@bongos/core 1.19.1075 → 1.19.1076

package/docs/recipes/bongos-cli-release.md

@@ -2,8 +2,7 @@
 
 How the compiled `bongos` binaries get built, published, and installed — the
 "no Node, no repo" on-ramp (task [#1248](https://example.com/builders#/task/1248), V4.R81).
-Mirrors the release flow the retired Dev Box app used:
-**CI builds, the operator publishes to a public releases repo, the server serves
+The release flow: **CI builds, the operator publishes to a public releases repo, the server serves
 branded redirects.** There is no cross-repo write token in CI — publishing is a
 deliberate operator step.
 

package/docs/recipes/multi-builder-merge.md

@@ -1,6 +1,6 @@
 # Multi-builder merge safety — audit + serialization model
 
-> **Deploy-mode note (current state).** This recipe documents the **`laptop`** merge path (operator merges `main` + SSHes the droplet). Since the 2026-06-13 cutover `config/deploy.json` is **`mode: ci`** — the merge + deploy run **server-side** (PR auto-merge + `.github/workflows/deploy-prod.yml`), and credential-less dev boxes ship via server-mediated publish ([ADR 0055](../adr/0055-server-mediated-branch-publish.md)). The local-`main`-worktree + merge-lock model below applies only if `deploy.json` is reverted to `mode: laptop`.
+> **Deploy-mode note (current state).** This recipe documents the **`laptop`** merge path (operator merges `main` + SSHes the droplet). Since the 2026-06-13 cutover `config/deploy.json` is **`mode: ci`** — the merge + deploy run **server-side** (PR auto-merge + `.github/workflows/deploy-prod.yml`), and a checkout with no GitHub push credential ships via server-mediated publish ([ADR 0055](../adr/0055-server-mediated-branch-publish.md)). The local-`main`-worktree + merge-lock model below applies only if `deploy.json` is reverted to `mode: laptop`.
 
 > **Task:** V3.R50 / [#269](https://example.com/builders#/task/269) (criterion **C6 — parallel-safe-under-load**).
 > **Question it answers:** when N>1 builders ship and merge concurrently, where do `ship.js` and `/merge-mode` assume "I am the only builder," and what serializes the shared state so they don't collide?

package/docs/recipes/ops-gotchas.md

@@ -282,15 +282,6 @@ Inside the namespace the file lists as `---------- 1 root root 0`. The runner un
 
 ---
 
-## Dev box
-
-### `bypassPermissions` "still not available" even though the box was provisioned for it (task 2022)
-
-- **Symptom:** you reconnect to the browser terminal (or SSH) on a dev box and `claude` still stops for permission prompts, even though tasks [#1251](https://example.com/builders#/task/1251) and [#1314](https://example.com/builders#/task/1314) default every box to `bypassPermissions`.
-- **Root cause:** `otb-box-launch.sh` (behind `box-terminal.service`) only ever runs `claude` once — the first time it creates the tmux `otb` session. Every later connect just reattaches to that **same running process**. The `defaultMode=bypassPermissions` setting is written into `~/.claude/settings.json` by `box-source-fetch.sh`'s cron, on its own `*/10` schedule (and, on an already-provisioned box, only after that box's baked copy of the script has self-updated to even contain the fix). If the `otb` tmux session got created before that write landed — an older box, or a fresh box whose very first connect raced the first cron tick — `claude` started once in normal `auto` mode and is stuck there for the life of the box; reconnecting never re-launches it, so the fix never takes effect even once the setting is correct on disk. (Flagged as an open follow-up in [ADR 0104](../adr/0104-trust-gds-api-channel-in-auto-mode.md).)
-- **Fix:** `otb-box-launch.sh` now asserts `defaultMode=bypassPermissions` itself, synchronously, right before it creates a **new** `otb` tmux session — so a fresh session never depends on cron timing. This prevents the race going forward but does **not** repair a box whose `otb` session is already running in the wrong mode: for that, from an SSH/browser-terminal shell run `tmux kill-session -t otb` then reconnect (the launcher creates a fresh session and picks up the corrected setting immediately). Killing the session only drops the terminal pane — it does not touch `/workspace` or in-flight git state.
-- **Why it bites:** every layer *looks* fixed — `~/.claude/settings.json` has the right value, `IS_SANDBOX=1` is set — because you're inspecting the box's filesystem, not the already-running process that never re-read it.
-
 ## New-project scaffolds & the core pin (gap 13 · task 1002706 · ADR 0168)
 
 ### Do NOT set `PROVISION_CORE_FROM_REGISTRY=1` on the box until the core package goes public

package/docs/recipes/self-host.md

@@ -12,7 +12,7 @@ docker compose up
 
 That builds the image, starts Postgres, applies the build-system migrations (game-module migrations are skipped — this is a Bongos-only instance), and serves the builders' hall at **http://localhost:3000**.
 
