheets were deleted when those two pages were removed with the dev box ([ADR 0346](../../../adr/0346-dev-boxes-are-retired.md)). The counts and lists below are as walked on 2026-09-02, with both pages in them.
+
 ## Page × rank
 
 | page | xenos | metic | archon |
@@ -31,13 +33,11 @@ Sheets: `<page>--<rank>.webp`, one per page-lane — dark rows above light, 1440
 | gate | 12 · refused (metic+) | 12 · clean | 18 · clean |
 | goals | 20 · clean | 20 · clean | 30 · clean |
 | government | 20 · refused (permissions view is archon) | 20 · refused (same) | 30 · clean |
-| harbor | 12 · refused (metic+) | 12 · clean | 18 · clean |
 | idea | 8 · clean | 8 · clean | 12 · clean |
 | ideas | 8 · clean | 8 · clean | 12 · clean |
 | index | 16 · clean | 16 · clean | 24 · clean |
 | modules | 20 · clean | 20 · clean | 30 · clean |
 | not-ready | 8 · clean | 8 · clean | 12 · clean |
-| pair | 8 · clean | 8 · clean | 12 · clean |
 | people | 12 · clean | 12 · clean | 18 · clean |
 | primer | 12 · harness (sign-in redirect) | 12 · harness | 18 · harness |
 | profile | 20 · **defect 1003497** (signed-out links) | 20 · **defect 1003497** | 30 · **defect 1003497** |

package/docs/design/vanilla-hall-ui-redesign-scope.md

@@ -38,7 +38,7 @@ The current hall is **one long single-column page** (`index.html`, `<main>` capp
 
 The eleven core widgets (from `hall-widgets.js`, by mount order): **Welcome, Path (onboarding), Standing (profile), Honours (8 laurels), Karma, Acclaim, Works (ships), Marks (grades), Curve (analytics), Bounty (red-team rewards), Roll (leaderboard)** — plus a **Goals** widget (`goals.js`).
 
-Separate full pages behind header links: **Work Board, Primer, Diagrams, Repo Atlas, Ranks, Settings, Pair**, plus Archon-only **Watch, Harbor, Gate**.
+Separate full pages behind header links: **Work Board, Primer, Diagrams, Repo Atlas, Ranks, Settings**, plus Archon-only **Watch, Gate**.
 
 The data and the registry seam stay. The redesign changes the **frame** the widgets live in.
 
@@ -99,7 +99,7 @@ Seven primary destinations plus a gated Admin group. Today's eleven scrolls coll
 | **Leaderboard** | Roll of the Foremost | Table view | signed-in |
 | **Docs** | Primer, Diagrams/maps, Repo Atlas | Doc pages + TOC | signed-in |
 | **Settings** | Settings (all panels) | Sub-nav + panels | signed-in |
-| **Admin ▾** | Watch, Harbor, Gate | Grouped, collapsed | **Archon only** |
+| **Admin ▾** | Watch, Gate | Grouped, collapsed | **Archon only** |
 
 > Rank/permission gating is **unchanged** — Xenos still don't see Work until graduation; Admin only unhides at `rank=archon`. The redesign moves *where* those links render (into the sidebar), not *whether* they gate.
 
@@ -152,7 +152,7 @@ Kept close to today's three-section structure (in-progress, claimable, history),
 
 ## 7. Surface · Settings — grouped panels
 
-Settings has the most sections today (~15: connections, dev box, box app, craft, display name, wandering, render, art key, CLI, voices, sounds, event sounds…). It gets its own left sub-nav so each group is a focused panel.
+Settings has the most sections today (~13: connections, craft, display name, wandering, render, art key, CLI, voices, sounds, event sounds…). It gets its own left sub-nav so each group is a focused panel.
 
 | Component | Type | Placement | Size |
 |---|---|---|---|
@@ -251,7 +251,7 @@ Not layout, but it rides along. Most of this already flows through the brand pac
 - Neutral default voice
 
