@bongos/core 1.19.877 → 1.19.879

package/modules/hall-ui/public/settings.css

@@ -157,11 +157,6 @@ select.voices__select { min-width: 140px; }
 .settings-btn--discord { background: #5865F2; border-color: #4853c4; color: #ffffff; }
 .settings-btn--discord:hover:not(:disabled) { background: #4853c4; border-color: #4853c4; color: #ffffff; }
 
-/* ---- dev box ------------------------------------------------------------- */
-/* the box panel is the shell's (.setup__box, box-panel.js); inside a settings
-   panel it sits on the glass rather than a second card */
-.settings-groups .setup__box { margin: var(--sp-sm) 0 0; background: var(--glass); border-color: var(--glass-edge); border-radius: var(--radius-sm); }
-
 /* Specialities panel (task 1003855, ADR 0296). A speciality is a named bundle of
    knowledge and terms under a craft; this styles the list, the train form and the
    create form. Tokens only — no literal colours, so light/dark follow the page. */

package/modules/hall-ui/public/settings.html

@@ -195,20 +195,6 @@
 
             <!-- ============ group: devbox ============ -->
 
-            <!-- DEV BOX — full box management (#807, ADR 0040). Request/wake, open
-                 the online terminal, see SSH details, and close the box. Settings
-                 shows BOTH the online terminal AND the SSH IP + command. The
-                 OTBBoxPanel module (box-panel.js) renders + polls inside #box-mount. -->
-            <section class="scroll" id="box-scroll" aria-labelledby="box-h" data-group="devbox" hidden>
-              <h2 id="box-h" class="scroll__h">Your dev box</h2>
-              <p class="scroll__lede">
-                The hosted machine your work runs on. Open it in your browser (the
-                online terminal) or connect over SSH — whichever you prefer.
-              </p>
-              <div class="setup__box" id="box-mount"></div>
-              <p class="section-note">Actions apply at once. Closing stops and deletes the box; you can start a fresh one anytime.</p>
-            </section>
-
             <!-- DEV BOX APP — the desktop switch (#904, ADR 0044). Static download
                  links; the /downloads/devbox/* redirects resolve to the current
                  release (config/devbox-app.json). -->
@@ -236,19 +222,6 @@
               </p>
             </section>
 
-            <!-- PAIRING — link out to the dedicated pair page (task 2172): keeps
-                 the whole dev-box story reachable from this group. -->
-            <section class="scroll" id="pairing-scroll" aria-labelledby="pairing-h" data-group="devbox" hidden>
-              <h2 id="pairing-h" class="scroll__h">Pair Claude Desktop</h2>
-              <p class="scroll__lede">
-                Connect your Claude Desktop to your dev box with a one-time pairing
-                code — the guided flow lives on its own page.
-              </p>
-              <div class="settings-card">
-                <a class="settings-btn" href="/pair">Open the pairing page</a>
-              </div>
-            </section>
-
             <!-- ============ group: preferences ============ -->
 
             <!-- INTERACTION PROFILE — how replies are pitched for you (task 2010,
@@ -453,8 +426,6 @@
 <!-- shared record overlay (#/idea|blocker/N) — every hall page carries it; this
      page was the one gap (task 2172). -->
 <script src="/builders/task-detail.js?v=2026-07-03-taskdetail"></script>
-<!-- #807: shared dev-box panel — loaded before settings.js so OTBBoxPanel exists. -->
-<script src="/builders/box-panel.js?v=2026-06-14-domutils"></script>
 <script src="/builders/settings.js?v=2026-09-02-panel"></script>
 <!-- task 1003341: the Active sessions panel. Its own file rather than more of
      settings.js, which sits close to the 1500-line size ratchet. -->

package/modules/hall-ui/public/settings.js

@@ -6,8 +6,6 @@
 //
 //   1. VOICES  — per-skill model picker (GET/PATCH /api/bongos/me/skill-prefs).
 //   2. CRAFT   — preferred disciplines (GET /api/bongos/me, PATCH /api/bongos/me/disciplines).
-//   3. DEV BOX — full box management via the shared OTBBoxPanel (#807, ADR 0040):
-//                request/open the online terminal, SSH details, and close.
 //   5. SOUNDS  — per-sound on/off toggles (GET/PATCH /api/bongos/me/sound-prefs, #786).
 //
 // On a 401 it redirects into the web sign-in flow, like the other hall pages.
@@ -813,24 +811,6 @@
     $('#display-name-scroll').hidden = false;
   }
 
