@bongos/core 1.19.877 → 1.19.879

package/tests/autonomy_digest.mjs

@@ -0,0 +1,302 @@
+// tests/autonomy_digest.mjs — the night, readable afterwards (task 1003906).
+//
+// The done-when is "a night produces one digest answering all five questions
+// without anyone opening a log". So the spine of this file is one test that
+// feeds a realistic night through and asserts all five answers are present and
+// correct — because five separately-passing sections can still add up to a page
+// that does not answer the question.
+
+import assert from 'node:assert/strict';
+import { test } from 'node:test';
+import { createRequire } from 'node:module';
+
+const require = createRequire(import.meta.url);
+const { buildDigest, renderDigest, windowsFromGauge, humanDuration } = require('../modules/autonomy/digest.js');
+const cli = require('../scripts/gds/autobongos-digest.js');
+
+const T0 = Date.parse('2026-09-19T02:00:00.000Z');
+const at = (m) => new Date(T0 + m * 60000).toISOString();
+const NOW_S = Math.floor((T0 + 8 * 3600e3) / 1000);
+
+const night = () => [
+  { at: at(0), event: 'boot_reconcile', ok: true, leftover: 0 },
+  { at: at(1), event: 'worked', task_id: 111, title: 'A shipped thing', goal_id: 1000119,
+    duration_s: 2820, cost_usd: 3.41, verified: true, ledger_shape: 'shipped',
+    undetermined_decisions: ['Cached for 60s rather than 5m'] },
+  { at: at(50), event: 'worked', task_id: 222, title: 'A stranded thing', goal_id: 1000119,
+    duration_s: 5400, cost_usd: 6.8, verified: false, ledger_shape: 'unlanded',
+    reason: 'the grade passed and the land never finished', blocker_id: '1000161',
+    undetermined_decisions: ['Sorted inactive last', 'Kept the id tie-break', 'Chose ascending'] },
+  { at: at(120), event: 'fenced', code: 'grader_unavailable', reason: 'the grader is bypassed' },
+  { at: at(121), event: 'fenced', code: 'grader_unavailable', reason: 'the grader is bypassed' },
+  { at: at(122), event: 'cadence', mode: 'probing', class: 'transient', consecutive_failures: 3, wait_s: 60 },
+  { at: at(200), event: 'nothing_claimable', goals: [1000119],
+    skipped: [{ id: 333, goal_id: 1000119, reasons: ['needs_migration'] }] },
+  { at: at(201), event: 'hold', reason: 'seven-day pace: 78% used' },
+];
+const gauge = {
+  five_hour: { used_percentage: 41, resets_at: NOW_S + 3600 },
+  seven_day: { used_percentage: 78, resets_at: NOW_S + 240000 },
+};
+
+// ── the done-when, in one test ─────────────────────────────────────────────────
+
+test('one night produces one page answering all five questions', () => {
+  const text = renderDigest(buildDigest(night(), { gauge, nowEpochS: NOW_S }));
+
+  // 1. what shipped — and ONLY what the ledger agreed shipped.
+  assert.match(text, /SHIPPED — 1 task/);
+  assert.match(text, /111\s+A shipped thing/);
+  assert.doesNotMatch(text.split('ON HOLD')[0], /222/, 'a task that ran but did not ship is not "shipped"');
+
+  // 2. what is on hold, and why.
+  assert.match(text, /ON HOLD/);
+  assert.match(text, /222\s+ran but did not ship — unlanded/);
+  assert.match(text, /blocker 1000161/);
+  assert.match(text, /fence: grader_unavailable ×2/);
+  assert.match(text, /every one halted/);
+  assert.match(text, /capacity: held 1 time/);
+
+  // 3. what each worker decided that its spec did not determine.
+  assert.match(text, /DECIDED FOR YOU — 4 decisions across 2 tasks/);
+  assert.match(text, /Cached for 60s rather than 5m/);
+  assert.match(text, /sentence the task description should have contained/);
+  assert.match(text, /Thinnest spec: 222/);
+
+  // 4. what it cost.
+  assert.match(text, /COST/);
+  assert.match(text, /\$10\.21 across 2 worker runs/);
+
+  // 5. where both limit windows stand.
+  assert.match(text, /Five-hour window\s+41% used, resets in 60m/);
+  assert.match(text, /Seven-day window\s+78% used/);
+});
+
+test('every section prints even when the night was empty', () => {
+  // A digest whose quiet sections vanish teaches its reader that absence means
