@bongos/core 1.19.714 → 1.19.724

package/docs/adr/0047-discord-bugs-intake-anti-abuse.md

@@ -3,7 +3,7 @@
 - **Status:** Accepted
 - **Date:** 2026-06-12
 - **Task:** [#931](https://example.com/builders#/task/931)
-- **Extends:** [ADR 0033](<redacted>.md) (Discord bot service principal, the `#ideas` → `idea_inbox` inbound path), [ADR 0016](<redacted>.md) (trust boundary), [ADR 0034](<redacted>.md) (the rank ladder this leans on)
+- **Extends:** [ADR 0033](0033-discord-bot-service-principal.md) (Discord bot service principal, the `#ideas` → `idea_inbox` inbound path), [ADR 0016](0016-trust-boundary-server-enforced-permissions.md) (trust boundary), [ADR 0034](0034-thetes-graduated-newcomer-rank.md) (the rank ladder this leans on)
 
 ## Context
 

package/docs/adr/0049-split-parallel-safety-contract.md

@@ -1,7 +1,7 @@
 # ADR 0049 — The split parallel-safety contract (detect-at-merge for humans, gate for the autonomous runner)
 
 **Date:** 2026-06-13
-**Context:** GDS-V3, task [#881](https://example.com/builders#/task/881), step [6/8] of the `touches[]` simplification cluster ([#875](https://example.com/builders#/task/875)–[#883](https://example.com/builders#/task/883)). Records the parallel-safety model that the cluster's code changes established — see the architect audit [`docs/audits/<redacted>.md`](../audits/<redacted>.md). Supersedes the *predictive* framing implicit in [ADR 0010](0010-pms-architecture.md) (GDS architecture) and [ADR 0015](<redacted>.md); complements [ADR 0017](<redacted>.md) (the "a hard block turned correct work into deferred backlog" lesson).
+**Context:** GDS-V3, task [#881](https://example.com/builders#/task/881), step [6/8] of the `touches[]` simplification cluster ([#875](https://example.com/builders#/task/875)–[#883](https://example.com/builders#/task/883)). Records the parallel-safety model that the cluster's code changes established — see the architect audit [`docs/audits/<redacted>.md`](../audits/<redacted>.md). Supersedes the *predictive* framing implicit in [ADR 0010](0010-pms-architecture.md) (GDS architecture) and [ADR 0015](0015-task-dependencies-and-auto-promotion.md); complements [ADR 0017](0017-code-simplification-and-repo-cleanliness.md) (the "a hard block turned correct work into deferred backlog" lesson).
 **Status:** Accepted.
 **Track:** `internal` (development system / methodology).
 

package/docs/adr/0050-device-flow-admission-invite-gated-by-default.md

@@ -1,7 +1,7 @@
 # ADR 0050 — Device-Flow admission posture: invite-gated by default
 
 **Date:** 2026-06-13
-**Context:** GDS, security report SR-19 / task [#1000](https://example.com/builders#/task/1000). Closes an admission inconsistency between the two GitHub enrollment paths in `src/bongos/auth.js`. Extends the web-sign-in approval gate added 2026-05-30 (the `access_requests` `'invited'` model) and is governed by the trust-boundary rule in [ADR 0016](<redacted>.md) (the server enforces admission, not the client).
+**Context:** GDS, security report SR-19 / task [#1000](https://example.com/builders#/task/1000). Closes an admission inconsistency between the two GitHub enrollment paths in `src/bongos/auth.js`. Extends the web-sign-in approval gate added 2026-05-30 (the `access_requests` `'invited'` model) and is governed by the trust-boundary rule in [ADR 0016](0016-trust-boundary-server-enforced-permissions.md) (the server enforces admission, not the client).
 **Status:** Accepted.
 **Track:** `internal` (development system / builder onboarding + access control).
 
@@ -12,7 +12,7 @@ The two ways a GitHub account becomes a builder were gated **inconsistently**:
 - **`completeWebFlow`** (the web hall sign-in, `/api/gds/auth/web/callback`) refused a **first-time** GitHub account unless an Archon had marked their `access_requests` row `'invited'`. Established builders (a `builders` row already exists for their `github_id`) always passed.
 - **`pollDeviceFlow`** (the CLI `/builder-setup` device flow, `/api/gds/auth/device/poll`) called `upsertBuilder()` **unconditionally** the moment GitHub returned an access token. So **any GitHub account could self-enroll as a Xenos and mint a never-expiring CLI session with no Archon approval whatsoever** — simply by running `/builder-setup` and authorizing on github.com.
 
-This directly contradicted the documented posture that **Archon admission is the only gate** for new builders (CLAUDE.md / [ADR 0016](<redacted>.md) / [ADR 0035](<redacted>.md)). The web door was locked; the CLI door was wide open. The blast radius is bounded by the Xenos sandbox (a self-enrolled account lands at the lowest rank, can only claim `xenos_claimable` tasks, and is kept out of the permission/methodology core), but it is still an unauthorized foothold inside the trust boundary and an inconsistency an auditor will (and did) flag.
+This directly contradicted the documented posture that **Archon admission is the only gate** for new builders (CLAUDE.md / [ADR 0016](0016-trust-boundary-server-enforced-permissions.md) / [ADR 0035](0035-builder-onboarding-three-paths.md)). The web door was locked; the CLI door was wide open. The blast radius is bounded by the Xenos sandbox (a self-enrolled account lands at the lowest rank, can only claim `xenos_claimable` tasks, and is kept out of the permission/methodology core), but it is still an unauthorized foothold inside the trust boundary and an inconsistency an auditor will (and did) flag.
 
 ## Decision
 

package/docs/adr/0051-full-session-transcript-corpus.md

@@ -1,13 +1,13 @@
 # ADR 0051 — Full session transcripts in the BFG corpus (with transcript-grade scrubbing)
 
 **Date:** 2026-06-13
-**Context:** GDS-V4, task [#1004](https://example.com/builders#/task/1004) (full-transcript capture) with hard precondition task [#1003](https://example.com/builders#/task/1003) (transcript-grade scrubber, extends [#723](https://example.com/builders#/task/723)) and coverage task [#965](https://example.com/builders#/task/965). **Amends the privacy/size posture of [ADR 0027](<redacted>.md)** (BFG session-inefficiency evaluator) and its schema (`migrations/062_session_records.sql`). Companion to [ADR 0026](<redacted>.md) (BFG charter + §6C transparency), [ADR 0020](<redacted>.md) (security-model posture), [ADR 0028](<redacted>.md), and [ADR 0016](<redacted>.md) (read access is server-enforced, not a doc claim). Read API: tasks [#541](https://example.com/builders#/task/541)/[#627](https://example.com/builders#/task/627). Coverage history: [#551](https://example.com/builders#/task/551)/[#608](https://example.com/builders#/task/608)/[#617](https://example.com/builders#/task/617)/[#620](https://example.com/builders#/task/620).
+**Context:** GDS-V4, task [#1004](https://example.com/builders#/task/1004) (full-transcript capture) with hard precondition task [#1003](https://example.com/builders#/task/1003) (transcript-grade scrubber, extends [#723](https://example.com/builders#/task/723)) and coverage task [#965](https://example.com/builders#/task/965). **Amends the privacy/size posture of [ADR 0027](0027-bfg-session-inefficiency-evaluator.md)** (BFG session-inefficiency evaluator) and its schema (`migrations/062_session_records.sql`). Companion to [ADR 0026](0026-bfg-memory-hygiene-and-cross-builder-learning.md) (BFG charter + §6C transparency), [ADR 0020](0020-security-model-public-stub.md) (security-model posture), [ADR 0028](0028-honest-llm-spend-accounting.md), and [ADR 0016](0016-trust-boundary-server-enforced-permissions.md) (read access is server-enforced, not a doc claim). Read API: tasks [#541](https://example.com/builders#/task/541)/[#627](https://example.com/builders#/task/627). Coverage history: [#551](https://example.com/builders#/task/551)/[#608](https://example.com/builders#/task/608)/[#617](https://example.com/builders#/task/617)/[#620](https://example.com/builders#/task/620).
 **Status:** Proposed. Directive accepted (Lars, 2026-06-13); the **mechanism awaits review, and capture MUST NOT ship until the scrubber precondition (task 1003) is verified.**
 **Track:** `internal` (dev-system / BFG).
 
 ## Problem
 
-[ADR 0027](<redacted>.md) made a deliberate choice, stated in `migrations/062_session_records.sql`:
+[ADR 0027](0027-bfg-session-inefficiency-evaluator.md) made a deliberate choice, stated in `migrations/062_session_records.sql`:
 
 > *"the heavy transcript CONTENT is never uploaded. Each row holds per-turn METADATA (role, tool name, error flag, token usage, content length) + short secret-scrubbed snippets + token aggregates. That keeps rows small (KB, not MB) and the secret surface minimal."*
 

package/docs/adr/0052-sandbox-for-everyone-game-only-preview.md

@@ -1,7 +1,7 @@
 # ADR 0052 — Sandbox for everyone: a game-only preview entrypoint + the game in the starter clone
 
 **Date:** 2026-06-13
-**Context:** GDS-V3, task [#1001](https://example.com/builders#/task/1001) (clone-scope + ungate) and task [#1002](https://example.com/builders#/task/1002) (hardware-verify). Builds on [ADR 0044](<redacted>.md) (the per-box live game preview / "sandbox") and [ADR 0031](<redacted>.md) (cloud dev boxes + rank-scoped source). Companion to [ADR 0046](<redacted>.md) (sandbox-first review) and [ADR 0016](<redacted>.md) (authority is server-enforced — source visibility grants nothing). **Reverses the full-clone gate from task [#903](https://example.com/builders#/task/903).** Decision by Lars, 2026-06-13.
+**Context:** GDS-V3, task [#1001](https://example.com/builders#/task/1001) (clone-scope + ungate) and task [#1002](https://example.com/builders#/task/1002) (hardware-verify). Builds on [ADR 0044](0044-per-box-live-game-preview.md) (the per-box live game preview / "sandbox") and [ADR 0031](0031-cloud-dev-environments-for-builders.md) (cloud dev boxes + rank-scoped source). Companion to [ADR 0046](0046-sandbox-first-review-gate.md) (sandbox-first review) and [ADR 0016](0016-trust-boundary-server-enforced-permissions.md) (authority is server-enforced — source visibility grants nothing). **Reverses the full-clone gate from task [#903](https://example.com/builders#/task/903).** Decision by Lars, 2026-06-13.
 **Status:** Accepted. Mechanism implemented under task [#1001](https://example.com/builders#/task/1001) (game-only entry `src/preview-server.js` + shared `registerGameRooms()` helper, `STARTER_SPARSE_PATHS` widened by `src/world`/`src/rooms`/`public`, `box-game-preview.service` repointed at the game-only entry, `box-source-fetch.sh` ungated); **hardware-verified under task [#1002](https://example.com/builders#/task/1002) (2026-06-14)** — a fresh **Xenos starter-scope** box (`LarsCode`) served the playable game over the public tunnel at `sandbox-<login>.example.com` (HTTP 200, Phaser client + `/game/*` assets) while **(b)** `/api/gds/*` returned 404 through that host (game-only entry does not mount the internal API) and **(c)** `migrations/` was absent on the box (the game paths `src/world`/`src/rooms`/`public` were present). Box deprovisioned after the run.
 **Track:** `internal` (dev boxes / builder experience).
 

