@bongos/core 1.19.877 → 1.19.879

package/docs/file-map.md

@@ -135,7 +135,7 @@
 │   ├── sessions/                ← CORE-DOMAIN carve (BV1.R82, default-on): the session_records corpus + data plane (upload, cross-builder search/deep-dive), the BFG read-the-room scorer, session-pulse/stale-claim helpers. Registers no port — reached via HTTP POST to its own /sessions route; resolves the economy `reward` port for the cost-plus token reward. CLAUDE.md, module.json, routes/sessions.js, bfg.js, pulse.js.
 │   ├── autonomy/                ← CORE-DOMAIN carve (BV1.R83, default-on): the MAS autonomy surfaces — the $0 deterministic autonomy gate (System 3, inert until armed), the conductor/architect CLIs, and the in-process routine timers (incl. the weekly peer-vote-tally poller). Registers no port; resolves the lifecycle `tallyPeerVotes` doorway. CLAUDE.md, module.json, routes/autonomy.js, autonomy.js.
 │   ├── status-ui/              ← CORE-DOMAIN WEB-SURFACE carve (BV1.R84, default-on): the public status dashboard at status.<apex>, moved from public-status/. NO routes/db/port — declares contributes.webSurfaces:[{host:"status.",dir:"public"}], served by the loader web-surface seam (moduleWebSurfaces → serve-internal). CLAUDE.md, module.json, public/{index.html,status.js,style.css,cursors/,snapshots/}.
-│   ├── hall-ui/                ← CORE-DOMAIN WEB-SURFACE carve (BV1.R85, default-on): the authenticated builders' hall at builders.<apex>, moved from public-builders/ (~13k LOC, the largest). NO routes/db/port — declares contributes.webSurfaces:[{host:"builders.",dir:"public"}] for discovery, but UNLIKE status-ui keeps its DEDICATED serving block in serve-internal (the /builders shim + canonical redirects + citizen/Archon page gates + asset-stamping + hall-widget injection), partitioned out of the generic web-surface loop and served from BUILDERS_DIR. CLAUDE.md, module.json, public/{index.html,builders.js,style.css,work,watch,harbor,gate,pair,settings,ranks,sessions,primer,diagrams,atlas,...}.{html,js},cursors/,chime.wav. Four ARCHETYPE sheets sit beside the per-page ones: `record.css` (the task + idea records, task 1003305), `room.css` (the READING ROOMS — the primer + the diagrams index, task 1003306: the reading measure and rhythm, the table of contents, the progress hairline and the framed figure diagram-viewer.js upgrades on both pages), `oversight.css` (the OVERSIGHT family — government, watch, harbor, gate, task 1003469: the row, the figure band inside a panel, the group head, the inline form, the grant toggle and the shared confirm modal; named oversight because the vocabulary wall bans "governance" on the government surface) and `panel.css` (the PANEL family — settings, profile, pair, task 1003308: the row, the switch, the field with its label above, the chip control, the four voices and the sign-in gate; the hall's my-projects page was DELETED in the same task — "my projects" is the hub's user-level page, and the hall keeps no link or redirect; the family's fourth page `not-ready.html` was deleted by task 1003450, along with the emptied `requireNonXenosPage` gate that was the only thing redirecting to it). A page sheet then holds only what one page has and the others do not — `primer.css` the acknowledge gate, `diagrams.css` the legend strip, `gate.css` the hold reasons and file chips, `watch.css` the severities, the report reader and the grade trend, `settings.css` the rail layout, the group head, the token ladder and the voices grid, `profile.css` the identity band and the shelf, `pair.css` the device row, `people.css` the directory's identity cell (task 1003470 made the legacy door `/scouting` ship the same body and script as `/people`; task 1003440 then deleted the door — `scouting.html` and `scouting.states.json` are gone and the URL 301s to `/people`).
+│   ├── hall-ui/                ← CORE-DOMAIN WEB-SURFACE carve (BV1.R85, default-on): the authenticated builders' hall at builders.<apex>, moved from public-builders/ (~13k LOC, the largest). NO routes/db/port — declares contributes.webSurfaces:[{host:"builders.",dir:"public"}] for discovery, but UNLIKE status-ui keeps its DEDICATED serving block in serve-internal (the /builders shim + canonical redirects + citizen/Archon page gates + asset-stamping + hall-widget injection), partitioned out of the generic web-surface loop and served from BUILDERS_DIR. CLAUDE.md, module.json, public/{index.html,builders.js,style.css,work,watch,gate,settings,ranks,sessions,primer,diagrams,atlas,...}.{html,js},cursors/,chime.wav. Four ARCHETYPE sheets sit beside the per-page ones: `record.css` (the task + idea records, task 1003305), `room.css` (the READING ROOMS — the primer + the diagrams index, task 1003306: the reading measure and rhythm, the table of contents, the progress hairline and the framed figure diagram-viewer.js upgrades on both pages), `oversight.css` (the OVERSIGHT family — government, watch, gate, task 1003469 (harbor was its fourth until task 1003890 removed the dev box): the row, the figure band inside a panel, the group head, the inline form, the grant toggle and the shared confirm modal; named oversight because the vocabulary wall bans "governance" on the government surface) and `panel.css` (the PANEL family — settings, profile, task 1003308 (pair was its third until task 1003890 removed the dev box): the row, the switch, the field with its label above, the chip control, the four voices and the sign-in gate; the hall's my-projects page was DELETED in the same task — "my projects" is the hub's user-level page, and the hall keeps no link or redirect; the family's fourth page `not-ready.html` was deleted by task 1003450, along with the emptied `requireNonXenosPage` gate that was the only thing redirecting to it). A page sheet then holds only what one page has and the others do not — `primer.css` the acknowledge gate, `diagrams.css` the legend strip, `gate.css` the hold reasons and file chips, `watch.css` the severities, the report reader and the grade trend, `settings.css` the rail layout, the group head, the token ladder and the voices grid, `profile.css` the identity band and the shelf, `people.css` the directory's identity cell (task 1003470 made the legacy door `/scouting` ship the same body and script as `/people`; task 1003440 then deleted the door — `scouting.html` and `scouting.states.json` are gone and the URL 301s to `/people`).
 │   ├── lifecycle/               ← CORE-DOMAIN carve (BV1.R86, default-on): the build state machine — tasks · claims · versions · done-when · goals · dependencies · claim→ship→grade→credit · github-push + merge-lock + conflict-resolve + publish-reconciler. The LAST, most-coupled carve; registers the `lifecycle` kernel port (createTask, classifyTaskKind, tallyPeerVotes, work-tracking reads). CLAUDE.md, module.json, routes/{tasks,claims,versions,done-when,goals,dependencies,gate-approvals,analytics}.js, lifecycle.js, github-push.js, merge-lock.js, conflict-resolve.js, publish-reconciler.js, task-visuals.js + task-visual-db.js + routes/visuals.js (the optional ship-time visual, task 1003109 — the route file is NOT named task-*.js on purpose; see the module CLAUDE.md).
