@bongos/core 1.19.645 → 1.19.647

package/.bongos-core.json

@@ -2,22 +2,22 @@
   "artifact": "bongos-core",
   "manifest_schema": 1,
   "generator": "scripts/gds/package-core.js",
-  "core_version": "1.19.645",
-  "core_contract": "1.19.645",
-  "source_commit": "14b1d4c19840d818f49d383ed7c50189913860ac",
+  "core_version": "1.19.647",
+  "core_contract": "1.19.647",
+  "source_commit": "8fa0f8d28d7d61f52297185e5c669d70a60480de",
   "source_ref": "HEAD",
-  "built_at": "2026-09-10T18:02:00.629Z",
+  "built_at": "2026-09-10T18:40:35.458Z",
   "redaction": {
     "model": "docs-redacted+functional-verbatim",
     "docs_redacted": 470,
     "agent_docs_stubbed": 24,
-    "functional_verbatim": 2106,
+    "functional_verbatim": 2107,
     "rules": 3,
     "gate_literals": 3,
     "gate": "passed"
   },
-  "file_count": 2600,
-  "tree_sha256": "39c1aaa7c37d7537a2b25d18b8de6e6096cef248e1549d529398fe0d2282e2c2",
+  "file_count": 2601,
+  "tree_sha256": "7cebbe4108e45c224a38f2068e1e7a1d00552500b0b6f6d7f5c111d45f63a037",
   "files": [
     {
       "path": ".claude/skills/backlog-review/SKILL.md",
@@ -172,7 +172,7 @@
     {
       "path": ".claude/skills/grade-recover/SKILL.md",
       "mode": "0000644",
-      "sha256": "51cf032ec08279f0f6cbd22a528493917b674ce87f007bcc54eb9ef94a8aad22"
+      "sha256": "4dbbf04c19558b33332d9ba1bb8747198ded19e1a3af06ef72ede58ee4eb95ad"
     },
     {
       "path": ".claude/skills/grader-health/SKILL.md",
@@ -362,12 +362,12 @@
     {
       "path": "clients/bongos-client/README.md",
       "mode": "0000644",
-      "sha256": "65fb7649709e966a90f431d57b8855bd39951684a754320c4a797da9e3ccac13"
+      "sha256": "03379a98721207feab9a9b4c03862051ee6d52a29a0bc467ed73ae1d36bf49cd"
     },
     {
       "path": "clients/bongos-client/bongos-client.global.js",
       "mode": "0000644",
-      "sha256": "ea404e8d932d396796888692651965072cb8d828b3d6e9ebb93bc205fb00f7b9"
+      "sha256": "ec75333abb0ee49b89320a86e73b56f2f3872c13c596b1e67f36e705b8ba1210"
     },
     {
       "path": "clients/bongos-client/examples/hello-world.mjs",
@@ -377,17 +377,17 @@
     {
       "path": "clients/bongos-client/index.cjs",
       "mode": "0000644",
-      "sha256": "a6fb1af25ba5d2ef74cee69f2e126811d535b193422d44ee6f2f4efb787d7584"
+      "sha256": "bce3dcdbe37505e0fa526e02b7b379ca9ab378f6c34b41345621d55170d9f19d"
     },
     {
       "path": "clients/bongos-client/index.d.ts",
       "mode": "0000644",
-      "sha256": "c109144665c545407dc0a56a8d08e77b277d7a1636ab3740d0e81e43c563f616"
+      "sha256": "a6b15120b937f2a73d47ef180956068560eb3ac3efe5cf58f3a021b544ff9bc0"
     },
     {
       "path": "clients/bongos-client/index.mjs",
       "mode": "0000644",
-      "sha256": "0b96a51d69f2aeb6485eea84d80254ee1a4f90a8292c6b33e9bb89075f8cc187"
+      "sha256": "3fbcb50de89350e95b86180e828a16b897be32a1f8b4cdf78cc060e1c5afff86"
     },
     {
       "path": "clients/bongos-client/package.json",
@@ -1892,12 +1892,12 @@
     {
       "path": "docs/api-reference.md",
       "mode": "0000644",
