@bongos/core 1.19.774 → 1.19.776

package/.bongos-core.json

@@ -2,11 +2,11 @@
   "artifact": "bongos-core",
   "manifest_schema": 1,
   "generator": "scripts/gds/package-core.js",
-  "core_version": "1.19.774",
-  "core_contract": "1.19.774",
-  "source_commit": "6d6560877cde735a21effbfbe166a9b6410dc6b5",
+  "core_version": "1.19.776",
+  "core_contract": "1.19.776",
+  "source_commit": "c0b7c8b7cbf3c7bc785585da449da6ea57197c32",
   "source_ref": "HEAD",
-  "built_at": "2026-09-16T18:13:25.558Z",
+  "built_at": "2026-09-16T18:38:32.418Z",
   "redaction": {
     "model": "docs-redacted+functional-verbatim",
     "docs_redacted": 486,
@@ -17,7 +17,7 @@
     "gate": "passed"
   },
   "file_count": 2662,
-  "tree_sha256": "9a1c294ec7e5b0ea58e0ae98f7a672078969f80834a4f92aa064246296c3ebda",
+  "tree_sha256": "c7dff0b9c97a50075315c645e421fe4fac5bfa6d21bf5c6cdfaea55e04dccd5c",
   "files": [
     {
       "path": ".claude/skills/ask-for-help/SKILL.md",
@@ -422,7 +422,7 @@
     {
       "path": "config/modules.neutral.json",
       "mode": "0000644",
-      "sha256": "ea124b7c53207fc2c361f91c34dabf0e0d827db19956c0152c4e14c5b4fd29f6"
+      "sha256": "9bdd8eb1fbfb9053ed0fb921c0f669dcdaad2fe8b2629ce4cc9457dca995afbe"
     },
     {
       "path": "docker-compose.yml",
@@ -1957,7 +1957,7 @@
     {
       "path": "docs/adr/0290-disconnect-is-the-owner-initiated-exception-to-address-retention.md",
       "mode": "0000644",
-      "sha256": "a9558eccfabc69b85388c0aa7e7f1604d9dd7fa946c1761155cb8077d4c58d72"
+      "sha256": "37ab80018f5d9e6fdb35271be80ca07f10e6e593ef33b9a7a0a30fe9ea8c5fb3"
     },
     {
       "path": "docs/adr/README.md",
@@ -2527,7 +2527,7 @@
     {
       "path": "docs/module-api-changelog.md",
       "mode": "0000644",
-      "sha256": "8580243194e524ec2b486bf25efba134ebde1c618ca73221c8cdb3b29dc11f9d"
+      "sha256": "7112a78b80e84df9950cdde4bc399b4c82f54138c044c1291b37c884def9f5f0"
     },
     {
       "path": "docs/modules-contract.md",
@@ -6372,7 +6372,7 @@
     {
       "path": "modules/provisioning/starter-bundles.js",
       "mode": "0000644",
-      "sha256": "78cdbb14f2dc911d78d1dd7e1ae73027734e94a3bbd8826b2f27e343a2daba1d"
+      "sha256": "85f4b8e39801614457ed31f36220a0d2491c3d7dd8cd85ea04771d4ce77a79c2"
     },
     {
       "path": "modules/provisioning/tests/liveness.mjs",
@@ -7317,7 +7317,7 @@
     {
       "path": "modules/ui-design/kit/serve.js",
       "mode": "0000644",
-      "sha256": "0dd05fcbc98d62c99d59b7a0c258c4e7104cbfb64382f58fa003c62812be0515"
+      "sha256": "b041a60e0babb4b9d409f6542f748471c86235b8015922bdc501a5c0b8a2625f"
     },
     {
       "path": "modules/ui-design/kit/tells.js",
@@ -7627,12 +7627,12 @@
     {
       "path": "package-lock.json",
       "mode": "0000644",
-      "sha256": "564ee1ef2714eb5d47be1bf7d996e0f0fb615837722a68534f9917de1cf3ebd1"
+      "sha256": "02c6bd2ec2e4afdc61d69e399a42ee98e762d908c69a3b84c9d27e8823b1f6cf"
     },
     {
       "path": "package.json",
       "mode": "0000644",
-      "sha256": "a6c0ebbfb2480954dad153c0105905a07553eb163a5e95c4ead4a7c64de8e58f"
+      "sha256": "2a771101f553f4e0207b498d8172bcef587e9115fbb3ff301539851f282e99ba"
     },
     {
       "path": "public-docs/index.html",
@@ -7987,7 +7987,7 @@
     {
       "path": "scripts/gds/db-backup-nightly.sh",
       "mode": "0000644",
-      "sha256": "ff4785dbde6a5c52036ce4c4aacca317c62e725f49d3e32201909ec444d85d44"
+      "sha256": "93f0b743b90a0cfdc91806ecb10da20456b98c0fac0f2b8eb3d690bccf79e532"
     },
     {
       "path": "scripts/gds/db-backup-offsite.sh",
@@ -8487,7 +8487,7 @@
     {
       "path": "scripts/gds/provision-disconnect.js",
       "mode": "0000644",
-      "sha256": "c849ceda1769145879cb8da61186a39beb1ea48bfe1cd3eb0406eb668052aadb"
+      "sha256": "81cdd20b43aa1fc8b39a4fa06aada292aa00e84724feb803ba96bf15ce92cca9"
     },
     {
       "path": "scripts/gds/provision-net.js",
@@ -9492,7 +9492,7 @@
     {
       "path": "src/module-api.js",
       "mode": "0000644",
-      "sha256": "672c2b371fd586c6e143353c9482040124e18da76d0a64da29e5854fd0c1c08e"
+      "sha256": "74ef2cad88c2d19fb73139455608b8e200f22f7e835c925910f6e28b3590c2a0"
     },
     {
       "path": "src/module-loader/catalog.js",
@@ -10357,7 +10357,7 @@
     {
       "path": "tests/db_backup_nightly.mjs",
       "mode": "0000644",
-      "sha256": "020dc551d105cc4a29e0f9c750a03cd14a91511d3edc47eb6719a1e430461936"
