@bongos/core 1.19.714 → 1.19.724

package/docs/adr/0027-bfg-session-inefficiency-evaluator.md

@@ -5,13 +5,13 @@
 - **Deciders:** Lars Kristensen (Archon), Claude
 - **Track:** `internal` (GDS)
 - **Context tasks:** GDS-V4 **[#515](https://example.com/builders#/task/515)** (the capability umbrella) · **[#539](https://example.com/builders#/task/539)** (this design task — ADR + task breakdown only, no implementation; mirrors the design-only shape of [#441](<redacted>.md)).
-- **Extends:** [ADR 0024 — Multi-Agent System architecture](<redacted>.md) (the BFG is its Phase 6) · [ADR 0026 — The BFG charter](<redacted>.md) (this adds a **new capability cluster, 6D**, to the BFG's "best building experience" objective) · [ADR 0016 — Trust boundary](<redacted>.md) (narrowly extended — session detail now lives server-side and is BFG-readable across builders) · [ADR 0022 — Secrets policy](0022-secrets-policy.md) (scrubbing on upload). Touches `credit_log` (example), `karma_log`, `builders` (rank + tenure), `task_grades` (the upsert-unique gap), `session_logs`.
+- **Extends:** [ADR 0024 — Multi-Agent System architecture](0024-multi-agent-system-architecture.md) (the BFG is its Phase 6) · [ADR 0026 — The BFG charter](0026-bfg-memory-hygiene-and-cross-builder-learning.md) (this adds a **new capability cluster, 6D**, to the BFG's "best building experience" objective) · [ADR 0016 — Trust boundary](0016-trust-boundary-server-enforced-permissions.md) (narrowly extended — session detail now lives server-side and is BFG-readable across builders) · [ADR 0022 — Secrets policy](0022-secrets-policy.md) (scrubbing on upload). Touches `credit_log` (example), `karma_log`, `builders` (rank + tenure), `task_grades` (the upsert-unique gap), `session_logs`.
 
 ## Context
 
 On **2026-06-01** Lars asked for a manual evaluation of the **[#506](https://example.com/builders#/task/506)** session — a one-line welcome-copy fix that burned ~90% of its tokens on process ceremony + footgun recovery rather than the actual change. The post-mortem ([session log](../session-logs/<redacted>.md)) produced three concrete systemic fixes — **[#513](https://example.com/builders#/task/513)** (trivial-diff fast-path for the grader), **[#514](https://example.com/builders#/task/514)** (self-explaining API error hints), **[#468](https://example.com/builders#/task/468)** (a stale smoke assertion) — plus a security finding (`#526`).
 
-Lars wants that analysis **automated and run across every session**, to surface systemic build-process waste — and, as the inverse, to mine *top performers'* sessions for transferable good practice (the [ADR 0026](<redacted>.md) §6B objective). This ADR is the design; [#506](https://example.com/builders#/task/506) is the **hand-labeled seed/validation corpus**.
+Lars wants that analysis **automated and run across every session**, to surface systemic build-process waste — and, as the inverse, to mine *top performers'* sessions for transferable good practice (the [ADR 0026](0026-bfg-memory-hygiene-and-cross-builder-learning.md) §6B objective). This ADR is the design; [#506](https://example.com/builders#/task/506) is the **hand-labeled seed/validation corpus**.
 
 ### The substrate problem (and the decision that resolves it)
 
@@ -22,7 +22,7 @@ The two candidate data sources don't overlap:
 
 Two earlier framings were put to Lars and rejected (see Alternatives): a local-only `/session-review` slash command, and a server-side analyzer. **Lars's decision** resolves the substrate problem directly:
 
-> **At ship time, upload the session's details to the server.** The BFG then runs as a **local Claude Code instance** (as it already does for hygiene, [ADR 0026](<redacted>.md) §6A.1) that **calls the server** to search across *all* sessions and deep-dive the interesting ones. The builder never runs anything — findings come to them.
+> **At ship time, upload the session's details to the server.** The BFG then runs as a **local Claude Code instance** (as it already does for hygiene, [ADR 0026](0026-bfg-memory-hygiene-and-cross-builder-learning.md) §6A.1) that **calls the server** to search across *all* sessions and deep-dive the interesting ones. The builder never runs anything — findings come to them.
 
 This is the load-bearing choice: the rich data stops being local, so one cross-builder corpus serves both the waste-hunt and the good-practice mine, and the analysis stays where the BFG already lives (a Claude Code routine), not on the always-on $14/mo droplet.
 
@@ -55,7 +55,7 @@ The server stores and serves; it does **no analysis**. Two endpoints over `sessi
 - **Search/filter** by *session* fields (`example_earned`, `total_tokens`, `duration`, the derived metrics) **and joined `builders` fields** — **tenure** (`now − created_at`), **rank**, **karma**, **example** (`total_credits`). So queries like *"rank = Xenos AND tenure < 7d AND overhead > 0.7"* (onboarding friction) or *"karma top-decile"* (good-practice mining) are expressible against one corpus.
 - **Fetch one session's** full scrubbed detail for deep-dive.
 
-Cross-builder reads are gated to the **BFG service principal** ([ADR 0026](<redacted>.md) §6B posture — the *exact principal identity*, not rank) and write an **`audit_log` row per read**. A builder may always read their *own* sessions self-serve. Filtering is plain SQL/keyword **for now** (semantic/vector deferred, consistent with [ADR 0024](<redacted>.md)/[0026](<redacted>.md)).
+Cross-builder reads are gated to the **BFG service principal** ([ADR 0026](0026-bfg-memory-hygiene-and-cross-builder-learning.md) §6B posture — the *exact principal identity*, not rank) and write an **`audit_log` row per read**. A builder may always read their *own* sessions self-serve. Filtering is plain SQL/keyword **for now** (semantic/vector deferred, consistent with [ADR 0024](0024-multi-agent-system-architecture.md)/[0026](0026-bfg-memory-hygiene-and-cross-builder-learning.md)).
 
 ### 3. The BFG routine — local Claude Code, search → deep-dive → reason (6D.3)
 
@@ -83,20 +83,20 @@ Ratio = work tokens ÷ total (with a parallel turn-based ratio). [#506](https://
 ### 4. Findings to the builder (6D.4)
 
 - **Systemic** build-process fixes → `idea_inbox` rows / backlog tasks (conservative grouping, like §6A.1 and the manual [#506](https://example.com/builders#/task/506) → [#513](https://example.com/builders#/task/513)/[#514](https://example.com/builders#/task/514)/[#468](https://example.com/builders#/task/468)).
-- **Per-builder** process findings → delivered to *that* builder via the [ADR 0026](<redacted>.md) **§6C transparent, BFG-authored, attributed note** path (builder-visible, deletable, audit-logged) — for the builder to **evaluate and act on**. The §6C write path is built by 0026's 6C.1/6C.2; 6D.4 wires session findings *into* it and degrades to inbox-only until 6C exists.
+- **Per-builder** process findings → delivered to *that* builder via the [ADR 0026](0026-bfg-memory-hygiene-and-cross-builder-learning.md) **§6C transparent, BFG-authored, attributed note** path (builder-visible, deletable, audit-logged) — for the builder to **evaluate and act on**. The §6C write path is built by 0026's 6C.1/6C.2; 6D.4 wires session findings *into* it and degrades to inbox-only until 6C exists.
 
 The builder-field querying does double duty: it powers the **waste hunt** *and* the charter's **6B good-practice mining** — one corpus, both objectives.
 
 ### Trust & privacy (load-bearing)
 
-Uploading session detail means transcripts **now live server-side and are BFG-readable across builders** — today they are local-only. This is a deliberate, narrow extension of [ADR 0016](<redacted>.md), in the same family as [ADR 0026](<redacted>.md)'s cross-builder paths. The safeguards are **enforcement requirements, not prose**:
+Uploading session detail means transcripts **now live server-side and are BFG-readable across builders** — today they are local-only. This is a deliberate, narrow extension of [ADR 0016](0016-trust-boundary-server-enforced-permissions.md), in the same family as [ADR 0026](0026-bfg-memory-hygiene-and-cross-builder-learning.md)'s cross-builder paths. The safeguards are **enforcement requirements, not prose**:
 
 - **Secrets scrubbed on upload** ([ADR 0022](0022-secrets-policy.md)) — known secret patterns + the builder's own env values redacted *before* the transcript leaves the machine; covered by a test.
 - **BFG-principal-only** cross-builder reads (a builder reads only their own self-serve); **`audit_log` row per cross-builder read**.
 - **Retention window** — sessions are pruned after a bounded period; the corpus is not hoarded forever.
 - **Builder-visible** — a builder can see, and request deletion of, their uploaded sessions.
 
-> **Non-goal — not covert surveillance.** This is not a tool for secretly ranking or punishing builders. Findings are transparent and attributed (the §6C posture). This mirrors [ADR 0026](<redacted>.md)'s explicit rejection of covert "nightmares": the steering is honest, visible, and reversible.
+> **Non-goal — not covert surveillance.** This is not a tool for secretly ranking or punishing builders. Findings are transparent and attributed (the §6C posture). This mirrors [ADR 0026](0026-bfg-memory-hygiene-and-cross-builder-learning.md)'s explicit rejection of covert "nightmares": the steering is honest, visible, and reversible.
 