+  // "fine" — and then the morning a section is missing because the DATA is
+  // missing reads exactly the same.
+  const text = renderDigest(buildDigest([], { gauge, nowEpochS: NOW_S }));
+  for (const heading of ['SHIPPED', 'ON HOLD', 'DECIDED FOR YOU', 'COST', 'LIMITS', 'RUNNER']) {
+    assert.ok(text.includes(heading), `${heading} must print on an empty night`);
+  }
+  assert.match(text, /nothing shipped/);
+  assert.match(text, /nothing is waiting on you/);
+  assert.match(text, /no worker had to fill a gap/);
+});
+
+// ── the answers, individually ──────────────────────────────────────────────────
+
+test('shipped is the LEDGER’s answer, never the worker’s', () => {
+  const d = buildDigest([
+    { at: at(0), event: 'worked', task_id: 1, verified: true, ledger_shape: 'shipped' },
+    { at: at(1), event: 'worked', task_id: 2, verified: false, ledger_shape: 'still_held' },
+    { at: at(2), event: 'worked', task_id: 3, outcome: 'claims_shipped', ledger_shape: 'shipped_no_artifact', verified: false },
+  ], { nowEpochS: NOW_S });
+  assert.deepEqual(d.shipped.map((s) => s.taskId), ['1']);
+  assert.deepEqual(d.onHold.ranButDidNotShip.map((r) => r.shape), ['still_held', 'shipped_no_artifact']);
+});
+
+test('an unworkable queue is reported as a queue problem, not as breakage', () => {
+  const d = buildDigest([{ at: at(0), event: 'nothing_claimable', skipped: [{ id: 9, reasons: ['needs_migration'] }] }], { nowEpochS: NOW_S });
+  assert.equal(d.onHold.unworkable.length, 1);
+  const text = renderDigest(d);
+  assert.match(text, /this is not a runner failure/);
+});
+
+test('the decisions list groups by task and names the thinnest spec', () => {
+  // The SHAPE is the signal: one task with six decisions is a thin spec, six
+  // tasks with one each is a normal night.
+  const d = buildDigest([
+    { at: at(0), event: 'worked', task_id: 1, verified: true, undetermined_decisions: ['a'] },
+    { at: at(1), event: 'worked', task_id: 2, verified: true, undetermined_decisions: ['b', 'c', 'd'] },
+    { at: at(2), event: 'worked', task_id: 3, verified: true, undetermined_decisions: [] },
+  ], { nowEpochS: NOW_S });
+  assert.equal(d.decisionCount, 4);
+  assert.equal(d.decisions.length, 2, 'a task with no decisions is not listed');
+  assert.equal(d.thinnestSpec.taskId, '2');
+});
+
+test('a decision from a task that did NOT ship is still surfaced', () => {
+  // These are the ones that matter most: the judgement was made, the work is not
+  // in, and the call is sitting in a branch nobody has read.
+  const text = renderDigest(buildDigest([
+    { at: at(0), event: 'worked', task_id: 7, title: 'T', verified: false, ledger_shape: 'unlanded', undetermined_decisions: ['picked a default'] },
+  ], { nowEpochS: NOW_S }));
+  assert.match(text, /picked a default/);
+  assert.match(text, /\[did not ship\]/);
+});
+
+test('an unreported cost is excluded and counted, never coerced to zero', () => {
+  const d = buildDigest([
+    { at: at(0), event: 'worked', task_id: 1, verified: true, cost_usd: 2.5 },
+    { at: at(1), event: 'worked', task_id: 2, verified: true, cost_usd: null },
+    { at: at(2), event: 'worked', task_id: 3, verified: true },
+  ], { nowEpochS: NOW_S });
+  assert.equal(d.cost.totalUsd, 2.5, 'a worker whose cost was not reported must not make the night look cheaper');
+  assert.equal(d.cost.reported, 1);
+  assert.equal(d.cost.unreported, 2);
+  assert.match(renderDigest(d), /2 did not report a cost/);
+});
+
+// ── the limit windows ──────────────────────────────────────────────────────────
+
+test('a window whose reset has PASSED is reported as stale, not as headroom', () => {
+  // "41% used, resets in 0s" invites a decision about headroom that no longer
+  // exists: the percentage was true of a window that has since rolled.
+  const [five] = windowsFromGauge({ five_hour: { used_percentage: 41, resets_at: NOW_S - 60 } }, NOW_S);