-- The instance is **vanilla** by default: the neutral Cloud Bongos brand, every feature module (game, art pipeline, Discord, dev boxes) **off**. `.dockerignore` keeps the host's `config/branding.json` and `config/modules.json` out of the image, so it resolves to `config/branding.neutral.json` + `config/modules.neutral.json`.
+- The instance is **vanilla** by default: the neutral Cloud Bongos brand, every feature module (game, art pipeline, Discord) **off**. `.dockerignore` keeps the host's `config/branding.json` and `config/modules.json` out of the image, so it resolves to `config/branding.neutral.json` + `config/modules.neutral.json`.
 - **No OTB scope-truth is seeded.** OTB/product data (game versions, goals, done-when criteria) lives in opt-in seed migrations under `migrations/instance/` (plus a few guarded blocks in the mixed files 003/006). `scripts/migrate.sh` skips them unless `GDS_APPLY_INSTANCE_SEEDS=1`, so a fresh DB comes up with only the schema and platform-universal defaults (ranks, achievements) — no crash, no foreign-key failures, no leftover versions. Platform system principals (`bfg-system`, `discord-bot-system`) are generic and remain. See task 1704 / [ADR 0105](../adr/0105-instance-seed-migrations-out-of-core.md).
 - **No prod topology** is referenced: the database is a local container, the credentials are local demo values, and the app reaches Postgres over TCP via `PG*` env (see `docker-compose.yml`).
 

package/docs/recipes/windows-builders.md

@@ -227,7 +227,7 @@ here, suspect these before assuming the platform is at fault:
   is a short path (`C:\Users\RUNNER~1\…`), `os.tmpdir()` keeps the short form while git and the
   shell answer with the long one — so two spellings of one directory compare unequal. This alone
   explained failures in `ship_preflight`, `migrate_root_resolution` and `sandbox_stage`, and the
-  last of those was a genuine bug: the dev box would have git-synced a checkout onto itself.
+  last of those was a genuine bug: the since-retired dev box ([ADR 0346](../adr/0346-dev-boxes-are-retired.md)) would have git-synced a checkout onto itself.
 - **A REPO-relative path must be POSIX on every platform** — it goes into a task's `touches[]`, a
   version row, or a generated manifest. `path.join`/`path.relative` emit `\` here. Use
   `path.posix.*`, or the house spelling `.split(path.sep).join('/')`. This was the bug in

package/migrations/core_258_drop_dev_box_tables.sql

@@ -46,6 +46,9 @@ DROP TABLE IF EXISTS builder_boxes;
 DROP TABLE IF EXISTS box_intents;
 DROP TABLE IF EXISTS builder_ssh_keys;
 
+-- claims.creator_session_id REFERENCES builder_sessions with no ON DELETE, so unlink box sessions first (task 1004362).
+UPDATE claims SET creator_session_id = NULL
+  WHERE creator_session_id IN (SELECT id FROM builder_sessions WHERE source = 'box');
 DELETE FROM builder_sessions WHERE source = 'box';
 ALTER TABLE builder_sessions
   DROP CONSTRAINT IF EXISTS builder_sessions_source_check;

package/modules/hall-ui/public/palette.js

@@ -9,7 +9,7 @@
 // Progressive enhancement is the contract: a page that does not load palette.js
 // keeps a hidden slot and no key handler, and nothing in shell.js calls in here.
 //
-// The index is CLIENT-SIDE ONLY (no new server surface, task 2178 scope):
+// The index has three CLIENT-SIDE layers (task 2178 scope):
 //   1. Pages — read live from the sidebar shell.js rendered, so rank + module
 //      gating come for free and can never drift from the nav. A hidden nav item
 //      is a hidden destination. (Cosmetic only; the server still gates each page.)
@@ -17,12 +17,33 @@
 //      cannot be read from another page's DOM, so they are declared below and
 //      held to the real ids by tests/hall_palette.mjs.
 //   3. Records — id syntax: `1234`, `g 12`, `b 7`, `i 42`.
-// Full-text search over tasks/docs is phase 2 — it needs a server surface.
+// PLUS one server-backed layer (task 1003460): typing prose (3+ chars, debounced,
+// per-open memoized) asks POST /api/bongos/search { source_kind: 'db' } — the
+// rank/owner-scoped recall layer (ADR 0060) that already indexes every
+// task/idea/blocker/doc, and had zero hall consumers before this. Content hits
+// are merged in ON TOP of the synchronous local compute() — never replacing it —
+// which is what keeps this progressive enhancement: a slow, failed, or killed
+// endpoint just means the merge never happens, and nav-jump/id-resolution/
+// page-jump (all pure, all local) are completely unaffected. Only source_refs
+// this palette can actually ROUTE to are surfaced (task/idea/blocker today — see
+// contentEntry) — a doc/session-log/commit hit is real prose the endpoint found,
+// but the hall has no page to jump to for it, and a palette row that goes
+// nowhere on Enter is worse than not showing it.
 (function () {
   'use strict';
 