+      "sha256": "cb731d19610530cc07457271aed57d5e04bec3d42bf85f246601b6cbdd02b3fd"
     },
     {
       "path": "tests/dead_deps.mjs",
@@ -12132,7 +12132,7 @@
     {
       "path": "tests/project_type_editable.mjs",
       "mode": "0000644",
-      "sha256": "9d2432b2f7ad937415213e3cdbdb98aca5dd8e0c6eff5d73757ca0e873e89b8b"
+      "sha256": "85ac90a891c8f6f19d7780dd1bae94964f770fbaa9620322c4bc3df16ce790d6"
     },
     {
       "path": "tests/project_visibility_db.mjs",
@@ -12242,7 +12242,7 @@
     {
       "path": "tests/provisioning_module_selection.mjs",
       "mode": "0000644",
-      "sha256": "92db65b8da5b849379bab03e70287239deab8b9a2b2e47b4574f12b8acac013e"
+      "sha256": "dffa4b500d3afe770764e562236ee97b6d581ed3db301ee3f984c5caa6f6f35e"
     },
     {
       "path": "tests/provisioning_onboard_mode.mjs",
@@ -12257,7 +12257,7 @@
     {
       "path": "tests/provisioning_recommendations.mjs",
       "mode": "0000644",
-      "sha256": "0557876002c1f0efde5a8e7c87702fa57df3a9efb26ea93b077969bcc10e3637"
+      "sha256": "587c6e640493939be17f6f293ceba8d22d125c79e43c070793b0325458132c71"
     },
     {
       "path": "tests/provisioning_restart.mjs",
@@ -12287,7 +12287,7 @@
     {
       "path": "tests/provisioning_starter_bundles.mjs",
       "mode": "0000644",
-      "sha256": "b63751ddf17d58ec3fdfdbd19c9f9a7569eed1ca9ff157a2a37f7034151eead7"
+      "sha256": "5996c2dac6fbb427fba2eac98058ec9cea529fd2aa74d4b51e4085263af798ae"
     },
     {
       "path": "tests/provisioning_teardown_intent.mjs",

package/config/modules.neutral.json

@@ -1,5 +1,5 @@
 {
-  "_note": "Feature-module selection — the VANILLA (customer-0) default: every optional feature OFF. A fresh Cloud Bongos instance is the methodology core only (builders/tasks/claims/credits/grading/memory/recall) with the engineer discipline. To enable a module on an instance, copy this to config/modules.json and flip flags (or set <ENVPREFIX>_MODULE_<NAME>=1). Sibling of config/branding.neutral.json. Owned by R54 / task 1193 (src/modules.js, ADR 0062 §4). Known modules: game, art-pipeline, discord, dev-box.",
+  "_note": "Feature-module selection — the VANILLA (customer-0) default: every optional feature OFF. A fresh Cloud Bongos instance is the methodology core only (builders/tasks/claims/credits/grading/memory/recall) with the engineer discipline. To enable a module on an instance, copy this to config/modules.json and flip flags (or set <ENVPREFIX>_MODULE_<NAME>=1). Sibling of config/branding.neutral.json. Owned by R54 / task 1193 (src/modules.js, ADR 0062 §4). Known modules: game, art-pipeline, discord. RETIRED: dev-box (goal 1000091, task 1003886) — no longer offered in any starter bundle and not in the creation picker's catalog. The flag stays declared and false until modules/dev-box/ is deleted, so an instance carrying an older config/modules.json cannot silently re-enable it.",
   "modules": {
     "game": false,
     "art-pipeline": false,

package/docs/adr/0290-disconnect-is-the-owner-initiated-exception-to-address-retention.md

@@ -35,6 +35,6 @@ A failed erase or catalog step returns a retryable `{ ok:false }`; a teardown th
 - The manage page's copy changed with the capability. The teardown truth now ends "Taking it offline erases nothing." rather than "Nothing here erases a project.", and the fold points at the new card instead of admitting the capability is missing.
 - The `project.catalog` port has three verbs. `tests/catalog_only_client.mjs` still pins the list.
 - If the runner dies mid-disconnect, the reconcile sweep re-enqueues a *teardown* for a `tearing_down` row, not a disconnect. The project is left offline, with its row, and the owner presses Disconnect again. This is accepted rather than giving the reconcile a memory of intent.
-- The nightly prune's `<db>-*.sql.gz` glob can still reach a longer-named sibling's dumps older than 30 days. It is filed as its own row, not fixed here.
+- The nightly prune's `<db>-*.sql.gz` glob could still reach a longer-named sibling's dumps older than 30 days. It was filed as its own row and fixed in [task 1003948](https://cloudbongos.com/builders#/task/1003948): the prune and its retained count now match the same exact filename.
 
 Proofs: `tests/provisioning_disconnect.mjs` (queue + route), `tests/provision_disconnect.mjs` (runner order, shapes, failure, guards), `tests/project_catalog_forget.mjs` (claim rules), `tests/hub_disconnect_ui.mjs` + the kit probe (the card).