+  assert.equal(five.known, false);
+  assert.equal(five.stale, true);
+  assert.match(five.detail, /has since reset/);
+});
+
+test('a window the gauge never reported says so rather than reading as zero', () => {
+  const [five, seven] = windowsFromGauge({ seven_day: { used_percentage: 12, resets_at: NOW_S + 999 } }, NOW_S);
+  assert.equal(five.known, false);
+  assert.equal(five.detail, 'not reported');
+  assert.equal(seven.known, true);
+  for (const g of [null, undefined, {}, 'nope']) {
+    assert.deepEqual(windowsFromGauge(g, NOW_S).map((w) => w.known), [false, false], JSON.stringify(g));
+  }
+});
+
+// ── the runner footer ──────────────────────────────────────────────────────────
+
+test('a night that ended probing says so — "nothing shipped" has two causes', () => {
+  const text = renderDigest(buildDigest([
+    { at: at(0), event: 'cadence', mode: 'full', class: 'quiet' },
+    { at: at(1), event: 'cadence', mode: 'probing', class: 'transient' },
+  ], { nowEpochS: NOW_S }));
+  assert.match(text, /Ended the night PROBING/);
+});
+
+test('an event this digest does not know about is counted, never dropped', () => {
+  // A digest that silently ignores what it does not understand is how a new
+  // failure mode stays invisible for a week.
+  const d = buildDigest([{ at: at(0), event: 'something_new_entirely' }], { nowEpochS: NOW_S });
+  assert.equal(d.runner.unrecognised, 1);
+  assert.equal(d.runner.byEvent.something_new_entirely, 1);
+  assert.match(renderDigest(d), /a kind this digest does not know about/);
+});
+
+test('malformed rows never take the night down', () => {
+  const d = buildDigest([null, undefined, 42, 'nope', {}, { event: 'worked', verified: true }], { nowEpochS: NOW_S });
+  assert.equal(d.shipped.length, 1);
+  assert.doesNotThrow(() => renderDigest(d));
+});
+
+// ── the CLI half ───────────────────────────────────────────────────────────────
+
+test('--since accepts a span and defaults to local midnight', () => {
+  const now = new Date('2026-09-19T14:30:00');
+  assert.equal(cli.sinceMs('24h', now), now.getTime() - 86400e3);
+  assert.equal(cli.sinceMs('90m', now), now.getTime() - 5400e3);
+  assert.equal(cli.sinceMs('3d', now), now.getTime() - 3 * 86400e3);
+  // Local midnight, because "last night" is a local idea — a UTC cut would split
+  // an owner's evening in half depending on where they live.
+  const midnight = new Date(now); midnight.setHours(0, 0, 0, 0);
+  assert.equal(cli.sinceMs(null, now), midnight.getTime());
+  assert.equal(cli.sinceMs('soon', now), null, 'an unparseable span must refuse, not guess');
+});
+
+test('a torn last line costs one row, not the night', async () => {
+  // A JSONL written by a process that can be killed mid-write has a torn last
+  // line more often than never.
+  const fs = require('node:fs'); const os = require('node:os'); const path = require('node:path');
+  const f = path.join(fs.mkdtempSync(path.join(os.tmpdir(), 'ab-digest-')), 'runs.jsonl');
+  fs.writeFileSync(f, `${JSON.stringify({ at: at(0), event: 'worked', task_id: 1, verified: true })}\n{"at":"x","event":"wor`);
+  const { rows, skipped, missing } = cli.readRows(f);
+  assert.equal(missing, false);
+  assert.equal(rows.length, 1);
+  assert.equal(skipped, 1);
+});
+
+test('a missing log is reported, not mistaken for a quiet night', async () => {
+  const { rows, missing } = cli.readRows('/definitely/not/here/runs.jsonl');
+  assert.deepEqual(rows, []);
+  assert.equal(missing, true);
+});
+
+test('humanDuration reads like a person wrote it', () => {
+  assert.equal(humanDuration(45), '45s');
+  assert.equal(humanDuration(2820), '47m');
+  assert.equal(humanDuration(10080), '2.8h');
+  assert.equal(humanDuration(null), null);
+});
+
+// ── the grader's three findings (task 1003906) ─────────────────────────────────
+
+test('the "did not ship" reason is the LEDGER’s, not the worker’s', () => {
+  // THE INVERSION THIS GOAL EXISTS TO UNDO. `row.reason` is verdict.reason — the