-  // ---- section 1b: DEV BOX (full management, #807 ADR 0040) ----------------
-  //
-  // Mounts the shared OTBBoxPanel (box-panel.js) with showSsh:true so a builder
-  // sees BOTH the online terminal and the SSH IP + command, and can request,
-  // open, or close their box. The module owns its own polling + state painting;
-  // we just hand it the mount element. Hidden if the module failed to load.
-  function setupBox() {
-    // R60 (task 1199): dev boxes are a feature module. On a vanilla instance the
-    // module is off — there is no box to manage, so the whole section stays
-    // hidden (its #box-scroll defaults to hidden in the markup).
-    if (!window.OTB.moduleOn('dev-box')) return;
-    const mount = $('#box-mount');
-    if (!mount || !window.OTBBoxPanel) return;
-    const panel = window.OTBBoxPanel.create({ api: API, showSsh: true, toast });
-    $('#box-scroll').hidden = false;
-    panel.mount(mount);
-  }
-
   // ---- section 3: CONNECTIONS (Discord link/unlink, F7 ADR 0033) -----------
   //
   // The /me payload carries `discord: { configured, linked }`. The section is
@@ -1243,9 +1223,7 @@
     'disciplines': 'craft-scroll',
     'cli': 'cli-scroll',
     'art-key': 'art-key',
-    'dev-box': 'box-scroll',
     'dev-box-app': 'boxapp-scroll',
-    'pairing': 'pairing-scroll',
     'interaction': 'interaction-scroll',
     'wandering': 'wandering-scroll',
     'rendering': 'render-scroll',
@@ -1358,14 +1336,11 @@
     // DISPLAY NAME — the label beside your work (task 1669); seeded from /me.
     setupDisplayName(builder);
 
-    // DEV BOX — full box management (online terminal + SSH + close), #807.
-    setupBox();
-    // DEV BOX APP + PAIRING — revealed once we know the viewer is a real builder,
+    // DEV BOX APP — revealed once we know the viewer is a real builder,
     // and only where the dev-box module runs (the group's rail entry is gated
     // the same way above — task 2172).
     if (window.OTB.moduleOn('dev-box')) {
       $('#boxapp-scroll').hidden = false;
-      $('#pairing-scroll').hidden = false;
       loadDevboxLatestVersion(); // #924: best-effort "latest version: X" courtesy line
     }
     // CONNECTIONS — Discord (hidden unless the server has Discord configured).

package/modules/hall-ui/public/shell.js

@@ -314,7 +314,6 @@
       // Metic+ oversight could not honestly hold it. Everything below IS a rank
       // surface, so this group's gate and audience are unchanged.
       { id: 'watch', label: 'Watch', icon: 'admin', href: '/watch', gate: 'government' },
-      { id: 'harbor', label: 'Harbor', icon: 'admin', href: '/harbor', gate: 'government', module: 'dev-box' },
       { id: 'gate', label: 'Gate', icon: 'admin', href: '/gate', gate: 'government' },
       { id: 'sessions', label: 'Sessions', icon: 'admin', href: '/sessions', gate: 'government' },
       // The project's own fundamentals (task 1003280, goal 1000072). Mirrors the