 ### Validation — the [#506](https://example.com/builders#/task/506) regression gate (6D.5)
 
@@ -122,26 +122,26 @@ This is the regression gate: classifier/detector changes must keep finding the k
 | **6D.5** | [#544](https://example.com/builders#/task/544) | [#506](https://example.com/builders#/task/506) validation/regression harness (seed fixture) | The evaluator provably reproduces the hand-labeled case. |
 | **6D.6** | [#545](https://example.com/builders#/task/545) | *(optional)* append-only grade-attempt logging | Re-grade thrash becomes countable — *only if the signal earns its keep.* |
 
-Each sub-phase answers "is this earning its tokens?" before the next — the Musk gate, same as [ADR 0024](<redacted>.md)/[0026](<redacted>.md).
+Each sub-phase answers "is this earning its tokens?" before the next — the Musk gate, same as [ADR 0024](0024-multi-agent-system-architecture.md)/[0026](0026-bfg-memory-hygiene-and-cross-builder-learning.md).
 
 ## Alternatives considered
 
 - **Local-only `/session-review` slash command (rejected by Lars).** The first proposal kept the rich data local and had the builder run the review on demand. Rejected: *"I want the average builder to not think about this"* — and a local tool can never see cross-builder sessions. Upload-on-ship + a server corpus replaces it.
 - **Server-side analyzer (rejected by Lars).** The second proposal ran the analysis on the server. Rejected: the BFG **runs as a local Claude Code instance**; the server only *stores and serves*. This keeps expensive LLM reasoning off the always-on droplet and matches the BFG's existing identity (a `SKILL.md` routine).
 - **Digest-only upload (deferred).** Store just the computed metrics, not the transcript. Rejected for now because the BFG must be able to deep-dive with *new* criteria later — a digest freezes the analysis. Full (scrubbed) transcript chosen, bounded by a retention window. Revisit if storage cost bites.
-- **Vector / semantic search over the corpus (deferred).** Consistent with [ADR 0024](<redacted>.md)/[0026](<redacted>.md)'s "vector store deferred." Plain SQL + keyword "for now" (Lars's word).
+- **Vector / semantic search over the corpus (deferred).** Consistent with [ADR 0024](0024-multi-agent-system-architecture.md)/[0026](0026-bfg-memory-hygiene-and-cross-builder-learning.md)'s "vector store deferred." Plain SQL + keyword "for now" (Lars's word).
 - **Counting re-grade thrash from `task_grades` (not possible).** `task_grades.task_id` is `UNIQUE` — only the *final* grade survives, so the number of grade attempts isn't persisted. 6D.6 optionally adds append-only grade-attempt logging if that signal proves wanted.
 
 ## Consequences
 
 **Good:**
 - The [#506](https://example.com/builders#/task/506) post-mortem becomes a **standing, automatic** capability; systemic waste surfaces as `idea_inbox`/tasks without anyone asking.
-- **One queryable corpus** serves both the waste hunt and [ADR 0026](<redacted>.md) §6B good-practice propagation.
+- **One queryable corpus** serves both the waste hunt and [ADR 0026](0026-bfg-memory-hygiene-and-cross-builder-learning.md) §6B good-practice propagation.
 - Analysis stays a local Claude Code routine — **no new always-on cost** on the droplet.
 
 **Bad / accepted:**
 - **Session transcripts now live server-side** — a new sensitive store to secure, scrub, and retain. Mitigated by upload-time scrubbing + principal-gating + audit + retention + builder visibility.
-- **The BFG can read across builders' sessions** — the audit trail is what keeps that legible (same residual risk [ADR 0026](<redacted>.md) accepted for memory).
+- **The BFG can read across builders' sessions** — the audit trail is what keeps that legible (same residual risk [ADR 0026](0026-bfg-memory-hygiene-and-cross-builder-learning.md) accepted for memory).
 - **`ship.js` gains an upload step** — it must be fast, non-blocking, and fail-safe; a broken upload can never block a ship.
 
 **Reversibility:**
@@ -161,9 +161,9 @@ evaluator's numbers did not reflect real friction. Three GDS-V4 fixes correct it
 
 ## References
 
-- [ADR 0024 — Multi-Agent System architecture](<redacted>.md) — the BFG is Phase 6
-- [ADR 0026 — The BFG charter](<redacted>.md) — 6D extends the "best building experience" objective; §6C is the findings-delivery path
-- [ADR 0016 — Trust boundary](<redacted>.md) — the rule this narrowly extends
+- [ADR 0024 — Multi-Agent System architecture](0024-multi-agent-system-architecture.md) — the BFG is Phase 6
+- [ADR 0026 — The BFG charter](0026-bfg-memory-hygiene-and-cross-builder-learning.md) — 6D extends the "best building experience" objective; §6C is the findings-delivery path
+- [ADR 0016 — Trust boundary](0016-trust-boundary-server-enforced-permissions.md) — the rule this narrowly extends
 - [ADR 0022 — Secrets policy](0022-secrets-policy.md) — upload-time scrubbing
 - [2026-06-01 #506 post-mortem session log](../session-logs/<redacted>.md) — the hand-labeled seed corpus
 - `migrations/003_pms.sql` (`credit_log`, `session_logs`, `claims`), `migrations/016_pms_task_grades.sql` (the upsert-unique grade), `migrations/040_builder_karma.sql` (karma)

package/docs/adr/0029-status-page-outage-resilience.md

@@ -5,7 +5,7 @@
 - **Deciders:** Lars Kristensen (Archon), Claude
 - **Track:** `internal` (the status dashboard / The Watch)
 - **Context tasks:** **[#565](https://example.com/builders#/task/565)** (slice 1 — external prober + alert + this ADR) · **blocker [#6](https://example.com/builders#/blocker/6)** (DigitalOcean backup payment + billing alerts — root-cause prevention, Lars-only) · follow-up **B** (move `public-status/` off-box + CORS on `/api/gds/public/*` + repoint `status.` DNS) · follow-up **C** (backfill the 2026-06-03 incident into the honest uptime history).
-- **Relates to:** [ADR 0003 — Cloudflare Origin Cert](<redacted>.md) (the CF↔origin leg) · the in-process poller [`src/bongos/uptime-poller.js`](../../src/bongos/uptime-poller.js) (now demoted from public source-of-truth) · [`docs/recipes/ops-gotchas.md`](../recipes/ops-gotchas.md) (the new "status page shared fate" gotcha).
+- **Relates to:** [ADR 0003 — Cloudflare Origin Cert](0003-cloudflare-origin-cert-over-letsencrypt.md) (the CF↔origin leg) · the in-process poller [`src/bongos/uptime-poller.js`](../../src/bongos/uptime-poller.js) (now demoted from public source-of-truth) · [`docs/recipes/ops-gotchas.md`](../recipes/ops-gotchas.md) (the new "status page shared fate" gotcha).
 
 ## Context
 

package/docs/adr/0030-builders-hall-live-updates.md

@@ -1,6 +1,6 @@
 # ADR 0030 — Builders-hall live updates via Postgres NOTIFY → WebSocket
 
-- **Status:** Accepted — **transport superseded by [ADR 0069](<redacted>.md)** (the hall now delivers nudges over SSE, not a Colyseus WebSocket room, so it works on a game-less Cloud Bongos boot; R55). The **change-signal layer below (§1 — `NOTIFY` + `src/bongos/live-channel.js`) is unchanged and still authoritative**; only the §2 delivery transport moved.
+- **Status:** Accepted — **transport superseded by [ADR 0069](0069-hall-live-channel-sse-decouple.md)** (the hall now delivers nudges over SSE, not a Colyseus WebSocket room, so it works on a game-less Cloud Bongos boot; R55). The **change-signal layer below (§1 — `NOTIFY` + `src/bongos/live-channel.js`) is unchanged and still authoritative**; only the §2 delivery transport moved.
 - **Date:** 2026-06-03
 - **Deciders:** task [#569](https://example.com/builders#/task/569) (commissioned by Lars — "these checks aren't very live, need to refresh every time"); transport chosen by Lars (WebSocket)
 - **Track:** `internal` (the builders hall)

package/docs/adr/0031-cloud-dev-environments-for-builders.md

@@ -1,7 +1,7 @@
 # ADR 0031 — Cloud dev environments for builders (hybrid: Claude Desktop → SSH → containerized DigitalOcean box)
 
 **Date:** 2026-06-04
-**Context:** GDS-V3, task [#595](https://example.com/builders#/task/595) (claim `#477`). Feeds done-when criteria **C1** (`onboarding ≤ 2h`) and **C8** (`cloneable repo / local-first memory, server-canonical on ship`). Companion to [ADR 0016](<redacted>.md) (trust boundary — same server-enforced posture), [ADR 0018](<redacted>.md) (Xenos → Metic → Archon), [ADR 0022](0022-secrets-policy.md) (no secrets in repo — precondition for a cloneable box), [ADR 0024](<redacted>.md) (memory follows the builder — unchanged by where the box runs), and [ADR 0002](<redacted>.md) (we already run on DigitalOcean).
+**Context:** GDS-V3, task [#595](https://example.com/builders#/task/595) (claim `#477`). Feeds done-when criteria **C1** (`onboarding ≤ 2h`) and **C8** (`cloneable repo / local-first memory, server-canonical on ship`). Companion to [ADR 0016](0016-trust-boundary-server-enforced-permissions.md) (trust boundary — same server-enforced posture), [ADR 0018](0018-three-rank-model-goes-live.md) (Xenos → Metic → Archon), [ADR 0022](0022-secrets-policy.md) (no secrets in repo — precondition for a cloneable box), [ADR 0024](0024-cloneable-repo-local-first-memory.md) (memory follows the builder — unchanged by where the box runs), and [ADR 0002](0002-digitalocean-over-hetzner.md) (we already run on DigitalOcean).
 **Status:** Accepted. *Decision recorded this session; implementation tasks to be seeded separately (see the Implementation sub-tasks at the end).*
 **Track:** `internal` (dev-system architecture).
 