+  // WORKER's account of itself — and quoting it here means the digest reports the
+  // thing being checked rather than the check. A worker that stopped dead needing
+  // a decision reports success; the ledger says what actually happened.
+  const d = buildDigest([{
+    at: at(0), event: 'worked', task_id: 9, title: 'T', verified: false, ledger_shape: 'unlanded',
+    reason: 'I finished the work and shipped it',
+    ledger_reason: 'the grade passed and the land never finished',
+    ledger_remedy: '/merge-mode is the documented manual fallback',
+  }], { nowEpochS: NOW_S });
+
+  assert.equal(d.onHold.ranButDidNotShip[0].reason, 'the grade passed and the land never finished');
+  assert.equal(d.onHold.ranButDidNotShip[0].workerSaid, 'I finished the work and shipped it');
+
+  const text = renderDigest(d);
+  assert.match(text, /the grade passed and the land never finished/);
+  assert.match(text, /next: \/merge-mode/);
+  // The disagreement is the single most useful line on the page.
+  assert.match(text, /the worker said: I finished the work and shipped it/);
+});
+
+test('the worker’s account is printed only when it disagrees', () => {
+  // A worker that agreed with the ledger tells the reader nothing twice.
+  const same = 'the grade parked this';
+  const text = renderDigest(buildDigest([{
+    at: at(0), event: 'worked', task_id: 9, verified: false, ledger_shape: 'ungraded', reason: same, ledger_reason: same,
+  }], { nowEpochS: NOW_S }));
+  assert.equal((text.match(/the grade parked this/g) || []).length, 1);
+  assert.doesNotMatch(text, /the worker said:/);
+});
+
+test('a row from before ledger_reason existed still shows something', () => {
+  const d = buildDigest([{ at: at(0), event: 'worked', task_id: 9, verified: false, ledger_shape: 'unlanded', reason: 'older row' }], { nowEpochS: NOW_S });
+  assert.equal(d.onHold.ranButDidNotShip[0].reason, 'older row');
+});
+
+test('the digest calls a gauge stale on the SAME rule the runner holds on', () => {
+  // A digest that applied a laxer test would print live headroom about a window
+  // the runner had already decided it could not vouch for — two surfaces
+  // disagreeing about one file, with the reader believing the wrong one.
+  const gaugeMod = require('../modules/autonomy/gauge.js');
+  const tooOld = gaugeMod.DEFAULT_STALE_AFTER_S + 60;
+
+  const [fresh] = windowsFromGauge(
+    { five_hour: { used_percentage: 41, resets_at: NOW_S + 7200, observed_at: NOW_S - 60 } }, NOW_S);
+  assert.equal(fresh.known, true, 'a recent reading is usable');
+
+  const [stale] = windowsFromGauge(
+    { five_hour: { used_percentage: 41, resets_at: NOW_S + 7200, observed_at: NOW_S - tooOld } }, NOW_S);
+  assert.equal(stale.known, false);
+  assert.equal(stale.stale, true);
+  assert.match(stale.detail, /older than the runner trusts/);
+  assert.doesNotMatch(stale.detail, /resets in/, 'never offer headroom from a reading the runner rejected');
+});
+
+test('a window with no observed_at falls back to the file’s written_at', () => {
+  // One window can go unreported while the other is carried forward — the exact
+  // shape gauge.js reads.
+  const gaugeMod = require('../modules/autonomy/gauge.js');
+  const old = NOW_S - gaugeMod.DEFAULT_STALE_AFTER_S - 60;
+  const [w] = windowsFromGauge({ written_at: old, five_hour: { used_percentage: 41, resets_at: NOW_S + 7200 } }, NOW_S);
+  assert.equal(w.stale, true);
+});
+
+test('the period bounds survive a log too long to spread as arguments', () => {
+  // `Math.min(...times)` throws past the engine's argument cap, and a reporting
+  // CLI that dies on a big log fails exactly when the log is worth reading.
+  const many = Array.from({ length: 200000 }, (_, i) => ({ at: at(i % 1000), event: 'cadence', mode: 'full' }));
+  let d;
+  assert.doesNotThrow(() => { d = buildDigest(many, { nowEpochS: NOW_S }); });
+  assert.equal(d.period.rows, 200000);
+  assert.equal(d.period.fromMs, T0);
+});