   var PALETTE_ID = 'jump-palette';
   var MAX_RESULTS = 40;
+  var SEARCH_MIN_LEN = 3;       // 1-2 chars is websearch_to_tsquery's least selective case (falls through
+                                 // to the unindexed trigram leg AND a zero-result corpusHealth() probe) —
+                                 // not worth a round trip on the palette's most common input length.
+  var SEARCH_DEBOUNCE_MS = 300; // paced against searchRateLimit (60/min/builder, modules/memory/routes/
+                                 // search.js) — a builder typing a phrase word-by-word still fires a
+                                 // handful of requests, not one per keystroke.
+  var SEARCH_LIMIT = 8;
+  var SEARCH_TITLE_MAX = 120;   // an indexed title is write-once ledger data — cap it before it's markup.
+  var SEARCH_CACHE_MAX = 30;    // per-open memo (cleared on open()) so retyping a prefix replays the
+                                 // last response instead of re-issuing an identical search.
 
   // Sub-destinations, grouped by the nav item that owns them. `gate` names the
   // element whose visibility decides whether the group is offered — the nav item
@@ -79,6 +100,10 @@
   var results = [];
   var cursor = 0;
   var lastFocus = null;
+  var searchSeq = 0;      // bumped on every keystroke/close — invalidates in-flight requests
+  var searchTimer = null;
+  var searchAbort = null; // the in-flight request's AbortController, if the runtime has one
+  var searchCache = {};   // query (trimmed+lowercased) -> raw hits[], this OPEN only
 
   function esc(s) {
     return String(s == null ? '' : s).replace(/[&<>"']/g, function (c) {
@@ -153,6 +178,116 @@
     return null;
   }
 