 **Deferred**
-- Archon pages — Watch, Harbor, Gate (inherit shell only; internal layout unchanged)
+- Archon pages — Watch, Gate (inherit shell only; internal layout unchanged)
 - Rank-name copy decision
 - Public apex landing page (separate surface)
 

package/docs/file-map.md

@@ -94,7 +94,7 @@
 │   ├── <redacted>.sql ← /builder-exit: deactivated builders drop to 'xenos'
 │   ├── <redacted>.sql ← builders.preferred_disciplines column (enum renamed by mig 086)
 │   ├── 029_rank_three_live.sql  ← #360/ADR 0018: rank default thetes→xenos + tasks.xenos_claimable (three-rank model live)
-│   ├── 067_builder_boxes.sql    ← #598/ADR 0031: builder_boxes (per-builder dev box lifecycle state) + box_events ledger
+│   ├── 067_builder_boxes.sql    ← #598/ADR 0031: the per-builder dev box lifecycle tables; dropped by core_258 (ADR 0346)
 │   └── <redacted>.sql ← task 615: rename disciplines engineering→engineer, creative→artist|ideator; swaps both CHECK constraints + backfills tasks.discipline & builders.preferred_disciplines
 ├── modules/                    ← self-contained optional feature modules (ADR 0083 / docs/modules-contract.md). Each `modules/<key>/` is a full vertical slice — routes, migrations, skills, seam registrations — reached only through src/module-api.js. The loader discovers them at boot; no core file changes to add one.
 │   ├── game/                   ← the playable Example world — Phaser client, Colyseus rooms (WorldRoom/QueueRoom), world/terrain model, game DB tables, static assets. Moved BV1.R49 (task 1418). CLAUDE.md, module.json, routes/game.js, rooms/, world/, public/, migrations/.
@@ -149,7 +149,7 @@
 │       ├── gen-file-map.js      ← ADR 0066 ([#1276](https://example.com/builders#/task/1276)): generates the `.claude/skills/` + `.claude/scheduled-tasks/` sections of docs/file-map.md from disk; per-entry notes come from docs/file-map.notes.json; `--check` fails on drift OR a skill/routine with no note (CI gate via fitness.js); regenerated on deploy by ship.js regenerateFileMap()
 │       ├── spike-task-map.js    ← (task 1003282, goal 1000072) the task-network-map spike harness: builds a ~1,357-task graph across a swept dependency density, lays it out for real (<redacted> + Barnes-Hut), counts what decides readability (isolated nodes, components, distinguishable marks / overplot, crossings, ink budget, payload) and renders PNGs with a hand-rolled encoder. Zero deps, no DB. `--from <tasks.json>` measures the REAL corpus instead of the model. Verdict: docs/research/task-network-map-readability.md
 │       ├── fitness.js           ← Path C (ADR 0062 §9, [#1225](https://example.com/builders#/task/1225)): architecture fitness functions — core↔host import boundary (zero grandfathered exceptions as of R52/#1191), CLAUDE.md budget + nested-doc presence (ADR 0061), no route bypasses rank checks (reuses route-rank-check), repo-map freshness. Enforced in CI via tests/fitness.mjs (the `unit` gate). `node scripts/gds/fitness.js`
-│       ├── ship.js              ← resolve claim as shipped, award credits (`/builder-ship`); also uploads a secret-scrubbed session digest to the corpus (6D.1, ADR 0027); on a dev box runs the sandbox-first review gate before resolving (#927, ADR 0046)
+│       ├── ship.js              ← resolve claim as shipped, award credits (`/builder-ship`); also uploads a secret-scrubbed session digest to the corpus (6D.1, ADR 0027); runs the sandbox-first review gate before resolving when the checkout has a local game preview (#927, ADR 0046)
 │       ├── ship-visual.js       ← the OPTIONAL `--visual <image> [--visual-alt "…"]` leg of a ship (task 1003109): screens the file BEFORE the claim resolves (bad input costs no claim), uploads it AFTER (a failed picture never fails a ship)
 │       ├── package-core.js      ← package the core as a versioned, installable artifact + pin manifest (`bongos package-core`; R84, ADR 0100 §1, [#1688](https://example.com/builders#/task/1688)): isPublishable() selection + mirror redaction + fail-closed no-leak gate → dist/bongos-core-<version>.{tgz,manifest.json}; version = src/module-api CORE_VERSION. Recipe: docs/recipes/packaging-the-core.md