@@ -53,7 +53,7 @@ We will adopt a **hybrid** model with a single shared foundation. In plain terms
 
 ### 1. UI — Claude Desktop is the primary interface
 
-> **Superseded in part (2026-06-06, [ADR 0038](<redacted>.md)):** the thin-device `claude rc` always-on-service on-ramp described in the Thin-device bullet below is retired. Headless `claude rc` can't bootstrap (Trusted-Devices enrollment is interactive-only); the browser-only on-ramp is now a box-served `ttyd` web terminal over an outbound Cloudflare Tunnel where the builder runs normal interactive `claude`. See [ADR 0038](<redacted>.md) (and [ADR 0040](<redacted>.md) for in-session Remote Control as the default browser experience). The Desktop→SSH and Local paths below are unchanged.
+> **Superseded in part (2026-06-06, [ADR 0038](0038-chromebook-ttyd-cloudflare-tunnel.md)):** the thin-device `claude rc` always-on-service on-ramp described in the Thin-device bullet below is retired. Headless `claude rc` can't bootstrap (Trusted-Devices enrollment is interactive-only); the browser-only on-ramp is now a box-served `ttyd` web terminal over an outbound Cloudflare Tunnel where the builder runs normal interactive `claude`. See [ADR 0038](0038-chromebook-ttyd-cloudflare-tunnel.md) (and [ADR 0040](0040-remote-control-default-browser-onramp.md) for in-session Remote Control as the default browser experience). The Desktop→SSH and Local paths below are unchanged.
 
 Most builders want a clean GUI, not a terminal or an IDE. The redesigned Claude Desktop app (April 2026) has a **Code** tab whose session **Environment** selector offers three mutually-exclusive choices for *where the worker runs*: **Local**, **Remote** (Anthropic-managed cloud VM), and **SSH** (a machine the org controls). We build on **SSH**.
 
@@ -96,7 +96,7 @@ The barrier to *start* is zero (org pays the first box, per the decision to **no
 
 The repo is **private** (today under a personal account — see §7; a move to a GitHub Organization would change the enforcement options below). Putting the worker on a box we control, reached only through the GUI, turns repo access from *"every builder holds a permanent local clone forever"* into *"access is to a box we own — gated, revocable, audited, egress-restricted."*
 
-- **Gate source access by rank.** Below a chosen rank: no box, no source. The box (not the builder) holds the scoped GitHub credential; below-rank builders have no direct clone rights. Extends the [ADR 0016](<redacted>.md) trust boundary from "writes are gated" to "source access is gated."
+- **Gate source access by rank.** Below a chosen rank: no box, no source. The box (not the builder) holds the scoped GitHub credential; below-rank builders have no direct clone rights. Extends the [ADR 0016](0016-trust-boundary-server-enforced-permissions.md) trust boundary from "writes are gated" to "source access is gated."
 - **No permanent local copy** (the code lives on the box; SSH/Remote-Control bypass any local folder).
 - **Central revocation + clean offboarding** (revoke rank → de-provision box → source access gone).
 - **Prod deploy moves to CI** (GitHub Actions, like staging already is), so **no builder box ever holds the production droplet SSH key.**
@@ -126,9 +126,9 @@ The repo is **private** (today under a personal account — see §7; a move to a
 **Good:**
 - Onboarding drops from "install a toolchain and hope" to "open Claude Desktop, pick the Example Dev Box" — the direct lever on C1 (≤2h).
 - Org inference cost = $0 (BYO subscription); org compute cost ≈ $0 ongoing (auto-suspend + self-funding), bounded by a small starter-box pool.
-- The container is a real security upgrade: rank-gated source access, no permanent local clones, central revocation, clean offboarding, egress restriction — strengthening [ADR 0016](<redacted>.md).
+- The container is a real security upgrade: rank-gated source access, no permanent local clones, central revocation, clean offboarding, egress restriction — strengthening [ADR 0016](0016-trust-boundary-server-enforced-permissions.md).
 - The box stays portable (devcontainer), so we are not locked to DigitalOcean, and VS-Code power-users can self-fund Codespaces off the same spec.
-- [ADR 0024](<redacted>.md) memory sync is unaffected — it keys on `builder_id`, not on where the box runs.
+- [ADR 0024](0024-cloneable-repo-local-first-memory.md) memory sync is unaffected — it keys on `builder_id`, not on where the box runs.
 
 **Costs / what it commits us to:**
 - Real build work: author + test the devcontainer across a DO box and a laptop (the `sharp` native build is the usual snag), build the auto-suspend automation (DO has none native), wire prod-deploy to CI, build rank-gated box provisioning, and write the onboarding primer page.
@@ -152,7 +152,7 @@ The repo is **private** (today under a personal account — see §7; a move to a
 
 ### §9.2 — Onboarding repo-access scoping: rank-gated, server-issued, fetched-not-baked (2026-06-05, [#600](https://example.com/builders#/task/600))
 
-**Decision: the box holds NO baked credential — it fetches a rank-scoped clone spec from the GDS at boot + on a cron, gated on the builder's LIVE rank.** This extends the [ADR 0016](<redacted>.md) trust boundary from "writes are gated" to "source is gated": `GET /api/gds/box/source-access` (`requireBuilder`; the scope + allow/deny decided inside from the live DB rank, not a static `requireRank`) returns either a 403 or a scope-appropriate spec + a short-lived, operator-supplied credential.
+**Decision: the box holds NO baked credential — it fetches a rank-scoped clone spec from the GDS at boot + on a cron, gated on the builder's LIVE rank.** This extends the [ADR 0016](0016-trust-boundary-server-enforced-permissions.md) trust boundary from "writes are gated" to "source is gated": `GET /api/gds/box/source-access` (`requireBuilder`; the scope + allow/deny decided inside from the live DB rank, not a static `requireRank`) returns either a 403 or a scope-appropriate spec + a short-lived, operator-supplied credential.
 
 - **Scope by rank** (`src/bongos/box-access.js`, `boxScopeForRank` from [#598](https://example.com/builders#/task/598)): **Xenos → `starter`** (cone-mode sparse-checkout of `.devcontainer`, `art`, `docs`, `public-status`, `generative-ideas.md` — the "first tasks on a scoped surface" this question asked for); **Metic+ → `full`**. Graduation rescopes the box (the box re-clones the full surface on its next refresh). Fail-closed: any unknown scope collapses to `starter`.
 - **Credential is fetched, never baked** (`src/bongos/box-credential.js`, env-backed default; the secret lives in the prod env per [ADR 0022](0022-secrets-policy.md), `configured:false` until set). The box clones via a one-shot authenticated URL then scrubs the token from `.git/config` (`infra/box-source-fetch.sh`). Because access is re-checked live on every fetch, **revocation is instant at the credential layer** — a demoted/deactivated builder is 403'd on their next refresh.
@@ -197,7 +197,7 @@ Droplet-vs-pool was a *backend* choice; it did not address the newcomer on-ramp.
 
 ### §9.4 — Box onboarding middleware: an intent queue, never the DO token in the web process (2026-06-06, [#701](https://example.com/builders#/task/701))
 
-> **Superseded in part (2026-06-06, [ADR 0038](<redacted>.md)):** the `claude rc` Remote-Control pairing path in this section — `infra/box-report-pairing.sh`, the `box/pairing` + `box/pairing-link` routes, and the "box reports its link UP" Chromebook flow — is retired. `claude rc` can't run headless on a box (see ADR 0038 *Problem*). The browser-only on-ramp is now a box-served `ttyd` web terminal over a Cloudflare Tunnel. The intent-queue / `box/ensure` auto-provision + wake-on-connect machinery below is **unaffected**.
+> **Superseded in part (2026-06-06, [ADR 0038](0038-chromebook-ttyd-cloudflare-tunnel.md)):** the `claude rc` Remote-Control pairing path in this section — `infra/box-report-pairing.sh`, the `box/pairing` + `box/pairing-link` routes, and the "box reports its link UP" Chromebook flow — is retired. `claude rc` can't run headless on a box (see ADR 0038 *Problem*). The browser-only on-ramp is now a box-served `ttyd` web terminal over a Cloudflare Tunnel. The intent-queue / `box/ensure` auto-provision + wake-on-connect machinery below is **unaffected**.
 
 **Decision: the web process records a REQUEST (an "intent"); the control-plane runner executes it.** The hard constraint (§6 + the `routes/box.js` header) is that the internet-facing Node process must never hold `DO_API_TOKEN` — a stolen builder token could otherwise spin up or destroy infrastructure. So [#701](https://example.com/builders#/task/701) does NOT move provisioning into the web tier. Instead:
 

package/docs/adr/0032-discord-mirror-of-gds.md

@@ -1,7 +1,7 @@
 # ADR 0032 — Discord as a one-way mirror of the GDS (outbound broadcast moves off Google Chat)
 
 **Date:** 2026-06-04
-**Context:** GDS-V3, task [#607](https://example.com/builders#/task/607) (claim `#482`). Stands up a Discord server for Example / Example — one server, permission-walled into a player wing and a builder wing — and moves the ship-broadcast off Google Chat. Companion to [ADR 0016](<redacted>.md) (the trust boundary — the load-bearing constraint here), [ADR 0018](<redacted>.md) (Xenos → Metic → Archon, the ranks Discord roles mirror), [ADR 0022](0022-secrets-policy.md) (webhook URLs are secrets, kept out of the repo), and [ADR 0008](0008-google-chat-oauth-user-auth.md) (the Google Chat broadcast this supersedes for outbound).
+**Context:** GDS-V3, task [#607](https://example.com/builders#/task/607) (claim `#482`). Stands up a Discord server for Example / Example — one server, permission-walled into a player wing and a builder wing — and moves the ship-broadcast off Google Chat. Companion to [ADR 0016](0016-trust-boundary-server-enforced-permissions.md) (the trust boundary — the load-bearing constraint here), [ADR 0018](0018-three-rank-model-goes-live.md) (Xenos → Metic → Archon, the ranks Discord roles mirror), [ADR 0022](0022-secrets-policy.md) (webhook URLs are secrets, kept out of the repo), and [ADR 0008](0008-google-chat-oauth-user-auth.md) (the Google Chat broadcast this supersedes for outbound).
 **Status:** Accepted. Phase 2 (outbound ship broadcast → Discord) implemented in [#607](https://example.com/builders#/task/607). Phases 3+ (interaction bot, inbound retirement, role sync) scoped below, not yet built.
 **Track:** `internal` (dev-system / team communication).
 