package/tests/core_upgrade_runner.mjs

@@ -28,6 +28,8 @@
 
 import { strict as assert } from 'node:assert';
 import { createRequire } from 'node:module';
+import fs from 'node:fs';
+import path from 'node:path';
 
 const require = createRequire(import.meta.url);
 const R = require('../scripts/gds/provision-core-upgrade.js');
@@ -46,13 +48,19 @@ const t = async (name, fn) => {
 // instant. `apply:true` because the interesting behaviour is the applied path.
 function makeDeps({ shape = 'control-plane', served = '1.19.760', available = ['1.19.758', '1.19.760', '1.19.762'], installed = '1.19.760', queries = [] } = {}) {
   const ran = [];
-  const exec = (cmd) => {
+  // task 1004053: the CWD is half of what makes a relative CLI path resolve, and the
+  // bug that shipped was invisible to every assertion that read only the command
+  // string. Captured alongside, so a test can check the pair.
+  const ranWith = [];
+  const exec = (cmd, opts) => {
     ran.push(cmd);
+    ranWith.push({ cmd, cwd: opts && opts.cwd });
     if (/\/version/.test(cmd)) return { ok: true, stdout: served == null ? '' : JSON.stringify({ coreVersion: served }) };
     return { ok: true, stdout: '' };
   };
   return {
     ran,
+    ranWith,
     queries,
     db: { query: async (sql, params) => { queries.push({ sql, params }); return { rows: [] }; } },
     provisioning: { recordEvent: async () => {}, clearErrorNote: async () => {} },
@@ -245,6 +253,40 @@ await t('drives upgrade.js with the registry, the health gate, the version read-
   assert.ok(cmd.includes('--commit-pin'));
 });
 
+await t('the upgrade CLI is run somewhere it ACTUALLY EXISTS — the bug that broke every standalone tenant (task 1004053)', async () => {
+  // The whole failure was a path that resolved nowhere:
+  //   Error: Cannot find module '/srv/<base>/<slug>/scripts/gds/upgrade.js'
+  // No assertion about FLAGS could have caught it, so this one resolves the composed
+  // cwd + relative CLI against the real filesystem, for every shape the door admits.
+  for (const shape of ['control-plane', 'standalone', 'co-tenant']) {
+    const d = makeDeps({ served: '1.19.762' });
+    await R.coreUpgradeInstance(inst({ hosting_shape: shape, slug: 'hermeslines-marketing', port: 3011 }), d, intent());
+    const call = d.ranWith.find((c) => /upgrade\.js/.test(c.cmd));
+    assert.ok(call, `${shape}: it ran the upgrade CLI`);
+    const rel = (call.cmd.match(/node (\S*scripts\/gds\/upgrade\.js)/) || [])[1];
+    assert.ok(rel, `${shape}: the command names the CLI`);
+    assert.ok(fs.existsSync(path.join(call.cwd, rel)),
+      `${shape}: ${path.join(call.cwd, rel)} must exist — this is the assertion the original bug would have failed`);
+  }
+});
+
+await t('a standalone tenant is NAMED with --instance, because the CLI no longer runs inside it', async () => {
+  const d = makeDeps({ served: '1.19.762' });
+  await R.coreUpgradeInstance(inst({ hosting_shape: 'standalone', slug: 'hermeslines-marketing', port: 3011 }), d, intent());
+  const cmd = d.ran.find((c) => /upgrade\.js/.test(c));
+  assert.match(cmd, /--instance \S*hermeslines-marketing/, 'the target is named explicitly');
+  assert.ok(cmd.includes('--service hermeslines-marketing'), 'and its own unit is still the one restarted');
+});
+
+await t('the control-plane row carries NO --instance — its target IS the checkout the CLI runs in', async () => {
+  // Naming it would be harmless but wrong, and the shapes that already worked must not
+  // change behaviour on the way to fixing the one that never did.
+  const d = makeDeps({ served: '1.19.762' });
+  await R.coreUpgradeInstance(inst(), d, intent());
+  const cmd = d.ran.find((c) => /upgrade\.js/.test(c));
+  assert.ok(!cmd.includes('--instance'), 'unchanged for the platform itself');
+});
+
 await t('the health URL and the version URL are LOOPBACK — the apex is behind basic_auth and a CDN (ADR 0293 D6)', async () => {
   const d = makeDeps();
   await R.coreUpgradeInstance(inst(), d, intent());

package/tests/government_page_gates.mjs

@@ -64,7 +64,7 @@ const LIVE_RANKS = ['xenos', 'thetes', 'metic', 'archon'];
 // unaffected — it held right up to the deletion.
 //
 // ADR 0157 (owner decision, 2026-08-05) lowered `page.view.government` archon→metic, so
-// the monitoring pages (/watch, /harbor, /gate) now open to the working rank. That gate
+// the monitoring pages (/watch, /gate) now open to the working rank. That gate
 // was spelled `requireArchonPage` through R107 and ADR 0157 — the name the rows below
 // were first written against — and was renamed once the floor moved; the audience here,
 // not the name, is the contract.