 │       ├── release-notes.js     ← what each core release brought in (task 1004218): generated at pack time from the ref's HISTORY into the package's release-notes.json (exact per-release ranges, 1 MiB bound; package-core redacts its prose like a doc), read back by the upgrade runner for a from→to range; home of the one merge-summary parser
@@ -208,7 +208,7 @@
 │   │   ├── catalog.js          ← the browsable module catalog model (ADR 0167 / ADR 0107 §2/§3): `source` (which TREE ships it — core package vs instance, read off the loader's discovery root) + resolved author/origin `credit` with an `inferred` flag. The ONE builder behind both `GET /api/bongos/modules` and `bongos module list --catalog`, so the hall + CLI can't drift.
 │   │   └── semver.js           ← minimal semver `satisfies(version, range)` used by the loader (no npm dep).
 │   ├── platform-server.js       ← BONGOS-ONLY entrypoint (ADR 0062 R51, task 1190): boots Express + the shared internal surface (API + hall + status) with NO game in the process; the inverse of preview-server.js. `node src/platform-server.js`
-│   ├── preview-server.js        ← GAME-ONLY entrypoint for the per-box sandbox (ADR 0052): Phaser/Colyseus + tiles, NO /api/bongos
+│   ├── preview-server.js        ← GAME-ONLY entrypoint for the local preview that `/builder-stage` runs (ADR 0052): Phaser/Colyseus + tiles, NO /api/bongos
 │   ├── seats.js                 ← in-process seat counter + EventEmitter
 │   ├── rooms/
 │   │   ├── WorldRoom.js         ← singleton room: move + interact + identity
@@ -221,8 +221,8 @@
 │   │   ├── routes.js            ← thin mounter — imports each routes/* sub-router + every enabled module's routes and stitches them behind kernel-composed auth
 │   │   ├── api-prefix.js        ← API_PREFIX ('/api/bongos') + LEGACY_API_PREFIXES ('/api/gds' permanent alias) + API_VERSION
 │   │   ├── api-path-404.js      ← recognize Bongos-API-shaped paths that missed the mount → JSON 404 + corrective hint (server.js catch-all; V4.R14, [#952](https://example.com/builders#/task/952))
-│   │   ├── serve-internal.js    ← (ADR 0062 R51, task 1190) the SHARED internal web surface: mountInternalSurfaces(app) wires /healthz + /version + /api/bongos + the Dev Box downloads + the status & builders hosts; called by BOTH server.js (game boot) and platform-server.js (Bongos-only) so the two never drift. Also injects clientBranding() as window.__BRANDING__ into the served hall/status HTML
-│   │   ├── routes/              ← one file per KERNEL feature so parallel branches stop colliding on routes.js — the domain routes (tasks/claims/versions/cost/leaderboard/memory/learnings/box/inbox/blockers/search/gate-approvals/discord/…) graduated with their domains into `modules/<key>/routes/`, reached only through the loader
+│   │   ├── serve-internal.js    ← (ADR 0062 R51, task 1190) the SHARED internal web surface: mountInternalSurfaces(app) wires /healthz + /version + /api/bongos + the `bongos` CLI downloads + the status & builders hosts; called by BOTH server.js (game boot) and platform-server.js (Bongos-only) so the two never drift. Also injects clientBranding() as window.__BRANDING__ into the served hall/status HTML
+│   │   ├── routes/              ← one file per KERNEL feature so parallel branches stop colliding on routes.js — the domain routes (tasks/claims/versions/cost/leaderboard/memory/learnings/inbox/blockers/search/gate-approvals/discord/…) graduated with their domains into `modules/<key>/routes/`, reached only through the loader
 │   │   │   ├── _helpers.js      ← validateOrRespond, parseId, LIMITS, asyncHandler, publicOrigin, corsPublicGet, parseCookie
 │   │   │   ├── healthz.js, auth.js, me.js, builders.js, instance.js
 │   │   │   ├── my-sessions.js   ← GET /me/sessions + POST /me/sessions/revoke{,-all} — the OWN-scoped session self-service (task 1003341, ADR 0206): see and kill your own sessions without an Archon. Kept apart from auth.js's admin-gated cross-builder pair so the no-caller-named-owner rule holds over a WHOLE file (tests/own_session_revoke.mjs)