package/docs/adr/0053-scoped-dev-box-session.md

@@ -1,7 +1,7 @@
 # ADR 0053 — Scoped, short-lived dev-box session + apex-cookie strip at the tunnel
 
 **Date:** 2026-06-13
-**Context:** GDS, security reports SR[#2](https://example.com/builders#/task/2) (HIGH) + SR[#11](https://example.com/builders#/task/11) (HIGH) from the 2026-06-08 server audit ([#870](https://example.com/builders#/task/870)); task [#919](https://example.com/builders#/task/919). Owner decision 2026-06-09: do the proper redesign, not the interim named-tunnel disable. Governed by the trust-boundary rule in [ADR 0016](<redacted>.md) and the box subsystem in [ADR 0031](<redacted>.md) / [ADR 0038](<redacted>.md) / [ADR 0044](<redacted>.md).
+**Context:** GDS, security reports SR[#2](https://example.com/builders#/task/2) (HIGH) + SR[#11](https://example.com/builders#/task/11) (HIGH) from the 2026-06-08 server audit ([#870](https://example.com/builders#/task/870)); task [#919](https://example.com/builders#/task/919). Owner decision 2026-06-09: do the proper redesign, not the interim named-tunnel disable. Governed by the trust-boundary rule in [ADR 0016](0016-trust-boundary-server-enforced-permissions.md) and the box subsystem in [ADR 0031](0031-cloud-dev-environments-for-builders.md) / [ADR 0038](0038-chromebook-ttyd-cloudflare-tunnel.md) / [ADR 0044](0044-per-box-live-game-preview.md).
 **Status:** Accepted.
 **Track:** `internal` (development system / builder dev boxes + access control).
 

package/docs/adr/0054-session-token-reward-cost-plus.md

@@ -1,7 +1,7 @@
 # ADR 0054 — Flat cost-plus session token reward (example as equity)
 
 **Date:** 2026-06-13
-**Context:** GDS-V4, task [#1005](https://example.com/builders#/task/1005). Builds on [ADR 0023](<redacted>.md) (per-task kind-multiplied credits), [ADR 0028](<redacted>.md) (the `llm-pricing.js` token→USD table + session-cost capture), and [ADR 0027](<redacted>.md) (the `session_records` upload-on-ship path this reward rides). Complements — does **not** replace — the per-task `credits_reward × kind_multiplier` path. Related future work: the full-transcript capture ADR (planned, task [#1004](https://example.com/builders#/task/1004)) will give this reward a more trustworthy raw-usage source, and the token-feed hardening scoped in task [#1005](https://example.com/builders#/task/1005) itself.
+**Context:** GDS-V4, task [#1005](https://example.com/builders#/task/1005). Builds on [ADR 0023](0023-kind-multipliers-and-idea-bonus.md) (per-task kind-multiplied credits), [ADR 0028](0028-honest-llm-spend-accounting.md) (the `llm-pricing.js` token→USD table + session-cost capture), and [ADR 0027](0027-bfg-session-inefficiency-evaluator.md) (the `session_records` upload-on-ship path this reward rides). Complements — does **not** replace — the per-task `credits_reward × kind_multiplier` path. Related future work: the full-transcript capture ADR (planned, task [#1004](https://example.com/builders#/task/1004)) will give this reward a more trustworthy raw-usage source, and the token-feed hardening scoped in task [#1005](https://example.com/builders#/task/1005) itself.
 **Status:** Accepted.
 **Track:** `internal` (development system / methodology).
 
@@ -18,7 +18,7 @@ Per **shipped session** (the unit; per-task attribution is a later refinement
 
 - **`true_cost_usd` is computed SERVER-SIDE** from the per-model token counts the ship upload already carries (`session_records.model_usage`), priced via `src/bongos/llm-pricing.js` (the locked API list-price table). The client uploads token *counts*, never a dollar figure — that figure is never trusted from the client.
 - **`true_cost` is deliberately the API LIST price**, not the builder's discounted subscription cost. A builder on a flat Claude Code subscription obtained those tokens far below list, so paying list-cost + 20% routes the subscription-vs-list spread to the builder as profit *on top of* the margin. This is intended: it is how the reward funds the builder's time and ideas, and it rewards taking advantage of the subsidy.
-- **Margin is a code constant** (`REWARD_MARGIN_PCT` in `src/bongos/db.js`), owner-changed via a commit, not a settings UI — the same review-trail rationale as `KIND_MULTIPLIERS` ([ADR 0023](<redacted>.md)). A future migration can promote it to a per-builder/per-version table if the economics ever need live tuning. No rank above Archon is introduced; the knob is an owner-scoped policy constant.
+- **Margin is a code constant** (`REWARD_MARGIN_PCT` in `src/bongos/db.js`), owner-changed via a commit, not a settings UI — the same review-trail rationale as `KIND_MULTIPLIERS` ([ADR 0023](0023-kind-multipliers-and-idea-bonus.md)). A future migration can promote it to a per-builder/per-version table if the economics ever need live tuning. No rank above Archon is introduced; the knob is an owner-scoped policy constant.
 - **Idempotent per `session_id`**: a new `credit_log.reason = 'session.token_reward'` row carries a `session_id` column backed by a partial-unique index, plus a SELECT fast-path guard inside the upsert transaction. Re-uploading the same session (re-ship, retry) is a true no-op — no double payout.
 - The existing per-task credit path is untouched. Both the token reward and per-task credits accrue to `builders.total_credits` via the existing `pms_apply_credit` trigger.
 - **Example = equity units** (owner framing). No special code — it is the interpretation of `total_credits`.
@@ -33,7 +33,7 @@ A flat cost-plus reward pays **more** for a more expensive session — it can re
 
 1. **PASS-gated by construction.** Only a *successful ship* uploads a session record, so a session that burned tokens and shipped nothing earns nothing.
 2. **Example are equity, not cash.** A builder who pads cost dilutes a pool they themselves hold; the incentive to waste is bounded by the fact that the payout currency is ownership in the thing being built. Early builders want their percentage to be worth something, so they self-police. Inflating the denominator hurts the inflator.
-3. **The waste signal already exists.** The BFG session-inefficiency evaluator ([ADR 0027](<redacted>.md)) flags wasteful sessions from the same uploaded digest; a later refinement can gate or discount the reward by a quality/efficiency factor, moving from flat cost-plus to cost-plus-adjusted-for-value. The owner's stated direction is to move toward **market dynamics** (bidding) once the builder pool is genuinely multi-party.
+3. **The waste signal already exists.** The BFG session-inefficiency evaluator ([ADR 0027](0027-bfg-session-inefficiency-evaluator.md)) flags wasteful sessions from the same uploaded digest; a later refinement can gate or discount the reward by a quality/efficiency factor, moving from flat cost-plus to cost-plus-adjusted-for-value. The owner's stated direction is to move toward **market dynamics** (bidding) once the builder pool is genuinely multi-party.
 
 ## Consequences
 
@@ -64,13 +64,13 @@ Revisit when: (a) per-task token attribution lands (the unit becomes the task, n
 
 ## Amendment — 2026-08-30 (task 1003435): the priced unit is the SESSION, subagents included
 
-**A gap in the Decision's premise, not a change to its formula.** The formula above prices `session_records.model_usage`, and that map was built from exactly one file — the interactive transcript. Claude Code persists Agent/Task-tool spawns in a sibling subtree (`<project-dir>/<session-id>/subagents/*.jsonl`), so a session's subagent tokens were invisible to the reward. The spend ledger had already closed this gap on its side: [ADR 0028](<redacted>.md)'s `session-cost.js` prices that subtree into its own `session:<redacted> cost row. Only the reward still read one file.
+**A gap in the Decision's premise, not a change to its formula.** The formula above prices `session_records.model_usage`, and that map was built from exactly one file — the interactive transcript. Claude Code persists Agent/Task-tool spawns in a sibling subtree (`<project-dir>/<session-id>/subagents/*.jsonl`), so a session's subagent tokens were invisible to the reward. The spend ledger had already closed this gap on its side: [ADR 0028](0028-honest-llm-spend-accounting.md)'s `session-cost.js` prices that subtree into its own `session:<redacted> cost row. Only the reward still read one file.
 
 That inverted the methodology's own instruction. CLAUDE.md tells builders to delegate freely and to route most subagent work to the top model tier; following it moved real, productive spend into a bucket the reward could not see, so the same work paid less when it was parallelized. This is **not** the accepted waste risk recorded in §"The residual rewards waste risk" — that section knowingly accepts paying for tokens that turned out wasteful. This was the opposite failure: guidance-following spend that earned nothing.
 
 **Change:** `model_usage` now describes the whole session — the interactive thread plus its subagents subtree. Grader worker transcripts are excluded **by signature**, not by location, reusing `looksLikeGraderTranscript()`, because a grader run can nest inside a `subagents/` dir and its cost is already captured through the worker envelope; re-pricing it would double-count, which is the ADR 0028 invariant.
 
-**The deliberate asymmetry, recorded because it looks like a bug otherwise.** Only `model_usage` grew. `detail`, `metrics.tokens`, `assistant_turns` and `total_tokens` remain the **interactive thread's** record. Those feed the BFG session corpus and the inefficiency evaluator ([ADR 0027](<redacted>.md)), which reason about one agent's turn-by-turn behaviour; splicing N subagent transcripts into that per-turn story would distort the very signal it exists to measure, and bloat the payload. So `total_tokens` is deliberately **less than** the sum of `model_usage`, and three counters — `subagent_files`, `subagent_tokens`, `subagent_grader_skipped` — carry the difference explicitly rather than leaving a reader to infer it from a mismatch.
+**The deliberate asymmetry, recorded because it looks like a bug otherwise.** Only `model_usage` grew. `detail`, `metrics.tokens`, `assistant_turns` and `total_tokens` remain the **interactive thread's** record. Those feed the BFG session corpus and the inefficiency evaluator ([ADR 0027](0027-bfg-session-inefficiency-evaluator.md)), which reason about one agent's turn-by-turn behaviour; splicing N subagent transcripts into that per-turn story would distort the very signal it exists to measure, and bloat the payload. So `total_tokens` is deliberately **less than** the sum of `model_usage`, and three counters — `subagent_files`, `subagent_tokens`, `subagent_grader_skipped` — carry the difference explicitly rather than leaving a reader to infer it from a mismatch.
 