package/tests/hall_landing_boot.mjs

@@ -91,7 +91,7 @@ async function boot({ meStatus }) {
       wirePager: () => {},
     },
     OTBHallRender: () => ({
-      SETUP_CONFIG_KEY: 'k', analyticsState: {}, lbState: {}, onboardingBox: () => makeEl(),
+      SETUP_CONFIG_KEY: 'k', analyticsState: {}, lbState: {},
       shipState: {}, shipsPager: { page: 1 }, welcomeDismissalKey: () => 'k',
       mountHallWidgets: spy('mountHallWidgets'),
       renderLanding: spy('renderLanding'),

package/tests/hall_nav.mjs

@@ -287,7 +287,7 @@ test('sidebar groups read by audience, in order', () => {
   // 'deploy' (task 1003159, ADR 0293) is the SECOND archon item, beside 'government':
   // its gate is the `core.pin.move` atom, archon-floor and system:true. It sits with
   // the steering surfaces because that is what it is — the owner's third release gate.
-  assert.deepEqual(nav[4].items.map((i) => i.id), ['watch', 'harbor', 'gate', 'sessions', 'project-settings', 'deploy', 'government']);
+  assert.deepEqual(nav[4].items.map((i) => i.id), ['watch', 'gate', 'sessions', 'project-settings', 'deploy', 'government']);
 });
 
 test('Economy lives in Docs and points at the reward-schedule page', () => {

package/tests/hall_oversight_world.mjs

@@ -1,5 +1,5 @@
 // tests/hall_oversight_world.mjs — the oversight family in the chrome world
-// (task 1003469, goal 1000081): government, watch, harbor and gate share one
+// (task 1003469, goal 1000081): government, watch and gate share one
 // archetype sheet (oversight.css) the way the records share record.css and the
 // reading rooms room.css. These are static pins over the shipped source: the
 // family sheet is linked and spends only the fifteen, every page renders the
@@ -17,7 +17,7 @@ import { fileURLToPath } from 'node:url';
 const ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
 const PUB = path.join(ROOT, 'modules', 'hall-ui', 'public');
 const read = (f) => fs.readFileSync(path.join(PUB, f), 'utf8').replace(/\r\n/g, '\n');
-const PAGES = ['government', 'watch', 'harbor', 'gate'];
+const PAGES = ['government', 'watch', 'gate'];
 
 test('every oversight page links the family sheet, before its own', () => {
   for (const p of PAGES) {
@@ -76,8 +76,8 @@ test('Government renders the rank description the create form collects', () => {
   assert.match(read('government.html'), /id="gov-create-desc"/, 'the form still collects it');
 });
 
-test('Harbor and Gate carry no coloured band: state is a pill', () => {
-  for (const p of ['harbor', 'gate']) {
+test('Gate carries no coloured band: state is a pill', () => {
+  for (const p of ['gate']) {
     assert.ok(!/__roof|__seal/.test(read(`${p}.js`)), `${p}.js emits no roof or seal band`);
     assert.ok(!/__roof|__seal/.test(read(`${p}.css`)), `${p}.css has no band rule`);
     assert.match(read(`${p}.js`), /fact-pill fact-pill--/, `${p}.js paints state as a .fact-pill`);
@@ -91,7 +91,7 @@ test('the shared confirm modal sits on --z-modal, closed by one hairline and no
   const modal = css.slice(css.indexOf('.ov-modal {'), css.indexOf('.ov-modal .scroll__h'));
   assert.ok(!/box-shadow/.test(modal), 'no shadow under the dialog');
   assert.match(modal, /border: var\(--line\) solid var\(--rule\)/, 'one rule hairline');
-  for (const p of ['harbor', 'gate']) {
+  for (const p of ['gate']) {
     assert.match(read(`${p}.js`), /className = 'ov-modal-bg'/, `${p}.js opens the family modal`);
     assert.ok(!/-modal-bg/.test(read(`${p}.css`)), `${p}.css no longer styles a modal of its own`);
   }

package/tests/hall_page_gate_map.mjs

@@ -44,7 +44,6 @@ const SRC = fs.readFileSync(path.join(ROOT, 'src/bongos/serve-internal.js'), 'ut
 const ORACLE = {
   // Any signed-in builder — no rank floor.
   '/builders/work': 'requireBuilderPage',
-  '/builders/pair': 'requireBuilderPage',
   '/builders/settings': 'requireBuilderPage',
   '/builders/atlas': 'requireBuilderPage',
   '/builders/modules': 'requireBuilderPage',
@@ -74,7 +73,6 @@ const ORACLE = {
 
   // Metic+ operator surfaces (the Governance nav group).
   '/builders/watch': 'requireGovernmentPage',
-  '/builders/harbor': 'requireGovernmentPage',
   '/builders/gate': 'requireGovernmentPage',
   '/builders/sessions': 'requireGovernmentPage',
   // The five fundamentals of the project (task 1003280, goal 1000072). Same tier as
@@ -155,6 +153,14 @@ const ORACLE = {
   // catch. GONE_PAGES below keeps the row honest if the file ever returns.
   '/builders/my-projects': null,
 