+  // V4 (docs/voice.md): a dash is banned in copy this project QUOTES, not copy it
+  // authors, enforced by normalising at render — never by editing the ledger. A
+  // task/idea/blocker title is exactly that quoted case. Same normalisation as
+  // modules/public-landing/public/index.html's cleanTitle() / goal-inbox.js's.
+  function cleanTitle(raw) {
+    return String(raw == null ? '' : raw)
+      .replace(/\s*[—–]\s*/g, ', ')
+      .replace(/,\s*,/g, ',')
+      .replace(/\s*\([^()]*\)\s*$/, '')
+      .replace(/[\s,]+$/, '')
+      .trim();
+  }
+
+  function truncate(s, max) {
+    s = String(s == null ? '' : s);
+    return s.length > max ? s.slice(0, max - 1).trim() + '…' : s;
+  }
+
+  // Map one POST /search hit to a palette entry, or null when this palette has
+  // nowhere to send the reader for that kind of hit (see the header note). Only
+  // source_kind='db' rows carry a source_ref this palette recognizes today —
+  // task/idea/blocker, the same three id-syntax already resolves in recordEntry.
+  // Scoping (rank + owner) is entirely the endpoint's (ADR 0016/0060) — this is
+  // presentation only, never a second filter.
+  function contentEntry(hit) {
+    if (!hit || hit.source_kind !== 'db') return null;
+    var ref = String(hit.source_ref || '');
+    var label = function (fallback) { return truncate(cleanTitle(hit.title) || fallback, SEARCH_TITLE_MAX); };
+    var m = ref.match(/^task:(\d+)$/);
+    if (m) return { label: label('Task ' + m[1]), group: 'Content', href: '/task/' + m[1] };
+    m = ref.match(/^idea:(\d+)$/);
+    if (m) return { label: label('Idea ' + m[1]), group: 'Content', href: '#/idea/' + m[1], overlay: true };
+    m = ref.match(/^blocker:(\d+)$/);
+    if (m) return { label: label('Blocker ' + m[1]), group: 'Content', href: '#/blocker/' + m[1], overlay: true };
+    return null;
+  }
+
+  // Merge raw /search hits into the rendered results, deduped by destination
+  // href against whatever's already showing (a local id-syntax match resolving
+  // the same task, or an earlier merge). MAX_RESULTS is the same ceiling the
+  // local pool is held to.
+  function mergeHits(hits) {
+    var seen = {};
+    results.forEach(function (e) { seen[e.href] = true; });
+    var added = [];
+    hits.forEach(function (hit) {
+      var e = contentEntry(hit);
+      if (e && !seen[e.href]) { seen[e.href] = true; added.push(e); }
+    });
+    if (!added.length) return;
+    results = results.concat(added).slice(0, MAX_RESULTS);
+    render();
+  }
+
+  // Debounced remote leg. Fires at most once per SEARCH_DEBOUNCE_MS of typing,
+  // and every keystroke invalidates whatever was scheduled/in-flight before it
+  // (searchSeq, plus actually aborting the request in flight so a superseded
+  // query doesn't keep FTS/trgm work running server-side) so a slow response
+  // for a stale query can never land after a newer one, or after the palette
+  // closed. A failed fetch (network error, a non-2xx, an abort, or `fetch` just
+  // not existing) resolves to nothing being appended — the synchronous local
+  // compute() already rendered, so the palette degrades to exactly today's
+  // behaviour, never an error state.
+  function scheduleSearch(query) {
+    if (searchTimer) { clearTimeout(searchTimer); searchTimer = null; }
+    if (searchAbort) { searchAbort.abort(); searchAbort = null; }
+    searchSeq++;
+    var mySeq = searchSeq;
+    var q = String(query || '').trim();
+    var key = q.toLowerCase();
+    if (q.length < SEARCH_MIN_LEN) return;
+    if (Object.prototype.hasOwnProperty.call(searchCache, key)) { mergeHits(searchCache[key]); return; }
+    if (typeof fetch !== 'function') return;
+    searchTimer = setTimeout(function () { runSearch(q, key, mySeq); }, SEARCH_DEBOUNCE_MS);
+  }
+
+  function cacheHits(key, hits) {
+    // Unbounded within one open() would leak for a palette left open a long
+    // time; this is a per-open convenience, not a durable cache, so just drop
+    // the oldest entry rather than a real LRU.
+    var keys = Object.keys(searchCache);
+    if (keys.length >= SEARCH_CACHE_MAX) delete searchCache[keys[0]];
+    searchCache[key] = hits;
+  }
+
+  function runSearch(q, key, mySeq) {
+    var controller = typeof AbortController === 'function' ? new AbortController() : null;
+    searchAbort = controller;
+    fetch('/api/bongos/search', {
+      method: 'POST',
+      credentials: 'same-origin',
+      headers: { 'Content-Type': 'application/json' },
+      body: JSON.stringify({ q: q, limit: SEARCH_LIMIT, source_kind: 'db' }),
+      signal: controller ? controller.signal : undefined,
+    }).then(function (r) {
+      return r && r.ok ? r.json() : null;
+    }).then(function (data) {
+      if (searchAbort === controller) searchAbort = null;
+      // Stale (a newer keystroke/search ran) or the palette closed meanwhile.
+      if (mySeq !== searchSeq || !isOpen()) return;
+      if (!data || !Array.isArray(data.results)) return;
+      cacheHits(key, data.results);
+      mergeHits(data.results);
+    }).catch(function () {
+      if (searchAbort === controller) searchAbort = null;
+      // Fail-open: killing the endpoint (or aborting a superseded request)
+      // leaves the palette exactly as useful as today.
+    });
+  }
+
   function compute(q) {
     var query = String(q || '').trim().toLowerCase();
     var rec = recordEntry(query);
@@ -227,6 +362,7 @@
       results = compute(input.value);
       cursor = 0;
       render();
+      scheduleSearch(input.value);
     });
     listEl.addEventListener('click', function (ev) {
       var li = ev.target.closest ? ev.target.closest('[data-i]') : null;
@@ -249,6 +385,7 @@
   function open() {
     if (!root) build();
     if (isOpen()) return;
+    searchCache = {}; // a fresh open may see DB state the last one didn't
     lastFocus = document.activeElement;
     root.hidden = false;
     document.documentElement.classList.add('palette-open');
@@ -261,6 +398,9 @@
 
   function close() {
     if (!isOpen()) return;
+    if (searchTimer) { clearTimeout(searchTimer); searchTimer = null; }
+    if (searchAbort) { searchAbort.abort(); searchAbort = null; }
+    searchSeq++; // invalidate any pending/in-flight search
     root.hidden = true;
     document.documentElement.classList.remove('palette-open');
     if (lastFocus && lastFocus.focus) lastFocus.focus();
@@ -297,5 +437,5 @@
     if (kbd) kbd.textContent = isMac ? '⌘K' : 'Ctrl K';
   }
 
-  window.OTBPalette = { open: open, close: close, isOpen: isOpen, compute: compute };
+  window.OTBPalette = { open: open, close: close, isOpen: isOpen, compute: compute, contentEntry: contentEntry };
 })();

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.1075",
+  "version": "1.19.1076",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.19.1075",
+      "version": "1.19.1076",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.1075",
+  "version": "1.19.1076",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/release-notes.json