@@ -22,7 +22,7 @@ The temptation, standing up Discord, is to let it *own* things — roles that gr
 
 1. **One server, two role families, permission-walled.** A public (player) wing and a builder-only wing in a single server. Builder roles **mirror** the live GDS ranks (Xenos / Metic / Archon) and gate the builder wing; players get a `Citizen` baseline (a `Patron` tier later, once purchases ship).
 
-2. **Discord roles are cosmetic, never authoritative ([ADR 0016](<redacted>.md)).** A Discord "Archon" badge unlocks Discord *channels* and nothing else. Authority stays in `builders.rank` on the prod DB, re-checked server-side per request. A Discord role is a *sticker*; the GDS holds the *keys*. Roles reflect what the DB already says — they never decide it. When a future bot auto-assigns roles, it reads `builders.rank` and writes the Discord role, never the reverse.
+2. **Discord roles are cosmetic, never authoritative ([ADR 0016](0016-trust-boundary-server-enforced-permissions.md)).** A Discord "Archon" badge unlocks Discord *channels* and nothing else. Authority stays in `builders.rank` on the prod DB, re-checked server-side per request. A Discord role is a *sticker*; the GDS holds the *keys*. Roles reflect what the DB already says — they never decide it. When a future bot auto-assigns roles, it reads `builders.rank` and writes the Discord role, never the reverse.
 
 3. **The GDS stays the single source of truth.** Logs mirror *into* Discord (webhooks, one-way). "Upvotes" arrive as Discord reactions that a bot writes *back* to the GDS as `peer_upvote` karma / idea votes — Discord is the input device, the GDS records the fact. No state's canonical home moves to Discord.
 
@@ -44,7 +44,7 @@ The temptation, standing up Discord, is to let it *own* things — roles that gr
 ## Alternatives considered
 
 - **Separate servers for builders vs players.** Rejected — one server with a permission-walled builder wing is the standard pattern and keeps the community in one place.
-- **Discord roles grant real permissions.** Rejected outright — violates [ADR 0016](<redacted>.md). Anything a builder's Discord membership could grant must be re-derived server-side from `builders.rank`.
+- **Discord roles grant real permissions.** Rejected outright — violates [ADR 0016](0016-trust-boundary-server-enforced-permissions.md). Anything a builder's Discord membership could grant must be re-derived server-side from `builders.rank`.
 - **Move idea votes / karma canonical into Discord.** Rejected — the GDS stays source of truth; Discord is an input surface whose reactions a bot writes back.
 - **Mirror outbound to both Google Chat and Discord.** Rejected — replace, don't double-post; the community consolidates on Discord. Google Chat keeps only its inbound role until Phase 3.
 - **A Discord bot (gateway) for outbound too.** Rejected for Phase 2 — a webhook is a one-line HTTP POST with no token or process to host; the bot is only needed for *reading* (Phase 3).

package/docs/adr/0033-discord-bot-service-principal.md

@@ -1,7 +1,7 @@
 # ADR 0033 — Discord bot as a service principal (account-linking, both-mode upvoting, role-sync, inbound retirement)
 
 **Date:** 2026-06-04
-**Context:** GDS-V3, task [#619](https://example.com/builders#/task/619). Phase 3 of the Discord integration begun in [ADR 0032](0032-discord-mirror-of-gds.md) ([#607](https://example.com/builders#/task/607)). Where Phase 2 was a one-way webhook (no identity, no inbound), Phase 3 adds a **bot** — a persistent connection that reads reactions/messages and assigns roles — which means Discord *actions* now trigger GDS *writes*. That lands on the trust boundary. Companion to [ADR 0016](<redacted>.md) (the boundary), [ADR 0026](<redacted>.md) (the service-principal + identity-gate pattern this reuses), [ADR 0018](<redacted>.md) (the ranks role-sync mirrors), [ADR 0022](0022-secrets-policy.md) (bot token + OAuth secret), and [ADR 0008](0008-google-chat-oauth-user-auth.md) (the inbound path this retires).
+**Context:** GDS-V3, task [#619](https://example.com/builders#/task/619). Phase 3 of the Discord integration begun in [ADR 0032](0032-discord-mirror-of-gds.md) ([#607](https://example.com/builders#/task/607)). Where Phase 2 was a one-way webhook (no identity, no inbound), Phase 3 adds a **bot** — a persistent connection that reads reactions/messages and assigns roles — which means Discord *actions* now trigger GDS *writes*. That lands on the trust boundary. Companion to [ADR 0016](0016-trust-boundary-server-enforced-permissions.md) (the boundary), [ADR 0026](0026-bfg-memory-hygiene-and-cross-builder-learning.md) (the service-principal + identity-gate pattern this reuses), [ADR 0018](0018-three-rank-model-goes-live.md) (the ranks role-sync mirrors), [ADR 0022](0022-secrets-policy.md) (bot token + OAuth secret), and [ADR 0008](0008-google-chat-oauth-user-auth.md) (the inbound path this retires).
 **Status:** Accepted (design). Implementation seeded as separate sub-tasks (listed at the end); nothing here is built yet. Foundation build is blocked on creating the Discord bot application.
 **Track:** `internal` (dev-system / team communication).
 
@@ -15,13 +15,13 @@ ADR 0032 established that Discord is a one-way mirror of the GDS. Phase 2 honore
 - **Role-sync** — builder ranks should appear as Discord role badges.
 - **Inbound** — team messages in Discord should become ideas, retiring the Google Chat inbound path.
 
-The first and third make a **Discord event cause a GDS write**. Naively, a bot with a database connection could just write karma or votes. That would re-open exactly the hole [ADR 0016](<redacted>.md) closes: an actor *outside* the trust boundary deciding authoritative state. We need a design where the bot can act **without ever becoming an authority**.
+The first and third make a **Discord event cause a GDS write**. Naively, a bot with a database connection could just write karma or votes. That would re-open exactly the hole [ADR 0016](0016-trust-boundary-server-enforced-permissions.md) closes: an actor *outside* the trust boundary deciding authoritative state. We need a design where the bot can act **without ever becoming an authority**.
 
 ## Decision
 
 ### 1. The bot is a service principal — trusted for identity, never for authorization
 
-The bot authenticates to the GDS as a dedicated **service principal** (`system_role = 'discord_bot'`), gated by a `requireDiscordBot` middleware that checks that exact identity — **not** a rank. This is the same shape the BFG cross-builder write path uses ([ADR 0026 §6C](<redacted>.md)): a stolen or rank-escalated *human* token has `system_role = NULL` and is rejected; only the bot principal's row passes.
+The bot authenticates to the GDS as a dedicated **service principal** (`system_role = 'discord_bot'`), gated by a `requireDiscordBot` middleware that checks that exact identity — **not** a rank. This is the same shape the BFG cross-builder write path uses ([ADR 0026 §6C](0026-bfg-memory-hygiene-and-cross-builder-learning.md)): a stolen or rank-escalated *human* token has `system_role = NULL` and is rejected; only the bot principal's row passes.
 
 The principal is trusted for **one** thing: asserting "this Discord user, who reacted/posted, is linked builder X." It is **never** trusted to decide what X may do. Every write the bot triggers re-derives authorization from **X's live `builders.rank`** server-side, through the same guards the web/CLI paths use. The bot cannot escalate; at most it can mis-report *which linked user* acted, and that blast radius is bounded (below).
 
@@ -64,7 +64,7 @@ The bot runs **in-process** in the existing Node server as a module, behind a `D
 
 ## Alternatives considered
 
-- **Bot writes karma/votes directly (its own DB access).** Rejected — it makes the bot an authority and re-opens [ADR 0016](<redacted>.md). The principal + per-write rank re-check is the whole point.
+- **Bot writes karma/votes directly (its own DB access).** Rejected — it makes the bot an authority and re-opens [ADR 0016](0016-trust-boundary-server-enforced-permissions.md). The principal + per-write rank re-check is the whole point.
 - **Trust Discord roles for authorization.** Rejected outright (ADR 0016 / 0032 §2): roles are cosmetic reflections, never keys.
 - **Map Discord→builder by matching usernames (no OAuth link).** Rejected — unverified and spoofable; identity must be self-asserted by the builder.
 - **A separate bot process / service.** Considered; in-process behind a kill-switch is simpler for one droplet. Revisit if the connection destabilizes the web process.

package/docs/adr/0034-thetes-graduated-newcomer-rank.md

@@ -1,7 +1,7 @@
 # ADR 0034 — `thetes`: a 4th live rank for graduated newcomers, with auto-graduation after 3 ships
 
 **Date:** 2026-06-05
-**Context:** GDS-V3, task [#692](https://example.com/builders#/task/692). Amends [ADR 0018](<redacted>.md) (the three-rank model). Companion to [ADR 0016](<redacted>.md) (server-enforced permissions) and the newcomer-supply work (the `newcomer-generator` routine). Role-sync mirrors it to Discord per [ADR 0033](<redacted>.md).
+**Context:** GDS-V3, task [#692](https://example.com/builders#/task/692). Amends [ADR 0018](0018-three-rank-model-goes-live.md) (the three-rank model). Companion to [ADR 0016](0016-trust-boundary-server-enforced-permissions.md) (server-enforced permissions) and the newcomer-supply work (the `newcomer-generator` routine). Role-sync mirrors it to Discord per [ADR 0033](0033-discord-bot-service-principal.md).
 **Status:** Accepted + shipped.
 **Track:** `internal` (dev-system / builder onboarding).
 