 │   ├── copy-desk/               ← CORE-DOMAIN module (task 1003113 / R02 of goal 1000074, default-on): the COPY half of the design contract — ADR 0081 gave design TOKENS a repo-owned source of truth, text had none. Owns the FLAG (anyone in any role marks a string or a whole surface as needing an artist's attention, with a reason required in BOTH the route and a CHECK constraint) and the QUEUE an artist reads it from. READS R01's committed registry (docs/copy-registry.json, generated by scripts/gds/copy-inventory.js) and never writes it. NO LIVE CMS is the hard non-goal: no column here could hold replacement text, and copy_no_cms.mjs pins that. Key is `copy-desk`, not `copy` — the branding contract already owns a `copy` block, so the bare word reds the "core carries no module code" fitness check. R03 (task 1003114, ADR 0233) added the PROPOSAL: an artist writes the replacement wording and it becomes a Bongos task carrying a fenced copy-proposal patch — no row, NO second migration (a proposals table is the forbidden column with extra steps), and scripts/gds/copy-apply.js lands it as a real diff under a claim. CLAUDE.md, module.json, registry.js, flags.js, proposals.js, routes/copy-desk.js, migrations/copy_desk_001_flags.sql, tests/{copy_flags,copy_queue,copy_no_cms,copy_proposals}.mjs. Its hall surface lives with hall-ui (public/copy-desk.{html,js,css}), per the one-key-per-web-surface precedent.
 │   ├── ui-design/               ← CORE-DOMAIN module (task 1003324 / ADR 0197, default-on): the design capability every builder on every instance gets — ships METHOD, never a world. Absorbs ADR 0081's layer: adapters/{claude-design,figma}/index.js (moved from src/ui/adapters/), scripts/{design-sync,figma-design-sync,validate-design}.js (moved from scripts/gds/, which keeps thin shims), docs/design-contract.md (moved from docs/). Declaration-only: contributes.skills design (the /design playbook, new) + design-sync + figma-design-sync; no routes/port/migrations, so disabling it touches no served surface. CLAUDE.md separates the platform FLOORS (the Fifteen Rule, the dark twins, no page :root, the 24px floor, AA in both modes, the kill switch) from the instance's WORLD (its packs + DESIGN.md). kit/ (task 1003320) is the look-before-you-ship kit: lib.js (the floors, the states/probes contracts, the action + expectation vocabularies, the WCAG maths, the stub spawner), serve.js (any surface through the doorway's real transforms + fixtures/), render.js (states × 1440/390/320 × dark/light, audited), probe.js (PASS/FAIL contracts), check-mock.js (platform rules + the instance's DESIGN.md taste bans, then the detector), tells.js (task 1003329 / ADR 0223: the anti-pattern detector as two tiers — floors FAIL, craft tells WARN, kit-ignore waivers per file; the rendered twins live in lib.js factsInPage), contrast.js + png.js; a page's <page>.states.json / <page>.probes.json sit BESIDE the surface (modules/public-landing/public/, modules/hall-ui/public/). Recipe: docs/recipes/ui-look-before-you-ship.md. skills/ (task 1003321 / ADR 0198) is the vendoring policy: policy.json (licence allowlist, verdicts that may land, sidecar fields, preamble markers), PREAMBLE.md (the platform preamble every vendored SKILL.md opens with), README.md (the roster — both origins scanned dangerous on 2026-08-28, landed as rebuild specs; nothing vendored — and the landing recipe); a landable copy goes under skills/vendor/<name>/ with PROVENANCE.md + LICENSE and is materialised into an instance's .claude/skills/ by claude-materialize.js step 1b. skills/<name>/ (task 1003325 / ADR 0220) are the in-house rebuilds from the specs, first-party and counted: design-taste-frontend (the default taste skill), design-taste-frontend-v1 (the earlier generation, kept distinct), high-end-visual-design (the polish pass), redesign-existing-projects (the in-place upgrade); each opens with the same preamble and carries a "Rebuilt from" section instead of a sidecar. impeccable/ (task 1003326 / ADR 0221) is the design-craft method as ONE skill with sub-commands: SKILL.md (the router, the menu, the craft floor, the bounded finish) + reference/<sub-command>.md (eighteen playbooks, one loaded per request); no hooks, no bypass agent, no telemetry, no live server. minimalist-ui/, industrial-brutalist-ui/, gpt-taste/, stitch-design-taste/ (task 1003327 / ADR 0230) are the four looks, composition grammars with no colours of their own: the palette is the instance's pack and the texture is a named entry in styles/; a substrate is an archetype that still ships both modes, gpt-taste's selection is derived from the route rather than rolled, and stitch-design-taste writes a DESIGN.md-shaped contract document whose thirteen are transcribed from the pack. image-to-code/, imagegen-frontend-web/, imagegen-frontend-mobile/, brandkit/ (task 1003328 / ADR 0222) are the image family under the hero-only rule: plates and hero objects only, the pair (JPEG dark plate + WebP alpha cutout) with a <file>.json sidecar beside each, through the instance's art pipeline key; the grove specimen's styles/grove/assets/ is the worked example. style/ (task 1003475 / ADR 0231) is the module's first FIRST-PARTY skill (no upstream, so a `## First party` section instead of `## Rebuilt from`): the /style session in which an owner authors their own look in four bounded steps, rendering the nearest library entries before asking, drafting inside the contract, retuning by measurement, and handing over the one-step adoption without ever writing config/branding.json. styles/ (task 1003323 / ADR 0219) is the style library: <name>/pack.json (the theme.ui overlay, exactly the fifteen) + DESIGN.md (the look's derived recipes, thirteen in lockstep with the pack) + mock.html (the specimen); chrome-world (pinned to the neutral pack), expedition, grove, blueprint (the first cool look, authored through /style at task 1003475); STYLE=<name> on the kit lays a look over the instance's pack through GDS_BRANDING_FILE; tests/ui_design_styles.mjs runs the world/cosmos/hall token suites once per alternate (UI_DESIGN_PACK). config/design-tokens.* + design-sources.json STAY in config/ as the host boundary; public-landing keeps its own key (first customer, not owner).