package/docs/module-api-changelog.md

@@ -2022,5 +2022,9 @@ is load-bearing: the script throws rather than guess if it is missing, and
         landed since 1.19.772 with no explicit bump. run 35118731311. (task 1002620)
   1.19.774 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
         landed since 1.19.773 with no explicit bump. run 35132992149. (task 1002620)
+  1.19.775 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+        landed since 1.19.774 with no explicit bump. run 35133750943. (task 1002620)
+  1.19.776 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+        landed since 1.19.775 with no explicit bump. run 35135604764. (task 1002620)
 ---------------------------------------------------------------------------
 ```

package/modules/provisioning/starter-bundles.js

@@ -70,6 +70,21 @@ const ALWAYS_ON_CORE = Object.freeze([
 // refuse them by construction rather than by anyone remembering.
 const HUB_ONLY_MODULES = Object.freeze(['platform-identity', 'provisioning']);
 
+// Modules that were once offered and are being WITHDRAWN. A retired key is still
+// a module on disk — its manifest, routes and tables are deleted by later tasks —
+// but it must stop being OFFERED the moment the withdrawal starts, or an owner
+// creating a project today opts into something that is on its way out.
+//
+// WHY A LIST AND NOT JUST DELETING THE ROW. The integrity test below pins
+// OPTIONAL_MODULES against the on-disk `default: false` manifests, so that a new
+// opt-in module cannot ship without owner-facing copy. Dropping a row while its
+// manifest is still on disk would trip exactly that guard. Naming the withdrawal
+// keeps the guard honest in both directions: the catalog may omit a RETIRED
+// module and may omit nothing else. The entry is deleted when the module is
+// (goal 1000091, task 1003892) — at which point the manifest is gone and the
+// plain drift check covers it again.
+const RETIRED_MODULES = Object.freeze(['dev-box']);
+
 // The OPT-IN catalog as the creation picker renders it (BV1.R20, task 1002339):
 // every module an owner may actually choose, in the order the picker lists them,
 // with copy written for someone who has met none of them.
@@ -90,11 +105,6 @@ const OPTIONAL_MODULES = Object.freeze([
     label: 'Extra agents',
     summary: 'More AI agents alongside the ones every project gets, for reading, research and review.',
   }),
-  Object.freeze({
-    key: 'dev-box',
-    label: 'Dev boxes',
-    summary: 'A cloud workspace where a change can be tried out before anyone else sees it. Nothing is charged until someone asks for one.',
-  }),
   Object.freeze({
     key: 'discord',
     label: 'Discord',
@@ -122,8 +132,10 @@ const OPTIONAL_MODULE_KEYS = Object.freeze(OPTIONAL_MODULES.map((m) => m.key));
 // stay there. Decision: ADR 0243 (BV1.R22, task 1002341).
 //
 // Deliberately tiny: ADR 0237 already made the per-type preset the opinion, and
-// today's opt-in catalog is three modules wide — so this table's job is to correct
-// a preset the owner's answer contradicts, not to re-derive it.
+// today's opt-in catalog is two modules wide — so this table's job is to correct
+// a preset the owner's answer contradicts, not to re-derive it. The two rules that
+// added and removed `dev-box` by team shape went with the module (task 1003886):
+// a rule about a module nobody can select adjusts nothing.
 //
 // A rule may only ever name an OPT-IN module. Adding or removing an always-on one
 // would be a toggle that toggles nothing (ADR 0237 §3's argument, and
@@ -136,20 +148,6 @@ const TEAM_SHAPE_RULES = Object.freeze([
     module: 'discord',
     reason: 'You said an open community is building this, so somewhere for it to gather is switched on.',
   }),
-  Object.freeze({
-    id: 'a-team-shares-one-environment',
-    teamShape: 'small-team',
-    effect: 'add',
-    module: 'dev-box',
-    reason: 'A small team gets one shared environment to build in, so nobody is debugging their own laptop.',
-  }),
-  Object.freeze({
-    id: 'building-alone-needs-no-shared-environment',
-    teamShape: 'solo',
-    effect: 'remove',
-    module: 'dev-box',
-    reason: 'You are building this alone, so the shared cloud environment is off — your own machine is the setup.',
-  }),
 ]);
 
 // The team shapes the rules above can fire on. Derived from the table rather than
@@ -167,16 +165,17 @@ const RULED_TEAM_SHAPES = Object.freeze([...new Set(TEAM_SHAPE_RULES.map((r) =>
 // here has not met any of these modules yet.
 //
 // The lists are SHORT on purpose. A preselect an owner has to audit is worse than
-// none, and today's opt-in catalog is genuinely small (`agents`, `dev-box`,
-// `discord`); a bundle grows as the catalog does, which is exactly why this is a
-// declaration and not a rule engine. Enabling `dev-box` opens the door to a cloud
-// dev environment — it provisions nothing and bills nothing until a builder asks
-// for a box — so preselecting it costs the owner nothing but a toggle.
+// none, and today's opt-in catalog is genuinely small (`agents`, `discord`); a
+// bundle grows as the catalog does, which is exactly why this is a declaration and
+// not a rule engine. `dev-box` was preselected by the game and business bundles
+// until it was retired (goal 1000091, task 1003886) — withdrawing it left both
+// bundles one module wide, which is the floor working as intended, not a gap to
+// backfill with a module an owner did not ask for.
 const STARTER_BUNDLES = Object.freeze({
   game: Object.freeze({
     label: 'Game starter',
-    summary: 'Somewhere for players to gather, and a place to walk a change through before anyone plays it.',
-    modules: Object.freeze(['dev-box', 'discord']),
+    summary: 'Somewhere for players to gather, hear what you are building, and send their ideas back.',
+    modules: Object.freeze(['discord']),
   }),
   research: Object.freeze({
     label: 'Research starter',
@@ -185,8 +184,8 @@ const STARTER_BUNDLES = Object.freeze({
   }),
   business: Object.freeze({
     label: 'Business starter',
-    summary: 'A place to try a change before customers see it, and agents to look it over first.',
-    modules: Object.freeze(['agents', 'dev-box']),
+    summary: 'Extra agents to look a change over before customers ever see it.',
+    modules: Object.freeze(['agents']),
   }),
   'non-profit': Object.freeze({
     label: 'Non-profit starter',
@@ -259,6 +258,8 @@ function adjustBundle(bundle, teamShape) {
   for (const rule of TEAM_SHAPE_RULES) {
     if (rule.teamShape !== teamShape) continue;
     if (rule.effect === 'add' && !held.has(rule.module)) held.add(rule.module);
+    // `remove` is declared but named by no live rule since dev-box was retired
+    // (task 1003886). Kept for the next rule that needs it, not exercised today.