-      "sha256": "72bfc066767c1c7301516d4f747c8a29725c2d623b5be1d916e6baa11e20a988"
+      "sha256": "0fa07d5f61ab66a43e0c51e51cfac8223afcb1aa12ea7342a226cb1832c0be62"
     },
     {
       "path": "docs/api/openapi.json",
       "mode": "0000644",
-      "sha256": "ac3c10aa8cc2cdad0d6878a7b2c51bb668b5207a2cd9649ee87da871e190494e"
+      "sha256": "02c082bff4c5bebbf13cefeeb46a6b9cdff430cc32b65dd4e78a72248c6fd74f"
     },
     {
       "path": "docs/architecture.md",
@@ -2772,7 +2772,7 @@
     {
       "path": "docs/module-api-changelog.md",
       "mode": "0000644",
-      "sha256": "7decbd6be1709b8c7fe6173a659d2caa8594bb766d353bece00c88a1e316f57e"
+      "sha256": "0f1d4f5ea01f97e24ee83708c35267828f6d7fb2c64a47db9b7b94c43205951a"
     },
     {
       "path": "docs/modules-contract.md",
@@ -3814,6 +3814,11 @@
       "mode": "0000644",
       "sha256": "06b53d66e710dfbf602011459ec8d69adce8e281632927daea0735f8078b2f86"
     },
+    {
+      "path": "migrations/core_237_box_widen_paths.sql",
+      "mode": "0000644",
+      "sha256": "2cda282b43ea71dd82ddf4e5ece90f11ad4013cbee0820f0a33391f202feff9c"
+    },
     {
       "path": "modules/agents/lib/validate.js",
       "mode": "0000644",
@@ -4212,7 +4217,7 @@
     {
       "path": "modules/dev-box/app/src/vendor/bongos-client.cjs",
       "mode": "0000644",
-      "sha256": "a6fb1af25ba5d2ef74cee69f2e126811d535b193422d44ee6f2f4efb787d7584"
+      "sha256": "bce3dcdbe37505e0fa526e02b7b379ca9ab378f6c34b41345621d55170d9f19d"
     },
     {
       "path": "modules/dev-box/app/test/unit.mjs",
@@ -4222,7 +4227,7 @@
     {
       "path": "modules/dev-box/box-access.js",
       "mode": "0000644",
-      "sha256": "a51e16aba67547c0692d9422587f83d8ce40f0e45830463b80bfd188401eb6c0"
+      "sha256": "7bc7c746f2518cb465773a205c8e9fe7efc30852c857001255be92ad8e340bca"
     },
     {
       "path": "modules/dev-box/box-credential.js",
@@ -4237,7 +4242,7 @@
     {
       "path": "modules/dev-box/boxes.js",
       "mode": "0000644",
-      "sha256": "a56b75218b3ac3fed0bb495b9c7f41b2794dafa5f3e6ec28cbb21a97e9b25b7b"
+      "sha256": "667993d81db36e1ddd1307013044f3d40b6baca3c6f5271b77332d10fa290063"
     },
     {
       "path": "modules/dev-box/db.js",
@@ -4252,7 +4257,7 @@
     {
       "path": "modules/dev-box/routes/box.js",
       "mode": "0000644",
-      "sha256": "bbe6ed7344f7e5dd1d4dba79e636f4bc02806d25193edb0609f41c850ffbad4c"
+      "sha256": "b61996de3fa3dbdc9b8fb639fd53aba5c1c2567350dc602b39ebbbd3a93164ac"
     },
     {
       "path": "modules/discord/CLAUDE.md",
@@ -7722,12 +7727,12 @@
     {
       "path": "package-lock.json",
       "mode": "0000644",
-      "sha256": "de884c55a00c4f37989b00d9c574fdcde904f617941dc65ee21ece636efd63c8"
+      "sha256": "b271a576a07b28caf13c7d64f1ba8407e3a4d5e53d13accf0da4ad461f94382e"
     },
     {
       "path": "package.json",
       "mode": "0000644",
-      "sha256": "a2949e78ffe45c9e0442261dd19892266aa1930607dfaa309ce10754b119921e"
+      "sha256": "e6e4d441aab1b961398eb377d6ac1e4cb9f072efcfa26bd5f51b878b116a8a3e"