package/docs/adr/0035-builder-onboarding-three-paths.md

@@ -1,11 +1,11 @@
 # ADR 0035 — Builder onboarding: three setup paths (Local / DO Box / Remote Control)
 
 **Date:** 2026-06-06
-**Context:** GDS-V3, task [#715](https://example.com/builders#/task/715). Feeds done-when criterion **C1** (`a Metic onboards in ≤ 2h`). This ADR is the *onboarding-as-experience* companion to [ADR 0031](<redacted>.md), which locked the **substrate** (the containerized DO box, auto-suspend, rank-gated source access) but never consolidated how a person actually *arrives*. Builds on [ADR 0034](<redacted>.md) (the `xenos < thetes < metic < archon` ladder), [ADR 0016](<redacted>.md) (server-enforced permissions), [ADR 0022](0022-secrets-policy.md) (no secrets in repo), and the box onboarding middleware shipped in [#701](https://example.com/builders#/task/701) (§9.4 of ADR 0031).
-**Status:** Accepted — §2 (the first-box Archon approval gate) superseded by [ADR 0059](<redacted>.md). *Decision record — locks the onboarding shape and three new policy decisions. The box-lane machinery already exists (ADR 0031 + [#701](https://example.com/builders#/task/701)); the deltas this ADR introduces (the Metic+ local gate, the first-box approval gate, the single hosted guide surface, the primer rewrite) are implementation sub-tasks listed at the end and are NOT yet built.*
+**Context:** GDS-V3, task [#715](https://example.com/builders#/task/715). Feeds done-when criterion **C1** (`a Metic onboards in ≤ 2h`). This ADR is the *onboarding-as-experience* companion to [ADR 0031](0031-cloud-dev-environments-for-builders.md), which locked the **substrate** (the containerized DO box, auto-suspend, rank-gated source access) but never consolidated how a person actually *arrives*. Builds on [ADR 0034](0034-thetes-graduated-newcomer-rank.md) (the `xenos < thetes < metic < archon` ladder), [ADR 0016](0016-trust-boundary-server-enforced-permissions.md) (server-enforced permissions), [ADR 0022](0022-secrets-policy.md) (no secrets in repo), and the box onboarding middleware shipped in [#701](https://example.com/builders#/task/701) (§9.4 of ADR 0031).
+**Status:** Accepted — §2 (the first-box Archon approval gate) superseded by [ADR 0059](0059-single-approval-remove-devbox-approval-gate.md). *Decision record — locks the onboarding shape and three new policy decisions. The box-lane machinery already exists (ADR 0031 + [#701](https://example.com/builders#/task/701)); the deltas this ADR introduces (the Metic+ local gate, the first-box approval gate, the single hosted guide surface, the primer rewrite) are implementation sub-tasks listed at the end and are NOT yet built.*
 **Track:** `internal` (dev-system / builder onboarding).
 
-> **⚠️ Superseded in part by [ADR 0059](<redacted>.md) (task [#1141](https://example.com/builders#/task/1141)).** Decision **§2 — "A newcomer's FIRST box requires Archon approval"** is **removed**: with admission now invite-gated ([ADR 0050](<redacted>.md)), member-join is the sole human gate, and an admitted builder's first box now provisions hands-off. §1 (Metic+ local clone) and §3 (the single hosted guide) stand unchanged. Read §2 below as historical.
+> **⚠️ Superseded in part by [ADR 0059](0059-single-approval-remove-devbox-approval-gate.md) (task [#1141](https://example.com/builders#/task/1141)).** Decision **§2 — "A newcomer's FIRST box requires Archon approval"** is **removed**: with admission now invite-gated ([ADR 0050](0050-device-flow-admission-invite-gated-by-default.md)), member-join is the sole human gate, and an admitted builder's first box now provisions hands-off. §1 (Metic+ local clone) and §3 (the single hosted guide) stand unchanged. Read §2 below as historical.
 
 ## Problem
 
@@ -44,7 +44,7 @@ Onboarding sorts every builder into exactly one of three on-ramps. All three sha
 
 ### Path 3 — Remote Control (Chromebook / thin devices)
 
-> **⚠️ Superseded by [ADR 0038](<redacted>.md).** The `claude rc` headless-service mechanism described below was retired — a headless box cannot bootstrap `claude rc` (interactive-only Trusted-Devices enrollment). The box now serves its own `ttyd` browser terminal over a Cloudflare Tunnel where the builder runs normal interactive `claude`. The Path-3 *intent* (a browser-only thin-device on-ramp to the same per-builder box) stands; the `claude rc`-as-always-on-service mechanics below are historical.
+> **⚠️ Superseded by [ADR 0038](0038-chromebook-ttyd-cloudflare-tunnel.md).** The `claude rc` headless-service mechanism described below was retired — a headless box cannot bootstrap `claude rc` (interactive-only Trusted-Devices enrollment). The box now serves its own `ttyd` browser terminal over a Cloudflare Tunnel where the builder runs normal interactive `claude`. The Path-3 *intent* (a browser-only thin-device on-ramp to the same per-builder box) stands; the `claude rc`-as-always-on-service mechanics below are historical.
 
 - **User group.** Users on a device that cannot run Claude Desktop (a literal Chromebook, an iPad, a phone).
 - **What it is.** Identical to Path 2 — the same per-builder box — but reached from a browser via Claude's Remote-Control (`claude rc` running as an always-on service on the box).

package/docs/adr/0036-builders-subdomain-and-ui-reorg.md

@@ -1,7 +1,7 @@
 # ADR 0036 — Builders subdomain + builder-UI reorganization (hall / watch / settings / status)
 
 **Date:** 2026-06-06
-**Context:** GDS-V3, task [#726](https://example.com/builders#/task/726). Builds on [ADR 0016](<redacted>.md) (server-enforced permissions), [ADR 0029](<redacted>.md) / [ADR 0030](<redacted>.md) (the status + hall surfaces being reorganized), and the asset-stamping serving model in `server.js` / `src/asset-version.js`.
+**Context:** GDS-V3, task [#726](https://example.com/builders#/task/726). Builds on [ADR 0016](0016-trust-boundary-server-enforced-permissions.md) (server-enforced permissions), [ADR 0029](0029-status-page-outage-resilience.md) / [ADR 0030](0030-builders-hall-live-updates.md) (the status + hall surfaces being reorganized), and the asset-stamping serving model in `server.js` / `src/asset-version.js`.
 **Status:** Accepted. Shipped under [#726](https://example.com/builders#/task/726) (grader skipped at Lars's instruction — UI/infra reorg, no logic the grader gates).
 **Track:** `internal` (dev-system / builder UI).
 

package/docs/adr/0037-discord-channel-management.md

@@ -2,7 +2,7 @@
 
 **Status:** Accepted — 2026-06-06
 **Context task:** [#727](https://example.com/builders#/task/727) (GDS-V3). Absorbs idea_inbox [#200](https://example.com/builders#/idea/200) ("discord builders channel role access auto managed by the example bot").
-**Companions:** [ADR 0032](0032-discord-mirror-of-gds.md) (Discord = one-way window into the GDS), [ADR 0033](<redacted>.md) (the bot is a service principal, never an authority), [ADR 0016](<redacted>.md) (the trust boundary), [ADR 0026 §6C](<redacted>.md) (the <redacted> write pattern this reuses).
+**Companions:** [ADR 0032](0032-discord-mirror-of-gds.md) (Discord = one-way window into the GDS), [ADR 0033](0033-discord-bot-service-principal.md) (the bot is a service principal, never an authority), [ADR 0016](0016-trust-boundary-server-enforced-permissions.md) (the trust boundary), [ADR 0026 §6C](0026-bfg-memory-hygiene-and-cross-builder-learning.md) (the <redacted> write pattern this reuses).
 
 ## Context
 

package/docs/adr/0038-chromebook-ttyd-cloudflare-tunnel.md

@@ -1,15 +1,15 @@
 # ADR 0038 — Chromebook / browser on-ramp via a box-hosted ttyd web terminal over a Cloudflare Tunnel
 
 **Date:** 2026-06-06
-**Context:** GDS-V3, task [#760](https://example.com/builders#/task/760). Feeds done-when criterion **C1** (`a Metic onboards in ≤ 2h`) by restoring a *working* thin-device on-ramp. Companion to [ADR 0031](<redacted>.md) (the per-builder DigitalOcean box substrate), [ADR 0035](<redacted>.md) (the three onboarding paths), [ADR 0016](<redacted>.md) (server-enforced trust boundary — the web tier only *asks*, never holds infra power), and [ADR 0022](0022-secrets-policy.md) (no secrets in repo).
-**Status:** Accepted. **Supersedes the Remote-Control (path 3) approach** in [ADR 0035](<redacted>.md) Path 3 and [ADR 0031](<redacted>.md) §1 / §9.4 (the `claude rc` thin-device on-ramp). Implemented this session under [#760](https://example.com/builders#/task/760).
+**Context:** GDS-V3, task [#760](https://example.com/builders#/task/760). Feeds done-when criterion **C1** (`a Metic onboards in ≤ 2h`) by restoring a *working* thin-device on-ramp. Companion to [ADR 0031](0031-cloud-dev-environments-for-builders.md) (the per-builder DigitalOcean box substrate), [ADR 0035](0035-builder-onboarding-three-paths.md) (the three onboarding paths), [ADR 0016](0016-trust-boundary-server-enforced-permissions.md) (server-enforced trust boundary — the web tier only *asks*, never holds infra power), and [ADR 0022](0022-secrets-policy.md) (no secrets in repo).
+**Status:** Accepted. **Supersedes the Remote-Control (path 3) approach** in [ADR 0035](0035-builder-onboarding-three-paths.md) Path 3 and [ADR 0031](0031-cloud-dev-environments-for-builders.md) §1 / §9.4 (the `claude rc` thin-device on-ramp). Implemented this session under [#760](https://example.com/builders#/task/760).
 