     else if (rule.effect === 'remove' && held.has(rule.module)) held.delete(rule.module);
     else continue;
     adjustments.push({ rule: rule.id, effect: rule.effect, module: rule.module, reason: rule.reason });
@@ -374,6 +375,7 @@ function effectiveModules(row) {
 module.exports = {
   ALWAYS_ON_CORE,
   HUB_ONLY_MODULES,
+  RETIRED_MODULES,
   OPTIONAL_MODULES,
   STARTER_BUNDLES,
   TEAM_SHAPE_RULES,

package/modules/ui-design/kit/serve.js

@@ -121,15 +121,14 @@ const STARTER_BUNDLES_FIXTURE = {
     'security', 'sessions', 'status-ui', 'ui-design',
   ],
   bundles: [
-    { type: 'game', bundle: ['dev-box', 'discord'] },
+    { type: 'game', bundle: ['discord'] },
     { type: 'research', bundle: ['agents'] },
-    { type: 'business', bundle: ['agents', 'dev-box'] },
+    { type: 'business', bundle: ['agents'] },
     { type: 'non-profit', bundle: ['discord'] },
     { type: 'not-sure', bundle: [] },
   ],
   optional: [
     { key: 'agents', label: 'Extra agents', summary: 'More AI agents alongside the ones every project gets, for reading, research and review.' },
-    { key: 'dev-box', label: 'Dev boxes', summary: 'A cloud workspace where a change can be tried out before anyone else sees it. Nothing is charged until someone asks for one.' },
     { key: 'discord', label: 'Discord', summary: 'A Discord server that carries your build news, and lets people send ideas and bug reports back.' },
   ],
 };

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.774",
+  "version": "1.19.776",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.19.774",
+      "version": "1.19.776",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.774",
+  "version": "1.19.776",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/scripts/gds/db-backup-nightly.sh

@@ -3,7 +3,7 @@
 #
 # Runs as user `lars` via the gds-db-backup.timer systemd unit (see
 # scripts/gds/gds-db-backup.timer + .service in this repo). Output lands
-# in /var/backups/gds/ as YYYY-MM-DD-HHMMSS.sql.gz (UTC timestamp), and
+# in /var/backups/gds/ as <db>-YYYY-MM-DDTHHMMSSZ.sql.gz (UTC timestamp), and
 # files older than 30 days are pruned.
 #
 # Authentication: peer auth via the local Unix socket — the invoking unix
@@ -59,6 +59,10 @@ RETENTION_DAYS="${GDS_BACKUP_RETENTION_DAYS:-30}"
 # Timestamp format. UTC so dumps sort sanely regardless of TZ.
 TS=$(date -u +"%Y-%m-%dT%H%M%SZ")
 OUT="${BACKUP_DIR}/${DB_NAME}-${TS}.sql.gz"
+# Exactly the name above. Every project's unit shares BACKUP_DIR, so a looser
+# `${DB_NAME}-*` would let `test` prune and count `test-nk`'s dumps (task 1003948).
+D='[0-9]'
+DUMP_GLOB="${DB_NAME}-${D}${D}${D}${D}-${D}${D}-${D}${D}T${D}${D}${D}${D}${D}${D}Z.sql.gz"
 
 # ---- preconditions ----------------------------------------------------------
 
@@ -173,7 +177,7 @@ fi
 # Done AFTER the new dump lands so a streak of failed runs can't erase
 # everything: we never delete on a day we didn't successfully dump.
 PRUNED=$(find "$BACKUP_DIR" -maxdepth 1 -type f \
-    -name "${DB_NAME}-*.sql.gz" \
+    -name "$DUMP_GLOB" \
     -mtime +"${RETENTION_DAYS}" \
     -print -delete | wc -l)
 
@@ -183,5 +187,5 @@ fi
 
 # ---- emit a one-line summary for journald + monitoring ---------------------
 
-REMAINING=$(find "$BACKUP_DIR" -maxdepth 1 -type f -name "${DB_NAME}-*.sql.gz" | wc -l)
+REMAINING=$(find "$BACKUP_DIR" -maxdepth 1 -type f -name "$DUMP_GLOB" | wc -l)
 echo "[$(date -u +%FT%TZ)] gds-db-backup: ok · ${REMAINING} dump(s) retained · ${BYTES} bytes latest"

package/scripts/gds/provision-disconnect.js

@@ -28,8 +28,8 @@ const { catalogOriginForInstance, ownerGithubIdForInstance } = require('../../mo
 const { deleteInstance } = require('../../modules/provisioning/disconnect.js');
 
 // The dump filename db-backup-nightly.sh writes — <db>-YYYY-MM-DDTHHMMSSZ.sql.gz — matched
-// EXACTLY. The nightly prune's own `<db>-*.sql.gz` would let a project named `test` erase
-// `test-nk`'s dumps, which is harmless for a 30-day prune and unacceptable for an erase. PURE.