     },
     {
       "path": "public-docs/index.html",
@@ -7917,7 +7922,7 @@
     {
       "path": "scripts/gds/box-sync.js",
       "mode": "0000644",
-      "sha256": "981544bfd56d486c2017edd744c86089659771a74399b4780455821c45e3b3a9"
+      "sha256": "33a79ddd2049419fe7df09cd7b5fe3da9163728a36bc8fe1351d89dcf2463a11"
     },
     {
       "path": "scripts/gds/box.js",
@@ -7982,7 +7987,7 @@
     {
       "path": "scripts/gds/claude-materialize.js",
       "mode": "0000644",
-      "sha256": "2d05a5e1dcb3a37480d42f6e0b30b26432a3fe02d671482f2d3762acb7bdb556"
+      "sha256": "cf333976f3c8fc9cfa1af57a121e5ee1f826d40fe7461bf1e32f939a59523663"
     },
     {
       "path": "scripts/gds/claude-md-template.js",
@@ -8862,7 +8867,7 @@
     {
       "path": "scripts/gds/ship-flow.js",
       "mode": "0000644",
-      "sha256": "95b5fa325ea0407dd6cd3d9ae3a03a0a0f0478a0bfcf76d77cf36b13a7c36bea"
+      "sha256": "9853e719e4a695cc52ec9089298d05163210ed3b51ca9eceb7553bc0ed9c65bd"
     },
     {
       "path": "scripts/gds/ship-git.js",
@@ -8882,7 +8887,7 @@
     {
       "path": "scripts/gds/ship-honesty.js",
       "mode": "0000644",
-      "sha256": "32827178a46cc01c36c422e1adef433be99492e8444a8affbe51e5e8c1e8ce9f"
+      "sha256": "29116265032b48115c31df794aa4689e7ce3f5eaeef152ea1ca2390dc2078c39"
     },
     {
       "path": "scripts/gds/ship-io.js",
@@ -9482,7 +9487,7 @@
     {
       "path": "src/module-api.js",
       "mode": "0000644",
-      "sha256": "e5d854562fcdec46abd9212cfdfc5c05bd1b29b43525d00abb9d6acb39dac48c"
+      "sha256": "5394603956c3ec34e8377f82a7f493d7c029f0db1d99b236a0e024fd619fe869"
     },
     {
       "path": "src/module-loader/catalog.js",
@@ -9862,7 +9867,7 @@
     {
       "path": "tests/box_access.mjs",
       "mode": "0000644",
-      "sha256": "fcad6c578c2d8698d6ad93fe04f500734d589013590f006910f1bc33fc908642"
+      "sha256": "911a764f72976298daa17855acb836d0ada3215b480961ae8607e1fc3634f882"
     },
     {
       "path": "tests/box_auth_check.mjs",
@@ -9932,7 +9937,7 @@
     {
       "path": "tests/box_sync_scope_report.mjs",
       "mode": "0000644",
-      "sha256": "010525c500aa1d5133f85a1a2ea7c23e9a680b08493a6f3b78c69a5108501468"
+      "sha256": "4b1df674e2e53ce9d521bab3c43c2b3959dee7daa51b97dfa9b23c20e2a41f94"
     },
     {
       "path": "tests/box_task_scope.mjs",
@@ -10067,7 +10072,7 @@
     {
       "path": "tests/claude_materialize.mjs",
       "mode": "0000644",
-      "sha256": "e67c44808dda0823a4b2b0e4ddd4ea70735f33a41c335c2d4b168f39eb9807ad"
+      "sha256": "b0474476af85716848114d345f4be67beb2e01ad3ceab36a25d474c3e9e536c5"
     },
     {
       "path": "tests/clawback_confirmed_backlog.mjs",
@@ -12517,7 +12522,7 @@
     {
       "path": "tests/ship_cannot_lie.mjs",
       "mode": "0000644",
-      "sha256": "82f6f951cc50c34860545be0f309e18a796ebb5baa712ccb341e1fd0dd72a233"
+      "sha256": "d8d99b6cd465b04eaf13790b0bdfe9a76ce36d77660407d3a2c6a17ac7852e8c"
     },
     {
       "path": "tests/ship_card.mjs",