@@ -7827,5 +7827,27 @@
       "id": "1003897",
       "text": "Cleanup: the code, tests and settings no longer describe the dev box as if it still existed, and seven code-quality limits are tightened to today's better numbers. Nothing changes for builders."
     }
+  ],
+  "1.19.1076": [
+    {
+      "id": "1004363",
+      "text": "Fixed the test that was still stopping new releases. It created a sample task without saying what kind of work it was, which the database no longer allows. With it fixed, the release carrying the database fix can go out, and t"
+    },
+    {
+      "id": "1003460",
+      "text": "Ctrl-K now searches the project's memory: typing prose merges in matching tasks/ideas/blockers from the existing recall search endpoint, debounced and gracefully degrading if the endpoint is ever unavailable — jumping by id, p"
+    },
+    {
+      "id": "1003899",
+      "text": "The dev box can't quietly come back: an automated check now fails the build if its code, tables, permissions or files reappear, and points whoever tripped it to the decision record that explains why."
+    },
+    {
+      "id": "1004362",
+      "text": "Fixed the database update that kept making the site upgrade roll back. It tried to delete old dev-box logins while one past task claim still pointed at one of them, and the database refused. The update now clears that pointer"
+    },
+    {
+      "id": "1003898",
+      "text": "The dev box's removal is written up in one decision record (ADR 0346), and the 20 older records that described it now point there. The live guides, the design mockups and the README no longer tell anyone to use a dev box."
+    }
   ]
 }