+// EXACTLY, as the nightly prune's DUMP_GLOB does (task 1003948): a looser `<db>-*.sql.gz` would
+// let a project named `test` erase `test-nk`'s dumps. PURE.
 function dumpGlob(inst) {
   const d = '[0-9]';
   return `${dbName(inst)}-${d.repeat(4)}-${d.repeat(2)}-${d.repeat(2)}T${d.repeat(6)}Z.sql.gz`;

package/src/module-api.js

@@ -71,7 +71,7 @@ const { responsibilityFor, ROLE_RESPONSIBILITIES } = require('./role-responsibil
 // there. scripts/gds/bump-version.js still rewrites the literal below; it appends
 // the entry to that file. Look for a version's history there, not here.
 // ---------------------------------------------------------------------------
-const CORE_VERSION = '1.19.774'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
+const CORE_VERSION = '1.19.776'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('dev-box'); log.info('mounted');

package/tests/db_backup_nightly.mjs

@@ -29,12 +29,19 @@ const ENV = 'gds_backup_'.toUpperCase();
 // A fake pg_dump: a plain-format dump of `rows` rows, closed the way pg_dump closes one
 // (including the \unrestrict line patched servers append) unless it is `cut` short, and
 // exiting `exitCode`.
-function runBackup({ rows = 40, cut = false, exitCode = 0, env = {} } = {}) {
+// `seed` pre-places dumps in the shared dir as [filename, ageInDays].
+function runBackup({ rows = 40, cut = false, exitCode = 0, env = {}, seed = [] } = {}) {
   const tmp = fs.mkdtempSync(path.join(os.tmpdir(), 'db-backup-'));
   const bin = path.join(tmp, 'bin');
   const dir = path.join(tmp, 'backups');
   fs.mkdirSync(bin);
   fs.mkdirSync(dir);
+  for (const [name, ageDays] of seed) {
+    const f = path.join(dir, name);
+    fs.writeFileSync(f, '');
+    const t = new Date(Date.now() - ageDays * 86400000);
+    fs.utimesSync(f, t, t);
+  }
   const body = Array.from({ length: rows }, (_, i) => `INSERT INTO public.t VALUES (${i});`).join('\n');
   const close = cut ? '' : '\n--\n-- PostgreSQL database dump complete\n--\n\n\\unrestrict abc123\n';
   fs.writeFileSync(path.join(bin, 'pg_dump'),
@@ -73,6 +80,19 @@ test('an explicit operator size floor is still enforced', { skip }, () => {
   assert.match(r.stderr, /floor/);
 });
 
+test('the prune and the count reach only this database\'s own dumps, never a longer-named sibling\'s (task 1003948)', { skip }, () => {
+  const r = runBackup({ seed: [
+    ['smallproj-2026-01-01T000000Z.sql.gz', 40],
+    ['smallproj-nk-2026-01-01T000000Z.sql.gz', 40],
+    ['smallproj-2-2026-09-01T000000Z.sql.gz', 2],
+  ] });
+  assert.equal(r.status, 0, r.stderr);
+  assert.ok(!r.dumps.includes('smallproj-2026-01-01T000000Z.sql.gz'), 'its own expired dump is pruned');
+  assert.ok(r.dumps.includes('smallproj-nk-2026-01-01T000000Z.sql.gz'), 'a sibling\'s expired dump is left for the sibling\'s own unit');
+  assert.match(r.stdout, /pruned 1 dump\(s\)/);
+  assert.match(r.stdout, /ok · 1 dump\(s\) retained/, 'the count is this database\'s dumps only');
+});
+
 test('no fixed size floor is baked in for every instance', () => {
   const src = fs.readFileSync(SCRIPT, 'utf8');
   assert.doesNotMatch(src, new RegExp(`${ENV}MIN_BYTES:-[1-9]`), 'a default floor fails every database smaller than it');

package/tests/project_type_editable.mjs

@@ -98,7 +98,7 @@ test('updateInstanceDetail can change the type and something else in one stateme
 test('every SET clause binds a PLACEHOLDER — a bare index is not valid SQL', async () => {
   const db = recordingDb({ id: 41 });
   await realUpdateInstanceDetail(db, 41, {
-    description: 'Hello.', detail: { team_shape: 'solo' }, modules: ['dev-box'], type: 'business',
+    description: 'Hello.', detail: { team_shape: 'solo' }, modules: ['agents'], type: 'business',
   });
   const { text, params } = db.calls[0];
   const sets = text.slice(text.indexOf('SET '), text.indexOf(' WHERE '));
@@ -114,10 +114,10 @@ test('every SET clause binds a PLACEHOLDER — a bare index is not valid SQL', a
 
 test('the modules branch still binds its JSON, not its own parameter index', async () => {
   const db = recordingDb({ id: 41 });
-  await realUpdateInstanceDetail(db, 41, { modules: ['dev-box', 'discord'] });
+  await realUpdateInstanceDetail(db, 41, { modules: ['agents', 'discord'] });
   const { text, params } = db.calls[0];
   assert.match(text, /modules = \$\d+::jsonb/, 'the placeholder carries the cast, the index does not replace it');
-  assert.ok(params.some((p) => typeof p === 'string' && p.includes('dev-box')),
+  assert.ok(params.some((p) => typeof p === 'string' && p.includes('agents')),
     'the serialized selection reaches the statement');
 });
 
@@ -313,7 +313,7 @@ function runKind({ inst, fetchImpl, catalogMods } = {}) {
   return { sandbox, els, calls, band: () => el('mKindPick').innerHTML, msg: () => el('mKindMsg') };
 }
 
-const INST = (over = {}) => ({ id: 18, type: 'game', modules: { selected: ['dev-box'], source: 'bundle' }, ...over });
+const INST = (over = {}) => ({ id: 18, type: 'game', modules: { selected: ['agents'], source: 'bundle' }, ...over });
 
 test('the band paints every kind from TYPE_META, with the declared one pressed', () => {
   const h = runKind({ inst: INST() });
@@ -353,7 +353,7 @@ function okFetch(body) {
 test('a pick sends the kind on the own-scoped detail channel and repaints from the PLATFORM\'S answer', async () => {
   const h = runKind({
     inst: INST({ type: 'game' }),
-    fetchImpl: okFetch({ type: 'research', modules: { selected: ['dev-box'], source: 'picked' } }),
+    fetchImpl: okFetch({ type: 'research', modules: { selected: ['agents'], source: 'picked' } }),
   });
   h.sandbox.doKindPick('research');
   await new Promise((r) => setImmediate(r));
@@ -369,7 +369,7 @@ test('when the extras followed the kind, the band above is repainted AND the own
   // the type's starter bundle (ADR 0240 §2) — so changing the kind moves the extras.