package/docs/handoff-template.md

@@ -65,7 +65,7 @@ If even one of these is false, the claim is `[verified-smoke]` or `[implemented-
 
 ### Diagram backstop (task [#357](https://example.com/builders#/task/357); conceptual diagrams auto-generated [#436](https://example.com/builders#/task/436))
 
-If your change touched anything the onboarding diagrams describe — the **rank enum or which ranks are wired** (`requireRank`, `builders.rank` default, exit/assign paths), the **task-status set**, the **versions** (id/track/status), or the **complete-architecture** (the ADR 0024 memory chain + the dev-box → production ship flow) **/ example-karma** models (which now flip per the **shipped** status of their backing tasks) — then before shipping:
+If your change touched anything the onboarding diagrams describe — the **rank enum or which ranks are wired** (`requireRank`, `builders.rank` default, exit/assign paths), the **task-status set**, the **versions** (id/track/status), or the **complete-architecture** (the ADR 0024 memory chain + the machine → production ship flow) **/ example-karma** models (which now flip per the **shipped** status of their backing tasks) — then before shipping:
 
 - **All five diagrams are auto-generated** by `scripts/gds/gen-diagrams.js` — run it (`node scripts/gds/gen-diagrams.js`) and confirm the result looks right; **do not hand-edit any `.mmd`**. The mechanical three (`01-task-lifecycle`, `02-rank-ladder`, `05-versioning`) regenerate from migrations + the public version API. The conceptual two (`03-example-karma`, `04-architecture`) regenerate from the **authenticated** `/tasks/:id` status of their backing tasks (and 03's seeded-achievement count); if no session is present the generator skips them cleanly. Rendering produces both `.svg` (the pannable viewer asset) and `.png` (fallback).
 - To change a diagram's **layout or wording**, edit the matching template function in `gen-diagrams.js` — not the `.mmd`. `assertions.json` is rebuilt by the generator in lockstep, so you don't hand-maintain it.