package/.claude/skills/grade-recover/SKILL.md

@@ -58,12 +58,14 @@ The panel ran and rejected the work. Recover by fixing, not by re-rolling:
 1. **Group `issues[]` by severity, then by worker.** Nit/minor findings are advisory by rubric policy — they cannot have caused the fail on their own, so do not start there. The fail came from blocker/major findings (or a gating axis under threshold).
 2. **For each blocker/major finding, add a checked-in `tests/*.mjs` case** that reproduces it, then fix until green. The grader treats throwaway verification as unverified — the committed test is what makes the fix real.
 3. **Fix real findings once; do not chase re-worded restatements** of a point you already answered (answer it in the commit or with a tracked task ref instead).
-4. Commit on the claim branch — the grader reads committed history — then:
+4. Commit on the claim branch — the grader reads committed history — then re-grade, saying how each finding was answered:
 
 ```bash
-node scripts/gds/ship.js <id> --regrade
+node scripts/gds/ship.js <id> --regrade --response-file response.md
 ```
 
+**`--response` is how you answer a finding; `--notes` is not** (task 1003702). The panel is given the task, your value summary, the changed files and the diff — it never reads ship notes, on a re-grade or on the first ship. `--response` rides to the panel fenced as the prior round's answer, so an already-answered finding cannot re-veto on re-wording alone. Passing `--notes` used to be accepted and silently dropped; it is now refused with this same guidance. Evidence itself still belongs in the **diff** — a committed test is what makes a fix real (step 2), and the panel can read every changed file.
+
 ### Not recoverable here — `REFUSED (authorization)`
 
 A grade block naming protected surfaces above your rank is an authorization wall, not a quality verdict: no re-grade at your rank can land that diff as-is. Split the protected files out of the diff and re-ship the rest, or hand the task to a builder at/above the floor the refusal names.

package/clients/bongos-client/README.md

@@ -5,7 +5,7 @@ A **generated**, zero-dependency typed client for the Bongos API — produced fr
 by hand; it regenerates when the spec changes, so it can never drift from the routes.
 
 - API version: **v1** (served at `/api/bongos/v1`)
-- 360 operations across 55 resource groups
+- 362 operations across 55 resource groups
 
 ## Use it from your project
 

package/clients/bongos-client/bongos-client.global.js

@@ -205,6 +205,10 @@ function createClient(opts = {}) {
       postBoxTerminal: (args) => request("POST", "/box/terminal", { hasBody: true }, args),
       // POST /box/version — rank: any-builder — POST /box/version
       postBoxVersion: (args) => request("POST", "/box/version", { hasBody: true }, args),
+      // GET /box/widen — rank: any-builder — GET /box/widen
+      getBoxWiden: (args) => request("GET", "/box/widen", { hasBody: false }, args),
+      // POST /box/widen — rank: any-builder — POST /box/widen
+      postBoxWiden: (args) => request("POST", "/box/widen", { hasBody: true }, args),
     },
     "boxes": {
       // GET /boxes — rank: metic+archon — GET /boxes

package/clients/bongos-client/index.cjs

@@ -204,6 +204,10 @@ function createClient(opts = {}) {
       postBoxTerminal: (args) => request("POST", "/box/terminal", { hasBody: true }, args),
       // POST /box/version — rank: any-builder — POST /box/version
       postBoxVersion: (args) => request("POST", "/box/version", { hasBody: true }, args),
+      // GET /box/widen — rank: any-builder — GET /box/widen
+      getBoxWiden: (args) => request("GET", "/box/widen", { hasBody: false }, args),
+      // POST /box/widen — rank: any-builder — POST /box/widen
+      postBoxWiden: (args) => request("POST", "/box/widen", { hasBody: true }, args),
     },
     "boxes": {
       // GET /boxes — rank: metic+archon — GET /boxes