   // Leaving that band painted from the old kind would be a lie on the same page.
   const h = runKind({
-    inst: INST({ type: 'game', modules: { selected: ['dev-box'], source: 'bundle' } }),
+    inst: INST({ type: 'game', modules: { selected: ['agents'], source: 'bundle' } }),
     fetchImpl: okFetch({ type: 'research', modules: { selected: [], source: 'bundle' } }),
   });
   h.sandbox.doKindPick('research');
@@ -380,8 +380,8 @@ test('when the extras followed the kind, the band above is repainted AND the own
 
 test('a set the owner picked for themselves never moves, and the receipt does not claim it did', async () => {
   const h = runKind({
-    inst: INST({ type: 'game', modules: { selected: ['dev-box'], source: 'picked' } }),
-    fetchImpl: okFetch({ type: 'business', modules: { selected: ['dev-box'], source: 'picked' } }),
+    inst: INST({ type: 'game', modules: { selected: ['agents'], source: 'picked' } }),
+    fetchImpl: okFetch({ type: 'business', modules: { selected: ['agents'], source: 'picked' } }),
   });
   h.sandbox.doKindPick('business');
   await new Promise((r) => setImmediate(r));

package/tests/provisioning_module_selection.mjs

@@ -235,12 +235,12 @@ await ta('POST /instances: the picker\'s ids ride the create request through to
 
   // Act — the body the wizard files
   const res = await post('/provisioning/instances', {
-    slug: 'mercury', hosting_shape: 'standalone', type: 'game', modules: ['dev-box', 'discord'],
+    slug: 'mercury', hosting_shape: 'standalone', type: 'game', modules: ['agents', 'discord'],
   });
 
   // Assert
   assert.equal(res.status, 201, `expected 201, got ${res.status} ${res.raw}`);
-  assert.deepEqual(lastCreateArgs && lastCreateArgs.modules, ['dev-box', 'discord']);
+  assert.deepEqual(lastCreateArgs && lastCreateArgs.modules, ['agents', 'discord']);
 });
 
 await ta('POST /instances: an omitted modules key is still a valid create — skipping is supported, not an error', async () => {
@@ -324,17 +324,17 @@ await ta('PATCH /detail: the reply carries modules, resolved from the row the UP
   detailRow = { id: 41, owner_builder_id: 7, slug: 'mercury', status: 'active', type: 'game', modules: null, detail: {} };
   lastUpdatedRow = null;
 
-  // Act — the owner says they are building it alone
-  const res = await patch('/provisioning/instances/41/detail', { detail: { team_shape: 'solo' } });
+  // Act — the owner says an open community is building it
+  const res = await patch('/provisioning/instances/41/detail', { detail: { team_shape: 'community' } });
 
   // Assert — the field is there, and it is the POST-patch resolution: a route
-  // that answered off `inst` instead of `updated` would still say 'dev-box'.
+  // that answered off `inst` instead of `updated` would still omit 'discord'.
   assert.equal(res.status, 200, res.raw);
   assert.ok(lastUpdatedRow, 'the route ran the update');
   assert.deepEqual(res.body.modules, effectiveModules(lastUpdatedRow));
-  assert.deepEqual(res.body.modules.selected, ['discord'], 'solo drops the shared dev box out of the game bundle');
+  assert.deepEqual(res.body.modules.selected, ['discord'], 'community keeps the gathering place in the game bundle');
   assert.equal(res.body.modules.source, 'bundle');
-  assert.ok(res.body.modules.adjustments.some((a) => a.module === 'dev-box'), 'and the change carries its reason');
+  assert.deepEqual(res.body.modules.adjustments, [], 'the game bundle already carried it, so nothing is claimed');
   detailRow = null; lastUpdatedRow = null;
 });
 
@@ -387,14 +387,14 @@ await ta('PATCH /detail: an owner who skipped the picker can add one module late
 await ta('PATCH /detail: a module can be REMOVED later too — the list replaces, it never merges', async () => {
   // The half a merging write would make impossible, which is why
   // updateInstanceDetail replaces `modules` and merges `detail`.
-  detailRow = { id: 41, owner_builder_id: 7, slug: 'mercury', status: 'active', type: 'game', modules: ['dev-box', 'discord'], detail: {} };
+  detailRow = { id: 41, owner_builder_id: 7, slug: 'mercury', status: 'active', type: 'game', modules: ['agents', 'discord'], detail: {} };
   lastUpdatedRow = null;
 
   const res = await patch('/provisioning/instances/41/detail', { modules: ['discord'] });
 
   assert.equal(res.status, 200, res.raw);
   assert.deepEqual(lastUpdatedRow.modules, ['discord']);
-  assert.deepEqual(res.body.modules.selected, ['discord'], 'dev-box is gone, not still merged in');
+  assert.deepEqual(res.body.modules.selected, ['discord'], 'agents is gone, not still merged in');
   assert.equal(res.body.modules.source, 'chosen');
   detailRow = null; lastUpdatedRow = null;
 });
@@ -517,17 +517,17 @@ await ta('PATCH /detail: another builder’s project is a 404, not a module chan
 // — not merely "close to one".