package/docs/module-api-changelog.md

@@ -2637,5 +2637,11 @@ is load-bearing: the script throws rather than guess if it is missing, and
         landed since 1.19.1073 with no explicit bump. run 36510198162. (task 1002620)
   1.19.1075 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
         landed since 1.19.1074 with no explicit bump. run 36512197709. (task 1002620)
+  (note, no bump) — auth.allowBoxScope is now a deprecated no-op (task 1003894).
+        The narrowing session scope it opted a route into, and the three box.*
+        permissions, were removed with the dev box (ADR 0346). The export is kept so
+        the doorway loses nothing inside 1.x; it goes at the next MAJOR.
+  1.19.1076 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+        landed since 1.19.1075 with no explicit bump. run 36523068301. (task 1002620)
 ---------------------------------------------------------------------------
 ```

package/docs/modules-contract.md

@@ -1,7 +1,7 @@
 # The module plugin-API contract (`src/module-api.js` + `modules/*/`)
 
 > **Decision record:** [ADR 0083](adr/0083-modular-architecture-strangler-build-plan.md) — the build plan.
-> **Live state:** the shipped modules under `modules/` are the four feature modules `dev-box`, `game`, `discord`, `art-pipeline` (+ `character-anim`, declaration-only; ADR 0088) and the carved core-domain modules `memory` (R72), `grading` (R73), `economy` (R77), `ideas` (R78), `security` (R79), `builder-settings` (R80), `onboarding` (R81), and `sessions` (R82) — see [ADR 0093](adr/0093-tranche-2-core-carve-sequence.md) for the remaining carve sequence.
+> **Live state:** the shipped modules under `modules/` are the three feature modules `game`, `discord`, `art-pipeline` (+ `character-anim`, declaration-only; ADR 0088) and the carved core-domain modules `memory` (R72), `grading` (R73), `economy` (R77), `ideas` (R78), `security` (R79), `builder-settings` (R80), `onboarding` (R81), and `sessions` (R82) — see [ADR 0093](adr/0093-tranche-2-core-carve-sequence.md) for the remaining carve sequence.
 > **Author a new module:** jump to [the module-author recipe](#module-author-recipe).
 
 The module system turns optional features into self-contained directories. Adding a feature is "drop `modules/<key>/`"; the loader discovers, validates, and mounts it — no core file changes. The **one-way rule** is the load-bearing invariant:
@@ -19,7 +19,7 @@ Two fitness checks enforce it on every build — a violation is a red CI gate, n
 ## The cut: core vs modules
 
 - **Core** is the trust kernel + the lifecycle state machine + the domains not yet carved: auth/identity/audit/rank (the kernel, [ADR 0091](adr/0091-bounding-the-kernel-and-db-carve.md) §1), the lifecycle (tasks, claims, versions, done-when, ship — never split), and the still-core domains (autonomy/MAS, the two web UIs) plus always-on infra (analytics, audit-log, gate-approvals, healthz, public). The remaining tranche-2 domains carve out per [ADR 0093](adr/0093-tranche-2-core-carve-sequence.md) §1; the lifecycle stays core. (Sessions/BFG — the `session_records` corpus + data plane + the BFG scorer + session-pulse — carved to `modules/sessions/` at R82; like `memory` it registers no port and core never calls back in. The per-claim `session_logs` ship LOG + `builder_sessions` auth tokens stay core.)
-- **Modules** are optional features an instance turns on via `config/modules.json` or env (the feature modules `dev-box`, `game`, `discord`, `art-pipeline`, `character-anim`), plus the **core-domain modules** that are `default: true` (always on unless disabled): `memory` (R72), `grading` (R73), `economy` — credits/cost/streaks/achievements/leaderboard (R77), `ideas` — inbox/capture/triage/blockers (R78), `security` — red-team reports + bounty (R79), `builder-settings` — wandering/skill/sound/render prefs + builder-needs (R80), `onboarding` — admission/onboarding-state/newcomer-restock (R81), and `sessions` — session_records corpus + BFG + session-pulse (R82). Each is a self-contained directory under `modules/<key>/`.
+- **Modules** are optional features an instance turns on via `config/modules.json` or env (the feature modules `game`, `discord`, `art-pipeline`, `character-anim`), plus the **core-domain modules** that are `default: true` (always on unless disabled): `memory` (R72), `grading` (R73), `economy` — credits/cost/streaks/achievements/leaderboard (R77), `ideas` — inbox/capture/triage/blockers (R78), `security` — red-team reports + bounty (R79), `builder-settings` — wandering/skill/sound/render prefs + builder-needs (R80), `onboarding` — admission/onboarding-state/newcomer-restock (R81), and `sessions` — session_records corpus + BFG + session-pulse (R82). Each is a self-contained directory under `modules/<key>/`.
 
 ---
 
@@ -34,7 +34,7 @@ The **only** core file a module may `require`. It re-exports the kernel capabili
 | `allowBoxScope` | **Deprecated no-op** (task 1003894): the narrowing session scope it opted a route into was retired, and a session of an undeclared source is now denied on every route regardless. Kept so the doorway loses no export inside 1.x; drop at the next MAJOR. |
 | `pool` | The shared Postgres pool. A module owns its `<key>_*` tables via its migrations. |
 | `instanceDbName` | The resolved DB name (from branding). |
-| `db` | Kernel-managed DB helpers (`getBuilderById`, `setBuilderBoxBlocked`, `getBuilderGeminiKeyRow`, `setBuilderGeminiKey`, `clearBuilderGeminiKey`, `insertAuditLog`, `createTask`). Grow this additive-only. |
+| `db` | Kernel-managed DB helpers (`getBuilderById`, `getBuilderGeminiKeyRow`, `setBuilderGeminiKey`, `clearBuilderGeminiKey`, `insertAuditLog`, `createTask`). Grow this additive-only. |
 | `branding` | The branding contract resolver — the resolved instance strings. |
 | `instanceConfig` | Module enablement config + env override resolution. |
 | `seams` | The seam registry (`registerProvider`, `hasProvider`, `resolve`, `resolveOptional`, `emit`, `on`) — how modules cooperate without importing each other. |
@@ -76,12 +76,12 @@ Every module must have a `module.json` at its root (`modules/<key>/module.json`)
 