+  // Gone with the dev box (task 1003890, goal 1000091). Harbor was the Archon
+  // view of the box fleet and pair the device-pairing page; the fleet was turned
+  // off at the control plane by task 1003886, so both pages drove an API that no
+  // longer answers. Their gates left serve-internal.js with them — a gate in
+  // front of nothing is the dead-guard shape the check below exists to catch.
+  '/builders/harbor': null,
+  '/builders/pair': null,
+
   // Gone too, and for a reason worth keeping in front of the next reader: this
   // was a bespoke refusal PAGE ("not yet — ship three tasks to graduate"), the
   // deniedTo of the thetes+ gate. Task 1002613 replaced that whole idea with a
@@ -278,6 +284,9 @@ const GONE_PAGES = {
   '/builders/my-projects': 'task 1003308 — the hub owns "my projects"',
   // Task 1003450 — the shell's ?denied= banner replaced the bespoke refusal page.
   '/builders/not-ready': 'task 1003450 — the shell renders the refusal from ?denied=',
+  // Task 1003890 — the dev-box deprecation removed the fleet these two drove.
+  '/builders/harbor': 'task 1003890 — the dev box is gone, so its Archon view is too',
+  '/builders/pair': 'task 1003890 — the dev box is gone, so its pairing page is too',
 };
 
 test('a row that is null because the page left the hall serves no page', () => {

package/tests/hall_settings_world.mjs

@@ -1,5 +1,6 @@
 // tests/hall_settings_world.mjs — the PANEL family in the chrome world
-// (task 1003308, goal 1000081): settings, profile, pair.
+// (task 1003308, goal 1000081): settings and profile. Pair left with the dev
+// box (task 1003890).
 //
 // tests/hall_tokens.mjs pins the TIER these pages spend; this pins how they
 // spend it. Everything here is a fact that is silent in a browser: the page
@@ -9,9 +10,9 @@
 //
 // What it locks:
 //   * ONE ARCHETYPE SHEET. panel.css holds the row, the switch, the field, the
-//     chip control and the family's voices; the four page sheets hold only what
-//     one page has. Every page links panel.css BEFORE its own sheet.
-//   * THE ONE h1. None of the five had one — the hall predates the floor — so
+//     chip control and the family's voices; the page sheets hold only what one
+//     page has. Every page links panel.css BEFORE its own sheet.
+//   * THE ONE h1. None of them had one — the hall predates the floor — so
 //     every render failed one-header-main-h1. The h1 is the page's name in the
 //     room voice, and it lives in the static markup so the DOM has it in every
 //     state, not only the happy path.
@@ -26,14 +27,14 @@
 //   * WHITE ON THE ACCENT, AND THE ONE EXCEPTION. Eight literals across three
 //     sheets are gone; the Discord blurple pair stays, because it is Discord's
 //     mark and not the world's, and it is named as the exception in a comment.
-//   * THE COMPAT ALIASES. Five sheets, zero aliases spent.
+//   * THE COMPAT ALIASES. Every sheet in the family, zero aliases spent.
 //
 // Reproduce the renders these came from (the family needs the fixture harness —
 // every panel is filled from /me/* reads the kit stub does not carry):
 //   node scripts/hall-preview/server.js --port 4621 --fixture-me
 //   node modules/ui-design/kit/render.js --states modules/hall-ui/public/settings.states.json \
 //     --base-in http://builders.localhost:4621 --base-out http://builders.localhost:4621
-//   (and profile / pair .states.json the same way)
+//   (and profile .states.json the same way)
 
 import { test } from 'node:test';
 import assert from 'node:assert/strict';
@@ -48,9 +49,10 @@ const stripComments = (css) => css.replace(/\/\*[\s\S]*?\*\//g, '');
 
 // not-ready was the fourth until task 1003450 deleted the page — see
 // tests/hall_page_gate_map.mjs (GONE_PAGES) for why, and for the row that stops
-// it coming back ungated. The archetype is unaffected: three pages still spend it.
-const PAGES = ['settings', 'profile', 'pair'];
-const SHEETS = ['panel.css', 'settings.css', 'pair.css', 'profile.css'];
+// it coming back ungated; pair left the same way in task 1003890. The archetype
+// is unaffected: the pages that remain still spend it.
+const PAGES = ['settings', 'profile'];
+const SHEETS = ['panel.css', 'settings.css', 'profile.css'];
 