-> **Update (2026-06-07, [ADR 0040](<redacted>.md)):** the "Remote Control is unfixable" conclusion below was specific to running RC *headless, as a background service*. Once this ADR's ttyd web terminal put a real human at a real PTY, Remote Control works — started in-session with `/remote-control` (not the standalone `claude rc`). RC is now the **default** browser-only experience (shipped in [#807](https://example.com/builders#/task/807)); the ttyd terminal is its one-time launchpad. The blockers in *Problem* still hold for *headless* RC. See ADR 0040.
+> **Update (2026-06-07, [ADR 0040](0040-remote-control-default-browser-onramp.md)):** the "Remote Control is unfixable" conclusion below was specific to running RC *headless, as a background service*. Once this ADR's ttyd web terminal put a real human at a real PTY, Remote Control works — started in-session with `/remote-control` (not the standalone `claude rc`). RC is now the **default** browser-only experience (shipped in [#807](https://example.com/builders#/task/807)); the ttyd terminal is its one-time launchpad. The blockers in *Problem* still hold for *headless* RC. See ADR 0040.
 **Track:** `internal` (dev-system / builder onboarding).
 
 ## Problem
 
-A per-builder cloud dev box ([ADR 0031](<redacted>.md)) is reached two ways: Mac/Windows builders via Claude Desktop + SSH (works), and Chromebook / browser-only builders via — originally — Claude's **Remote Control** (`claude rc`) running as a headless systemd service (`infra/claude-rc.service`), with the box publishing a claude.ai pairing link UP to the GDS so the builder reaches it from a browser ([ADR 0031](<redacted>.md) §9.4, [#701](https://example.com/builders#/task/701)).
+A per-builder cloud dev box ([ADR 0031](0031-cloud-dev-environments-for-builders.md)) is reached two ways: Mac/Windows builders via Claude Desktop + SSH (works), and Chromebook / browser-only builders via — originally — Claude's **Remote Control** (`claude rc`) running as a headless systemd service (`infra/claude-rc.service`), with the box publishing a claude.ai pairing link UP to the GDS so the builder reaches it from a browser ([ADR 0031](0031-cloud-dev-environments-for-builders.md) §9.4, [#701](https://example.com/builders#/task/701)).
 
 Task [#745](https://example.com/builders#/task/745) leg-5 verification-tested that path on hardware and found it **broken end to end**. This session's research (June 2026, Claude Code CLI v2.1.x) confirmed it is **not** fixable by plumbing — there are three hard blockers, all on Anthropic's side and by design:
 
@@ -47,7 +47,7 @@ The box reports its current terminal URL + credential UP to the GDS (`POST /api/
 - **Localhost binding.** ttyd binds to `127.0.0.1` — only the tunnel reaches it.
 - **Basic auth.** HTTP basic auth with a per-box random password, stored mode-600 at `/etc/otb/terminal-credential` and persisted in the box snapshot across park/wake.
 - **Secret containment.** The credential is returned ONLY to the box's own builder via `GET /box/terminal`; it never appears on any public surface or in `box_events`.
-- **Revocation.** Rides the existing rank/status gate + box reconcile: a demoted/deactivated builder loses source access and the box is deprovisioned ([ADR 0031](<redacted>.md) §9.2).
+- **Revocation.** Rides the existing rank/status gate + box reconcile: a demoted/deactivated builder loses source access and the box is deprovisioned ([ADR 0031](0031-cloud-dev-environments-for-builders.md) §9.2).
 - **Defense in depth.** An unguessable tunnel URL **and** basic auth, both over HTTPS.
 
 ## Consequences

package/docs/adr/0039-setup-first-onboarding-ux.md

@@ -1,7 +1,7 @@
 # ADR 0039 — Setup-first onboarding UX: two-config selector + action-only Path checklist
 
 **Date:** 2026-06-06
-**Context:** GDS-V3, task [#777](https://example.com/builders#/task/777). Feeds done-when criterion **C1** (`a newcomer onboards in ≤ 2h`). Builds on [ADR 0035](<redacted>.md) (three onboarding paths), [ADR 0038](<redacted>.md) (the box-hosted ttyd browser terminal, now hardware-verified under [#771](https://example.com/builders#/task/771)), [ADR 0033](<redacted>.md) (the Discord OAuth account-link + auto-join), and [ADR 0034](<redacted>.md)/[#692](https://example.com/builders#/task/692) (the 3-ship xenos→thetes promotion).
+**Context:** GDS-V3, task [#777](https://example.com/builders#/task/777). Feeds done-when criterion **C1** (`a newcomer onboards in ≤ 2h`). Builds on [ADR 0035](0035-builder-onboarding-three-paths.md) (three onboarding paths), [ADR 0038](0038-chromebook-ttyd-cloudflare-tunnel.md) (the box-hosted ttyd browser terminal, now hardware-verified under [#771](https://example.com/builders#/task/771)), [ADR 0033](0033-discord-bot-service-principal.md) (the Discord OAuth account-link + auto-join), and [ADR 0034](0034-thetes-graduated-newcomer-rank.md)/[#692](https://example.com/builders#/task/692) (the 3-ship xenos→thetes promotion).
 **Status:** Accepted. Implemented this session under [#777](https://example.com/builders#/task/777).
 **Track:** `internal` (dev-system / builder onboarding).
 
@@ -9,7 +9,7 @@
 
 The builders'-hall onboarding (the "Welcome to the Hall" panel + the "Path into the City" checklist) had two faults for a **zero-technical** newcomer who **won't read paragraphs**:
 
-1. **Setup and milestones were tangled.** The welcome panel mixed *how to get a working environment* (install Claude Code, clone the repo, run `/builder-setup`) with *what to do next*, in dense prose. It also still told newcomers to clone a repo locally — but post-[ADR 0035](<redacted>.md) a Xenos is **box-only** and never clones anything to their own machine.
+1. **Setup and milestones were tangled.** The welcome panel mixed *how to get a working environment* (install Claude Code, clone the repo, run `/builder-setup`) with *what to do next*, in dense prose. It also still told newcomers to clone a repo locally — but post-[ADR 0035](0035-builder-onboarding-three-paths.md) a Xenos is **box-only** and never clones anything to their own machine.
 2. **The first checklist step was redundant.** "Bear the city's seal" (GitHub sign-in) is already done — a builder signed in with GitHub to even see the page.
 
 ## Decision
@@ -18,20 +18,20 @@ The builders'-hall onboarding (the "Welcome to the Hall" panel + the "Path into
 
 ### 1. Setup screen — pick how you connect to your dev box
 
-Both configs reach the SAME hosted dev box (Xenos are box-only, [ADR 0035](<redacted>.md)); the choice is only the *client*:
+Both configs reach the SAME hosted dev box (Xenos are box-only, [ADR 0035](0035-builder-onboarding-three-paths.md)); the choice is only the *client*:
 
 - **Claude Desktop app (recommended)** — install the desktop app, open it on an empty folder, then paste a single instruction telling Claude to **read the hosted connect guide** (`GET /api/gds/box/connect`) and follow it. That guide (already served, public, no secrets) runs the OS-appropriate `box-connect` bootstrap (device-flow GitHub sign-in + SSH key + Desktop connection file). Then connect via *Code → Environment → "Example Dev Box"*.
-- **Claude Online (browser only)** — no install; the hall **delivers the box terminal automatically**: one "Set up my dev box" button calls `POST /box/ensure` (auto-provision/wake; [#701](https://example.com/builders#/task/701)) and polls `GET /box/terminal`, then shows the ttyd URL + password ([ADR 0038](<redacted>.md)) right in the panel. Open it and type `claude`. No SSH, no `#support` relay.
+- **Claude Online (browser only)** — no install; the hall **delivers the box terminal automatically**: one "Set up my dev box" button calls `POST /box/ensure` (auto-provision/wake; [#701](https://example.com/builders#/task/701)) and polls `GET /box/terminal`, then shows the ttyd URL + password ([ADR 0038](0038-chromebook-ttyd-cloudflare-tunnel.md)) right in the panel. Open it and type `claude`. No SSH, no `#support` relay.
 
 **Why the hosted guide (not "type a `/builder-*` command"):** a brand-new builder has no repo and therefore none of the project's `/builder-*` skills locally. Pointing Claude at the public guide URL is self-contained — Claude fetches it and runs the bootstrap with nothing pre-installed. The bootstrap self-authenticates via device flow, so it does **not** require `/builder-setup` first.
 
-Steps are short, scannable, and plain-spoken (the Mediterranean theme stays in the headings). The repo-clone walkthrough — and the `/public/repo-info` fetch that fed it — is removed from the newcomer panel. Getting the box itself is requested in Discord `#support` (an Archon provisions it — the [ADR 0035](<redacted>.md) §2 first-box cost gate).
+Steps are short, scannable, and plain-spoken (the Mediterranean theme stays in the headings). The repo-clone walkthrough — and the `/public/repo-info` fetch that fed it — is removed from the newcomer panel. Getting the box itself is requested in Discord `#support` (an Archon provisions it — the [ADR 0035](0035-builder-onboarding-three-paths.md) §2 first-box cost gate).
 