package/clients/bongos-client/index.d.ts

@@ -29,6 +29,7 @@ export interface GetBoxMeResponse { box: unknown; open_intent: unknown; cost: un
 export interface GetBoxSourceAccessResponse { scope: unknown; mode: unknown; sparse_paths: unknown; repo_url: unknown; credential: unknown; configured: unknown; separate_starter_repo: unknown; expires_at: unknown; ttl_seconds: unknown; guidance: unknown }
 export interface GetBoxSshKeyResponse { keys: unknown }
 export interface GetBoxTerminalResponse { state: unknown; url: unknown; credential: unknown; hint: unknown; warming_up?: boolean; terminal_at?: unknown }
+export interface GetBoxWidenResponse { widen_paths: unknown; admitted: unknown; ignored: unknown; max: unknown }
 export interface GetBoxesResponse { boxes: unknown }
 export interface GetBuildersDirectoryResponse { builders: unknown }
 export interface GetBuildersIdActiveClaimsResponse { builder_id: unknown; claims: unknown; stale_hours: unknown; stale_hours_source: unknown }
@@ -222,6 +223,8 @@ export interface PostBoxTerminalRequest { url: string; credential?: string }
 export interface PostBoxTerminalResponse { ok: boolean; state: unknown }
 export interface PostBoxVersionRequest { sha: string; committed_at?: string }
 export interface PostBoxVersionResponse { ok: boolean; state: unknown }
+export interface PostBoxWidenRequest { add?: unknown[]; remove?: unknown[]; clear?: boolean }
+export interface PostBoxWidenResponse { ok: boolean; widen_paths: unknown; admitted: unknown; ignored: unknown; max: unknown }
 export interface PostBoxesBuilderIdCloseResponse { ok: boolean; queued: unknown; action: unknown; state: unknown; message: unknown }
 export interface PostClaimsBatchReleaseRequest { claim_ids: unknown[]; force?: boolean }
 export interface PostClaimsBatchReleaseResponse { released: unknown; failures: unknown }
@@ -536,6 +539,10 @@ export interface BongosClient {
     postBoxTerminal(args: RequestArgs & { body: PostBoxTerminalRequest }): Promise<PostBoxTerminalResponse>;
     /** POST /box/version — rank: any-builder */
     postBoxVersion(args: RequestArgs & { body: PostBoxVersionRequest }): Promise<PostBoxVersionResponse>;
+    /** GET /box/widen — rank: any-builder */
+    getBoxWiden(args?: RequestArgs): Promise<GetBoxWidenResponse>;
+    /** POST /box/widen — rank: any-builder */
+    postBoxWiden(args?: RequestArgs & { body?: PostBoxWidenRequest }): Promise<PostBoxWidenResponse>;
   };
   "boxes": {
     /** GET /boxes — rank: metic+archon */

package/clients/bongos-client/index.mjs

@@ -201,6 +201,10 @@ export function createClient(opts = {}) {
       postBoxTerminal: (args) => request("POST", "/box/terminal", { hasBody: true }, args),
       // POST /box/version — rank: any-builder — POST /box/version
       postBoxVersion: (args) => request("POST", "/box/version", { hasBody: true }, args),
+      // GET /box/widen — rank: any-builder — GET /box/widen
+      getBoxWiden: (args) => request("GET", "/box/widen", { hasBody: false }, args),
+      // POST /box/widen — rank: any-builder — POST /box/widen
+      postBoxWiden: (args) => request("POST", "/box/widen", { hasBody: true }, args),
     },
     "boxes": {
       // GET /boxes — rank: metic+archon — GET /boxes