 **The acceptance test is a reconciliation, not a fixture.** `tests/credit_grant.mjs` runs both real pricing paths over one on-disk fixture and asserts the reward's `true_cost_usd` equals the sum of that session's `session:<redacted> and `session:<redacted> cost rows within independent-rounding epsilon — so a change made to one side and not the other fails the build. Idempotency is unchanged: the award is still a per-session watermark, so a re-ship pays only the increment and never twice.
 
@@ -80,11 +80,11 @@ That inverted the methodology's own instruction. CLAUDE.md tells builders to del
 
 The amendment above fixed the reward forward. This one is about history: every session shipped before it was paid `round(interactive x 1.20)` when it was owed `round((interactive + subagent) x 1.20)`. The owner asked for the backfill; `scripts/gds/backfill-subagent-rewards.js` is it.
 
-**Where the missing number comes from.** Not from transcripts — the subagents subtree lives only on builders' machines and is routinely gone. The spend ledger recorded the leg the whole time: the `cost_log` row with source ending `:subagent` and `source_ref = '<session-id>:sub'` ([ADR 0028](<redacted>.md)), priced through the same locked `PRICES` table the reward uses. That row is the evidence, and it is per-session.
+**Where the missing number comes from.** Not from transcripts — the subagents subtree lives only on builders' machines and is routinely gone. The spend ledger recorded the leg the whole time: the `cost_log` row with source ending `:subagent` and `source_ref = '<session-id>:sub'` ([ADR 0028](0028-honest-llm-spend-accounting.md)), priced through the same locked `PRICES` table the reward uses. That row is the evidence, and it is per-session.
 
 **The top-up is booked through the normal reward writer, not a private reason key.** `awardSessionTokenReward` gained an optional `extraCostUsd` (default 0, so every existing call site is unchanged), and the backfill passes the recovered subagent dollars into it. That is the load-bearing choice, and it is not cosmetic: the watermark selects on `reason = 'session.token_reward'`, so a backfill written under its own reason would be **invisible** to it and the next ship in that session would pay the same leg a second time. Routing through the real writer means the backfill is just a top-up at a higher `reward_basis` — the `(session_id, reward_basis)` unique index gives idempotency, the no-clawback rule and the legacy refusal keep applying, and a later ship still books only its own increment. All four properties are pinned in `tests/backfill_subagent_rewards.mjs`.
 
-**What it refuses to pay, and why that is the point.** [ADR 0173](<redacted>.md) declined a structurally similar backfill because the reconstruction was incomplete and correcting in one direction only is a policy choice, not a repair. Rather than repeat that argument or quietly ignore it, the dry-run states the same asymmetries as first-class output. Four classes are reported and never minted:
+**What it refuses to pay, and why that is the point.** [ADR 0173](0173-legacy-multi-ship-shortfall-not-backfilled.md) declined a structurally similar backfill because the reconstruction was incomplete and correcting in one direction only is a policy choice, not a repair. Rather than repeat that argument or quietly ignore it, the dry-run states the same asymmetries as first-class output. Four classes are reported and never minted:
 
 - **`pre_dedup_fix`** — task 1003217 (landed 2026-08-23T21:50Z) fixed a ~2.22x over-count in *both* the cost ledger and the digest: one API call is written as several transcript lines that repeat the same usage block, and every line was being priced. Cost rows recorded before that fix are inflated, so paying from them would **overpay**. The cutoff is a lower bound, not a guarantee — a machine still on an older core kept writing inflated rows after that date — so `--since` moves it and the report names the dollars parked in this class.
 - **`no_subagent_record`** — the cost hook never ran (no token, hard kill, 401). Unrecoverable, and deliberately never estimated from `total_tokens` or a ratio.

package/docs/adr/0055-server-mediated-branch-publish.md

@@ -1,7 +1,7 @@
 # ADR 0055 — Server-mediated branch publish (the dev box holds no GitHub credential)
 
 **Date:** 2026-06-13
-**Context:** GDS, task [#1025](https://example.com/builders#/task/1025). A live "can I publish from a dev box?" test failed even after CI self-deploy ([#859](https://example.com/builders#/task/859) / [ADR 0042](<redacted>.md)) went live. Sits at the intersection of [ADR 0042](<redacted>.md) (ci deploy mode), [ADR 0053](0053-scoped-dev-box-session.md) (box-scoped session, [#919](https://example.com/builders#/task/919)), and the box on-ramp ([ADR 0038](<redacted>.md) browser-only builders, [ADR 0044](<redacted>.md), [ADR 0046](<redacted>.md) sandbox-first ship gate / [#927](https://example.com/builders#/task/927), which expects `/builder-ship` to run *on* a box). Governed by the trust boundary in [ADR 0016](<redacted>.md).
+**Context:** GDS, task [#1025](https://example.com/builders#/task/1025). A live "can I publish from a dev box?" test failed even after CI self-deploy ([#859](https://example.com/builders#/task/859) / [ADR 0042](0042-builder-self-deploy-ci-auto-merge.md)) went live. Sits at the intersection of [ADR 0042](0042-builder-self-deploy-ci-auto-merge.md) (ci deploy mode), [ADR 0053](0053-scoped-dev-box-session.md) (box-scoped session, [#919](https://example.com/builders#/task/919)), and the box on-ramp ([ADR 0038](0038-chromebook-ttyd-cloudflare-tunnel.md) browser-only builders, [ADR 0044](0044-per-box-live-game-preview.md), [ADR 0046](0046-sandbox-first-review-gate.md) sandbox-first ship gate / [#927](https://example.com/builders#/task/927), which expects `/builder-ship` to run *on* a box). Governed by the trust boundary in [ADR 0016](0016-trust-boundary-server-enforced-permissions.md).
 **Status:** Accepted.
 **Track:** `internal` (development system / builder dev boxes + ship pipeline).
 
@@ -46,7 +46,7 @@ A **fine-grained GitHub PAT** scoped to the single repo: `Contents: read/write`
 
 ## Consequences
 
-- A dev-box builder ships end-to-end: `/builder-reauth` → claim → edit → `/builder-stage` ([ADR 0046](<redacted>.md)) → `/builder-ship`, with the GDS doing the push. The box holds no GitHub credential, so the [ADR 0053](0053-scoped-dev-box-session.md) blast-radius argument still holds.
+- A dev-box builder ships end-to-end: `/builder-reauth` → claim → edit → `/builder-stage` ([ADR 0046](0046-sandbox-first-review-gate.md)) → `/builder-ship`, with the GDS doing the push. The box holds no GitHub credential, so the [ADR 0053](0053-scoped-dev-box-session.md) blast-radius argument still holds.
 - The blast radius moves from "box holds a push credential" to "server holds a branch-push-only PAT." This is the direction blocker [#15](https://example.com/builders#/blocker/15) ([SEC #863](https://example.com/builders#/task/863)) already wants — a server identity holding the push credential, not builder machines.
 - **Follow-up (hardening) — DONE + LIVE (task 1028 code, task 1043 cutover):** the standing PAT is replaced by a **GitHub App** (the server holds only the App private key and mints short-lived, repo-scoped installation tokens per push). See the *Update* above — the App is live on prod and the PAT has been removed.
 - **Verified end-to-end on hardware, 2026-08-25 (task 1003247)** — first proof since the

package/docs/adr/0056-prod-deploy-script-mirror-and-healthcheck-retry.md

@@ -1,7 +1,7 @@
 # ADR 0056 — Version-control the prod deploy script as a reviewable mirror, and retry the post-restart healthcheck
 
 **Date:** 2026-06-13
-**Context:** GDS, task [#1026](https://example.com/builders#/task/1026) (follow-up to [#1025](https://example.com/builders#/task/1025)). Builds on [ADR 0042](<redacted>.md) (ci deploy mode — `deploy-prod.yml` SSHes the droplet's `~/deploy.sh`) and [ADR 0043](<redacted>.md) (the forced-command lock on the deploy key).
+**Context:** GDS, task [#1026](https://example.com/builders#/task/1026) (follow-up to [#1025](https://example.com/builders#/task/1025)). Builds on [ADR 0042](0042-builder-self-deploy-ci-auto-merge.md) (ci deploy mode — `deploy-prod.yml` SSHes the droplet's `~/deploy.sh`) and [ADR 0043](0043-git-ssh-trust-boundary-and-rank-floor-on-permission-paths.md) (the forced-command lock on the deploy key).
 **Status:** Accepted.
 **Track:** `internal` (development system / deploy pipeline).
 
@@ -22,7 +22,7 @@ CODE=$(curl -s -o /dev/null -w "%{http_code}" http://127.0.0.1:3000/healthz)
 
 Two compounding issues:
 
-1. **A false failure on a healthy deploy.** In `ci` mode ([ADR 0042](<redacted>.md)) `ship.js pollCiDeploy` / `publish-status` reads `conclusion=failure` and **cannot auto-advance `confirmed → shipped`** — every ci ship that hits the race needs a manual `POST /tasks/:id/ship` (had to for [#1025](https://example.com/builders#/task/1025)).
+1. **A false failure on a healthy deploy.** In `ci` mode ([ADR 0042](0042-builder-self-deploy-ci-auto-merge.md)) `ship.js pollCiDeploy` / `publish-status` reads `conclusion=failure` and **cannot auto-advance `confirmed → shipped`** — every ci ship that hits the race needs a manual `POST /tasks/:id/ship` (had to for [#1025](https://example.com/builders#/task/1025)).
 2. **The authoritative deploy script lived only on the droplet.** Prod's `~/deploy.sh` was hand-maintained at `/home/lars/deploy.sh`, un-versioned and un-reviewed — which is exactly why this race went unnoticed. (Staging's analogue, `scripts/deploy/deploy-staging.sh`, *is* in the repo and installed by `deploy-staging.yml` — but it carried the **same** single-curl bug, just manifesting as a clean `fail` rather than exit 7 because its `if ! curl … | grep` form suppresses `set -e`.)
 