 
 await ta('PATCH /detail: answer then CLEAR — the row reads back exactly as one that was never asked', async () => {
-  // Arrange — a game project that skipped the picker, so its modules resolve from
+  // Arrange — a research project that skipped the picker, so its modules resolve from
   // the bundle and the interview answer is the only thing that can move them.
-  const virgin = { id: 41, owner_builder_id: 7, slug: 'mercury', status: 'active', type: 'game', modules: null, detail: {} };
+  const virgin = { id: 41, owner_builder_id: 7, slug: 'mercury', status: 'active', type: 'research', modules: null, detail: {} };
   const neverAnswered = effectiveModules(virgin);
   assert.equal(neverAnswered.source, 'bundle', 'the fixture really is an unanswered project');
 
   detailRow = { ...virgin };
   lastUpdatedRow = null;
-  const answered = await patch('/provisioning/instances/41/detail', { detail: { team_shape: 'solo' } });
+  const answered = await patch('/provisioning/instances/41/detail', { detail: { team_shape: 'community' } });
   assert.equal(answered.status, 200, answered.raw);
-  assert.deepEqual(answered.body.detail, { team_shape: 'solo' });
+  assert.deepEqual(answered.body.detail, { team_shape: 'community' });
   assert.notDeepEqual(answered.body.modules.selected, neverAnswered.selected,
     'the fixture is only meaningful if the answer really moved the bundle');
 
@@ -543,7 +543,7 @@ await ta('PATCH /detail: answer then CLEAR — the row reads back exactly as one
   assert.deepEqual(cleared.body.detail, {}, 'and the read surface says the interview is unanswered');
   assert.deepEqual(cleared.body.modules, neverAnswered, 'source, preset and adjustments are the never-answered ones');
   assert.equal(cleared.body.modules.source, 'bundle');
-  assert.deepEqual(cleared.body.modules.selected, bundleForProjectType('game').bundle, 'the UNADJUSTED preset');
+  assert.deepEqual(cleared.body.modules.selected, bundleForProjectType('research').bundle, 'the UNADJUSTED preset');
   assert.deepEqual(cleared.body.modules.adjustments, [], 'no rule fired, so nothing claims to have');
   assert.deepEqual(cleared.body.publish, answered.body.publish, 'clearing an answer is not a publish change');
   detailRow = null; lastUpdatedRow = null;

package/tests/provisioning_recommendations.mjs

@@ -101,42 +101,34 @@ test('an open community adds somewhere to gather to a bundle that lacks one', ()
   assert.ok(recs.bundle.adjustments[0].reason.length > 0, 'an adjustment always says why');
 });
 
-test('a small team adds the shared build environment', () => {
-  // Arrange
-  const answers = { type: 'research', team_shape: 'small-team' };
-
-  // Act
-  const recs = recommendationsForDetails(answers);
-
-  // Assert
-  assert.deepEqual(recs.bundle.bundle, ['agents', 'dev-box']);
-  assert.deepEqual(recs.bundle.adjustments.map((a) => a.module), ['dev-box']);
-});
-
-test('a solo builder drops the shared build environment from the bundle', () => {
-  // Arrange — the business bundle is `agents` + `dev-box`, so the removal bites.
-  const answers = { type: 'business', team_shape: 'solo' };
+test('a community adds the gathering place to a bundle that lacks it', () => {
+  // The surviving bundle rule's ADD path. The two rules that added and removed
+  // `dev-box` by team shape went with the module (task 1003886), which leaves
+  // `effect: 'remove'` declared in adjustBundle but named by no live rule - it is
+  // kept for the next rule that needs it, not because anything exercises it today.
+  // Arrange - the research bundle is `agents` alone, so the addition bites.
+  const answers = { type: 'research', team_shape: 'community' };
 
   // Act
   const recs = recommendationsForDetails(answers);
 
   // Assert
-  assert.deepEqual(recs.bundle.bundle, ['agents']);
-  assert.equal(recs.bundle.adjustments.length, 1);
-  assert.equal(recs.bundle.adjustments[0].effect, 'remove');
-  assert.equal(recs.bundle.adjustments[0].module, 'dev-box');
+  assert.deepEqual(recs.bundle.bundle, ['agents', 'discord']);
+  assert.deepEqual(recs.bundle.adjustments.map((a) => a.module), ['discord']);
+  assert.equal(recs.bundle.adjustments[0].effect, 'add');
 });
 
 test('a rule does not fire for a team shape it does not name', () => {
-  // Arrange — `solo` removes dev-box; `community` must leave it exactly alone.
-  const answers = { type: 'business', team_shape: 'community' };
+  // Arrange - `community` adds discord; `solo` names no rule, so the business
+  // bundle must come back exactly as declared.