package/docs/api/openapi.json

@@ -2275,6 +2275,91 @@
         ]
       }
     },
+    "/box/widen": {
+      "get": {
+        "operationId": "get_box_widen",
+        "tags": [
+          "box"
+        ],
+        "summary": "GET /box/widen",
+        "description": "GET /box/widen — the caller's own recorded widen set (task 1003087). rank: any authenticated builder, own resource. Reports what is STORED plus what is currently ADMITTED, because those differ whenever a request sits outside the builder's rank scope — showing only the stored list would let a Xenos believe a widen took effect that the fetch quietly drops.\n\n**Rank:** `any-builder` — Any authenticated builder (row-level ownership enforced in-handler).",
+        "x-rank": "any-builder",
+        "x-source": "modules/dev-box/routes/box.js",
+        "responses": {
+          "200": {
+            "description": "Success.",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/GetBoxWidenResponse"
+                }
+              }
+            }
+          },
+          "400": {
+            "$ref": "#/components/responses/BadRequest"
+          },
+          "401": {
+            "$ref": "#/components/responses/Unauthorized"
+          },
+          "403": {
+            "$ref": "#/components/responses/Forbidden"
+          }
+        },
+        "security": [
+          {
+            "builderSession": []
+          }
+        ]
+      },
+      "post": {
+        "operationId": "post_box_widen",
+        "tags": [
+          "box"
+        ],
+        "summary": "POST /box/widen",
+        "description": "POST /box/widen — record extra sparse-checkout directories that must SURVIVE the */10 source-fetch (task 1003087, idea 1000793). rank: any authenticated builder, OWN box (builder_id-scoped in SQL, so no id from the body can point this at someone else's box). Deliberately NOT allowBoxScope. The on-box crons read source-access with a box-scoped session (ADR 0053); this is a WRITE that changes what the box pulls forever after, so it takes the builder's own session — the same posture that keeps a stolen box token from re-scoping the checkout it was stolen from. add/remove are applied to the stored set and the result is re-normalized, so the endpoint is idempotent: widening twice is not an error, and neither is removing something that was never there. A path outside the caller's rank scope is ACCEPTED into storage but reported in `ignored` rather than refused. That is the honest shape: rank can change, and a builder promoted to Metic should find the widen they asked for as a Xenos simply start working, instead of having been silently discarded months earlier. What it can never do is take effect early — admissibleWidenPaths is re-evaluated against the LIVE rank on every single fetch.\n\n**Rank:** `any-builder` — Any authenticated builder (row-level ownership enforced in-handler).",
+        "x-rank": "any-builder",
+        "x-source": "modules/dev-box/routes/box.js",
+        "requestBody": {
+          "required": false,
+          "content": {
+            "application/json": {
+              "schema": {
+                "$ref": "#/components/schemas/PostBoxWidenRequest"
+              }
+            }
+          },
+          "x-validated": true
+        },
+        "responses": {
+          "200": {
+            "description": "Success.",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/PostBoxWidenResponse"
+                }
+              }
+            }
+          },
+          "400": {
+            "$ref": "#/components/responses/ValidationFailed"
+          },
+          "401": {
+            "$ref": "#/components/responses/Unauthorized"
+          },
+          "403": {
+            "$ref": "#/components/responses/Forbidden"
+          }
+        },
+        "security": [
+          {
+            "builderSession": []
+          }
+        ]
+      }
+    },
     "/boxes": {
       "get": {
         "operationId": "get_boxes",
@@ -16801,6 +16886,21 @@
           "hint"
         ]
       },
+      "GetBoxWidenResponse": {
+        "type": "object",
+        "properties": {
+          "widen_paths": {},
+          "admitted": {},
+          "ignored": {},
+          "max": {}
+        },
+        "required": [
+          "widen_paths",
+          "admitted",
+          "ignored",
+          "max"
+        ]
+      },
       "GetBoxesResponse": {
         "type": "object",
         "properties": {
@@ -19429,6 +19529,40 @@
           "state"
         ]
       },
+      "PostBoxWidenRequest": {
+        "type": "object",
+        "properties": {
+          "add": {
+            "type": "array"
+          },
+          "remove": {
+            "type": "array"
+          },
+          "clear": {
+            "type": "boolean"
+          }
+        },
+        "additionalProperties": false
+      },
+      "PostBoxWidenResponse": {
+        "type": "object",
+        "properties": {
+          "ok": {
+            "type": "boolean"
+          },
+          "widen_paths": {},
+          "admitted": {},
+          "ignored": {},
+          "max": {}
+        },
+        "required": [
+          "ok",
+          "widen_paths",
+          "admitted",
+          "ignored",
+          "max"
+        ]
+      },
       "PostBoxesBuilderIdCloseResponse": {
         "type": "object",
         "properties": {
@@ -22806,9 +22940,9 @@
       "description": "A required dependency/feature is not configured or is temporarily down."
     }
   },
-  "x-endpoint-count": 360,
-  "x-schema-count": 398,
+  "x-endpoint-count": 362,
+  "x-schema-count": 401,
   "x-undocumented-bodies": 9,
-  "x-response-schemas": 268,
+  "x-response-schemas": 270,
   "x-generated-by": "scripts/gds/gen-api-docs.js"
 }