@@ -265,7 +265,7 @@
 │       ├── terrain.js           ← (Phase D + ADR 0012, CJS): TERRAIN + OBJECT enums + BLOCKING_TERRAINS + BLOCKING_OBJECTS (server twin of public/game/world/terrain.js)
 │       └── map.js               ← (Phase D + ADR 0012): two-grid INITIAL_MAP {ground, objects}; isBlocked checks both layers (mirrors public/game/world/{terrain,map}.js)
 │   (public-status/ moved to modules/status-ui/public/ in BV1.R84 — see the modules/ block above)
-│   (public-builders/ moved to modules/hall-ui/public/ in BV1.R85 — the authenticated builders' hall; see the modules/ block above. It keeps its DEDICATED serving block in src/bongos/serve-internal.js: the builders.<apex> + apex /builders/* shim, canonical redirects, the citizen/Archon page gates, asset-stamping, and the module hall-widget injection — partitioned out of the generic web-surface loop. index.html=the hall dashboard; work/board/roadmap/goals/watch/harbor/gate/pair/settings/ranks/sessions/primer/diagrams/atlas pages; ideas.{html,js,css}=the Full Idea composer (task 1002928 / R152 of goal 1000062 — the five R141 fields with a live R142 completeness meter, both fetched from the server so the page carries no copy of the rules; drafts in localStorage so navigation costs nothing. Task 1002930 / R154 added the SPARK QUEUE above it and a second mode: `?develop=<id>` reuses the same form to develop a spark — the spark's words shown above the fields, its title read-only, and the file routed to POST /inbox/:id/develop instead of POST /inbox, under its own per-idea draft key); idea.html/idea.js=the idea-detail PAGE (/idea/:id, task 1002929 / R153 — the SECOND two-segment hall page after /task/:id: grade, the five answers in template order, the score, and both attributions. The GRADE decides what the page contains — a quick idea gets no five-field skeleton. task-detail.js keeps the #/idea/N overlay because ~320 of its lines are the Metic+ triage panel; the overlay now links here); profile.html/profile.js=the public, shareable builder profile page (/profile?id=N — rank, works, credits, karma, achievements; task 1467); profile-connections.js=section 6 of that page, the hub-only connections block (task 1002296 / R20 of goal 1000045 — the viewer-relative 1st/2nd/3rd/out-of-network label, the mutuals it was computed from, the connect button, and on your own profile both request queues plus your connections ledger. Loaded BEFORE profile.js, which calls window.OTBConnections.render behind a guard, so a page that omits the script simply has no section; the section reveals only when the hub's /connections routes answer, exactly as the cross-project record does. ADR 0212 records why it is on this page rather than the not-yet-built /u/&lt;handle&gt;, and why it addresses a builder by github_login and then uses the canonical handle the API echoes back); profile-canonical.js=the canonical-profile wiring for that page (task 1002804 / P08, ADR 0214 — on a FEDERATED instance the rel=canonical plus the visible "see the cross-project record" link-out ADR 0171 D1 asks for; on the HUB the numeric ?id= form redirects to the handle URL instead, because a page cannot both redirect to a URL and declare it canonical. All three read ONE resolver, modules/platform-identity/canonical-profile.js, which answers null while /u/&lt;handle&gt; does not exist — so everything is dark today and one boolean turns it all on together); task.html/task.js=the task-detail page (/task/:id, task 751 — replaced the old #/task/N overlay); builders.js=the controller; dom-utils.js/hall-widgets.js=the widget+settings-panel registries.)
+│   (public-builders/ moved to modules/hall-ui/public/ in BV1.R85 — the authenticated builders' hall; see the modules/ block above. It keeps its DEDICATED serving block in src/bongos/serve-internal.js: the builders.<apex> + apex /builders/* shim, canonical redirects, the citizen/Archon page gates, asset-stamping, and the module hall-widget injection — partitioned out of the generic web-surface loop. index.html=the hall dashboard; work/board/roadmap/goals/watch/gate/settings/ranks/sessions/primer/diagrams/atlas pages (harbor + pair left with the dev box, task 1003890); ideas.{html,js,css}=the Full Idea composer (task 1002928 / R152 of goal 1000062 — the five R141 fields with a live R142 completeness meter, both fetched from the server so the page carries no copy of the rules; drafts in localStorage so navigation costs nothing. Task 1002930 / R154 added the SPARK QUEUE above it and a second mode: `?develop=<id>` reuses the same form to develop a spark — the spark's words shown above the fields, its title read-only, and the file routed to POST /inbox/:id/develop instead of POST /inbox, under its own per-idea draft key); idea.html/idea.js=the idea-detail PAGE (/idea/:id, task 1002929 / R153 — the SECOND two-segment hall page after /task/:id: grade, the five answers in template order, the score, and both attributions. The GRADE decides what the page contains — a quick idea gets no five-field skeleton. task-detail.js keeps the #/idea/N overlay because ~320 of its lines are the Metic+ triage panel; the overlay now links here); profile.html/profile.js=the public, shareable builder profile page (/profile?id=N — rank, works, credits, karma, achievements; task 1467); profile-connections.js=section 6 of that page, the hub-only connections block (task 1002296 / R20 of goal 1000045 — the viewer-relative 1st/2nd/3rd/out-of-network label, the mutuals it was computed from, the connect button, and on your own profile both request queues plus your connections ledger. Loaded BEFORE profile.js, which calls window.OTBConnections.render behind a guard, so a page that omits the script simply has no section; the section reveals only when the hub's /connections routes answer, exactly as the cross-project record does. ADR 0212 records why it is on this page rather than the not-yet-built /u/&lt;handle&gt;, and why it addresses a builder by github_login and then uses the canonical handle the API echoes back); profile-canonical.js=the canonical-profile wiring for that page (task 1002804 / P08, ADR 0214 — on a FEDERATED instance the rel=canonical plus the visible "see the cross-project record" link-out ADR 0171 D1 asks for; on the HUB the numeric ?id= form redirects to the handle URL instead, because a page cannot both redirect to a URL and declare it canonical. All three read ONE resolver, modules/platform-identity/canonical-profile.js, which answers null while /u/&lt;handle&gt; does not exist — so everything is dark today and one boolean turns it all on together); task.html/task.js=the task-detail page (/task/:id, task 751 — replaced the old #/task/N overlay); builders.js=the controller; dom-utils.js/hall-widgets.js=the widget+settings-panel registries.)
 │
 ├── infra/                          ← ON-BOX scripts (task 1002699): the four reporter/heartbeat crons every dev box runs from its /workspace clone — box-heartbeat.sh (idle-sweep activity signal), box-report-version.sh (HEAD → POST /box/version), box-report-host-keys.sh (SSH host keys → POST /box/host-keys), box-report-terminal.sh (ttyd URL+credential → POST /box/terminal). Delivered by the workspace clone itself (modules/dev-box/box-access.js sparse scope includes infra/); crons self-installed by box-source-fetch.sh's per-tick bring-up. API base resolves GDS_BASE env → session-file api_base → skip (no hardcoded host in the neutral core).
 ├── devbox-app/                     ← OTB Dev Box — Electron menu-bar/tray switch for the builder's box (#904, ADR 0045; internal). SELF-CONTAINED: own package.json (never feeds the droplet's npm ci); built by .github/workflows/build-devbox-app.yml; published to the public releases repo per config/devbox-app.json; release recipe docs/recipes/devbox-app-release.md

package/docs/module-api-changelog.md

@@ -2227,6 +2227,10 @@ is load-bearing: the script throws rather than guess if it is missing, and
   1.19.876 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
         landed since 1.19.875 with no explicit bump. run 35420916304. (task 1002620)
   1.19.877 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
-        landed since 1.19.876 with no explicit bump. run 35438291185. (task 1002620)
+        landed since 1.19.876 with no explicit bump. run 35438492966. (task 1002620)
+  1.19.878 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+        landed since 1.19.877 with no explicit bump. run 35439004814. (task 1002620)
+  1.19.879 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+        landed since 1.19.878 with no explicit bump. run 35439529685. (task 1002620)
 ---------------------------------------------------------------------------
 ```

package/docs/recipes/autobongos-windows-host.md

@@ -101,7 +101,32 @@ A runner can be **Allowed to work** and **Not checking in** at the same time:
 that is a machine that is off, unplugged or wedged, and it is the state worth
 noticing.