package/modules/hall-ui/public/style.css

@@ -2421,50 +2421,6 @@ main [id] { scroll-margin-top: calc(var(--topbar-h) + 16px); }
 }
 .setup__btn:hover:not(:disabled) { background: var(--accent-deep); border-color: var(--accent-deep); color: #fff; text-decoration: none; }
 .setup__btn:disabled, .setup__btn--open[aria-disabled="true"] { opacity: 0.5; cursor: not-allowed; }
-.setup__btn--box { background: var(--surface); border-color: var(--border-strong); color: var(--ink); }
-.setup__btn--box:hover:not(:disabled) { background: var(--surface-2); color: var(--ink); }
-.setup__btn--danger { background: var(--surface); border-color: color-mix(in srgb, var(--danger) 45%, transparent); color: var(--danger); }
-.setup__btn--danger:hover:not(:disabled) { background: var(--danger-weak); }
-
-.setup__box { border: 1px solid var(--border); border-radius: var(--radius-sm); padding: 12px 14px; margin: 10px 0; background: var(--surface-2); }
-.setup__box-btns { display: flex; flex-wrap: wrap; gap: 8px; margin: 8px 0; }
-.setup__box-msg { font-size: 13px; margin: 6px 0; }
-.setup__box-msg--ok { color: var(--ok); }
-.setup__box-msg--warn { color: var(--warn); }
-.setup__box-msg--err { color: var(--danger); }
-.setup__box-out {
-  font-family: ui-monospace, "SF Mono", Menlo, Consolas, monospace;
-  font-size: 12px;
-  background: var(--surface);
-  border: 1px solid var(--border);
-  border-radius: var(--radius-sm);
-  padding: 8px 10px;
-  max-height: 180px;
-  overflow: auto;
-}
-.setup__box-close { margin-left: auto; }
-.setup__box-close-hint { font-size: 12px; color: var(--ink-faint); }
-.setup__cred-row { display: flex; align-items: center; gap: 8px; margin: 4px 0; font-size: 13px; flex-wrap: wrap; }
-.setup__cred-k { color: var(--ink-faint); min-width: 90px; }
-.setup__cred-v {
-  font-family: ui-monospace, "SF Mono", Menlo, Consolas, monospace;
-  font-size: 12px;
-  background: var(--surface-2);
-  border: 1px solid var(--border);
-  border-radius: 4px;
-  padding: 2px 8px;
-}
-.setup__copy {
-  border: 1px solid var(--border-strong);
-  background: var(--surface);
-  color: var(--ink-soft);
-  border-radius: var(--radius-sm);
-  font-size: 12px;
-  padding: 3px 10px;
-  cursor: pointer;
-}
-.setup__copy:hover { background: var(--surface-2); }
-.setup__copy--copied { background: var(--ok-weak); color: var(--ok); border-color: color-mix(in srgb, var(--ok) 35%, transparent); }
 .setup__getcode { margin: 10px 0; }
 /* A <summary> is a control, so it owes the 24px floor like any other; it
    measured 20px tall (task 1003304). The height is bought with padding rather

package/modules/hall-ui/public/watch.html

@@ -89,13 +89,6 @@
         <!-- ============ tab: Operations ============ -->
         <div id="pane-operations" role="tabpanel" aria-labelledby="tab-operations" hidden>
 
-          <!-- 5. BOX COSTS (#602) — per-builder dev-box cost ledger + totals. -->
-          <section class="scroll" id="box-costs-scroll" aria-labelledby="box-costs-h" hidden>
-            <h2 id="box-costs-h" class="scroll__h">Dev-box costs</h2>
-            <p class="scroll__lede">What each builder's dev box has cost — spin-up, compute, and storage. Tracked for oversight; not charged in the early stage.</p>
-            <div id="box-costs-body"><span class="kit-skel"></span></div>
-          </section>
-
           <!-- 6. SESSIONS — the tally, and the five most recent sessions the page
                always fetched and used to throw away (task 1003469). -->
           <section class="scroll" id="sessions-scroll" aria-labelledby="sessions-h" hidden>