package/scripts/gds/dev-box-guard.js

@@ -0,0 +1,165 @@
+#!/usr/bin/env node
+// scripts/gds/dev-box-guard.js — the dev box stays retired (task 1003899, goal
+// 1000120; ADR 0346).
+//
+// WHY. The dev box was removed across a dozen areas: a module, a third of it
+// leaked into the core, four tables, a session source, three permissions, a CLI,
+// a desktop app, hall pages. A removal spread that wide rots back in one careless
+// import, fixture or copied migration. This is the ratchet that holds it: every
+// tracked file outside the historical record is scanned for the retired names,
+// and any hit fails CI with a pointer to ADR 0346, so the next builder learns WHY
+// and not only THAT.
+//
+// WHAT COUNTS, narrowly — each rule names a thing that only ever meant the box:
+//   • module-key     the key `dev-box` used AS A KEY: quoted ('dev-box', "dev-box",
+//                    `dev-box`) or as a path segment (modules/dev-box/). Matched
+//                    with fitness-lib's delimited-token matcher, so `dev-boxes`
+//                    and an ADR filename like 0072-dev-box-code-… never hit. Prose
+//                    ("the dev-box removal") is deliberately not a key.
+//   • identifier     the dropped tables and columns: builder_boxes, box_intents,
+//                    box_events, builder_ssh_keys, box_blocked*.
+//   • permission     a quoted permission key of the retired `box.*.*` family.
+//   • session-source a session `source` compared or assigned to 'box'.
+//   • path           a tracked file under scripts/gds/box*, infra/box-*,
+//                    modules/dev-box/ or .devcontainer/.
+// "box" alone is NOT a rule: it also means a server (the co-hosting box, box.env).
+
+'use strict';
+
+const fs = require('fs');
+const path = require('path');
+const { execFileSync } = require('node:child_process');
+const { keyTokenRe } = require('./fitness-lib.js');
+
+const REPO_ROOT = path.resolve(__dirname, '..', '..');
+const ADR = 'docs/adr/0346-dev-boxes-are-retired.md';
+const NAME = 'the dev box stays retired (ADR 0346)';
+
+// THE EXEMPTION LIST — the one place a file may still name the box. Each entry is
+// `path-or-prefix` → why. A prefix ends in '/'. Keep reasons about the file's
+// PURPOSE, never about what the tree happens to contain today.
+const DEV_BOX_EXEMPT = new Map([
+  // The historical record — superseded, never rewritten (ADR README "Superseding").
+  ['docs/adr/', 'historical record: ADRs are superseded by ADR 0346, never rewritten'],
+  ['docs/session-logs/', 'historical record: dated session logs'],
+  ['docs/audits/', 'historical record: dated audit reports'],
+  ['docs/governance/', 'historical record: dated governance reports'],
+  ['limitations/', 'historical record: shipped-version scope archives'],
+  ['docs/module-api-changelog.md', 'history ledger of doorway releases; entries are appended, never rewritten'],
+  // Applied migrations: they created the box objects and, last, dropped them. Named one
+  // by one so a NEW migration is still checked. The column drop of task 1004360 joins
+  // this list when it lands.
+  ['migrations/067_builder_boxes.sql', 'applied migration (created the box tables)'],
+  ['migrations/069_builder_ssh_keys.sql', 'applied migration'],
+  ['migrations/070_box_intents.sql', 'applied migration'],
+  ['migrations/071_box_first_provision_approval.sql', 'applied migration'],
+  ['migrations/073_box_terminal_access.sql', 'applied migration'],
+  ['migrations/078_box_claude_active.sql', 'applied migration'],
+  ['migrations/079_box_first_connected_at.sql', 'applied migration'],
+  ['migrations/090_box_scoped_sessions.sql', 'applied migration (added the box session source)'],
+  ['migrations/102_remove_box_first_provision_approval.sql', 'applied migration'],
+  ['migrations/104_builder_box_blocked.sql', 'applied migration (added the box_blocked columns)'],
+  ['migrations/105_box_host_keys.sql', 'applied migration'],
+  ['migrations/121_box_code_version.sql', 'applied migration'],
+  ['migrations/core_236_rank_floor_backfill.sql', 'applied migration (names the key in an example)'],
+  ['migrations/core_237_box_widen_paths.sql', 'applied migration'],
+  ['migrations/core_238_box_unattended_cap.sql', 'applied migration'],
+  ['migrations/core_248_module_enablement_overrides.sql', 'applied migration (names the key in an example)'],
+  ['migrations/core_258_drop_dev_box_tables.sql', 'the migration that drops the box tables and session source by name (task 1003895)'],
+  ['modules/government/migrations/governance_002_seed_and_backfill.sql', 'applied migration (seeded the box.* keys)'],
+  ['modules/government/migrations/governance_007_delegate_archon_ops_to_metic.sql', 'applied migration'],
+  ['modules/government/migrations/government_019_retire_box_permissions.sql', 'the migration that revokes the box.* keys by name (task 1003894)'],
+  ['modules/provisioning/migrations/provisioning_014_module_selection.sql', 'applied migration (names the key in an example)'],
+  ['modules/provisioning/migrations/provisioning_001_tables.sql', 'applied migration (its comments cite the box queue it was modelled on)'],