 
-The full log lives on the box at `%LOCALAPPDATA%\cloudbongos\autobongos.log`.
+### Reading the night
+
+The log answers "what happened" only if you are willing to read a log, and the
+whole premise is that you are not at the keyboard. One command gives you the
+night in five answers instead:
+
+```powershell
+powershell -ExecutionPolicy Bypass -File scripts\gds\autobongos-service.ps1 digest
+```
+
+or from any checkout: `node scripts/gds/autobongos-digest.js` (add `--since 24h`
+for a rolling window, `--all` for everything, `--json` for the structured shape).
+
+It answers: **what shipped**, **what is on hold and why**, **what each worker
+decided that its task description did not determine**, **what it cost**, and
+**where both limit windows stand**.
+
+The third one is the one to actually read. A worker will not reliably stop and
+ask — given an under-specified task it makes the call and writes it into the
+file, which is what a good engineer does. So the decisions happen whether or not
+anyone sees them, and every line in that section is a sentence the task
+description should have contained. The task with the most entries is the thinnest
+spec you wrote, and the digest names it.
+
+The full log still lives on the box at `%LOCALAPPDATA%\cloudbongos\autobongos.log`
+if you want the raw rows.
 
 ## 5. Stopping it
 

package/modules/autonomy/digest.js

@@ -0,0 +1,344 @@
+'use strict';
+
+// modules/autonomy/digest.js — the night, readable afterwards (task 1003906,
+// ADR 0307). Pure: rows in, a digest out. No I/O, no clock of its own.
+//
+// THE OWNER IS NOT AT THE KEYBOARD. That is the whole premise, and it means the
+// run log — an append-only JSONL nobody will ever open — is not an answer. One
+// page has to answer five questions, and it has to answer them without anyone
+// reading a log: what shipped, what is on hold and why, what each worker decided
+// that its task description did not determine, what it cost, and where the two
+// limit windows stand.
+//
+// THE THIRD QUESTION IS THE ONE THAT COMPOUNDS, and it is worth saying why it is
+// here at all. A worker will NOT reliably stop to ask: tested on an ambiguous
+// task, it made four genuine judgement calls and wrote them straight into the
+// file, which is what a competent engineer does with an under-specified brief.
+// So the decisions happen either way. What the digest changes is whether anyone
+// finds out. And every entry is also a sentence the task description SHOULD have
+// contained — which makes this list a spec-quality signal, not just an audit
+// trail: the goals whose decisions pile up are the goals whose specs are thin,
+// and fixing those is what lowers tomorrow's halt count.
+//
+// WHAT COUNTS AS SHIPPED IS THE LEDGER'S ANSWER, never the worker's. A `worked`
+// row with `verified: false` is a task that ran and did not ship, and putting it
+// under "shipped" because a session ended would reintroduce the exact confusion
+// task 1003903 exists to end.
+
+// ---------------------------------------------------------------------------
+// Helpers
+// ---------------------------------------------------------------------------
+
+const isRow = (r) => r && typeof r === 'object' && typeof r.event === 'string';
+
+// num — a number, or null for "not a number I can use".
+//
+// THE GUARD ON null IS LOAD-BEARING, and it is not defensive noise:
+// `Number(null)` is 0 and 0 is finite, so the obvious one-liner turns every
+// absent cost into a free worker and every absent duration into an instant one.
+// The same trap cost a bug in modules/autonomy/cadence.js's fingerprint, where an
+// unread claimable count became the literal string "null" for the same reason.
+// Empty string behaves identically. Both are spelled out rather than trusted to
+// Number().
+const num = (v) => {
+  if (v === null || v === undefined || v === '') return null;
+  const n = Number(v);
+  return Number.isFinite(n) ? n : null;
+};
+
+function parseAt(row) {
+  const t = Date.parse(row && row.at);
+  return Number.isFinite(t) ? t : null;
+}
+
+// humanDuration — minutes and hours, the way a person says them.
+function humanDuration(s) {
+  const n = num(s);
+  if (n === null || n < 0) return null;
+  if (n < 90) return `${Math.round(n)}s`;
+  if (n < 5400) return `${Math.round(n / 60)}m`;
+  return `${(n / 3600).toFixed(1)}h`;
+}
+
+function usd(n) {
+  const v = num(n);
+  return v === null ? null : `$${v.toFixed(2)}`;
+}
+
+// windowsFromGauge — question five, from the gauge file's own shape.
+//
+// Reports what it can SEE and says so when it cannot. A digest that silently
+// omits a window reads as "nothing to report", and the one morning that matters
+// is the morning the gauge stopped being written.
+// STALENESS IS GAUGE.JS'S RULE, NOT A SECOND ONE. modules/autonomy/gauge.js holds
+// a window UNKNOWN when its `observed_at` is older than staleAfterS (30 minutes
+// by default), and the runner HOLDS on unknown. A digest that applied a laxer
+// test would print "41% used, resets in 2h" about a window the runner had already
+// decided it could not vouch for — two surfaces disagreeing about one file, with
+// the reader believing the one that is wrong. Same threshold, same conclusion.
+// (Grader finding, task 1003906.)
+function windowsFromGauge(gauge, nowEpochS, { staleAfterS = null } = {}) {
+  const limit = staleAfterS === null ? require('./gauge.js').DEFAULT_STALE_AFTER_S : staleAfterS;
+  const writtenAt = gauge && typeof gauge === 'object' ? num(gauge.written_at) : null;
+  const one = (key, label) => {
+    const w = gauge && typeof gauge === 'object' ? gauge[key] : null;
+    const used = w ? num(w.used_percentage) : null;
+    const resets = w ? num(w.resets_at) : null;
+    // Per-window observed_at, falling back to the file's written_at — exactly the
+    // shape gauge.js reads, because one window can go unreported while the other
+    // is carried forward.
+    const observedAt = w ? (num(w.observed_at) ?? writtenAt) : null;
+    if (used === null) return { key, label, known: false, detail: 'not reported' };
+
+    const ageS = observedAt !== null && Number.isFinite(nowEpochS) ? nowEpochS - observedAt : null;
+    if (ageS !== null && ageS > limit) {
+      return {
+        key, label, known: false, stale: true, usedPct: Math.round(used), resetsAt: resets, ageS,
+        detail: `last read ${Math.round(used)}% used ${humanDuration(ageS)} ago — older than the runner trusts, so it is holding`,
+      };
+    }
+    const ahead = resets !== null && Number.isFinite(nowEpochS) ? resets - nowEpochS : null;
+
+    // A RESET TIME IN THE PAST MEANS THE READING IS STALE, not that the window is
+    // about to turn over. The percentage was true of a window that has since
+    // rolled, so printing it as a live figure is worse than printing nothing —
+    // "41% used, resets in 0s" invites a decision about headroom that no longer
+    // exists. Say the reading is old and let the reader go look.