package/modules/hall-ui/public/watch.js

@@ -897,41 +897,6 @@
     });
   }
 
-  // ---- Box costs (#602): per-builder container-cost totals + recent ledger ----
-  function renderBoxCosts(data, target) {
-    const totals = Array.isArray(data.totals_by_builder) ? data.totals_by_builder : [];
-    const recent = Array.isArray(data.ledger) ? data.ledger : [];
-    const usd = (n) => `$${(Number(n) || 0).toFixed(2)}`;
-    target.innerHTML = '';
-    if (!totals.length) {
-      target.innerHTML = emptyStateHtml('No dev-box costs accrued yet.');
-      return;
-    }
-    ledger(group(target, 'Totals by builder', totals.length), {
-      columns: ['Builder', { label: 'Total', class: 'num' }],
-      rowHtml: (tb) => `<tr><td>${escapeHtml(tb.builder_login || ('#' + (tb.builder_id ?? '?')))}</td><td class="num">${usd(tb.total_usd)}</td></tr>`,
-    }).render(totals);
-    ledger(group(target, 'Recent ledger', recent.length), {
-      columns: ['When', 'Builder', 'Kind', { label: 'Amount', class: 'num' }, 'Detail'],
-      pager: makePager('watch-boxcosts', 'otb.watch.boxCostsPerPage'),
-      emptyMsg: 'No ledger rows yet.',
-      rowHtml: (r) => `<tr><td>${escapeHtml(String(r.recorded_at || '').slice(0, 16).replace('T', ' '))}</td>` +
-        `<td>${escapeHtml(r.builder_login || ('#' + (r.builder_id ?? '?')))}</td>` +
-        `<td><span class="ov-mono">${escapeHtml((r.source || '').replace('box-', ''))}</span></td>` +
-        `<td class="num">${usd(r.amount_usd)}</td>` +
-        `<td>${escapeHtml(r.description || '')}</td></tr>`,
-    }).render(recent);
-    target.insertAdjacentHTML('beforeend', foot('Container cost is tracked for oversight — not charged in the early stage.'));
-  }
-
-  function loadBoxCosts() {
-    return section($('#box-costs-body'), () => fetchJson('/boxes/cost-ledger?limit=100'), renderBoxCosts, {
-      sealedMsg: 'The cost ledger is not visible at your rank.',
-      errMsg: 'Could not load the dev-box cost ledger.',
-      name: 'box costs',
-    });
-  }
-
   // =========================================================================
   // 4. MARKS — reviews by builder (per-builder grade breakdown)
   // NOTE: built in parallel — code defensively (404 / [] / missing fields).
@@ -1316,7 +1281,7 @@
 
   function revealSections() {
     [
-      'watch-attention', 'watch-tabs', 'gate-scroll', 'watch-scroll', 'roster-scroll', 'box-costs-scroll',
+      'watch-attention', 'watch-tabs', 'gate-scroll', 'watch-scroll', 'roster-scroll',
       'marks-scroll', 'mason-marks-scroll', 'surveyor-scroll', 'ledger-scroll', 'sessions-scroll',
     ].forEach((id) => {
       const el = document.getElementById(id);
@@ -1376,7 +1341,6 @@
     loadOverrides();
     loadAudit();
     loadRoster();
-    loadBoxCosts();
     loadMarks();
     loadMasonMarks();
     loadSurveyor();

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.877",
+  "version": "1.19.879",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.19.877",
+      "version": "1.19.879",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.877",
+  "version": "1.19.879",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/scripts/gds/autobongos-digest.js