 ```jsonc
 {
-  "key":         "dev-box",           // REQUIRED. ^[a-z][a-z0-9-]*$ — must match the dir name.
-  "title":       "Dev boxes",         // REQUIRED. Human label.
+  "key":         "discord",           // REQUIRED. ^[a-z][a-z0-9-]*$ — must match the dir name.
+  "title":       "Discord",           // REQUIRED. Human label.
   "description": "…",                 // REQUIRED. One sentence.
   "version":     "1.0.0",             // REQUIRED. The module's OWN exact version "X.Y.Z" (not a range) —
                                       //   what update, rollout channels and re-assessment name (task 1003781).
-  "coreVersion": "^1.2.0",           // REQUIRED. semver range of CORE_VERSION this module supports.
+  "coreVersion": "^1.4.0",           // REQUIRED. semver range of CORE_VERSION this module supports.
   "default":     false,               // OPTIONAL (default false). Fail-safe when no config names it.
   "author":      "…",                 // OPTIONAL. Attribution (ADR 0107 §2) — portable, not a cross-Bongos FK.
   "origin":      "…",                 // OPTIONAL. Origin instance/project this module was built in.
@@ -95,12 +95,12 @@ Every module must have a `module.json` at its root (`modules/<key>/module.json`)
     "note":        "…"                //   OPTIONAL. The path out, in one sentence.
   },
   "contributes": {                    // REQUIRED object (may be empty {}).
-    "routes":      ["box"],           //   route-factory files in routes/ (one export = () => Router())
+    "routes":      ["discord"],       //   route-factory files in routes/ (one export = () => Router())
     "rooms":       ["WorldRoom"],     //   Colyseus room classes (game module only)
-    "pollers":     ["box-lifecycle"], //   background pollers (start/stop lifecycle)
+    "pollers":     ["discord-bot"],   //   background pollers (start/stop lifecycle)
     "disciplines": ["artist"],        //   builder disciplines this module adds
     "skills":      ["otb-tile-generate"], // slash-command skills it ships
-    "uiSections":  ["boxes"],         //   hall/status UI sections gated by window.__MODULES__. Ship public/hall-widget.js
+    "uiSections":  ["task-where"],    //   hall/status UI sections gated by window.__MODULES__. Ship public/hall-widget.js
                                       //   and it is injected into the hall index; ship public/task-widget.js and it
                                       //   is injected into a task's page before task.js, to fill #task-contrib on
                                       //   `otb:task-shown` (task 1004301). The page itself names no module.
@@ -109,7 +109,7 @@ Every module must have a `module.json` at its root (`modules/<key>/module.json`)
                                                             // apex root (ADR 0218). One or the other, never both.
     "migrations":  true               //   true → modules/<key>/migrations/*.sql applied if enabled
   },
-  "provides": ["box.hasEverConnected"], // OPTIONAL. Seam PORTS this module registers a provider for.
+  "provides": ["discord.isLinked"],     // OPTIONAL. Seam PORTS this module registers a provider for.
   "consumes": [],                       // OPTIONAL. Seam ports this module resolves (required caps).
   "prerequisites": { "modules": [] },   // OPTIONAL. Other modules that must be enabled first.
   "spend": { "requiresPayer": true },   // OPTIONAL. This module spends MONEY for whoever calls it.
@@ -196,7 +196,7 @@ The loader is safe-by-construction: with no `modules/` dir it returns empty and
 env override  →  config/modules.json  →  config/modules.neutral.json  →  manifest.default (false)
 ```
 
-Env override key: `<envPrefix>_MODULE_<NAME>` (`NAME` = upper-snake of the key; `dev-box` → `DEV_BOX`). Example: `OTB_MODULE_DISCORD=0`.
+Env override key: `<envPrefix>_MODULE_<NAME>` (`NAME` = upper-snake of the key; `npm-release` → `NPM_RELEASE`). Example: `OTB_MODULE_DISCORD=0`.
 
 A fresh instance with **no** config resolves to **vanilla**: every module off (fail-to-vanilla).
 