+    if (ahead !== null && ahead <= 0) {
+      return {
+        key, label, known: false, stale: true, usedPct: Math.round(used), resetsAt: resets, resetsInS: 0,
+        detail: `last read ${Math.round(used)}% used, but that window has since reset — the gauge is stale`,
+      };
+    }
+    return {
+      key, label, known: true, usedPct: Math.round(used),
+      resetsAt: resets, resetsInS: ahead,
+      detail: `${Math.round(used)}% used${ahead !== null ? `, resets in ${humanDuration(ahead)}` : ''}`,
+    };
+  };
+  return [one('five_hour', 'Five-hour window'), one('seven_day', 'Seven-day window')];
+}
+
+// ---------------------------------------------------------------------------
+// The digest
+// ---------------------------------------------------------------------------
+
+// buildDigest — every question answered from the rows, or explicitly unanswered.
+//
+// `rows` is the run log for the period, oldest first. `gauge` is the raw gauge
+// file (the same shape modules/autonomy/gauge.js reads). Unrecognised rows are
+// COUNTED rather than dropped: a digest that silently ignores what it does not
+// understand is how a new failure mode stays invisible for a week.
+function buildDigest(rows = [], { gauge = null, nowEpochS = null, sinceMs = null, untilMs = null, staleAfterS = null } = {}) {
+  const all = (Array.isArray(rows) ? rows : []).filter(isRow);
+  const worked = all.filter((r) => r.event === 'worked');
+
+  // 1. WHAT SHIPPED — the ledger's answer.
+  const shipped = worked.filter((r) => r.verified === true).map((r) => ({
+    taskId: String(r.task_id ?? ''), title: r.title || null, goalId: r.goal_id ?? null,
+    durationS: num(r.duration_s), costUsd: num(r.cost_usd),
+  }));
+
+  // 2. WHAT IS ON HOLD, AND WHY. Four different shapes of "did not ship", kept
+  // apart because the owner's next action differs for each.
+  const ranButDidNotShip = worked.filter((r) => r.verified !== true).map((r) => ({
+    taskId: String(r.task_id ?? ''), title: r.title || null,
+    shape: r.ledger_shape || 'unknown',
+    // THE LEDGER'S REASON FIRST, and the worker's only as a fallback. `row.reason`
+    // is verdict.reason — the WORKER's account of itself — and quoting that in the
+    // "did not ship" section is the precise inversion this whole goal exists to
+    // undo: a worker that stopped dead needing a decision reports success. The
+    // ledger's explanation ("the grade passed and the land never finished") is the
+    // one a person can act on. Older rows predate ledger_reason, so the fallback
+    // stays rather than leaving them blank.
+    reason: r.ledger_reason || r.reason || null,
+    remedy: r.ledger_remedy || null,
+    workerSaid: r.reason || null,
+    blockerId: r.blocker_id ?? null,
+    parked: !!r.task_parked,
+    claimReleased: !!r.claim_released,
+  }));
+
+  const fenced = all.filter((r) => r.event === 'fenced').map((r) => ({
+    code: r.code || 'unknown', reason: r.reason || null, taskId: r.task_id ? String(r.task_id) : null,
+  }));
+
+  // An UNWORKABLE QUEUE is not breakage, and the digest must not present it as
+  // such: the machine is healthy and there is nothing it may work on.
+  const unworkable = [];
+  for (const r of all) {
+    if (r.event !== 'nothing_claimable') continue;
+    for (const sk of (Array.isArray(r.skipped) ? r.skipped : [])) {
+      unworkable.push({ taskId: String(sk.id ?? ''), goalId: sk.goal_id ?? null, reasons: sk.reasons || [] });
+    }
+  }
+
+  const held = all.filter((r) => r.event === 'hold').map((r) => ({ reason: r.reason || null, sleepUntil: r.sleep_until ?? null }));
+
+  // 3. WHAT EACH WORKER DECIDED that its spec did not determine — grouped by task,
+  // because the SHAPE of this list is the signal. One task with six decisions is a
+  // thin spec; six tasks with one each is a normal night.
+  const decisions = [];
+  for (const r of worked) {
+    const list = Array.isArray(r.undetermined_decisions) ? r.undetermined_decisions : [];
+    if (!list.length) continue;
+    decisions.push({
+      taskId: String(r.task_id ?? ''), title: r.title || null, goalId: r.goal_id ?? null,
+      shipped: r.verified === true,
+      decisions: list.map((d) => String(d)),
+    });
+  }
+  const decisionCount = decisions.reduce((n, d) => n + d.decisions.length, 0);
+  // The thinnest spec of the night, named. A list is browsable; a name is
+  // actionable, and this one is the sentence the description should have carried.
+  const thinnestSpec = decisions.slice().sort((a, b) => b.decisions.length - a.decisions.length)[0] || null;
+
+  // 4. WHAT IT COST. Nulls are EXCLUDED and counted, never coerced to zero — a
+  // worker whose cost was not reported must not make the night look cheaper.
+  const costs = worked.map((r) => num(r.cost_usd));
+  const knownCosts = costs.filter((c) => c !== null);
+  const cost = {
+    totalUsd: knownCosts.reduce((a, b) => a + b, 0),
+    reported: knownCosts.length,
+    unreported: costs.length - knownCosts.length,
+    workerRuns: worked.length,
+    totalDurationS: worked.reduce((a, r) => a + (num(r.duration_s) || 0), 0),
+  };
+
+  // 5. THE TWO LIMIT WINDOWS.
+  const windows = windowsFromGauge(gauge, nowEpochS, { staleAfterS });
+
+  // How the runner spent the night, so "nothing shipped" can be told apart from
+  // "nothing ran".
+  const KNOWN = new Set(['worked', 'fenced', 'hold', 'nothing_claimable', 'dry_run',
+    'pick_failed', 'worktree_failed', 'claim_failed', 'verify_halt', 'cadence', 'boot_reconcile']);
+  const byEvent = {};
+  let unrecognised = 0;
+  for (const r of all) {
+    byEvent[r.event] = (byEvent[r.event] || 0) + 1;
+    if (!KNOWN.has(r.event)) unrecognised += 1;
+  }
+
+  const cadenceRows = all.filter((r) => r.event === 'cadence' && r.mode);
+  const endedProbing = cadenceRows.length ? cadenceRows[cadenceRows.length - 1].mode === 'probing' : false;
+
+  // reduce, not Math.min(...times): `--all` on a long-lived log can hold more
+  // timestamps than the engine will accept as call arguments, and a reporting CLI
+  // that throws on a big log fails exactly when the log is most worth reading.