 ### 2. "The Path into the City" — orientation, action-only, all auto-detected
 
 Four displayed steps: **Join the Discord server** → **Choose thy craft** → **Run `/builder-setup`** → **Ship three works — and rise to Thetes**. The redundant GitHub-sign-in step is dropped from display, as are `first_start`/`first_claim` (implied by shipping). **Every step auto-detects — no manual ticking** ("the city watches"):
 
-- **join_discord** clears when the builder links Discord. The button runs the **existing** OAuth flow (`GET /api/gds/auth/discord/start`, [ADR 0033](<redacted>.md)) — same control as `/builders/settings` — which auto-joins the guild + assigns the rank role; `discord.linked` then reads true. No new Discord backend.
+- **join_discord** clears when the builder links Discord. The button runs the **existing** OAuth flow (`GET /api/gds/auth/discord/start`, [ADR 0033](0033-discord-bot-service-principal.md)) — same control as `/builders/settings` — which auto-joins the guild + assigns the rank role; `discord.linked` then reads true. No new Discord backend.
 - **cli_setup** clears once the builder has authenticated the GDS CLI — i.e. run `/builder-setup` (or the box-connect bootstrap); both mint a `source='cli'` session. Detected via `db.hasCliSession` (an `EXISTS` over `builder_sessions`); no manual mark.
 - **pick_disciplines** / **ship_three** are the existing engine-backed steps (craft picker; 3-ship counter).
 

package/docs/adr/0040-remote-control-default-browser-onramp.md

@@ -1,9 +1,9 @@
 # ADR 0040 — Remote Control is the default browser-only on-ramp (reversing 0038's "RC is dead" verdict)
 
-- **Status:** Accepted. **Reverses the "Remote Control is unfixable" conclusion of [ADR 0038](<redacted>.md)** (tasks [#745](https://example.com/builders#/task/745) / [#760](https://example.com/builders#/task/760)). Implemented in the onboarding/Settings work under [#807](https://example.com/builders#/task/807); recorded here under [#838](https://example.com/builders#/task/838); remaining legs (cloud-init trust pre-seed + the connect-guide / recipe-Part-2 rewrites that lead browser-only builders into the Claude app via `/remote-control`) landed under [#824](https://example.com/builders#/task/824).
+- **Status:** Accepted. **Reverses the "Remote Control is unfixable" conclusion of [ADR 0038](0038-chromebook-ttyd-cloudflare-tunnel.md)** (tasks [#745](https://example.com/builders#/task/745) / [#760](https://example.com/builders#/task/760)). Implemented in the onboarding/Settings work under [#807](https://example.com/builders#/task/807); recorded here under [#838](https://example.com/builders#/task/838); remaining legs (cloud-init trust pre-seed + the connect-guide / recipe-Part-2 rewrites that lead browser-only builders into the Claude app via `/remote-control`) landed under [#824](https://example.com/builders#/task/824).
 - **Date:** 2026-06-07 (trust pre-seed leg: 2026-06-29, [#824](https://example.com/builders#/task/824))
 - **Track:** `internal` (dev-system / builder onboarding)
-- **Builds on:** [ADR 0038](<redacted>.md) (ttyd web terminal + Cloudflare Tunnel), [ADR 0031](<redacted>.md), [ADR 0035](<redacted>.md), [ADR 0039](<redacted>.md), [ADR 0016](<redacted>.md)
+- **Builds on:** [ADR 0038](0038-chromebook-ttyd-cloudflare-tunnel.md) (ttyd web terminal + Cloudflare Tunnel), [ADR 0031](0031-cloud-dev-environments-for-builders.md), [ADR 0035](0035-builder-onboarding-three-paths.md), [ADR 0039](0039-setup-first-onboarding-ux.md), [ADR 0016](0016-trust-boundary-server-enforced-permissions.md)
 
 ## Context
 
@@ -36,7 +36,7 @@ The ttyd terminal (ADR 0038) is retained but its role narrows to a **one-time la
 ### What we explicitly do NOT do
 
 - **No headless RC, no `claude-rc.service`.** ADR 0038 was right that RC can't run as a backgrounded service. RC is always started by a human in the ttyd terminal. The `claude-rc.service` / `box-report-pairing.sh` units deleted in [#760](https://example.com/builders#/task/760) stay deleted. (A stale comment in `infra/builder-box-cloud-init.yaml` still referenced the deleted unit; cleaned up under [#838](https://example.com/builders#/task/838).)
-- **No token funneled to the box for RC.** RC authenticates through the builder's own interactive browser `/login` in the ttyd terminal — the same full-scope OAuth ADR 0038 relies on. The trust boundary ([ADR 0016](<redacted>.md)) is unchanged: no Anthropic credential is baked onto the box.
+- **No token funneled to the box for RC.** RC authenticates through the builder's own interactive browser `/login` in the ttyd terminal — the same full-scope OAuth ADR 0038 relies on. The trust boundary ([ADR 0016](0016-trust-boundary-server-enforced-permissions.md)) is unchanged: no Anthropic credential is baked onto the box.
 - **Workspace trust IS now pre-seeded — but as a NON-load-bearing convenience ([#824](https://example.com/builders#/task/824), updating the original deferral).** The cloud-init writes `/root/.claude.json` with `<redacted>` for `/root` + `/workspace` so the first `claude` launch usually skips the trust dialog before the builder reaches `/remote-control`. It is **deliberately best-effort**: the seed runs only when `/root/.claude.json` is absent (it never clobbers a config `claude` later writes), and upstream pre-seeding is known to be flaky ([#9113](https://github.com/anthropics/claude-code/issues/9113)). So nothing depends on it working — if it doesn't take, the builder accepts trust once during sign-in exactly as before. This is a one-keypress smoother, NOT a security control: trust is a UI convenience, and the real trust boundary is unchanged (no Anthropic credential is baked; auth is the builder's own interactive `/login`). The deferred question of whether RC can be spun up without the separate-window terminal dance at all remains open (idea_inbox).
 
 ## Consequences

package/docs/adr/0041-temporary-grader-bypass-killswitch.md

@@ -3,7 +3,7 @@
 - **Status:** Accepted. Implemented in [#853](https://example.com/builders#/task/853).
 - **Date:** 2026-06-07
 - **Track:** `internal` (dev-system / shipping pipeline)
-- **Builds on:** [ADR 0016](<redacted>.md) (server-enforced permissions / trust boundary), [ADR 0024](<redacted>.md) (the grader)
+- **Builds on:** [ADR 0016](0016-trust-boundary-server-enforced-permissions.md) (server-enforced permissions / trust boundary), [ADR 0024](0024-multi-agent-system-architecture.md) (the grader)
 
 ## Context
 
@@ -23,7 +23,7 @@ Add a **server-side, default-OFF environment kill-switch**: `GRADER_BYPASS_ENABL
 
 The flag is read **live on each request** — there is no caching. Flipping the env and redeploying is the entire on/off control; turning it off immediately re-arms the Archon-only gate and the normal grader flow.
 
-### Why this honors the trust boundary ([ADR 0016](<redacted>.md))
+### Why this honors the trust boundary ([ADR 0016](0016-trust-boundary-server-enforced-permissions.md))
 
 The relaxation is **server-side and default-OFF**. A builder editing local files (CLAUDE.md, ship.js, skills) cannot turn it on — only an operator with droplet env + deploy access can. When the env is unset, the system behaves exactly as before. The bypass is a deliberate, operator-controlled, logged, *temporary* widening — not a standing grant.
 

package/docs/adr/0042-builder-self-deploy-ci-auto-merge.md

@@ -1,7 +1,7 @@
 # ADR 0042 — Builder self-deploy: CI auto-deploy on main + PR auto-merge
 
 **Date:** 2026-06-07
-**Context:** GDS-V3, task [#679](https://example.com/builders#/task/679) (cut prod deploy over to CI). Completes the [#597](https://example.com/builders#/task/597) / [ADR 0031](<redacted>.md) §6 goal — *no builder box holds the production droplet SSH key*. Extends [ADR 0031](<redacted>.md) §6; re-applies [ADR 0016](<redacted>.md) to CI.
+**Context:** GDS-V3, task [#679](https://example.com/builders#/task/679) (cut prod deploy over to CI). Completes the [#597](https://example.com/builders#/task/597) / [ADR 0031](0031-cloud-dev-environments-for-builders.md) §6 goal — *no builder box holds the production droplet SSH key*. Extends [ADR 0031](0031-cloud-dev-environments-for-builders.md) §6; re-applies [ADR 0016](0016-trust-boundary-server-enforced-permissions.md) to CI.
 **Status:** Accepted — **armed in production 2026-06-13** (interim, grader-off variant — task [#859](https://example.com/builders#/task/859); `config/deploy.json` `mode: ci`; see the *Arming record* below + session log [`<redacted>.md`](../session-logs/<redacted>.md)).
 
 ## Problem
@@ -31,7 +31,7 @@ The cutover is **atomic** — flipping `config/deploy.json` to `ci` must happen
 
 ### The auto-merge gate must be tamper-proof — the security crux
 
-With no human in the merge loop, **the CI checks *are* the authority**. The threat (per [ADR 0016](<redacted>.md)) is a trusted-but-bounded builder weakening the gate from inside their own PR. Two defenses:
+With no human in the merge loop, **the CI checks *are* the authority**. The threat (per [ADR 0016](0016-trust-boundary-server-enforced-permissions.md)) is a trusted-but-bounded builder weakening the gate from inside their own PR. Two defenses:
 
 1. **[`CODEOWNERS`](../../CODEOWNERS)** — a PR touching any gate surface (`.github/`, `config/deploy.json`, `ship.js`, the grader, `auth.js`/`route-rank-check.js`) **or any code that executes on the droplet at deploy** (`migrations/`, `scripts/migrate.sh`, `package.json`/`package-lock.json`, `scripts/deploy/` — `~/deploy.sh` runs migrations + `npm ci` from the merged tree, so a malicious migration or poisoned lockfile would otherwise auto-merge and run on prod) requires Archon review *even under auto-merge*, when branch protection has "Require review from Code Owners" on. Ordinary PRs (game, art, docs) carry no code owner and auto-merge freely — that's the point.
 