 ## Decision
@@ -36,7 +36,7 @@ Poll localhost `/healthz` up to **15× at 1s** before concluding failure (matchi
 `scripts/deploy/deploy-prod.sh` is now the **version-controlled source-of-truth mirror** of `/home/lars/deploy.sh` — byte-faithful, so `diff <(ssh droplet cat deploy.sh) scripts/deploy/deploy-prod.sh` is empty. This makes the authoritative deploy logic reviewable + diffable and stops the silent drift that hid this bug.
 
 It is **not** auto-scp'd onto the droplet the way `deploy-staging.yml` installs `deploy-staging.sh`, and that asymmetry is deliberate: the prod CI deploy key (`otb-ci-deploy-prod`) is **forced-command-locked** in the droplet's `~/.ssh/authorized_keys` —
-`command="/home/lars/deploy.sh",no-pty,no-agent-forwarding,no-port-forwarding,no-X11-forwarding` ([ADR 0042](<redacted>.md)/[0043](<redacted>.md)). That lock means the CI runner can **only** trigger a deploy, never run `scp` or any other command — a trust-boundary control we will **not** weaken just to auto-sync a script. So prod stays hand-installed by an operator (with a non-forced key) whenever the mirror changes:
+`command="/home/lars/deploy.sh",no-pty,no-agent-forwarding,no-port-forwarding,no-X11-forwarding` ([ADR 0042](0042-builder-self-deploy-ci-auto-merge.md)/[0043](0043-git-ssh-trust-boundary-and-rank-floor-on-permission-paths.md)). That lock means the CI runner can **only** trigger a deploy, never run `scp` or any other command — a trust-boundary control we will **not** weaken just to auto-sync a script. So prod stays hand-installed by an operator (with a non-forced key) whenever the mirror changes:
 
 ```sh
 scp scripts/deploy/deploy-prod.sh lars@REDACTED_IP:deploy.sh

package/docs/adr/0057-container-cost-ledger.md

@@ -3,7 +3,7 @@
 **Date:** 2026-06-15
 **Status:** Accepted
 **Track:** `internal` (dev-system / cost oversight).
-**Context:** GDS-V3, task [#602](https://example.com/builders#/task/602), criterion C-cost. Implements the ledger half of ADR 0031 §5 (cost passthrough). Companion to [ADR 0031](<redacted>.md) (the dev box) and the early-stage billing policy ("tracked, not settled" — both example earnings and container costs are recorded but not actually paid/charged yet).
+**Context:** GDS-V3, task [#602](https://example.com/builders#/task/602), criterion C-cost. Implements the ledger half of ADR 0031 §5 (cost passthrough). Companion to [ADR 0031](0031-cloud-dev-environments-for-builders.md) (the dev box) and the early-stage billing policy ("tracked, not settled" — both example earnings and container costs are recorded but not actually paid/charged yet).
 
 ## Problem
 

package/docs/adr/0057-discord-archon-approval-channels.md

@@ -1,11 +1,11 @@
 # ADR 0057 — Approve new members and first dev boxes from Discord (Archon 👍/👎)
 
 **Date:** 2026-06-15
-**Context:** GDS-V4, task [#1100](https://example.com/builders#/task/1100). Builds on [ADR 0033](<redacted>.md) (the in-process Discord bot as a service principal), [ADR 0037](<redacted>.md) (config-driven channel layout), [ADR 0016](<redacted>.md) (server-enforced permissions / trust boundary), [ADR 0035](<redacted>.md) §2 (the first-box Archon approval gate, [#717](https://example.com/builders#/task/717)), and [ADR 0050](<redacted>.md) (invite-gated admission).
+**Context:** GDS-V4, task [#1100](https://example.com/builders#/task/1100). Builds on [ADR 0033](0033-discord-bot-service-principal.md) (the in-process Discord bot as a service principal), [ADR 0037](0037-discord-channel-management.md) (config-driven channel layout), [ADR 0016](0016-trust-boundary-server-enforced-permissions.md) (server-enforced permissions / trust boundary), [ADR 0035](0035-builder-onboarding-three-paths.md) §2 (the first-box Archon approval gate, [#717](https://example.com/builders#/task/717)), and [ADR 0050](0050-device-flow-admission-invite-gated-by-default.md) (invite-gated admission).
 **Status:** Accepted.
 **Track:** `internal` (development system / onboarding + Discord surface).
 
-> **⚠️ Superseded in part by [ADR 0059](<redacted>.md) (task [#1141](https://example.com/builders#/task/1141)).** The **box half** — the `📦-box-approvals` channel and the box-intent 👍/👎 approve/deny wiring — is **removed**: there is no longer a first-box approval gate, so an admitted builder's first box provisions hands-off. The **member half** (`🚪-member-approvals` + the admit/dismiss reaction wiring) is unchanged — member-join admission is still the gate. Read the box-channel parts below as historical.
+> **⚠️ Superseded in part by [ADR 0059](0059-single-approval-remove-devbox-approval-gate.md) (task [#1141](https://example.com/builders#/task/1141)).** The **box half** — the `📦-box-approvals` channel and the box-intent 👍/👎 approve/deny wiring — is **removed**: there is no longer a first-box approval gate, so an admitted builder's first box provisions hands-off. The **member half** (`🚪-member-approvals` + the admit/dismiss reaction wiring) is unchanged — member-join admission is still the gate. Read the box-channel parts below as historical.
 
 ## Problem
 

package/docs/adr/0058-automatic-gate-surface-gatekeeper.md

@@ -3,14 +3,14 @@
 - **Status:** Accepted
 - **Date:** 2026-06-15
 - **Track:** internal
-- **Builds on:** [ADR 0042](<redacted>.md) (CI self-deploy), [ADR 0043](<redacted>.md) (protected paths + rank floor), [ADR 0016](<redacted>.md) (trust boundary), [ADR 0055](<redacted>.md) (server-mediated publish), [ADR 0057](<redacted>.md) (Archon approval channels)
+- **Builds on:** [ADR 0042](0042-builder-self-deploy-ci-auto-merge.md) (CI self-deploy), [ADR 0043](0043-git-ssh-trust-boundary-and-rank-floor-on-permission-paths.md) (protected paths + rank floor), [ADR 0016](0016-trust-boundary-server-enforced-permissions.md) (trust boundary), [ADR 0055](0055-server-mediated-branch-publish.md) (server-mediated publish), [ADR 0057](0057-discord-archon-approval-channels.md) (Archon approval channels)
 - **Task:** 1139
 
 ## Context
 
-In deploy mode `ci` ([ADR 0042](<redacted>.md)) PRs auto-merge on green required checks and `main` auto-deploys to prod. `CODEOWNERS` (owner review on gate surfaces, enforced by `require_code_owner_reviews`) was the **only** human in that loop — it stops a builder from weakening the gate from inside their own auto-merging PR (disabling a check, muting a test, lowering a rank requirement, sneaking a malicious migration).
+In deploy mode `ci` ([ADR 0042](0042-builder-self-deploy-ci-auto-merge.md)) PRs auto-merge on green required checks and `main` auto-deploys to prod. `CODEOWNERS` (owner review on gate surfaces, enforced by `require_code_owner_reviews`) was the **only** human in that loop — it stops a builder from weakening the gate from inside their own auto-merging PR (disabling a check, muting a test, lowering a rank requirement, sneaking a malicious migration).
 
-That review made the owner a bottleneck: **every** PR touching a gate surface (the ~36 `PROTECTED_GLOBS` in [`src/bongos/permission-path-check.js`](../../src/bongos/permission-path-check.js)) blocked on a manual approval — and nothing surfaced those pending PRs, so server-mediated-publish PRs ([ADR 0055](<redacted>.md)) stranded silently (the 2026-06-15 retro: tasks 1068/1096/602/476 sat `confirmed` for days, blocked on an approval the owner never saw).
+That review made the owner a bottleneck: **every** PR touching a gate surface (the ~36 `PROTECTED_GLOBS` in [`src/bongos/permission-path-check.js`](../../src/bongos/permission-path-check.js)) blocked on a manual approval — and nothing surfaced those pending PRs, so server-mediated-publish PRs ([ADR 0055](0055-server-mediated-branch-publish.md)) stranded silently (the 2026-06-15 retro: tasks 1068/1096/602/476 sat `confirmed` for days, blocked on an approval the owner never saw).
 
 A red-team design pass established one hard truth: a **deterministic** analyzer can only *safely* certify a tiny set of changes as benign (un-muting a test, narrowing the secret allowlist, and PRs touching no gate surface). New migrations, dependency bumps, and auth/route changes are **undecidable** by rules — and an LLM reviewer is rejected as authoritative because the project's own history (grader prompt-injection fencing, task 995) proves it is trickable.
 
@@ -30,7 +30,7 @@ The hard floor is the irreducible root of trust: a compromised or prompt-injecte
 - **Two-layer enforcement**: the in-CI `gate-review` check is the fast cooperative gate; `main-audit.js --verify-head` on the droplet is the authoritative net (asserts the merged SHA carries a `success` gate-review conclusion — closes the workflow-self-neuter, raw-push, and cancelled-check races).
 - **Trusted-base overlay**: the workflow overlays the whole `scripts/` + `src/` from `origin/main` before running, so a PR cannot edit the analyzer to pass itself.
 - **`run-unit-tests.js`, `config/deploy.json`, `CODEOWNERS`, `scripts/deploy/`, `gate-review.js`, `grader-rubric.json` added to `PROTECTED_GLOBS`** — these gate-machinery paths were previously unprotected at the sub-Metic floor; adding them closes that pre-existing gap and makes the hard floor a subset of the protected set.
-- **Escalation reuses [ADR 0057](<redacted>.md)**: a `#gate-approvals` channel + `gate-pr #<n>` marker; the owner clears it by approving the (App-authored) PR. Inert until `DISCORD_GATE_APPROVALS_WEBHOOK` is set.
+- **Escalation reuses [ADR 0057](0057-discord-archon-approval-channels.md)**: a `#gate-approvals` channel + `gate-pr #<n>` marker; the owner clears it by approving the (App-authored) PR. Inert until `DISCORD_GATE_APPROVALS_WEBHOOK` is set.
 
 ## Rollout (the gate is never weaker mid-flight)
 
@@ -48,7 +48,7 @@ The hard floor is the irreducible root of trust: a compromised or prompt-injecte
 
 The gatekeeper went **ENFORCING** (task 1142): `gate-review.yml` no longer sets `GATE_REPORT_ONLY`, and `gate-review` is a required check. The `GATE_AUTHOR_TRUSTED` signal is the `gate-author-trust` **commit status** — set only by the server (which alone holds the authenticated builder's server-resolved rank + the App/PAT credential), so CI reads it but cannot forge it. The server posts it via `githubPush.setCommitStatus` from **two** ship paths, sharing one helper (`postGateAuthorTrust` in [`src/bongos/routes/tasks.js`](../../src/bongos/routes/tasks.js)):
 
-1. **Server-mediated publish** ([ADR 0055](<redacted>.md), dev box / `pushVia 'server'`): `POST /tasks/:id/publish-branch` attests the pushed tip after opening the PR.
+1. **Server-mediated publish** ([ADR 0055](0055-server-mediated-branch-publish.md), dev box / `pushVia 'server'`): `POST /tasks/:id/publish-branch` attests the pushed tip after opening the PR.