+  const times = all.map(parseAt).filter((t) => t !== null);
+  const minAt = times.length ? times.reduce((a, b) => (b < a ? b : a)) : null;
+  const maxAt = times.length ? times.reduce((a, b) => (b > a ? b : a)) : null;
+  return {
+    period: {
+      fromMs: sinceMs ?? minAt,
+      toMs: untilMs ?? maxAt,
+      rows: all.length,
+    },
+    shipped,
+    onHold: { ranButDidNotShip, fenced, unworkable, held },
+    decisions, decisionCount, thinnestSpec,
+    cost,
+    windows,
+    runner: { byEvent, unrecognised, endedProbing, bootReconciles: byEvent.boot_reconcile || 0 },
+  };
+}
+
+// ---------------------------------------------------------------------------
+// Rendering
+// ---------------------------------------------------------------------------
+
+const plural = (n, one, many) => `${n} ${n === 1 ? one : many}`;
+
+// renderDigest — the five questions, in the order they are asked, as plain text a
+// person reads over coffee. Deliberately not a table: the widths are unknowable
+// and a wrapped table is worse than prose.
+//
+// EVERY SECTION PRINTS, even when empty. A digest whose quiet sections vanish
+// teaches its reader that absence means "fine", and then the one morning a
+// section is missing because the DATA is missing reads exactly the same.
+function renderDigest(d, { title = 'Autobongos — overnight' } = {}) {
+  const L = [];
+  const when = d.period.fromMs && d.period.toMs
+    ? `${new Date(d.period.fromMs).toISOString().slice(0, 16).replace('T', ' ')} → ${new Date(d.period.toMs).toISOString().slice(11, 16)} UTC`
+    : 'no runs recorded';
+  L.push(title, '='.repeat(title.length), when, '');
+
+  // 1
+  L.push(`SHIPPED — ${plural(d.shipped.length, 'task', 'tasks')}`);
+  if (!d.shipped.length) L.push('  nothing shipped.');
+  for (const s of d.shipped) {
+    L.push(`  ${s.taskId}  ${s.title || '(untitled)'}`);
+    const bits = [humanDuration(s.durationS), usd(s.costUsd)].filter(Boolean);
+    if (bits.length) L.push(`         ${bits.join(' · ')}`);
+  }
+  L.push('');
+
+  // 2
+  const holdTotal = d.onHold.ranButDidNotShip.length + d.onHold.fenced.length + d.onHold.unworkable.length + d.onHold.held.length;
+  L.push(`ON HOLD — ${plural(holdTotal, 'thing', 'things')}`);
+  if (!holdTotal) L.push('  nothing is waiting on you.');
+  for (const r of d.onHold.ranButDidNotShip) {
+    L.push(`  ${r.taskId}  ran but did not ship — ${r.shape}`);
+    if (r.reason) L.push(`         ${String(r.reason).slice(0, 160)}`);
+    if (r.remedy) L.push(`         next: ${String(r.remedy).slice(0, 160)}`);
+    // Printed only when it ADDS something. A worker that agreed with the ledger
+    // tells the reader nothing twice; one that claimed success against a ledger
+    // that says otherwise is the single most useful line on the page.
+    if (r.workerSaid && r.workerSaid !== r.reason) L.push(`         the worker said: ${String(r.workerSaid).slice(0, 160)}`);
+    if (r.blockerId) L.push(`         blocker ${r.blockerId}${r.parked ? ' (task parked, out of the queue)' : ''}`);
+  }
+  // Fenced refusals are collapsed by code: twenty identical lines say nothing the
+  // first one did not.
+  const byCode = {};
+  for (const f of d.onHold.fenced) (byCode[f.code] = byCode[f.code] || []).push(f);
+  for (const [code, list] of Object.entries(byCode)) {
+    L.push(`  fence: ${code} ×${list.length}`);
+    if (list[0].reason) L.push(`         ${String(list[0].reason).slice(0, 160)}`);
+  }
+  if (d.onHold.unworkable.length) {
+    L.push(`  queue: ${plural(d.onHold.unworkable.length, 'task', 'tasks')} in the allowlist, every one halted`);
+    L.push('         (this is not a runner failure — it has nothing it may work on)');
+    for (const u of d.onHold.unworkable.slice(0, 5)) L.push(`         ${u.taskId}: ${(u.reasons || []).join(', ') || 'halted'}`);
+  }
+  if (d.onHold.held.length) L.push(`  capacity: held ${plural(d.onHold.held.length, 'time', 'times')} — ${d.onHold.held[0].reason || 'no headroom'}`);
+  L.push('');
+
+  // 3 — the one that compounds.
+  L.push(`DECIDED FOR YOU — ${plural(d.decisionCount, 'decision', 'decisions')} across ${plural(d.decisions.length, 'task', 'tasks')}`);
+  if (!d.decisionCount) {
+    L.push('  no worker had to fill a gap in its spec.');
+  } else {
+    L.push('  Each line is a sentence the task description should have contained.');
+    for (const t of d.decisions) {
+      L.push(`  ${t.taskId}  ${t.title || '(untitled)'}${t.shipped ? '' : '  [did not ship]'}`);
+      for (const one of t.decisions) L.push(`       · ${one}`);
+    }
+    if (d.thinnestSpec && d.thinnestSpec.decisions.length > 1) {
+      L.push('');
+      L.push(`  Thinnest spec: ${d.thinnestSpec.taskId} (${d.thinnestSpec.decisions.length} decisions).`);
+      L.push('  Tightening that description is what lowers tomorrow’s halts.');
+    }
+  }
+  L.push('');
+
+  // 4
+  L.push('COST');
+  L.push(`  ${usd(d.cost.totalUsd)} across ${plural(d.cost.workerRuns, 'worker run', 'worker runs')}` +
+    (d.cost.unreported ? ` (${d.cost.unreported} did not report a cost)` : ''));
+  if (d.cost.totalDurationS) L.push(`  ${humanDuration(d.cost.totalDurationS)} of worker time`);
+  L.push('');
+
+  // 5
+  L.push('LIMITS');
+  for (const w of d.windows) L.push(`  ${w.label.padEnd(18)} ${w.detail}`);
+  L.push('');
+
+  // The footer answers "did it run at all", which none of the five questions do.