+  // Retirement guards: code and tests whose JOB is to name the retired thing.
+  ['src/modules.js', 'RETIRED_MODULE_KEYS: an instance config still saying "dev-box": true boots with a warning'],
+  ['tests/modules.mjs', 'proves the retired-key tolerance (and that a typo like "dev-boxes" still throws)'],
+  ['tests/government_session_scope.mjs', 'proves a leftover source=box session is refused'],
+  ['tests/auth_page_gate.mjs', 'proves a leftover source=box session is refused a page'],
+  ['tests/terms_acceptance.mjs', 'proves a leftover source=box session cannot mint an acceptance'],
+  ['tests/government_seed.mjs', 'proves government_019 revoked the box.* keys from every rank'],
+  ['tests/core_258_box_session_claims_db.mjs', 'proves core_258 applies over a claim created from a box session (task 1004362)'],
+  ['tests/government_protected_surfaces.mjs', 'RETIRED_SINCE_R101: retired protected paths may leave the registry only once gone'],
+  ['scripts/gds/dev-box-guard.js', 'this guard (it defines the rules)'],
+  // Captured data and seed history that name real records.
+  ['scripts/gds/seed-', 'one-shot task seeders: their subject is the historical tasks they filed'],
+  ['scripts/hall-preview/fixtures/', 'captured API responses: the ledger still holds these task and goal rows'],
+  ['.bongos-core.json', 'a 1.0.0 seed manifest from July (commit b6ee5d29) that this repo never regenerates'],
+]);
+
+const TEXT_EXT = /\.(js|mjs|cjs|json|md|sql|sh|html|css|yml|yaml|txt|toml)$/;
+const PATH_RULE = /^(scripts\/gds\/box|infra\/box-|modules\/dev-box\/|\.devcontainer\/)/;
+
+function exemptionFor(rel) {
+  for (const [entry, why] of DEV_BOX_EXEMPT) {
+    if (entry.endsWith('/') || entry.endsWith('-') ? rel.startsWith(entry) : rel === entry) return why;
+  }
+  return null;
+}
+
+// The key used as a key: fitness-lib's delimited match, with a quote, backtick or
+// slash on both sides (a colon may close it, as in a JSON key).
+// Compiled once for the whole scan; a global regex is stateful, so lastIndex is reset per line.
+const KEY_RE = new RegExp(keyTokenRe('dev-box').source, 'g');
+function namesModuleKey(line) {
+  const re = KEY_RE;
+  re.lastIndex = 0;
+  let m;
+  while ((m = re.exec(line))) {
+    if (/['"`/]/.test(m[1] || '') && /['"`/:]/.test(m[2] || '')) { re.lastIndex = 0; return true; }
+    re.lastIndex = m.index + 1;
+  }
+  return false;
+}
+
+const LINE_RULES = [
+  ['module-key', namesModuleKey],
+  ['identifier', (l) => /\b(builder_boxes|box_intents|box_events|builder_ssh_keys|box_blocked\w*)\b/.test(l)],
+  ['permission', (l) => /['"`]box\.[a-z_]+\.[a-z_]+['"`]/.test(l)],
+  ['session-source', (l) => /\bsource\b\s*(?:===?|!==?|:|=|IN\s*\()[^\n]{0,40}['"]box['"]/i.test(l)],
+];
+
+// Pure: scan one file's text. Returns [{ rule, line }].
+function scanText(text) {
+  const hits = [];
+  String(text == null ? '' : text).split('\n').forEach((l, i) => {
+    for (const [rule, test] of LINE_RULES) if (test(l)) hits.push({ rule, line: i + 1 });
+  });
+  return hits;
+}
+
+function trackedFiles(root = REPO_ROOT) {
+  return execFileSync('git', ['ls-files'], { cwd: root, encoding: 'utf8', maxBuffer: 64 * 1024 * 1024, timeout: 30000 })
+    .split('\n').filter(Boolean);
+}
+
+// The fitness check. `files` and `read` are injectable so the tests can plant a
+// violation without touching the tree.
+function checkNoDevBox({ files, read } = {}) {
+  const list = files || trackedFiles();
+  const readFile = read || ((rel) => fs.readFileSync(path.join(REPO_ROOT, rel), 'utf8'));
+  const violations = [];
+  for (const rel of list) {
+    if (exemptionFor(rel)) continue;
+    if (PATH_RULE.test(rel)) violations.push(`${rel} — path: a retired dev-box location (ADR 0346)`);
+    if (!TEXT_EXT.test(rel)) continue;
+    let text;
+    try { text = readFile(rel); } catch { continue; }
+    for (const { rule, line } of scanText(text)) violations.push(`${rel}:${line} — ${rule}: a retired dev-box name (ADR 0346)`);
+  }
+  const note = `The dev box was removed on purpose (${ADR}). ${list.length} tracked file(s) scanned for its module key, tables/columns, box.* permissions, box session source and paths. `
+    + `A hit means use what replaced it (a local checkout; server-mediated publish for a checkout with no push credential). Only a retirement guard or a historical record may name the box: add it to DEV_BOX_EXEMPT in scripts/gds/dev-box-guard.js, with its reason.`;
+  if (list.length === 0) {
+    return { name: NAME, ok: false, hardFail: true, violations: ['scan defect — enumerated 0 tracked files; a broken enumeration, not a clean result.'], warnings: [], note };
+  }
+  return { name: NAME, ok: violations.length === 0, hardFail: violations.length > 0, violations, warnings: [], note };
+}
+
+module.exports = { checkNoDevBox, scanText, namesModuleKey, exemptionFor, DEV_BOX_EXEMPT, PATH_RULE };
+
+if (require.main === module) {
+  const r = checkNoDevBox();
+  console.log(`${r.ok ? 'PASS' : 'FAIL'}  ${r.name}\n${r.note}`);
+  for (const v of r.violations) console.log(`  ✗ ${v}`);
+  process.exitCode = r.ok ? 0 : 1;
+}