package/docs/api-reference.md

@@ -2,7 +2,7 @@
 
 # Bongos API reference
 
-> **Generated from the live route files** — the route file is authoritative. 360 endpoints across 58 route files.
+> **Generated from the live route files** — the route file is authoritative. 362 endpoints across 58 route files.
 > Machine-readable spec: [`docs/api/openapi.json`](api/openapi.json) (OpenAPI 3.1). Rendered docs site: **`/docs`** (e.g. `cloudbongos.com/docs`).
 
 Base path: `/api/bongos`. Ranks (enforced server-side, [ADR 0016](adr/<redacted>.md)): `public` < `any-builder` < `metic+archon` < `archon`.
@@ -81,7 +81,7 @@ Base path: `/api/bongos`. Ranks (enforced server-side, [ADR 0016](adr/<redacted>
 | POST | `/api/bongos/blockers/:id/link` | `metic+archon` | `task_id` | Link an existing blocker to a task. |
 | POST | `/api/bongos/blockers/:id/resolve` | `metic+archon` | `resolution_note` | Resolve. |
 
-## `box` (18)
+## `box` (20)
 
 | Method | Path | Rank | Body | Description |
 |---|---|---|---|---|
@@ -103,6 +103,8 @@ Base path: `/api/bongos`. Ranks (enforced server-side, [ADR 0016](adr/<redacted>
 | GET | `/api/bongos/box/terminal` | `any-builder` | — | GET /box/terminal — the caller reads their box's web-terminal URL + credential (the Chromebook on-ramp, ADR 0038: ttyd behind a Cloudflar… |
 | POST | `/api/bongos/box/terminal` | `any-builder` | `url`, `credential` | POST /box/terminal — the box publishes its current web-terminal URL + the per-box basic-auth credential. |
 | POST | `/api/bongos/box/version` | `any-builder` | `sha`, `committed_at` | POST /box/version — the box reports its /workspace HEAD commit so the server can flag a stale box (idea 332 / task 1316, ADR 0072). |
+| GET | `/api/bongos/box/widen` | `any-builder` | — | GET /box/widen — the caller's own recorded widen set (task 1003087). |
+| POST | `/api/bongos/box/widen` | `any-builder` | `add`, `remove`, `clear` | POST /box/widen — record extra sparse-checkout directories that must SURVIVE the */10 source-fetch (task 1003087, idea 1000793). |
 