+  const events = Object.entries(d.runner.byEvent).sort((a, b) => b[1] - a[1]).map(([k, n]) => `${k} ${n}`).join(' · ');
+  L.push(`RUNNER  ${events || 'no rows'}`);
+  if (d.runner.endedProbing) L.push('  Ended the night PROBING — it hit repeated failures and slowed itself down.');
+  if (d.runner.unrecognised) L.push(`  ${plural(d.runner.unrecognised, 'row', 'rows')} of a kind this digest does not know about.`);
+  return L.join('\n');
+}
+
+module.exports = { buildDigest, renderDigest, windowsFromGauge, humanDuration };

package/modules/hall-ui/module.json

@@ -1,7 +1,7 @@
 {
   "key": "hall-ui",
   "title": "Builders' Hall",
-  "description": "The authenticated builders' hall served at builders.<apex> (builders.example.com) — the roster, work board, standing/karma, leaderboard, achievements, primer, system maps, settings, dev-box pair page, and the Archon-only watch/harbor/gate pages, all polling /api/bongos/* and the read-only /api/bongos/public/* surface. The largest WEB-SURFACE core-domain module (~13k LOC), carved out of the GDS core in BV1.R85 (ADR 0093 §1; 02-module-map §6). default-on: a Cloud Bongos instance ships its hall like it ships its status page. Registers no port and contributes no routes — it declares a webSurface (host prefix + static dir). Unlike the generic status surface, the hall keeps its dedicated serving block in serve-internal.js (the builders.<apex> + apex /builders/* shim, canonical redirects, the citizen/Archon page gates, asset-stamping, and the module hall-widget injection) — the webSurfaces declaration is the discovery + scope-map + window.__MODULES__ record; serve-internal serves it from this module's public/ dir with that richer machinery. The me/public/leaderboard read endpoints it renders stay SHARED core in routes/{me,public,builders}.js (the status surface + the off-box mirror read them too).",
+  "description": "The authenticated builders' hall served at builders.<apex> (builders.example.com) — the roster, work board, standing/karma, leaderboard, achievements, primer, system maps, settings, and the Archon-only watch/gate pages, all polling /api/bongos/* and the read-only /api/bongos/public/* surface. The largest WEB-SURFACE core-domain module (~13k LOC), carved out of the GDS core in BV1.R85 (ADR 0093 §1; 02-module-map §6). default-on: a Cloud Bongos instance ships its hall like it ships its status page. Registers no port and contributes no routes — it declares a webSurface (host prefix + static dir). Unlike the generic status surface, the hall keeps its dedicated serving block in serve-internal.js (the builders.<apex> + apex /builders/* shim, canonical redirects, the citizen/Archon page gates, asset-stamping, and the module hall-widget injection) — the webSurfaces declaration is the discovery + scope-map + window.__MODULES__ record; serve-internal serves it from this module's public/ dir with that richer machinery. The me/public/leaderboard read endpoints it renders stay SHARED core in routes/{me,public,builders}.js (the status surface + the off-box mirror read them too).",
   "coreVersion": "^1.11.0",
   "default": true,
   "maintenance": { "status": "core-maintained" },

package/modules/hall-ui/public/builders.js

@@ -408,15 +408,6 @@
   }
 
 
-  // #777/#783/#807: the dev-box management UI now lives in the shared OTBBoxPanel
-  // module (public-builders/box-panel.js) so it can be reused verbatim on the
-  // Settings page. Here it runs in browser-only mode (showSsh:false) — a newcomer
-  // sees only the online terminal, never raw SSH details. We hold ONE instance;
-  // it owns its own self-rescheduling poll + terminal-window handle. Lazily
-  // created so it survives the very first renderWelcome regardless of which
-  // <script> finished loading first; a no-op shim keeps callers safe if the
-  // module somehow failed to load.
-
   // ---- onboarding checklist (V3.R75 #294; reshaped #777) ------------------
   // Renders the "Path into the City" checklist for the CURRENT logged-in
   // builder. Hidden once graduated (current_stage === 'graduated') so it
@@ -1284,8 +1275,6 @@
 
     // #777: setup-config toggle in the welcome panel. Flips which config pane
     // (Desktop app vs Claude Online) is shown — pure client-side, no round-trip.
-    // The dev-box buttons + credential-copy inside the online pane are handled by
-    // the OTBBoxPanel module's own scoped listener (#807), not here.
     $('#welcome-body')?.addEventListener('click', (e) => {
       const tab = e.target.closest('.setup__tab[data-config]');
       if (!tab) return;
@@ -1305,7 +1294,6 @@
       if (!scroll) return;
       const minimized = scroll.classList.toggle('scroll--welcome--minimized');
       if (btn) btn.textContent = minimized ? '+' : '−';
-      if (minimized) onboardingBox().stop(); else onboardingBox().refresh();
     });
 
     // V3.R25 (#245): delegated click handler for the peer-acclaim vote buttons.
@@ -1425,7 +1413,7 @@
   // reads what this page holds NOW rather than what it held at boot. Everything
   // else is stable for the life of the page. This call sits AFTER every
   // declaration it passes — moving it earlier is a temporal-dead-zone crash.
-  const { SETUP_CONFIG_KEY, acclaimEvidenceHtml, analyticsState, lbState, mountHallWidgets, onboardingBox, renderCurveBody, renderGreeting, renderLanding, renderNav, renderOnboarding, renderProfile, renderRecentShips, renderWelcomeCore, shipState, shipsPager, welcomeDismissalKey } = window.OTBHallRender({
+  const { SETUP_CONFIG_KEY, acclaimEvidenceHtml, analyticsState, lbState, mountHallWidgets, renderCurveBody, renderGreeting, renderLanding, renderNav, renderOnboarding, renderProfile, renderRecentShips, renderWelcomeCore, shipState, shipsPager, welcomeDismissalKey } = window.OTBHallRender({
     API, RANK_ORDER, api, brandWorld, curLabel, emptyRow, fmtDate, mins, normalizeRank, pct, postJSON, rankLabel, rankWeight, signClasses, toast, usd,
     get instanceRepo() { return instanceRepo; },
     get lastClaimableCount() { return lastClaimableCount; },

package/modules/hall-ui/public/dom-utils.js

@@ -6,8 +6,8 @@
 // NOT a consumer: modules/status-ui/public/ (the off-box status mirror) stays
 // self-contained by design — do not wire this there. Network helpers
 // (getJSON/postJSON/patchJSON) and renderRankBadge are deliberately NOT here:
-// the former carry auth-redirect drift that differs per page (and box-panel
-// catches its redirect by message), the latter is single-use and coupled to
+// the former carry auth-redirect drift that differs per page, the latter is
+// single-use and coupled to
 // the rank-ladder constant (a D1 concern). See
 // docs/audits/2026-06-14-repo-cleanup-audit.md §2A/§2B (frontend-utils).
 //
@@ -212,8 +212,8 @@
   // Module→core settings-panel contribution seam (BV1.R42, ADR 0083) — the
   // browser twin of the server's 'profile.fields' seam (src/module-seams.js). A
   // module that has left core registers a Settings panel from its own client
-  // script (loaded before settings.js, the box-panel.js pattern); settings.js
-  // then renders every registered panel instead of hardcoding box/discord/art.
+  // script (loaded before settings.js); settings.js then renders every
+  // registered panel instead of hardcoding discord/art.
   // Empty until a module registers → the page renders exactly what it does today.
   // A panel: { id, title?, order?, mount(el) } — mount() is handed a container
   // element to render into. order sorts ascending (default 0).

package/modules/hall-ui/public/hall-render.js

@@ -854,9 +854,7 @@
         <div class="setup__pane setup__pane--online">
           <ol class="setup__steps">
             <li><strong>Create your <a href="https://claude.com" target="_blank" rel="noopener noreferrer">Claude</a> account.</strong></li>
-            <li><strong>Open your online environment.</strong> This is the environment you will build in — no SSH, nothing to install.
-              <div class="setup__box" data-box-panel></div>
-            </li>
+            <li><strong>Open your online environment.</strong> This is the environment you will build in — no SSH, nothing to install.</li>
             <li><strong>Sign in when Claude prompts you.</strong> Claude starts automatically when you open the terminal.