@@ -54,7 +54,7 @@ Until (1)–(5), the switch stays `laptop` and the operator lands work as today
 ## Consequences
 
 - **Builder `#25` and every future builder** can ship end to end from any machine (Windows, Chromebook, dev box) with no `main` checkout and no droplet key.
-- **The merge to `main` becomes the control checkpoint** — what reaches `main` goes live within ~1 min. Governance moves from "who holds the key" to "what the checks require + who reviews the gate" — squarely inside the [ADR 0016](<redacted>.md) model.
+- **The merge to `main` becomes the control checkpoint** — what reaches `main` goes live within ~1 min. Governance moves from "who holds the key" to "what the checks require + who reviews the gate" — squarely inside the [ADR 0016](0016-trust-boundary-server-enforced-permissions.md) model.
 - **New dependency:** `ci` mode uses the GitHub CLI (`gh`) on the builder's machine to open the PR + enable auto-merge. A follow-up either adds a `doctor.js` check for `gh` or moves PR creation server-side (the server already holds a GitHub principal) to drop the per-builder dependency.
 - **Deploy confirmation is workflow-run-based**, not commit-pinned at the edge (`/healthz` returns only `ok`). A follow-up can expose the running commit for a stricter edge assertion.
 
@@ -69,13 +69,13 @@ Until (1)–(5), the switch stays `laptop` and the operator lands work as today
 
 `ci` mode was **armed in production** on 2026-06-13 under task 859 — but as a deliberate
 **interim variant** that defers precondition 1 (the CI grade-gate), because the
-subagent grader was already globally bypassed (`GRADER_BYPASS_ENABLED=1`, [ADR 0041](<redacted>.md))
+subagent grader was already globally bypassed (`GRADER_BYPASS_ENABLED=1`, [ADR 0041](0041-temporary-grader-bypass-killswitch.md))
 during the provider outage. With the grader off everywhere, gating auto-merge on a
 *grade-gate* would be theater; instead the merge gate is:
 
 - **Required PR checks:** `unit` (the DB-free unit suite, task 856) + `trufflehog` (full-history secret scan). Both were red on `main` for unrelated reasons and were greened first: `anti_grid` (needs numpy, Node-only runner) moved to the unit runner's `KNOWN_FAILING` set; `tests/bfg.mjs` (deliberate fake-DSN fixtures) added to the secret-scan allowlist.
 - **Code-Owner review** on every gate surface (this repo's `CODEOWNERS`), now extended to the gate "brains" (`scripts/gds/run-unit-tests.js`, `.husky/`) so a PR cannot mute a test or allowlist a real secret unreviewed.
-- **Deploy-time `main-audit`** on the droplet (`~/deploy.sh` → `infra/deploy-main-audit-gate.sh`, [ADR 0043](<redacted>.md)) — reverts/blocks sub-Metic edits to permission-sensitive paths regardless of how they merged.
+- **Deploy-time `main-audit`** on the droplet (`~/deploy.sh` → `infra/deploy-main-audit-gate.sh`, [ADR 0043](0043-git-ssh-trust-boundary-and-rank-floor-on-permission-paths.md)) — reverts/blocks sub-Metic edits to permission-sensitive paths regardless of how they merged.
 
 What was set: `PROD_SSH_KEY` (a dedicated ed25519 deploy key, **forced-command `~/deploy.sh`** in the droplet's `authorized_keys`) + `DROPLET_KNOWN_HOSTS` secrets; repo var `PROD_DEPLOY_VIA_CI=true`; branch protection on `main` (require PR, required checks `unit`+`trufflehog`, require Code-Owner review, 0 ordinary approvals, block direct push for non-admins); repo auto-merge enabled; `config/deploy.json` → `ci`. `deploy-prod.yml` verified end-to-end (Actions → SSH → `~/deploy.sh` → public healthz) before the flip.
 

package/docs/adr/0043-git-ssh-trust-boundary-and-rank-floor-on-permission-paths.md

@@ -1,7 +1,7 @@
 # ADR 0043 — Git/SSH trust-boundary gap + a rank floor on permission-sensitive paths
 
 **Date:** 2026-06-08
-**Context:** SEC [#863](https://example.com/builders#/task/863) — the "Builder 25" incident. Extends [ADR 0016](<redacted>.md) (the HTTP trust boundary).
+**Context:** SEC [#863](https://example.com/builders#/task/863) — the "Builder 25" incident. Extends [ADR 0016](0016-trust-boundary-server-enforced-permissions.md) (the HTTP trust boundary).
 **Status:** Accepted. Implemented in part (Option A's protections); the full server-side merge+deploy and GitHub-native block are staged behind operator actions (blockers [#15](https://example.com/builders#/blocker/15)–[#17](https://example.com/builders#/task/17)).
 
 ## The incident
@@ -17,7 +17,7 @@ The SSH deploy failed (their box had no droplet key), but it didn't matter: the
 
 ## The gap
 
-[ADR 0016](<redacted>.md) put authority in `builders.rank` and enforced it **server-side per request** — but **only for `/api/gds/*` HTTP routes**. It explicitly does not cover two surfaces:
+[ADR 0016](0016-trust-boundary-server-enforced-permissions.md) put authority in `builders.rank` and enforced it **server-side per request** — but **only for `/api/gds/*` HTTP routes**. It explicitly does not cover two surfaces:
 
 1. **GitHub `main` is writable by every collaborator.** The repo is a **free-plan private repo**, so GitHub branch protection is *not available* ("Upgrade to GitHub Pro…"). All collaborators (`example-owner`, `LarsCode`, `willExample`, `IAMMASTERQUA`) have full push to `main`. The grader / confirm / rank gates live inside `ship.js` and the server — a raw `git push origin main` touches neither.
 2. **The legit pipeline itself distributes the dangerous credentials.** `ship.js` does the merge-to-`main` and `ssh …deploy.sh` **client-side, from the builder's machine** — so the design hands every shipping builder the exact credentials needed to bypass it.

package/docs/adr/0044-mediterranean-palette-replacement.md

@@ -8,7 +8,7 @@
 ## Context
 
 The art pipeline's locked palette is 64 colors extracted from the Pokémon FireRed
-reference corpus (`art/template/palette.json`), per [ADR 0008](./<redacted>.md)
+reference corpus (`art/template/palette.json`), per [ADR 0008](./0008-family-based-tile-generation.md)
 and the hard constraint in `art/template/style_guide.md` ([#3](https://example.com/builders#/task/3) "Locked palette"). Every
 output pixel must quantize to one of those 64 colors. Per CLAUDE.md §7.1, **any palette
 change is an ADR-level decision** because it ripples through every existing tile and the

package/docs/adr/0044-per-box-live-game-preview.md

@@ -1,7 +1,7 @@
 # ADR 0044 — Per-box live game preview (the builder sandbox)
 
 **Date:** 2026-06-10
-**Context:** GDS-V3, task [#897](https://example.com/builders#/task/897) (this ADR + the tunnel mechanism), wired into provisioning under [#898](https://example.com/builders#/task/898), hardware-verified under [#899](https://example.com/builders#/task/899). Companion to [ADR 0031](<redacted>.md) (per-builder DigitalOcean box substrate), [ADR 0038](<redacted>.md) (the box's ttyd terminal over a Cloudflare Tunnel — the mechanism this extends), and [ADR 0016](<redacted>.md) (the web tier only *asks*; the control plane holds infra power).
+**Context:** GDS-V3, task [#897](https://example.com/builders#/task/897) (this ADR + the tunnel mechanism), wired into provisioning under [#898](https://example.com/builders#/task/898), hardware-verified under [#899](https://example.com/builders#/task/899). Companion to [ADR 0031](0031-cloud-dev-environments-for-builders.md) (per-builder DigitalOcean box substrate), [ADR 0038](0038-chromebook-ttyd-cloudflare-tunnel.md) (the box's ttyd terminal over a Cloudflare Tunnel — the mechanism this extends), and [ADR 0016](0016-trust-boundary-server-enforced-permissions.md) (the web tier only *asks*; the control plane holds infra power).
 **Status:** Accepted. Mechanism implemented under [#897](https://example.com/builders#/task/897).
 **Track:** `internal` (dev-system / builder experience).
 

package/docs/adr/0046-sandbox-first-review-gate.md

@@ -1,7 +1,7 @@
 # ADR 0046 — Sandbox-first review in the dev-box ship flow
 
 **Date:** 2026-06-11
-**Context:** GDS-V3, task [#927](https://example.com/builders#/task/927). Builds directly on [ADR 0044](<redacted>.md) (the per-box live game preview / "sandbox") and the three-state ship lifecycle in `scripts/gds/ship.js` (Phase 5). Companion to [ADR 0031](<redacted>.md) (dev boxes) and [ADR 0016](<redacted>.md) (the gate is a workflow aid, not an authority surface).
+**Context:** GDS-V3, task [#927](https://example.com/builders#/task/927). Builds directly on [ADR 0044](0044-per-box-live-game-preview.md) (the per-box live game preview / "sandbox") and the three-state ship lifecycle in `scripts/gds/ship.js` (Phase 5). Companion to [ADR 0031](0031-cloud-dev-environments-for-builders.md) (dev boxes) and [ADR 0016](0016-trust-boundary-server-enforced-permissions.md) (the gate is a workflow aid, not an authority surface).
 **Status:** Accepted.
 **Track:** `internal` (dev-system / builder experience).