@@ -0,0 +1,123 @@
+#!/usr/bin/env node
+'use strict';
+
+// scripts/gds/autobongos-digest.js — read the night without opening a log
+// (task 1003906, ADR 0307).
+//
+//   node scripts/gds/autobongos-digest.js              # since midnight, local
+//   node scripts/gds/autobongos-digest.js --since 24h  # a rolling window
+//   node scripts/gds/autobongos-digest.js --json       # the structured shape
+//   node scripts/gds/autobongos-digest.js --all        # the whole log
+//
+// The decision logic is modules/autonomy/digest.js and has no I/O; this half
+// finds the two files it reads and prints the result. Exit 0 always, including on
+// an empty night: a digest is a report, and a non-zero exit would make a cron
+// wrapper treat "nothing happened" as a failure.
+
+const fs = require('node:fs');
+const path = require('node:path');
+
+const digest = require('../../modules/autonomy/digest.js');
+
+const REPO_ROOT = path.resolve(__dirname, '..', '..');
+
+function arg(flag, argv) {
+  const i = argv.indexOf(flag);
+  return i >= 0 ? argv[i + 1] : null;
+}
+
+function logPath() {
+  if (process.env.AUTOBONGOS_LOG_FILE) return process.env.AUTOBONGOS_LOG_FILE;
+  try { return require('../../src/instance-config.js').configPath('autobongos-runs.jsonl'); }
+  catch (_) { return path.join(REPO_ROOT, 'autobongos-runs.jsonl'); }
+}
+
+function gaugePath() {
+  if (process.env.AUTOBONGOS_GAUGE_FILE) return process.env.AUTOBONGOS_GAUGE_FILE;
+  try { return require('../../src/instance-config.js').configPath('autobongos-gauge.json'); }
+  catch (_) { return path.join(REPO_ROOT, 'autobongos-gauge.json'); }
+}
+
+// readRows — an append-only JSONL, and a single unparseable line must not cost
+// the whole night. A JSONL written by a process that can be killed mid-write has
+// a torn last line more often than never.
+function readRows(file) {
+  let text;
+  try { text = fs.readFileSync(file, 'utf8'); }
+  catch (_) { return { rows: [], missing: true, skipped: 0 }; }
+  const rows = [];
+  let skipped = 0;
+  for (const line of text.split('\n')) {
+    const t = line.trim();
+    if (!t) continue;
+    try { rows.push(JSON.parse(t)); } catch (_) { skipped += 1; }
+  }
+  return { rows, missing: false, skipped };
+}
+
+function readGaugeFile(file) {
+  try { return JSON.parse(fs.readFileSync(file, 'utf8')); }
+  catch (_) { return null; }
+}
+
+// sinceMs — `--since 24h|90m|3d`, or midnight LOCAL by default.
+//
+// Local rather than UTC because the question is "what happened last night" and
+// night is a local idea; a UTC midnight cut would split an owner's evening in
+// half depending on where they live.
+function sinceMs(spec, now = new Date()) {
+  if (!spec) {
+    const d = new Date(now);
+    d.setHours(0, 0, 0, 0);
+    return d.getTime();
+  }
+  const m = /^(\d+(?:\.\d+)?)\s*([hmd])$/i.exec(String(spec).trim());
+  if (!m) return null;
+  const mult = { h: 3600e3, m: 60e3, d: 86400e3 }[m[2].toLowerCase()];
+  return now.getTime() - Number(m[1]) * mult;
+}
+
+function main(argv) {
+  const all = argv.includes('--all');
+  const asJson = argv.includes('--json');
+  const now = new Date();
+  const from = all ? null : sinceMs(arg('--since', argv), now);
+  if (!all && from === null) {
+    console.error('autobongos-digest: --since wants a span like 24h, 90m or 3d.');
+    return 2;
+  }
+
+  const lf = logPath();
+  const { rows, missing, skipped } = readRows(lf);
+  const inWindow = all ? rows : rows.filter((r) => {
+    const t = Date.parse(r && r.at);
+    return Number.isFinite(t) ? t >= from : true;   // an undated row is kept, not silently dropped
+  });
+
+  const d = digest.buildDigest(inWindow, {
+    gauge: readGaugeFile(gaugePath()),
+    nowEpochS: Math.floor(now.getTime() / 1000),
+    sinceMs: all ? null : from,
+    untilMs: now.getTime(),
+  });
+
+  if (asJson) { console.log(JSON.stringify(d, null, 2)); return 0; }
+
+  console.log('');
+  console.log(digest.renderDigest(d));
+  // Both of these are about the DIGEST's own reliability, so they sit outside the
+  // five questions rather than being folded into them.
+  if (missing) {
+    console.log('');
+    console.log(`  No run log at ${lf} — the runner has not written one here yet.`);
+  }
+  if (skipped) console.log(`  (${skipped} unreadable line(s) in the log were skipped.)`);
+  console.log('');
+  return 0;
+}
+
+if (require.main === module) {
+  process.exit(main(process.argv.slice(2)));
+}
+
+module.exports = { main, sinceMs, readRows, logPath, gaugePath };

package/scripts/gds/autobongos-run.js

@@ -381,6 +381,13 @@ async function iteration(opts, deps = {}) {
     // What the LEDGER says, kept separate from what the worker said, so the run
     // log can be read afterwards without having to trust either one alone.
     ledger_status: ledger.status, ledger_shape: ledger.shape, verified: !!ledger.verified,
+    // The LEDGER's own explanation, kept beside the worker's. `reason` above is
+    // verdict.reason — what the WORKER said happened — and it was the only reason
+    // in the row, so anything reading the log afterwards was quoting the thing
+    // being checked rather than the check. The morning digest did exactly that
+    // until the grader caught it (task 1003906).
+    ledger_reason: ledger.reason || null,
+    ledger_remedy: ledger.remedy || null,
     artifact_on_main: ledger.artifact && ledger.artifact.checked ? !!ledger.artifact.onMain : null,
     claim_released: !!ledger.released,
     blocker_id: ledger.blocker && ledger.blocker.blockerId ? ledger.blocker.blockerId : null,