@@ -218,7 +218,6 @@ A module calls `api.seams.emit(eventName, payload)` to broadcast. Any module tha
 
 | Port / Event | Provider | Consumer(s) | Contract |
 |---|---|---|---|
-| Port: `box.hasEverConnected` | `dev-box` | core `routes/me.js`, `routes/builders.js` | `(builderId) → Promise<bool>` — whether the builder's box has ever connected. Core reads via `resolveOptional(…, async () => false)` so onboarding degrades cleanly on a box-less instance. |
 | Port: `game.staticRoot` | `game` | `server.js` static-serve | `() → string` — absolute path to the game's static root. |
 | Port: `game.registerRooms` | `game` | `server.js` Colyseus setup | `(matchMaker) → void` — registers WorldRoom + QueueRoom. |
 | Port: `game.precreateWorldRoom` | `game` | `server.js` pre-create step | `(matchMaker) → Promise<void>` — pre-creates the singleton room. |
@@ -230,7 +229,6 @@ A module calls `api.seams.emit(eventName, payload)` to broadcast. Any module tha
 | Port: `security` | `security` (R79) | core `routes/public.js` (`/public/bounty-table`) | `{ bountyTableDetailed(), bountyTable() }` — the env-aware red-team bounty payout schedule. Core reads via `resolveOptional('security').bountyTableDetailed()` instead of importing the module (security is default-on; only <redacted> moved — [ADR 0093](adr/0093-tranche-2-core-carve-sequence.md) §1, [02-module-map §5](design/modular-architecture/02-module-map.md)). |
 | Port: `builder-settings` | `builder-settings` (R80) | core `routes/me.js` (`GET /me`) + `cascade-dispatch.js` | `{ getBuilderBehaviorPrefs, describeWandering, describeRender, computeNeeds, skillCeiling }` — the per-builder prefs read surface. The `GET /me` aggregator resolves it for its wandering/render/needs slices; the dormant cascade router for the skill ceiling. Default-on; degrades gracefully when off ([ADR 0093](adr/0093-tranche-2-core-carve-sequence.md) §1, [02-module-map §2](design/modular-architecture/02-module-map.md)). |
 | Port: `onboarding` | `onboarding` (R81) | the lifecycle (`db.js` claim/ship — transaction-participant `markStage`) + `auth.js` + `routes/me.js`/`builders.js`/`tasks.js`/`claims.js` | `{ getState, shapeForApi, safeMarkStage, markStage, broadcastGraduation, restockForClaim, restockAll, SOURCE_TAG }` — the onboarding state-machine + newcomer-restock surface. The FIRST core→module port the lifecycle ticks inside its own txn (alongside `reward`). Default-on; degrades to best-effort no-ops when off ([ADR 0093](adr/0093-tranche-2-core-carve-sequence.md) §1). |
-| Event: `builder.box-reconcile-needed` | core `db.js` (on rank change / deactivate / auto-graduation) | `dev-box` | `{ builderId, rank, status, actor }` — flags the box for reconciliation. |
 | Event: `builder.secrets-scrub-needed` | core `db.js` (`deactivateBuilder`) | `art-pipeline` (when installed) | `{ builderId, actor }` — task 1003338 / [ADR 0332](adr/0332-offboarding-secret-scrub-semantics.md): best-effort teardown port for a MODULE-owned builder-keyed secret (today: the Gemini BYOK key, `gemini_key_enc`/`last4`/`set_at`). Core does not write those columns directly (ADR 0102) — the module listens and clears its own store. `github_oauth_tokens` (core-owned) is deleted synchronously inside `deactivateBuilder`'s transaction instead, no event needed. |
 
 ---
@@ -264,7 +262,6 @@ Rules (enforced by the `BV1.R45` fitness check):
 
 | Module | `contributes` | Seam ports | `coreVersion` |
 |---|---|---|---|
-| **`dev-box`** | routes: `box`; pollers: `box-lifecycle`; uiSections: `boxes` | provides `box.hasEverConnected`; listens `builder.box-reconcile-needed` | `^1.2.0` |
 | **`game`** | routes: `game`; rooms: `WorldRoom`/`QueueRoom` | provides `game.staticRoot`, `game.registerRooms`, `game.precreateWorldRoom` | `^1.4.0` |
 | **`discord`** | routes: `discord`, `bug-attachments`; pollers: `discord-bot` | provides `discord.isLinked`; consumes `ideas.capture` | `^1.4.0` |
 | **`art-pipeline`** | routes: `art-key`; disciplines: `artist`; skills: `otb-tile-generate` etc.; uiSections: `art` | provides `art.sharedKeyConfigured` | `^1.3.0` |