 2. **Laptop `ci`-land** (`pushVia 'local'` — task 1169): `ship.js` pushes the branch + opens the PR with the laptop's own `gh` credential, which **cannot** forge the attestation. So `ciLandLocal` calls `POST /tasks/:id/attest-gate` (`requireBuilder` + ownership, deliberately **no** `allowBoxScope`) right **after the push and before opening the PR** — race-free for a fresh PR, since the PR-open is what fires `gate-review` and it runs only after the status is already present. Before task 1169 the laptop path posted *nothing*, so a Metic+ author's gate-surface PR from a laptop was BLOCKED and they could not self-approve their own PR (hit live on task 1162 / PR #131).
 
 A commit status posted on a SHA does **not** re-trigger a `pull_request`-triggered check, so a **reused** open PR that already ran `gate-review` red (on the same SHA, before the attestation existed) gets a best-effort `gh run rerun` nudge of that stale run. A freshly-opened PR needs no nudge.
@@ -58,7 +58,7 @@ A commit status posted on a SHA does **not** re-trigger a `pull_request`-trigger
 Clearing an ESCALATE (and a NEEDS_TRUST without a Metic+ author) required a GitHub `APPROVED` review by `example-owner` on the head SHA — i.e. the owner had to leave a GitHub/terminal review, which the non-technical owner should never have to (feedback: auth flows must be UI-first). This adds a **second owner-approval channel**, trust-equal to the GitHub review, drivable from the builders' hall:
 
 - **The Gate** (`/builders/gate`, Archon-only page, server-gated by `requireArchonPage`) lists every open PR whose `gate-review` check is red — the LIVE check conclusion is the authoritative "awaiting approval" signal — and renders **why** by reusing the **exact** pure `classifyChanges()` the CI runs (no duplicated policy). Each held PR shows its task, author, head SHA, the verdict + per-file reasons (hard-floor flagged), changed files, and a diff link.
-- **Approve** (`POST /api/gds/gate-approvals/:pr/approve`, `requireBuilder` + `requireRank('archon')`) sets a **`gate-owner-approved`** commit status on the head SHA via `githubPush.setGateOwnerApproved` — set **exactly like** `gate-author-trust`: only the server holds the credential, and it sets it only after re-checking the caller's Archon rank server-side ([ADR 0016](<redacted>.md)). A PR author cannot forge it. `gate-review.yml`'s trust step now resolves `OWNER_APPROVED=1` from **either** a `example-owner` GitHub review **or** this status. Both are read on the head SHA, so a later commit's head carries no approval (the same red-team `#2b` sha-pin protection).
+- **Approve** (`POST /api/gds/gate-approvals/:pr/approve`, `requireBuilder` + `requireRank('archon')`) sets a **`gate-owner-approved`** commit status on the head SHA via `githubPush.setGateOwnerApproved` — set **exactly like** `gate-author-trust`: only the server holds the credential, and it sets it only after re-checking the caller's Archon rank server-side ([ADR 0016](0016-trust-boundary-server-enforced-permissions.md)). A PR author cannot forge it. `gate-review.yml`'s trust step now resolves `OWNER_APPROVED=1` from **either** a `example-owner` GitHub review **or** this status. Both are read on the head SHA, so a later commit's head carries no approval (the same red-team `#2b` sha-pin protection).
 - **Re-trigger without a new App permission.** A commit status does not re-fire a `pull_request` check, and the publish App is not granted `actions:write`. So Approve **closes+reopens** the PR (`recheckPullRequest`, using the `pull_requests:write` the App already holds), which fires `pull_request: reopened` → `gate-review` re-runs with the real PR context, reads the new status on the correct head SHA, and goes green; auto-merge is re-armed and the publish reconciler `mergeIfGreen` sweep (task 1162) is the backstop.
 
 The approve route **clears the hard floor**, so `POST /gate-approvals/:pr/approve` is pinned `archon` in `route-rank-check.EXPECTED_RANKS` (a silent downgrade would let any builder clear an ESCALATE). Because `gate-review.yml` is itself a hard-floor surface, the PR that introduces this change ESCALATEs and must be owner-approved to land — the bootstrapping case, shipped via `OTB_PUSH_VIA_SERVER=1` so the App authors the PR and the owner can approve it. Coverage: `tests/gate_approvals.mjs`. Authority is unchanged in substance — only `rank='archon'` (server-checked) can clear the gate, as before; this just adds a browser surface to do it.

package/docs/adr/0059-single-approval-remove-devbox-approval-gate.md

@@ -3,24 +3,24 @@
 - **Status:** Accepted
 - **Date:** 2026-06-16
 - **Track:** internal
-- **Supersedes:** [ADR 0035](<redacted>.md) §2 (the first-box Archon approval gate, [#717](https://example.com/builders#/task/717) / migration 071) and the **box half** of [ADR 0057](<redacted>.md) (the `#box-approvals` channel + the box-intent approve/deny wiring)
-- **Builds on:** [ADR 0050](<redacted>.md) (invite-gated admission), [ADR 0031](<redacted>.md) (cloud dev boxes + the box provisioning rank floor), [ADR 0016](<redacted>.md) (server-enforced permissions)
+- **Supersedes:** [ADR 0035](0035-builder-onboarding-three-paths.md) §2 (the first-box Archon approval gate, [#717](https://example.com/builders#/task/717) / migration 071) and the **box half** of [ADR 0057](0057-discord-archon-approval-channels.md) (the `#box-approvals` channel + the box-intent approve/deny wiring)
+- **Builds on:** [ADR 0050](0050-device-flow-admission-invite-gated-by-default.md) (invite-gated admission), [ADR 0031](0031-cloud-dev-environments-for-builders.md) (cloud dev boxes + the box provisioning rank floor), [ADR 0016](0016-trust-boundary-server-enforced-permissions.md) (server-enforced permissions)
 - **Task:** 1141
 
 ## Context
 
 A builder hit **two** human gates between "I heard about this" and "I'm shipping from a dev box":
 
-1. **Member-join admission** ([ADR 0050](<redacted>.md)). A stranger submits their GitHub username → an `access_requests` row lands `pending` → an Archon invites or dismisses it (the hall Watch, or the `#member-approvals` Discord 👍/👎 from [ADR 0057](<redacted>.md)). This is the **admission** gate: it decides who is allowed into the hall at all.
-2. **First-box Archon approval** ([ADR 0035](<redacted>.md) §2, [#717](https://example.com/builders#/task/717), migration 071). An already-admitted builder's *first* dev box was held at `box_intents.state='pending_approval'` until an Archon approved it (`POST /api/gds/box/intents/:id/approve`, or the `#box-approvals` Discord 👍/👎). Only then did the control-plane runner provision the paid (~$24/mo) droplet.
+1. **Member-join admission** ([ADR 0050](0050-device-flow-admission-invite-gated-by-default.md)). A stranger submits their GitHub username → an `access_requests` row lands `pending` → an Archon invites or dismisses it (the hall Watch, or the `#member-approvals` Discord 👍/👎 from [ADR 0057](0057-discord-archon-approval-channels.md)). This is the **admission** gate: it decides who is allowed into the hall at all.
+2. **First-box Archon approval** ([ADR 0035](0035-builder-onboarding-three-paths.md) §2, [#717](https://example.com/builders#/task/717), migration 071). An already-admitted builder's *first* dev box was held at `box_intents.state='pending_approval'` until an Archon approved it (`POST /api/gds/box/intents/:id/approve`, or the `#box-approvals` Discord 👍/👎). Only then did the control-plane runner provision the paid (~$24/mo) droplet.
 
-The first-box gate existed when admission was **open** — back then anyone with a GitHub account could become a Xenos with zero human in the loop, so a second human gate on the first paid box was the only thing standing between a signup and a charge ([ADR 0035](<redacted>.md) §Problem-3). Since [ADR 0050](<redacted>.md) closed that hole — admission is now invite-gated by default — the two gates are **redundant**: an Archon already had to admit this person before they could request a box at all. The second approval is a now-pointless second click that an Archon must remember to action (or it strands silently — the same failure mode the 2026-06-15 gate-surface retro called out for stranded approvals).
+The first-box gate existed when admission was **open** — back then anyone with a GitHub account could become a Xenos with zero human in the loop, so a second human gate on the first paid box was the only thing standing between a signup and a charge ([ADR 0035](0035-builder-onboarding-three-paths.md) §Problem-3). Since [ADR 0050](0050-device-flow-admission-invite-gated-by-default.md) closed that hole — admission is now invite-gated by default — the two gates are **redundant**: an Archon already had to admit this person before they could request a box at all. The second approval is a now-pointless second click that an Archon must remember to action (or it strands silently — the same failure mode the 2026-06-15 gate-surface retro called out for stranded approvals).
 
 ## Decision
 
-Collapse the two human gates to **one — member-join admission.** Once a member is admitted ([ADR 0050](<redacted>.md)), their first dev box provisions **hands-off** through the existing box-intent runner: `POST /api/gds/box/ensure` enqueues the intent at `state='pending'` straight away (the same state a wake or a subsequent re-provision already uses), and the control-plane runner drains it unchanged. There is no `pending_approval` hold and no first-box approve step.
+Collapse the two human gates to **one — member-join admission.** Once a member is admitted ([ADR 0050](0050-device-flow-admission-invite-gated-by-default.md)), their first dev box provisions **hands-off** through the existing box-intent runner: `POST /api/gds/box/ensure` enqueues the intent at `state='pending'` straight away (the same state a wake or a subsequent re-provision already uses), and the control-plane runner drains it unchanged. There is no `pending_approval` hold and no first-box approve step.
 
-This **supersedes** [ADR 0035](<redacted>.md) §2 (Decision §2, "A newcomer's FIRST box requires Archon approval") and the **box half** of [ADR 0057](<redacted>.md) (the `#box-approvals` channel and its box-intent approve/deny reaction wiring). The rest of [ADR 0035](<redacted>.md) (§1 Metic+ local clone, §3 the single hosted guide) and the **member half** of [ADR 0057](<redacted>.md) (the `#member-approvals` channel) stand unchanged.
+This **supersedes** [ADR 0035](0035-builder-onboarding-three-paths.md) §2 (Decision §2, "A newcomer's FIRST box requires Archon approval") and the **box half** of [ADR 0057](0057-discord-archon-approval-channels.md) (the `#box-approvals` channel and its box-intent approve/deny reaction wiring). The rest of [ADR 0035](0035-builder-onboarding-three-paths.md) (§1 Metic+ local clone, §3 the single hosted guide) and the **member half** of [ADR 0057](0057-discord-archon-approval-channels.md) (the `#member-approvals` channel) stand unchanged.
 