package/scripts/gds/autobongos-service.ps1

@@ -3,6 +3,7 @@
 #
 #   powershell -ExecutionPolicy Bypass -File scripts\gds\autobongos-service.ps1 install
 #   powershell -ExecutionPolicy Bypass -File scripts\gds\autobongos-service.ps1 status
+#   powershell -ExecutionPolicy Bypass -File scripts\gds\autobongos-service.ps1 digest
 #   powershell -ExecutionPolicy Bypass -File scripts\gds\autobongos-service.ps1 start|stop|uninstall
 #
 # WHY TASK SCHEDULER AND NOT A REAL SERVICE. Windows services speak a protocol
@@ -29,7 +30,7 @@
 [CmdletBinding()]
 param(
   [Parameter(Position = 0)]
-  [ValidateSet('install', 'uninstall', 'start', 'stop', 'status')]
+  [ValidateSet('install', 'uninstall', 'start', 'stop', 'status', 'digest')]
   [string]$Action = 'status',
 
   # The checkout to run from. Defaults to the repo this script lives in, so the
@@ -118,6 +119,11 @@ switch ($Action) {
     Unregister-ScheduledTask -TaskName $TaskName -Confirm:$false -ErrorAction SilentlyContinue
     Write-Host "removed '$TaskName'. The log at $LogFile is left in place."
   }
+  'digest' {
+    # The night in one page (task 1003906). On the box for convenience; the same
+    # five answers are what the Gate page and a mailed digest would carry.
+    & node (Join-Path $RepoRoot 'scripts\gds\autobongos-digest.js') @args
+  }
   'start'  { Start-ScheduledTask -TaskName $TaskName; Write-Host "started '$TaskName'" }
   'stop'   {
     Stop-ScheduledTask -TaskName $TaskName

package/scripts/gds/provision-core-upgrade.js

@@ -187,6 +187,25 @@ async function coreUpgradeInstance(inst, deps, intent) {
   const healthUrl = `http://127.0.0.1:${inst.port}/healthz`;
   const versionUrl = `http://127.0.0.1:${inst.port}/version`;
   const sudoP = privileged ? 'sudo ' : '';
+  // WHERE THE CLI LIVES AND WHERE THE TARGET LIVES ARE DIFFERENT PLACES (task 1004053).
+  //
+  // `scripts/gds/upgrade.js` ships in the CORE checkout. A provisioned instance root holds
+  // no scripts/ directory at all — its core sits under node_modules/@bongos/core — so
+  // running the CLI with cwd = the instance root resolved nothing, and EVERY standalone
+  // upgrade died before it began:
+  //
+  //   Error: Cannot find module '/srv/<base>/<slug>/scripts/gds/upgrade.js'
+  //
+  // It worked only where instanceDir HAPPENED to be this checkout — the control-plane self
+  // row and a co-tenant — which is why it survived to production: the shapes that are
+  // upgraded by hand are the shapes the relative path fits. Every ACTIVE tenant is
+  // standalone, so the deploy door could not move a single one of them.
+  //
+  // upgrade.js's own header states the contract this restores: "Runs from the consumer
+  // instance root (default) or `--instance <dir>`. This script ships IN the core … against
+  // `--instance <consumer>`." So: run it where it exists, and NAME the target.
+  const runDir = REPO_ROOT;
+  const targetArg = instanceDir === REPO_ROOT ? '' : `--instance ${instanceDir}`;
   const cli = path.posix.join('scripts', 'gds', 'upgrade.js');
   const requestedBy = intent.requested_by && /^api:archon:(\d+)$/.test(intent.requested_by)
     ? intent.requested_by.replace(/^api:archon:/, '')
@@ -195,6 +214,7 @@ async function coreUpgradeInstance(inst, deps, intent) {
     `${sudoP}node ${cli}`,
     '--registry',
     `--to ${to}`,
+    targetArg,
     `--service ${inst.slug}`,
     `--health-url ${healthUrl}`,
     `--version-url ${versionUrl}`,
@@ -204,13 +224,13 @@ async function coreUpgradeInstance(inst, deps, intent) {
   ].filter(Boolean).join(' ');
 
   if (!apply) {
-    log(`  ✓ would run: ${cmd} (dry-run — nothing ran)`);
+    log(`  ✓ would run (in ${runDir}): ${cmd} (dry-run — nothing ran)`);
     log(`  ✓ would then read ${versionUrl} on the box and require it to say ${to}`);
     return { ok: true, served: null };
   }
   try {
-    log(`  [upgrade] ${cmd}`);
-    boxExec(cmd, { cwd: instanceDir });
+    log(`  [upgrade] (in ${runDir}) ${cmd}`);
+    boxExec(cmd, { cwd: runDir });
   } catch (e) {
     // upgrade.js rolls itself back on a failed health check or an unchanged served
     // version, so by the time this throws the instance is back on the core it had.