 const panelCss = read('panel.css');
 const settingsCss = read('settings.css');
@@ -94,7 +96,7 @@ test('the archetype holds the row, the switch, the field and the voices; the pag
   for (const sel of ['.prow', '.sw', '.sw__track', '.sw__knob', '.field-label', '.pinput', '.chip-ctl', '.panel-note', '.panel-status', '.gate']) {
     assert.ok(ruleOf(panelCss, sel), `panel.css defines ${sel}`);
   }
-  for (const sheet of ['settings.css', 'pair.css', 'profile.css']) {
+  for (const sheet of ['settings.css', 'profile.css']) {
     const css = read(sheet);
     for (const sel of ['.prow', '.sw', '.sw__track', '.pinput', '.chip-ctl']) {
       assert.equal(ruleOf(css, sel), null, `${sheet} must not redefine ${sel} — that is how the family would drift`);
@@ -104,7 +106,7 @@ test('the archetype holds the row, the switch, the field and the voices; the pag
 
 // ---- 2. the one h1, in the static markup ----------------------------------
 
-test('each of the five pages has exactly one h1, in the family\'s page head', () => {
+test('each page in the family has exactly one h1, in the family\'s page head', () => {
   for (const p of PAGES) {
     const html = read(`${p}.html`).replace(/<!--[\s\S]*?-->/g, '');
     const h1s = html.match(/<h1\b/g) || [];
@@ -301,7 +303,7 @@ test('no sheet in the family spends a compat alias', () => {
 });
 
 test('white on the accent is gone, and the Discord mark is the one named exception', () => {
-  for (const sheet of ['panel.css', 'pair.css', 'profile.css']) {
+  for (const sheet of ['panel.css', 'profile.css']) {
     const bare = stripComments(read(sheet));
     assert.doesNotMatch(bare, /#[0-9a-f]{3,8}\b/i, `${sheet} carries no colour literal`);
     assert.doesNotMatch(bare, /:\s*white\b/i, `${sheet} carries no named white`);
@@ -318,16 +320,17 @@ test('white on the accent is gone, and the Discord mark is the one named excepti
     assert.match(selector, /\.settings-btn--discord/, `${lit} is spent only on the Discord button`);
   }
   assert.match(settingsCss, /THIRD-PARTY MARK, KEPT ON PURPOSE/, 'the exception is named in a comment so a literal sweep leaves it alone');
-  // the save/accent buttons take --accent-on. `.pair-approve` and `.craft-save`
-  // are members of the base pill rule AND the save rule, so the save rule is
-  // found by its own name and the two are asserted as its members.
+  // the save/accent buttons take --accent-on. `.craft-save` is a member of the
+  // base pill rule AND the save rule, so the save rule is found by its own name
+  // and the member is asserted against it. (`.pair-approve` was its sibling here
+  // until task 1003890 removed the pair page.)
   const save = ruleOf(panelCss, '.pbtn--save');
   assert.ok(save, '.pbtn--save has a rule');
   assert.match(save, /background:\s*var\(--accent\)/);
   assert.match(save, /color:\s*var\(--accent-on\)/, 'the dark ink for the salmon — white on it fails AA');
   const saveSelector = stripComments(panelCss).match(/([^{}]*\.pbtn--save[^{}]*)\{/);
   assert.ok(saveSelector, 'the save rule\'s selector list is readable');
-  for (const member of ['.craft-save', '.pair-approve']) {
+  for (const member of ['.craft-save']) {
     assert.ok(saveSelector[1].split(',').map((s) => s.trim()).includes(member), `${member} is the accent door on its page`);
   }
 });
@@ -394,14 +397,14 @@ test('the profile identity band is a MODIFIER on the shell\'s .profile, never a
 
 // ---- 6. the floors are reproducible ------------------------------------------
 
-test('all five pages have a states file, so the floors are reproducible', () => {
+test('every page in the family has a states file, so the floors are reproducible', () => {
   for (const p of PAGES) {
     const json = JSON.parse(read(`${p}.states.json`));
     assert.equal(json.surface, 'hall-ui', `${p}.states.json names its surface`);
     assert.ok(Object.keys(json.states).length >= 2, `${p}.states.json renders more than the default state`);
   }
   assert.ok(Object.keys(JSON.parse(read('settings.states.json')).states).length >= 4, 'settings renders every rail group');
-  for (const fx of ['me__sessions', 'auth__app-pair__info']) {
+  for (const fx of ['me__sessions']) {
     assert.ok(fs.existsSync(path.join(ROOT, 'scripts', 'hall-preview', 'fixtures', `${fx}.json`)),
       `the harness serves ${fx} — without it the page only ever rendered its empty state`);
   }