 ## Consequences
 
@@ -28,10 +28,10 @@ This **supersedes** [ADR 0035](<redacted>.md) §2 (Decision §2, "A newcomer's F
 - **The box provisioning RANK FLOOR still bounds eligibility.** `BOX_PROVISION_MIN_RANK` ([`src/bongos/boxes.js`](../../src/bongos/boxes.js)) is unchanged: the floor is still the rank-side control on who may have a box at all, and the per-builder "one box at a time" invariant (`box_intents` partial unique index, one `builder_boxes` row) is untouched. Removing the *first-box* gate does not widen *who* qualifies; it only removes the second human click for someone already admitted and already above the floor.
 - **Migration 102 reverts the schema** introduced by migration 071 — the `pending_approval` box-intent state (and any approval-tracking column) is removed; in-flight first-box intents are migrated to `pending` so the runner drains them.
 - **The box-panel "awaiting approval" UI state is removed** — `/builder-box` and the hall box panel no longer surface "your box is awaiting approval," because no box waits.
-- **The `#box-approvals` Discord channel + its box-intent approve/deny wiring are removed** (the box half of [ADR 0057](<redacted>.md)). `#member-approvals` and the admission approve/dismiss wiring stay — admission is still the gate.
-- **The trust-boundary invariant from [ADR 0031](<redacted>.md) §6 is unchanged.** The web tier still only *records a provision intent*; it never holds `DO_API_TOKEN` and never provisions directly. This ADR removes a human approval step, not the control-plane separation.
+- **The `#box-approvals` Discord channel + its box-intent approve/deny wiring are removed** (the box half of [ADR 0057](0057-discord-archon-approval-channels.md)). `#member-approvals` and the admission approve/dismiss wiring stay — admission is still the gate.
+- **The trust-boundary invariant from [ADR 0031](0031-cloud-dev-environments-for-builders.md) §6 is unchanged.** The web tier still only *records a provision intent*; it never holds `DO_API_TOKEN` and never provisions directly. This ADR removes a human approval step, not the control-plane separation.
 
 ## Alternatives considered
 
-- **Keep both gates.** Rejected — with admission now invite-gated ([ADR 0050](<redacted>.md)), the first-box gate is a redundant second click on a person an Archon already vetted, and it strands silently when un-actioned. The cost concern it was built for ([ADR 0035](<redacted>.md) §Problem-3) is already covered by admission + the rank floor.
-- **Drop admission and keep first-box approval instead.** Rejected — admission is the stronger control (it gates *all* access, including reading and idea-filing, not just the box), and [ADR 0050](<redacted>.md) deliberately made it the default. Keeping the weaker, narrower gate while dropping the broader one inverts the design.
+- **Keep both gates.** Rejected — with admission now invite-gated ([ADR 0050](0050-device-flow-admission-invite-gated-by-default.md)), the first-box gate is a redundant second click on a person an Archon already vetted, and it strands silently when un-actioned. The cost concern it was built for ([ADR 0035](0035-builder-onboarding-three-paths.md) §Problem-3) is already covered by admission + the rank floor.
+- **Drop admission and keep first-box approval instead.** Rejected — admission is the stronger control (it gates *all* access, including reading and idea-filing, not just the box), and [ADR 0050](0050-device-flow-admission-invite-gated-by-default.md) deliberately made it the default. Keeping the weaker, narrower gate while dropping the broader one inverts the design.

package/docs/adr/0060-gds-retrieval-layer.md

@@ -3,7 +3,7 @@
 - **Status:** Accepted
 - **Date:** 2026-06-16
 - **Track:** internal
-- **Builds on:** [ADR 0016](<redacted>.md) (server-enforced permissions — the read posture this index must never bypass), [ADR 0043](<redacted>.md) (sub-Metic stay out of the permission/methodology core), [ADR 0024](<redacted>.md) (the memory/learning corpus this indexes), [ADR 0010](0010-pms-architecture.md) (the GDS Postgres this lives in)
+- **Builds on:** [ADR 0016](0016-trust-boundary-server-enforced-permissions.md) (server-enforced permissions — the read posture this index must never bypass), [ADR 0043](0043-git-ssh-trust-boundary-and-rank-floor-on-permission-paths.md) (sub-Metic stay out of the permission/methodology core), [ADR 0024](0024-cloneable-repo-local-first-memory.md) (the memory/learning corpus this indexes), [ADR 0010](0010-pms-architecture.md) (the GDS Postgres this lives in)
 - **Task:** 940 (V4.R02) — locks the architecture for the GDS-V4 "one-call recall" criterion. Implemented by V4.R06 (migration, [#944](https://example.com/builders#/task/944)), V4.R07 (chunker, [#945](https://example.com/builders#/task/945)), V4.R09/R10 (ingesters, [#947](https://example.com/builders#/task/947)/[#948](https://example.com/builders#/task/948)), V4.R11 (search route, [#949](https://example.com/builders#/task/949)), V4.R12 (scoping + isolation suite, [#950](https://example.com/builders#/task/950)); the embedding layer is gated behind the V4.R24 eval ([#962](https://example.com/builders#/task/962)).
 
 ## Context
@@ -13,7 +13,7 @@ A builder starting a session re-discovers the same project knowledge by hand eve
 Two hard constraints frame every choice below:
 
 1. **Budget + ops (CLAUDE.md §4).** $5k/year, one ~$14/mo droplet, one Node process, one Postgres. A retrieval stack that adds a managed vector DB, a separate search service, or a GPU box is off the table unless lexical-in-Postgres demonstrably can't do the job.
-2. **The trust boundary ([ADR 0016](<redacted>.md) / [ADR 0043](<redacted>.md)).** Some indexed content is rank-gated (permission-core docs are Metic+; a builder's own memory is theirs alone). A search index is a classic read-side bypass: if it returns a snippet of a doc the caller can't otherwise read, the index just defeated the boundary. Scoping is therefore a **first-class, server-enforced** property of the index, not a filter bolted on later.
+2. **The trust boundary ([ADR 0016](0016-trust-boundary-server-enforced-permissions.md) / [ADR 0043](0043-git-ssh-trust-boundary-and-rank-floor-on-permission-paths.md)).** Some indexed content is rank-gated (permission-core docs are Metic+; a builder's own memory is theirs alone). A search index is a classic read-side bypass: if it returns a snippet of a doc the caller can't otherwise read, the index just defeated the boundary. Scoping is therefore a **first-class, server-enforced** property of the index, not a filter bolted on later.
 
 The 2026-06-12 research report ("GDS retrieval architecture") surveyed the options and recommended **lexical-first, in Postgres**: Postgres ships full-text search (`tsvector`/`tsquery`) and trigram fuzzy match (`pg_trgm`) in the box we already run; the corpus (a few thousand markdown chunks + DB prose rows) is tiny by search standards; and embeddings buy little until a *measured* lexical gap justifies their cost and operational weight. This ADR locks that in.
 
@@ -71,7 +71,7 @@ This is the load-bearing security property, mirroring [`src/bongos/routes/memory
 
 - Every query is filtered **in the SQL WHERE clause** (not post-hoc in JS) by the caller's **live, server-resolved rank** (`req.builder.rank`, read fresh per request — never from input): `min_rank` must be ≤ the caller's rank in the ladder.
 - A chunk with a non-null `owner_builder_id` (a per-builder private chunk, e.g. memory) is returned **only** to that owner — `owner_builder_id IS NULL OR owner_builder_id = req.builder.id`. There is no parameter to name another builder; the owner is always the authenticated session.
-- Permission-core docs (the [ADR 0043](<redacted>.md) protected set: trust-boundary docs, rank/authz, the ship/grade/deploy pipeline) are ingested at `min_rank='metic'` so a Xenos/Thetes search can never return a snippet of them.
+- Permission-core docs (the [ADR 0043](0043-git-ssh-trust-boundary-and-rank-floor-on-permission-paths.md) protected set: trust-boundary docs, rank/authz, the ship/grade/deploy pipeline) are ingested at `min_rank='metic'` so a Xenos/Thetes search can never return a snippet of them.
 - **No public/unauthenticated surface.** `POST /api/gds/search` is `requireBuilder`. The public read API ([`src/bongos/routes/public.js`](../../src/bongos/routes/public.js)) gains nothing here.
 - A dedicated isolation suite (`tests/search_isolation.mjs`, in the style of `tests/memory_isolation.mjs`) proves: a sub-Metic query never returns a `min_rank='metic'` chunk; a builder never returns another builder's owned chunk; the filter is in SQL, not a JS post-filter that a future refactor could drop.
 

package/docs/adr/0061-context-layer-decomposition.md

@@ -3,7 +3,7 @@
 - **Status:** Accepted
 - **Date:** 2026-06-18
 - **Track:** internal
-- **Builds on:** [ADR 0016](<redacted>.md) (markdown only describes; the server/DB enforce — so trimming CLAUDE.md can never weaken authority), [ADR 0060](0060-gds-retrieval-layer.md) (the `/recall` retrieval half of "find what we know"; this ADR is the *instruction/navigation* half), [ADR 0024](<redacted>.md) (the Architect, which drives the deeper Path C module refactor)
+- **Builds on:** [ADR 0016](0016-trust-boundary-server-enforced-permissions.md) (markdown only describes; the server/DB enforce — so trimming CLAUDE.md can never weaken authority), [ADR 0060](0060-gds-retrieval-layer.md) (the `/recall` retrieval half of "find what we know"; this ADR is the *instruction/navigation* half), [ADR 0024](0024-multi-agent-system-architecture.md) (the Architect, which drives the deeper Path C module refactor)
 - **Task:** 1222 (GDS-V4) — Path A of the 2026-06-18 "context cliff" research.
 
 ## Context
@@ -19,7 +19,7 @@ CLAUDE.md is the most-loaded artifact we have: Claude Code reads the root **in f
 
 Cursor addresses the same problem by splitting one rules file into many small, **scoped, lazily-loaded** `.cursor/rules` files (loaded only when a matching file is in context). Claude Code has the native equivalent — **nested `CLAUDE.md` files load on demand** when an agent reads a file in that directory — and we were not using it: one root file, zero nested ones.
 
-> On the owner's worry that "CLAUDE.md is deeply ingrained into making everything work": per [ADR 0016](<redacted>.md) it is **descriptive, not authoritative** — the server/DB enforce permissions and the ship pipeline, and editing the file grants no authority. So the risk is *not* that a wrong CLAUDE.md breaks enforcement. The risk is narrower and real: it over-spends the always-loaded context budget, and its live-state prose drifts. This ADR fixes that risk without touching enforcement.