package/scripts/gds/fitness-lib.js

@@ -70,8 +70,18 @@ function walkJsAllRoots(subpath, roots = MODULE_ROOTS) {
   return out;
 }
 
+// Match a module key as a DELIMITED token so `art-pipeline` hits in `'art-pipeline'` /
+// `mount('art-pipeline')` but never inside `art-pipelines` or `xart-pipeline`. Hyphens are
+// non-word chars, so the boundary guards against word-chars AND hyphens on both
+// sides (no lookbehind — portable on every node the unit gate runs). Moved here from
+// fitness.js (task 1003899) so dev-box-guard.js matches the retired key the same way.
+function keyTokenRe(key) {
+  const esc = key.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
+  return new RegExp(`(^|[^\\w-])${esc}($|[^\\w-])`);
+}
 
 module.exports = {
+  keyTokenRe,
   CORE_ROOT,
   INSTANCE_ROOT,
   MODULE_ROOTS,

package/scripts/gds/fitness.js

@@ -33,7 +33,7 @@ const { resolveCoreRoot, resolveInstanceRoot } = require('../../src/instance-con
 // live beside it — the shared roots/walkers and three check clusters. They are
 // IMPORTED (not registered by path) so the CHECKS array and module.exports below
 // stay byte-identical to the single-file version every test was written against.
-const { CORE_ROOT, INSTANCE_ROOT, MODULE_ROOTS, REPO_ROOT, rel, walkJs, walkJsAllRoots } = require('./fitness-lib.js');
+const { CORE_ROOT, INSTANCE_ROOT, MODULE_ROOTS, REPO_ROOT, keyTokenRe, rel, walkJs, walkJsAllRoots } = require('./fitness-lib.js');
 const { IDENTITY_SCAN_ALLOWED, IDENTITY_SCAN_EXCLUDE, IDENTITY_SCAN_EXTRA_FILES, IDENTITY_SCAN_EXTS, IDENTITY_SCAN_ROOTS, IDENTITY_SCAN_SKIP_DIRS, PROMPT_IDENTITY_LITERALS, checkDesignContract, checkKernelPromptsNoHardcodedIdentity, checkNeutralConfigsNoHostIdentity, collectIdentityFiles, scanPromptIdentity, stripCommentsForIdentity } = require('./fitness-checks-identity.js');
 const { WRITE_VALIDATION_BASELINE, WRITE_VALIDATION_EXEMPT, checkWriteRoutesValidated, scanUnvalidatedWriteRoutes } = require('./fitness-checks-write-validation.js');
 const { GOAL_VOCAB_CITATION, GOAL_VOCAB_LINE_SCOPED, GOAL_VOCAB_SURFACE, LIFECYCLE_DB_FILES, PRELAUNCH_SURFACE, RENAME_IDENTITY_RE, VOCAB_ALLOW, VOCAB_BANNED, VOCAB_CITATION, VOCAB_EXTS, VOCAB_HISTORICAL_REF, VOCAB_SURFACE, checkGoalMembershipVocabulary, checkGovernmentRenameIdentity, checkPrelaunchVocabulary, checkVocabularyWall, vocabFilesToScan } = require('./fitness-checks-vocabulary.js');
@@ -683,15 +683,6 @@ function moduleDir(key) {
   return path.join(CORE_ROOT, 'modules', key);
 }
 
-// Match a module key as a DELIMITED token so `art-pipeline` hits in `'art-pipeline'` /
-// `mount('art-pipeline')` but never inside `art-pipelines` or `xart-pipeline`. Hyphens are
-// non-word chars, so the boundary guards against word-chars AND hyphens on both
-// sides (no lookbehind — portable on every node the unit gate runs).
-function keyTokenRe(key) {
-  const esc = key.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
-  return new RegExp(`(^|[^\\w-])${esc}($|[^\\w-])`);
-}
-
 // Pure: scan kernel source text for any hardcoded module key, skipping comment
 // lines. Returns violation strings (one per hit). Exported for the negative test
 // (mirrors scanScopeMapSource / scanDeterministicBody).
@@ -1350,6 +1341,7 @@ const CHECKS = [
   // Task 1003206 carved this file from 2,004 lines to ~1,350, so that toll is paid
   // and the check gets its own line back.
   require('./version-literal-guard.js').checkNoVersionLiterals,
+  require('./dev-box-guard.js').checkNoDevBox, // task 1003899 / ADR 0346: the retired dev box stays out (its exemption list lives in that file)
   require('./control-manifest.js').checkControlsExist, // Check 21 — task 1003131: goal-1000076 controls assert their own existence (the ADR 0022 assurance-of-assurance)
   require('./routine-schedule.js').checkRoutineCadencesScheduled, // Check 25 — task 1003209: a routine that declares a cadence must have a scheduler firing it AT that period (ADR 0188)
   require('./baseline-staleness.js').checkBaselineFloors, // Check 26 — task 1003210: a shrink-only baseline that never shrinks is unmanaged debt; a floor exempting one must say why

package/scripts/gds/run-unit-tests.js

@@ -118,6 +118,10 @@ const INTEGRATION = new Set([
   // (Prose here avoids single-quoted tokens: the pairing guard below parses this
   // set out of the source, so a quoted word in a comment reads as an entry.)
   'copy_desk_flags_db',
+  // task 1004362: core_258 against a real Postgres holding a claim created from a
+  // dev box session. The claims foreign key that failed the live upgrade is a
+  // schema fact only a transaction engine enforces. Always rolled back.
+  'core_258_box_session_claims_db',
   'discord_autojoin', 'discord_oauth',
   // task 1003000 (IC6): the three ideator credit streams against a real Postgres.
   // The three DB-free sibling suites stub the client and SIMULATE the

package/src/bongos/module-scope-map.js

@@ -431,7 +431,7 @@ const MODULE_GLOBS = {
     'scripts/gds/scope-roster-guard.js',
     'scripts/gds/route-shadow-guard.js', 'scripts/gds/routine-schedule.js',
     'scripts/gds/seam-wiring-guard.js', 'scripts/gds/skill-preflight.js',
-    'scripts/gds/test-path-guard.js', 'scripts/gds/version-literal-guard.js',
+    'scripts/gds/test-path-guard.js', 'scripts/gds/version-literal-guard.js', 'scripts/gds/dev-box-guard.js',
   
     // ADOPTED (task 1004111): the enforcement surfaces this module already IS.
     // install-git-hooks.js + scripts/gds/hooks/ are the pre-push hook beside the

package/src/module-api.js

@@ -75,7 +75,7 @@ const { responsibilityFor, ROLE_RESPONSIBILITIES } = require('./role-responsibil
 // MAJOR (see allowBoxScope below): passes the request through untouched.
 function deprecatedNoopMiddleware(_req, _res, next) { next(); }
 
-const CORE_VERSION = '1.19.1075'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
+const CORE_VERSION = '1.19.1076'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('discord'); log.info('mounted');