 ## `boxes` (4)
 

package/docs/module-api-changelog.md

@@ -1739,5 +1739,9 @@ is load-bearing: the script throws rather than guess if it is missing, and
         landed since 1.19.643 with no explicit bump. run 34509682128. (task 1002620)
   1.19.645 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
         landed since 1.19.644 with no explicit bump. run 34511775606. (task 1002620)
+  1.19.646 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+        landed since 1.19.645 with no explicit bump. run 34512629504. (task 1002620)
+  1.19.647 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+        landed since 1.19.646 with no explicit bump. run 34515733973. (task 1002620)
 ---------------------------------------------------------------------------
 ```

package/migrations/core_237_box_widen_paths.sql

@@ -0,0 +1,40 @@
+-- core_237_box_widen_paths.sql — let a builder's own sparse-checkout widening
+-- survive the */10 source-fetch tick (task 1003087, goal 1000095, idea 1000793).
+--
+-- THE BUG THIS EXISTS FOR. The box's source-fetch cron re-applies the
+-- SERVER-COMPUTED sparse set every ~10 minutes. A builder who runs
+-- `git sparse-checkout add <path>` to see code their task scope did not pull gets
+-- it deleted out from under them on the next tick — including WHILE A COMMAND IS
+-- RUNNING. A live test suite died mid-run with MODULE_NOT_FOUND that read exactly
+-- like a code bug. It also breaks gen-repo-map, whose output is TREE-DEPENDENT:
+-- a sparse tree regenerates different nested CLAUDE.md symbol blocks than CI's
+-- full tree, so a box-committed regen reds CI's freshness gate (learning 1000192;
+-- it stranded PR #254 until the tree was widened).
+--
+-- WHY THE FIX LIVES IN THE DATABASE AND NOT IN THE FETCH SCRIPT. The obvious fix
+-- is "make box-source-fetch.sh union the builder's additions". It cannot be done
+-- there from this repo: the fetch script is INSTANCE-owned, not shipped by the
+-- neutral core (ADR 0150). More importantly it would not work — the cron asks the
+-- SERVER for the set on every tick, so anything the script remembers locally is
+-- one `git sparse-checkout set` away from being overwritten anyway. Recording the
+-- widening server-side is what makes it tick-surviving: the union is computed in
+-- GET /box/source-access, so EVERY fetch — cron included — already returns it,
+-- and no instance-owned file has to change.
+--
+-- ONE COLUMN, NOT A TABLE. A widen set is small (capped in box-access.js), has no
+-- attributes of its own, and is meaningless apart from its box — the same shape
+-- as the existing array-ish per-box state on this table. A join table would buy
+-- nothing and cost a query on the hot source-fetch path.
+--
+-- NOT AN AUTHORITY GRANT. This column widens what is MATERIALIZED on the box, not
+-- what the builder may author. The wall stays where ADR 0148 put it — goal-scope
+-- -check against the module globs, not what happens to be on disk — and
+-- box-access.js admits a widen path only when the builder's RANK scope already
+-- reaches it, so a Xenos cannot widen past the starter surface. Empty default, so
+-- every existing box is unchanged until its owner asks for something.
+
+ALTER TABLE builder_boxes
+  ADD COLUMN IF NOT EXISTS widen_paths text[] NOT NULL DEFAULT '{}';
+
+COMMENT ON COLUMN builder_boxes.widen_paths IS
+  'Builder-requested extra sparse-checkout directories, unioned into the server-computed set on every source fetch so they survive the */10 cron (task 1003087). Admitted only within the builder''s rank scope — see modules/dev-box/box-access.js admissibleWidenPaths.';

package/modules/dev-box/app/src/vendor/bongos-client.cjs

@@ -204,6 +204,10 @@ function createClient(opts = {}) {
       postBoxTerminal: (args) => request("POST", "/box/terminal", { hasBody: true }, args),
       // POST /box/version — rank: any-builder — POST /box/version
       postBoxVersion: (args) => request("POST", "/box/version", { hasBody: true }, args),
+      // GET /box/widen — rank: any-builder — GET /box/widen
+      getBoxWiden: (args) => request("GET", "/box/widen", { hasBody: false }, args),
+      // POST /box/widen — rank: any-builder — POST /box/widen
+      postBoxWiden: (args) => request("POST", "/box/widen", { hasBody: true }, args),
     },
     "boxes": {
       // GET /boxes — rank: metic+archon — GET /boxes