package/src/bongos/serve-internal.js

@@ -927,16 +927,16 @@ function mountInternalSurfaces(app) {
     return res.redirect(301, `https://builders.${apex}/${rest}${qs}`);
   });
 
-  // The /watch monitoring page and the /harbor dev-box management page (idea 257)
-  // and the /gate page (task 1179) all sit behind `page.view.government` — Metic
-  // and up since ADR 0157. Same server-side page gate, same posture: a builder
-  // without the permission never receives the shell (requireGovernmentPage — named
-  // requireArchonPage before ADR 0157 — redirects them to the hall, and an
-  // unauthenticated visitor into sign-in). The subdomain shim above has already
-  // rewritten the bare /watch + /harbor + /gate onto /builders/*. (Defense in
-  // depth: every data endpoint these pages call carries its own server-side gate.)
+  // The /watch monitoring page and the /gate page (task 1179) both sit behind
+  // `page.view.government` — Metic and up since ADR 0157. Same server-side page
+  // gate, same posture: a builder without the permission never receives the shell
+  // (requireGovernmentPage — named requireArchonPage before ADR 0157 — redirects
+  // them to the hall, and an unauthenticated visitor into sign-in). The subdomain
+  // shim above has already rewritten the bare /watch + /gate onto /builders/*.
+  // (Defense in depth: every data endpoint these pages call carries its own
+  // server-side gate.) /harbor sat here too until task 1003890 removed the dev
+  // box: its page is gone, and a gate in front of nothing is a dead guard.
   const WATCH_PAGE_RE = /^\/builders\/watch(?:\.html)?\/?$/;
-  const HARBOR_PAGE_RE = /^\/builders\/harbor(?:\.html)?\/?$/;
   const GATE_PAGE_RE = /^\/builders\/gate(?:\.html)?\/?$/;
   // /sessions (the session-log ledger) belongs to that same Governance group and
   // its data route (`session.search`) carries the same metic floor since ADR 0157
@@ -1020,7 +1020,7 @@ function mountInternalSurfaces(app) {
     if (isModuleSurfaceHost(req)) return next();
     if (!req.path.startsWith('/builders')) return next();
     const norm = path.posix.normalize(req.path);
-    if (WATCH_PAGE_RE.test(norm) || HARBOR_PAGE_RE.test(norm) || GATE_PAGE_RE.test(norm)
+    if (WATCH_PAGE_RE.test(norm) || GATE_PAGE_RE.test(norm)
       || SESSIONS_PAGE_RE.test(norm) || PROJECT_SETTINGS_PAGE_RE.test(norm)) {
       return gdsAuth.requireGovernmentPage(req, res, next);
     }
@@ -1201,7 +1201,7 @@ function mountInternalSurfaces(app) {
   // read behind it is gated server-side, so this closed an inconsistency rather
   // than an exposure; the point is that one URL cannot be two tiers at once.
   const SIGNEDIN_BUILDERS_PAGE_RE =
-    /^\/builders\/(?:work|pair|settings|atlas|modules|goals|roadmap|copy-desk|studio|ideas|collab|task|idea|primer(?:\.md)?|diagrams)(?:\.html)?\/?$/;
+    /^\/builders\/(?:work|settings|atlas|modules|goals|roadmap|copy-desk|studio|ideas|collab|task|idea|primer(?:\.md)?|diagrams)(?:\.html)?\/?$/;
   // The diagram image assets under /builders/diagrams/ ride the same tier as the
   // page that embeds them.
   const SIGNEDIN_BUILDERS_PREFIX_RE = /^\/builders\/diagrams\//;

package/src/module-api.js

@@ -71,7 +71,7 @@ const { responsibilityFor, ROLE_RESPONSIBILITIES } = require('./role-responsibil
 // there. scripts/gds/bump-version.js still rewrites the literal below; it appends
 // the entry to that file. Look for a version's history there, not here.
 // ---------------------------------------------------------------------------
-const CORE_VERSION = '1.19.877'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
+const CORE_VERSION = '1.19.879'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('dev-box'); log.info('mounted');