+> On the owner's worry that "CLAUDE.md is deeply ingrained into making everything work": per [ADR 0016](0016-trust-boundary-server-enforced-permissions.md) it is **descriptive, not authoritative** — the server/DB enforce permissions and the ship pipeline, and editing the file grants no authority. So the risk is *not* that a wrong CLAUDE.md breaks enforcement. The risk is narrower and real: it over-spends the always-loaded context budget, and its live-state prose drifts. This ADR fixes that risk without touching enforcement.
 
 ## Decision
 

package/docs/adr/0062-medusa-instance-model-decoupling.md

@@ -3,11 +3,11 @@
 - **Status:** Accepted
 - **Date:** 2026-06-18
 - **Track:** internal
-- **Builds on:** [ADR 0010](0010-pms-architecture.md) (the GDS architecture being extracted), [ADR 0016](<redacted>.md) (the trust boundary — *core*, survives the split untouched), [ADR 0061](<redacted>.md) (the context-layer charter + nested docs — this ADR makes that the *portable methodology core*), [ADR 0004](0004-example-name-and-trademark-acceptance.md) (the civ-name "single config string" rule — generalized here into the branding contract), [ADR 0024](<redacted>.md) (the grader/architect/onboarding prompts that carry brand and must be parameterized)
+- **Builds on:** [ADR 0010](0010-pms-architecture.md) (the GDS architecture being extracted), [ADR 0016](0016-trust-boundary-server-enforced-permissions.md) (the trust boundary — *core*, survives the split untouched), [ADR 0061](0061-context-layer-decomposition.md) (the context-layer charter + nested docs — this ADR makes that the *portable methodology core*), [ADR 0004](0004-example-name-and-trademark-acceptance.md) (the civ-name "single config string" rule — generalized here into the branding contract), [ADR 0024](0024-multi-agent-system-architecture.md) (the grader/architect/onboarding prompts that carry brand and must be parameterized)
 - **Task:** [#1189](https://example.com/builders#/task/1189) (V4.R50) — the spike that **locks the boundary before the R51–R74 structural epics build**. Satisfies the design half of criteria **C8** (decouple the GDS into an instance model — "the GDS builds itself") and frames **C9** (AGPL open-source track).
-- **Amended by:** [ADR 0108](<redacted>.md) — resolves §10's build-sequence assumption that instance content sits at the repo root into the configurable-root composition mechanism (a consumer installs the core as a dependency and injects an instance-root).
+- **Amended by:** [ADR 0108](0108-instance-composition-configurable-root.md) — resolves §10's build-sequence assumption that instance content sits at the repo root into the configurable-root composition mechanism (a consumer installs the core as a dependency and injects an instance-root).
 
-> **⚠ Renamed (2026-06-19):** the platform this ADR calls **Medusa** was renamed **Cloud Bongos** by owner directive. This record is kept verbatim as history; the rename decision (and what it touches vs. leaves as history) is [ADR 0064](<redacted>.md). Forward-facing config + docs now read "Cloud Bongos."
+> **⚠ Renamed (2026-06-19):** the platform this ADR calls **Medusa** was renamed **Cloud Bongos** by owner directive. This record is kept verbatim as history; the rename decision (and what it touches vs. leaves as history) is [ADR 0064](0064-rename-medusa-to-cloud-bongos.md). Forward-facing config + docs now read "Cloud Bongos."
 
 ## Context
 
@@ -66,13 +66,13 @@ A **module registry**: each module declares what it contributes — route mounts
 
 ### 5. DB carve-out (R52, [#1191](https://example.com/builders#/task/1191))
 
-A GDS-owned Pool reading `DATABASE_URL`/`PG*` (not hard-defaulting to the `example` DB) — sever `src/bongos/db.js`'s `require('../db')`. A GDS-only migration sequence; game migrations 001/002 belong to the `game` module and are simply not applied on a non-game instance. Drop the hardcoded track taxonomy. **The trust boundary ([ADR 0016](<redacted>.md)) and per-request rank enforcement are core and unchanged.**
+A GDS-owned Pool reading `DATABASE_URL`/`PG*` (not hard-defaulting to the `example` DB) — sever `src/bongos/db.js`'s `require('../db')`. A GDS-only migration sequence; game migrations 001/002 belong to the `game` module and are simply not applied on a non-game instance. Drop the hardcoded track taxonomy. **The trust boundary ([ADR 0016](0016-trust-boundary-server-enforced-permissions.md)) and per-request rank enforcement are core and unchanged.**
 
 ### 6. Config namespace (R61, [#1200](https://example.com/builders#/task/1200))
 
 Consolidate `OTB_*`/`PMS_*` env prefixes + the `~/.config/otb/` path to a neutral product namespace driven by instance config, with back-compat shims (existing local sessions/boxes keep working). Owner bootstrap from instance config replaces migration 023's hardcoded `github_login='example-owner'` Archon literal (R62, [#1201](https://example.com/builders#/task/1201)).
 
-### 7. Portable methodology core ↔ host context split (folds in [ADR 0061](<redacted>.md) + R66 [#1205](https://example.com/builders#/task/1205))
+### 7. Portable methodology core ↔ host context split (folds in [ADR 0061](0061-context-layer-decomposition.md) + R66 [#1205](https://example.com/builders#/task/1205))
 
 - **CLAUDE.md becomes the portable methodology core** Medusa ships: the working rules, session protocol, claim→ship lifecycle, the ADR 0061 **content charter**, and the **nested-`CLAUDE.md`** pattern. Instance-agnostic.
 - **The host authors its own project-context file.** The OTB identity (company, vision, world, visual style — today's CLAUDE.md §§3/5/6/7) moves OUT of the shipped core into an instance-owned context doc + the branding pack. This is the concrete meaning of "move the project identity": **it is the core/host split, not tidying.**

package/docs/adr/0063-generated-repo-map-symbol-skeleton.md

@@ -3,12 +3,12 @@
 - **Status:** Accepted
 - **Date:** 2026-06-18
 - **Track:** internal
-- **Builds on:** [ADR 0061](<redacted>.md) (the content charter + nested per-module `CLAUDE.md` — this generates their *factual half*), [ADR 0060](0060-gds-retrieval-layer.md) (the lexical recall layer — this is its structural/code complement), [ADR 0062](<redacted>.md) §9 (Path B, folded into the Medusa portable core)
+- **Builds on:** [ADR 0061](0061-context-layer-decomposition.md) (the content charter + nested per-module `CLAUDE.md` — this generates their *factual half*), [ADR 0060](0060-gds-retrieval-layer.md) (the lexical recall layer — this is its structural/code complement), [ADR 0062](0062-medusa-instance-model-decoupling.md) §9 (Path B, folded into the Medusa portable core)
 - **Task:** [#1224](https://example.com/builders#/task/1224) (V4.R75) — Path B of the 2026-06-18 context-cliff plan.
 
 ## Context
 
-As an AI-authored repo grows, an agent's ability to make safe changes degrades: it cannot hold the whole tree in context, so it either reads too many files (burning budget) or guesses (drifting). [ADR 0061](<redacted>.md) added nested per-module `CLAUDE.md` docs whose hand-written "Key files / public surface" section is exactly the kind of fact that **drifts** — the moment a function is renamed or a file added, the prose lies, and nothing forces it back into sync.
+As an AI-authored repo grows, an agent's ability to make safe changes degrades: it cannot hold the whole tree in context, so it either reads too many files (burning budget) or guesses (drifting). [ADR 0061](0061-context-layer-decomposition.md) added nested per-module `CLAUDE.md` docs whose hand-written "Key files / public surface" section is exactly the kind of fact that **drifts** — the moment a function is renamed or a file added, the prose lies, and nothing forces it back into sync.
 
 Path B (the 2026-06-18 research) is the fix: a committed, **generated** symbol skeleton, regenerated mechanically so it cannot drift — the same "generate, don't narrate" discipline `gen-diagrams.js` already applies to the onboarding diagrams (task 357). It gives an agent an **altitude map** (à la Aider's repo map): the most central symbols and per-file signatures, so it can navigate without reading every file. It complements the recall layer ([ADR 0060](0060-gds-retrieval-layer.md)), which indexes *prose* (docs + DB rows) — the repo map indexes *code*.
 

package/docs/adr/0064-rename-medusa-to-cloud-bongos.md

@@ -3,12 +3,12 @@
 - **Status:** Accepted
 - **Date:** 2026-06-19
 - **Track:** internal
-- **Amends:** [ADR 0062](<redacted>.md) (the instance-model build platform, formerly named "Medusa"). The 0062 architecture — portable core / host instance / gated feature-modules, the branding contract, feature-module selection — is **unchanged**; only the platform's name changes.
+- **Amends:** [ADR 0062](0062-medusa-instance-model-decoupling.md) (the instance-model build platform, formerly named "Medusa"). The 0062 architecture — portable core / host instance / gated feature-modules, the branding contract, feature-module selection — is **unchanged**; only the platform's name changes.
 - **Task:** 1242 (this rename). Sibling: task 1216 / V4.R74 (the Cloud Bongos visual brand pack — the look this name wears).
 
 ## Context
 
-The build platform decoupled out of the GDS in [ADR 0062](<redacted>.md) was named **Medusa** (a working name from the 2026-06-17 planning session). While designing the vanilla "customer 0" brand pack (task 1216 / V4.R74), the owner settled on a different identity and renamed the platform to **Cloud Bongos** — a light, joyful, "playing in the clouds" developer tool where *building software is laying down a beat*.
+The build platform decoupled out of the GDS in [ADR 0062](0062-medusa-instance-model-decoupling.md) was named **Medusa** (a working name from the 2026-06-17 planning session). While designing the vanilla "customer 0" brand pack (task 1216 / V4.R74), the owner settled on a different identity and renamed the platform to **Cloud Bongos** — a light, joyful, "playing in the clouds" developer tool where *building software is laying down a beat*.
 
 The visual direction is recorded with the brand pack (task 1216), not here: a Lion-King sunrise backdrop, Apple-style liquid-glass "cloud" cards, a bongo-pair mark with an equalizer/beat motif, and the type pairing **baloo 2** (lowercase wordmark) · **Quicksand** (interface) · **Fira Code** (numbers & code). *This* ADR records only the name and the rename's scope.
 
@@ -31,7 +31,7 @@ The visual direction is recorded with the brand pack (task 1216), not here: a Li