               <span class="setup__hint">To paste the sign-in code: <strong>Ctrl+Shift+V</strong> or right-click — plain Ctrl+V will not paste here. Claude takes over the terminal with its own interface once you're signed in. This guide stays open in its own tab. If Claude didn't start automatically, type <code>claude</code> and press Enter.</span></li>
             <li><strong>Then drive it however you like:</strong>
@@ -912,20 +910,6 @@
     // Remember the stage we rendered for, so the dismiss handler can record it.
     scroll.dataset.stageIdx = String(currentIdx);
     scroll.hidden = false;
-    // #783/#807: mount the shared dev-box panel into the online pane and paint
-    // it from live server state. Browser-only onboarding hides SSH details
-    // (showSsh:false) — a newcomer sees only the online terminal. The panel runs
-    // its own poll while anything is in flight (survives tab flips / re-renders /
-    // reloads / background approvals); mount re-binds to the freshly-rendered DOM.
-    const boxMount = body.querySelector('[data-box-panel]');
-    if (boxMount) onboardingBox().mount(boxMount);
-  }
-  let _onboardingBox = null;
-  function onboardingBox() {
-    if (!_onboardingBox && window.OTBBoxPanel) {
-      _onboardingBox = window.OTBBoxPanel.create({ api: API, showSsh: false, toast });
-    }
-    return _onboardingBox || { mount() {}, refresh() {}, stop() {} };
   }
   function renderOnboarding(onboarding, discord) {
     const scroll = $('#onboarding-scroll');
@@ -1351,6 +1335,6 @@
     return idx === -1 ? null : { place: idx + 1, total: ranked.length };
   }
 
-    return { SETUP_CONFIG_KEY, acclaimEvidenceHtml, analyticsState, lbState, mountHallWidgets, onboardingBox, renderCurveBody, renderGreeting, renderLanding, renderNav, renderOnboarding, renderProfile, renderRecentShips, renderWelcomeCore, shipState, shipsPager, welcomeDismissalKey };
+    return { SETUP_CONFIG_KEY, acclaimEvidenceHtml, analyticsState, lbState, mountHallWidgets, renderCurveBody, renderGreeting, renderLanding, renderNav, renderOnboarding, renderProfile, renderRecentShips, renderWelcomeCore, shipState, shipsPager, welcomeDismissalKey };
   };
 })();

package/modules/hall-ui/public/index.html

@@ -105,9 +105,6 @@
 <script src="/builders/shell.js?v=2026-07-02-shell1" defer></script>
 <!-- jump palette (Ctrl/Cmd-K). Optional by design: without it the shell's slot stays hidden. -->
 <script src="/builders/palette.js" defer></script>
-<!-- #807: shared dev-box management panel — loaded BEFORE builders.js so the
-     OTBBoxPanel global is defined when the welcome panel mounts it. -->
-<script src="/builders/box-panel.js?v=2026-06-14-domutils" defer></script>
 <!-- task 2166: the shared component kit (window.OTBKit) — pager/ledger/rail.
      Loaded BEFORE hall-widgets.js, whose skeletons call OTBKit.pagerBarHtml(). -->
 <script src="/builders/hall-visual.js?v=2026-09-16-visual1" defer></script>

package/modules/hall-ui/public/panel.css

@@ -48,9 +48,8 @@
 .settings-card__hint { font-size: 13px; color: var(--ink-faint); }
 .panel-status,
 .settings-status,
-.pair-status { margin: var(--sp-xs) 0 0; min-height: 1.2em; font-size: 13.5px; color: var(--ink-soft); }
-.panel-status--ok, .settings-card__ok, .pair-status--ok { color: var(--ok); }
-.panel-status--danger, .pair-status--err { color: var(--danger); }
+.panel-status--ok, .settings-card__ok { color: var(--ok); }
+.panel-status--danger { color: var(--danger); }
 .panel-status:empty, .settings-status:empty { margin-top: 0; min-height: 0; }
 /* a prose link in any of the four voices is a control and owes the 24px floor */
 .panel-lede a, .panel-note a, .panel-hint a, .panel-status a, .settings-card__hint a, .section-note a {
@@ -114,7 +113,7 @@
    accent door — the panel's one primary act — and takes --accent-on, the dark
    ink for the salmon; white on it fails AA and DESIGN.md bans it. */
 .pbtn,
-.settings-btn, .sessions-row__end, .event-sound-preview, .pair-approve {
+.settings-btn, .sessions-row__end, .event-sound-preview {
   display: inline-flex;
   align-items: center;
   justify-content: center;
@@ -135,14 +134,14 @@
   transition: background 200ms cubic-bezier(.2,.7,.3,1), border-color 200ms cubic-bezier(.2,.7,.3,1), color 200ms cubic-bezier(.2,.7,.3,1);
 }
 .pbtn:hover:not(:disabled), .settings-btn:hover:not(:disabled), .sessions-row__end:hover:not(:disabled),
-.event-sound-preview:hover:not(:disabled), .pair-approve:hover:not(:disabled) { background: var(--glass-strong); color: var(--ink); text-decoration: none; }
-.pbtn:disabled, .settings-btn:disabled, .sessions-row__end:disabled, .pair-approve:disabled,
+.event-sound-preview:hover:not(:disabled) { background: var(--glass-strong); color: var(--ink); text-decoration: none; }
+.pbtn:disabled, .settings-btn:disabled, .sessions-row__end:disabled,
 .pbtn[aria-disabled="true"], .settings-btn[aria-disabled="true"] { color: var(--ink-faint); background: var(--glass); cursor: default; }
 .pbtn--quiet, .settings-btn--quiet, .sessions-row__end, .event-sound-preview { background: transparent; }
 .pbtn--save,
-.craft-save, .pair-approve { background: var(--accent); border-color: var(--accent); color: var(--accent-on); font-weight: 500; }
-.pbtn--save:hover:not(:disabled), .craft-save:hover:not(:disabled), .pair-approve:hover:not(:disabled) { background: var(--accent-lift); border-color: var(--accent-lift); color: var(--accent-on); }
-.craft-save:disabled, .pbtn--save:disabled, .pair-approve:disabled { background: var(--glass); border-color: var(--glass-edge); color: var(--ink-faint); }
+.craft-save { background: var(--accent); border-color: var(--accent); color: var(--accent-on); font-weight: 500; }
+.pbtn--save:hover:not(:disabled), .craft-save:hover:not(:disabled) { background: var(--accent-lift); border-color: var(--accent-lift); color: var(--accent-on); }
+.craft-save:disabled, .pbtn--save:disabled { background: var(--glass); border-color: var(--glass-edge); color: var(--ink-faint); }
 /* the shell's `.craft-save` was a bordered box; it is the family's save button
    now, so it carries the pill's own box model too */
 button.craft-save { display: inline-flex; align-items: center; justify-content: center; min-height: 38px; min-width: 38px; padding: 0 15px; border-radius: var(--radius-pill); font: inherit; font-size: 14px; cursor: pointer; }