+  const answers = { type: 'business', team_shape: 'solo' };
 
   // Act
   const recs = recommendationsForDetails(answers);
 
   // Assert
-  assert.ok(recs.bundle.bundle.includes('dev-box'), 'the solo removal did not leak onto another shape');
-  assert.deepEqual(recs.bundle.adjustments.map((a) => a.rule), ['a-community-needs-somewhere-to-gather']);
+  assert.deepEqual(recs.bundle.bundle, ['agents'], 'the community addition did not leak onto another shape');
+  assert.deepEqual(recs.bundle.adjustments, [], 'and nothing is claimed');
 });
 
 test('a rule whose module the bundle already carries records no adjustment', () => {
@@ -304,8 +296,8 @@ test('a caller may mutate the result without corrupting the declaration', () =>
 
   // Assert
   const second = recommendationsForDetails({ type: 'game', team_shape: 'small-team' });
-  assert.deepEqual(second.bundle.bundle, ['dev-box', 'discord']);
-  assert.deepEqual(second.bundle.modules, [...ALWAYS_ON_CORE, 'dev-box', 'discord']);
+  assert.deepEqual(second.bundle.bundle, ['discord']);
+  assert.deepEqual(second.bundle.modules, [...ALWAYS_ON_CORE, 'discord']);
   assert.equal(second.invites.seeking.limit, 3);
 });
 

package/tests/provisioning_starter_bundles.mjs

@@ -37,6 +37,7 @@ import {
   OPTIONAL_MODULES,
   STARTER_BUNDLES,
   HUB_ONLY_MODULES,
+  RETIRED_MODULES,
   RULED_TEAM_SHAPES,
   bundleForProjectType,
   allStarterBundles,
@@ -335,6 +336,9 @@ test('the opt-in catalog declared for the picker IS the on-disk opt-in set', ()
   const onDisk = manifestsOnDisk();
   const optInOnDisk = [...onDisk.values()]
     .filter((m) => m.default !== true && !HUB_ONLY_MODULES.includes(m.key))
+    // A RETIRED module is still on disk while its removal lands, and must already
+    // be gone from the catalog — so it is the one permitted absence (task 1003886).
+    .filter((m) => !RETIRED_MODULES.includes(m.key))
     .map((m) => m.key)
     .sort();
 
@@ -346,6 +350,24 @@ test('the opt-in catalog declared for the picker IS the on-disk opt-in set', ()
     'the picker\'s catalog has drifted from the manifests — a module was added, removed, or flipped its default');
 });
 
+test('a RETIRED module is withdrawn everywhere an owner could still reach it', () => {
+  // The retirement is only real if it holds at every offer point at once. A key
+  // left in any one of them is still a module a new project can end up with,
+  // which is exactly what the withdrawal exists to stop (task 1003886).
+  for (const key of RETIRED_MODULES) {
+    assert.ok(!OPTIONAL_MODULES.some((m) => m.key === key),
+      `retired module "${key}" is still a row the creation picker offers`);
+    for (const [type, bundle] of Object.entries(STARTER_BUNDLES)) {
+      assert.ok(!bundle.modules.includes(key),
+        `retired module "${key}" is still preselected by the "${type}" bundle`);
+    }
+    // Posting it directly is a real answer that resolves to nothing, not a
+    // non-answer: the key is DROPPED, exactly as an unknown one would be.
+    assert.deepEqual(normalizeModuleSelection([key]), [],
+      `retired module "${key}" is still accepted when an owner posts it directly`);
+  }
+});
+
 test('every opt-in module carries owner-facing copy, and no module jargon rides along', () => {
   for (const row of OPTIONAL_MODULES) {
     assert.ok(row.label && row.label.length <= 40, `"${row.key}" needs a short label`);
@@ -411,24 +433,24 @@ test('effectiveModules: an answered picker wins over the bundle, including "none
 });
 
 test('effectiveModules: a skipped picker after an ANSWERED interview yields the TAILORED bundle', () => {
-  // BV1.R22 / ADR 0243 — the property ADR 0240 §2 leans the skip on ("the
+  // BV1.R22 / ADR 0243 — the property ADR 0240 leans the skip on ("the
   // preselect and the fallback are the same declaration"), now that the panel
   // preselects the team-shape-adjusted set. Without this the picker would show a
-  // solo owner one thing and the project would quietly get another.
-  const eff = effectiveModules({ type: 'game', modules: null, detail: { team_shape: 'solo' } });
+  // community owner one thing and the project would quietly get another.
+  const eff = effectiveModules({ type: 'research', modules: null, detail: { team_shape: 'community' } });
 
-  assert.deepEqual(eff.selected, ['discord'], 'the shared environment the rule removes is not silently restored');
+  assert.deepEqual(eff.selected, ['agents', 'discord'], 'the gathering place the rule adds is really there');
   assert.equal(eff.source, 'bundle', 'and it is still an UNANSWERED set, not a stored one');
-  assert.deepEqual(eff.adjustments.map((a) => a.module), ['dev-box']);
-  assert.match(eff.adjustments[0].reason, /building this alone/, 'carrying the reason the panel showed');
+  assert.deepEqual(eff.adjustments.map((a) => a.module), ['discord']);
+  assert.match(eff.adjustments[0].reason, /open community/, 'carrying the reason the panel showed');
 });
 
 test("effectiveModules: the owner's own answer is never re-adjusted by a rule", () => {
   // A rule corrects a PRESELECT the owner did not make. Once they have toggled,
   // re-applying it would overrule them with an answer they had already refused.
-  const eff = effectiveModules({ type: 'game', modules: ['dev-box'], detail: { team_shape: 'solo' } });
+  const eff = effectiveModules({ type: 'research', modules: [], detail: { team_shape: 'community' } });
 
-  assert.deepEqual(eff.selected, ['dev-box'], 'solo removes dev-box, and the owner put it back');
+  assert.deepEqual(eff.selected, [], 'community adds discord, and the owner switched everything off');
   assert.equal(eff.source, 'chosen');
   assert.deepEqual(eff.adjustments, [], 'and no reason is handed back for a choice they made themselves');
 });
@@ -439,7 +461,7 @@ test('effectiveModules: a detail that says nothing usable adjusts nothing', () =
   // importing it.
   for (const detail of [undefined, null, {}, { team_shape: null }, { team_shape: 'a-huge-corporation' }, 'not-an-object', []]) {
     const eff = effectiveModules({ type: 'game', modules: null, detail });
-    assert.deepEqual(eff.selected, ['dev-box', 'discord'], `detail=${JSON.stringify(detail)} falls back to the type's bundle`);
+    assert.deepEqual(eff.selected, ['discord'], `detail=${JSON.stringify(detail)} falls back to the type's bundle`);
     assert.deepEqual(eff.adjustments, []);
   }
 });