 - **Live DB strings** (follow-up, task 1244 / migration `<redacted>.sql`): the GDS-V4 **C8 + C9** done-when criteria and the **R67** proof-task title/description — rewritten forward because the API serves them to users (/status, the hall, /recall). Display text only; the `medusa-*` `criterion_id` keys and the `schema_migrations` version strings are untouched.
 
 **Left as history (NOT rewritten):**
-- ADR 0062 body (carries a pointer note to here), [ADR 0063](<redacted>.md).
+- ADR 0062 body (carries a pointer note to here), [ADR 0063](0063-generated-repo-map-symbol-skeleton.md).
 - `docs/session-logs/<redacted>.md` and other logs.
 - Applied migrations `110_medusa_planning_seed.sql`, `<redacted>.sql` (immutable once applied).
 - `scripts/gds/seed-medusa-tasks.js` (the historical seed tooling; its filename and the **other 23** V4.R50–R74 task titles/descriptions that say "Medusa" — the R67 proof task + the C8/C9 criteria were rewritten live via migration 114 / task 1244; the rest stay as history per the owner's choice).

package/docs/adr/0065-agpl-nonprofit-ai-first-governance.md

@@ -4,12 +4,12 @@
 - **Date:** 2026-06-19
 - **Track:** internal
 - **Task:** [#1207](https://example.com/builders#/task/1207) (V4.R68) — the foundational decision for the C9 open-source track.
-- **Builds on:** [ADR 0062](<redacted>.md) (the instance-model build platform — defines the portable core / host instance / feature-module cut-line this ADR releases), [ADR 0064](<redacted>.md) (the platform is named **Cloud Bongos**), [ADR 0016](<redacted>.md) (the server-enforced trust boundary — survives open-sourcing untouched).
+- **Builds on:** [ADR 0062](0062-medusa-instance-model-decoupling.md) (the instance-model build platform — defines the portable core / host instance / feature-module cut-line this ADR releases), [ADR 0064](0064-rename-medusa-to-cloud-bongos.md) (the platform is named **Cloud Bongos**), [ADR 0016](0016-trust-boundary-server-enforced-permissions.md) (the server-enforced trust boundary — survives open-sourcing untouched).
 - **Gates:** [#1208](https://example.com/builders#/task/1208) (R69 LICENSE file), [#1209](https://example.com/builders#/task/1209) (R70 governance docs), [#1210](https://example.com/builders#/task/1210) (R71 public mirror + carve-out), [#1211](https://example.com/builders#/task/1211) (R72 delayed export pipeline), [#1212](https://example.com/builders#/task/1212) (R73 lineage-consistency proof). This ADR is the decision those five tasks implement.
 
 ## Context
 
-[ADR 0062](<redacted>.md) decoupled the GDS into **Cloud Bongos** — a configurable, self-hostable build platform where AI agents claim tasks and ship code, with a human owner setting scope and the hard gates. Example (the Example game) becomes **customer 1** running on it; Cloud Bongos runs on its own plain vanilla brand as **customer 0** and builds itself.
+[ADR 0062](0062-medusa-instance-model-decoupling.md) decoupled the GDS into **Cloud Bongos** — a configurable, self-hostable build platform where AI agents claim tasks and ship code, with a human owner setting scope and the hard gates. Example (the Example game) becomes **customer 1** running on it; Cloud Bongos runs on its own plain vanilla brand as **customer 0** and builds itself.
 
 Criterion **C9 (`medusa-open-and-protected`)** commits Cloud Bongos to being *open, free, and protected from capture*: released to the public as open source on a deliberate, delayed cadence. Three questions had to be answered before any of R69–R73 could be built, because each is downstream of the answer:
 
@@ -34,7 +34,7 @@ The license covers the **publishable subset only** — the portable methodology
 The project is run as a **non-profit**: it is **not monetized from its contributors**, and it is structured so no single party can capture it.
 
 - No contributor pays to contribute, and no contribution is resold as a proprietary add-on by the project.
-- The example/credit economy ([ADR 0054](<redacted>.md)) is an **instance-internal** mechanism — it rewards builders on a given instance out of that instance's own budget; it is not the project monetizing the commons. It ships as a feature an instance configures, not as a revenue stream flowing to a central owner.
+- The example/credit economy ([ADR 0054](0054-session-token-reward-cost-plus.md)) is an **instance-internal** mechanism — it rewards builders on a given instance out of that instance's own budget; it is not the project monetizing the commons. It ships as a feature an instance configures, not as a revenue stream flowing to a central owner.
 - The AGPL is the legal backstop; the non-profit posture is the social one. Together they are the "protected from capture" half of C9.
 
 Optional **managed-hosting** (operating instances for owners) was captured as a post-C8 idea in the planning session. If it is ever built, it is a service offered *on top of* the same AGPL artifact — it does not change the artifact's license or the non-profit posture of the platform itself.
@@ -43,7 +43,7 @@ Optional **managed-hosting** (operating instances for owners) was captured as a
 
 Cloud Bongos is **AI-first**: the expectation is that **AI agents write the code** — a human owner sets scope, direction, and the hard gates (rank, approval, deploy); the day-to-day building is done by AI agents claiming tasks.
 
-This is a **documented norm folded into governance/methodology, not a technical gate**. We do *not* add machinery that detects or blocks human-authored commits. The norm is stated in CONTRIBUTING (R70) and lives in the portable methodology core (CLAUDE.md, [ADR 0061](<redacted>.md)); enforcement is cultural and reviewable, the same way the "every change is backed by a claimed task" rule is. An instance is free to relax it; the project ships it as the default expectation because the whole methodology — the grader, the session-token economy, the claim lifecycle — is designed around agents as the primary authors.
+This is a **documented norm folded into governance/methodology, not a technical gate**. We do *not* add machinery that detects or blocks human-authored commits. The norm is stated in CONTRIBUTING (R70) and lives in the portable methodology core (CLAUDE.md, [ADR 0061](0061-context-layer-decomposition.md)); enforcement is cultural and reviewable, the same way the "every change is backed by a claimed task" rule is. An instance is free to relax it; the project ships it as the default expectation because the whole methodology — the grader, the session-token economy, the claim lifecycle — is designed around agents as the primary authors.
 
 ### 4. The public-mirror boundary (jointly defined with R50)
 
@@ -64,6 +64,6 @@ The mirror is **generated** from the private Example repo by the delayed-export
 ## Consequences
 
 - **R69–R73 have one decision to build against.** R69 drops the AGPL-3.0 `LICENSE` file; R70 writes GOVERNANCE/CONTRIBUTING/CODE_OF_CONDUCT encoding the non-profit + AI-first norms decided here; R71 carves the publishable subtree to the §4 boundary; R72 builds the 6-month-delayed redacted export; R73 proves lineage + no-leak.
-- **The trust boundary and rank ladder are unaffected.** Server-enforced permissions ([ADR 0016](<redacted>.md)) and the Greek rank enum ([ADR 0062](<redacted>.md) planning lock) are core methodology; open-sourcing the code does not weaken them — an instance's authority still lives in its own DB, checked server-side, regardless of who can read the source.
+- **The trust boundary and rank ladder are unaffected.** Server-enforced permissions ([ADR 0016](0016-trust-boundary-server-enforced-permissions.md)) and the Greek rank enum ([ADR 0062](0062-medusa-instance-model-decoupling.md) planning lock) are core methodology; open-sourcing the code does not weaken them — an instance's authority still lives in its own DB, checked server-side, regardless of who can read the source.
 - **Downstream operators inherit the AGPL obligation.** Anyone hosting a modified Cloud Bongos owes their users source. That is the intended effect, not a side effect.
 - **No new infrastructure or recurring cost** from this decision itself; it is a license + posture choice. The export pipeline (R72) has its own cost profile, evaluated under its task.

package/docs/adr/0066-generated-file-map-sections.md

@@ -3,12 +3,12 @@
 - **Status:** Accepted
 - **Date:** 2026-06-19
 - **Track:** internal
-- **Builds on:** [ADR 0063](<redacted>.md) (generated symbol skeleton — same "generate, don't narrate" discipline + the `git-merge-regen` self-heal), [ADR 0062](<redacted>.md) §8–§9 (Path C fitness gate + the gen-on-deploy pattern), [ADR 0061](<redacted>.md) (the context-layer docs this keeps honest)
+- **Builds on:** [ADR 0063](0063-generated-repo-map-symbol-skeleton.md) (generated symbol skeleton — same "generate, don't narrate" discipline + the `git-merge-regen` self-heal), [ADR 0062](0062-medusa-instance-model-decoupling.md) §8–§9 (Path C fitness gate + the gen-on-deploy pattern), [ADR 0061](0061-context-layer-decomposition.md) (the context-layer docs this keeps honest)
 - **Task:** [#1276](https://example.com/builders#/task/1276)
 
 ## Context
 
-`docs/file-map.md` is the repo's "where things live" index. Every other self-knowledge doc had already been moved off the honor system: the onboarding diagrams (`gen-diagrams.js`, task 357), the code symbol skeleton (`gen-repo-map.js`, [ADR 0063](<redacted>.md)), and the session-log index (`gen-session-index.js`, [ADR 0062](<redacted>.md) §8) are all **generated and CI-enforced** — so an agent physically cannot forget to update them. `file-map.md` was the last one still hand-maintained.
+`docs/file-map.md` is the repo's "where things live" index. Every other self-knowledge doc had already been moved off the honor system: the onboarding diagrams (`gen-diagrams.js`, task 357), the code symbol skeleton (`gen-repo-map.js`, [ADR 0063](0063-generated-repo-map-symbol-skeleton.md)), and the session-log index (`gen-session-index.js`, [ADR 0062](0062-medusa-instance-model-decoupling.md) §8) are all **generated and CI-enforced** — so an agent physically cannot forget to update them. `file-map.md` was the last one still hand-maintained.
 
 The cost showed up concretely: task 1267/1269/1272 shipped three new skills (`/ideate`, `/paint`, `/dev`) without adding them to `file-map.md`, which then needed a *separate* doc-hygiene task ([#1274](https://example.com/builders#/task/1274)) just to catch the map up. Worse, an audit while building this found the two enumerable sections had silently drifted into curated **subsets**: `.claude/skills/` had 28 dirs on disk but the map listed ~18 (`recall`, `status`, `builder-box`, `priority-session`, … were simply absent), and `.claude/scheduled-tasks/` had 17 but listed ~6. The map looked complete and wasn't.