@bongos/core 1.19.883 → 1.19.885

package/.bongos-core.json

@@ -2,22 +2,22 @@
   "artifact": "bongos-core",
   "manifest_schema": 1,
   "generator": "scripts/gds/package-core.js",
-  "core_version": "1.19.883",
-  "core_contract": "1.19.883",
-  "source_commit": "38ac16c0f1716d2a3d3b040a38b4d61bcafb4598",
+  "core_version": "1.19.885",
+  "core_contract": "1.19.885",
+  "source_commit": "3fc3d4952a5f3df767b788d749535c4b5d9574d2",
   "source_ref": "HEAD",
-  "built_at": "2026-09-19T19:12:16.216Z",
+  "built_at": "2026-09-19T19:35:51.138Z",
   "redaction": {
     "model": "docs-redacted+functional-verbatim",
-    "docs_redacted": 498,
+    "docs_redacted": 497,
     "agent_docs_stubbed": 26,
-    "functional_verbatim": 2315,
+    "functional_verbatim": 2264,
     "rules": 3,
     "gate_literals": 3,
     "gate": "passed"
   },
-  "file_count": 2839,
-  "tree_sha256": "d96e15159f4ccd498d4c218b70f298a70541b1d97dae0f21124c8fde891881f0",
+  "file_count": 2787,
+  "tree_sha256": "1f06d46b4f715ae25938179a4a59b60eb2064c18c3b651c5248ddf87a414e634",
   "files": [
     {
       "path": ".claude/skills/ask-for-help/SKILL.md",
@@ -367,7 +367,7 @@
     {
       "path": "clients/bongos-client/index.d.ts",
       "mode": "0000644",
-      "sha256": "a433058b1d11a710689cb4eebe94d4182f5d644bc2df341359ee4ec6348718b4"
+      "sha256": "890072b8a2de95a5f1913f4a5fdefc7462f1977b8cb7a18869cb50706c5a645e"
     },
     {
       "path": "clients/bongos-client/index.mjs",
@@ -2052,12 +2052,12 @@
     {
       "path": "docs/api/openapi.json",
       "mode": "0000644",
-      "sha256": "4a74552e803444eb13792a0c61fc41da324bda5c35c50b070d8980025d4d4935"
+      "sha256": "19cb42bb52d123f89bf24d9e4b8667955f0fc682b2481790f0c48d8d1ed09e79"
     },
     {
       "path": "docs/architecture.md",
       "mode": "0000644",
-      "sha256": "f269ba3a95f2109cfc578f7b81f5210773ec0a0b910d8a482c13533bea63361e"
+      "sha256": "845aca9c32af0d4982eba5aefae1126cb77807eb8f5452f338a79895a9a56eb8"
     },
     {
       "path": "docs/branding-contract.md",
@@ -2597,7 +2597,7 @@
     {
       "path": "docs/file-map.md",
       "mode": "0000644",
-      "sha256": "0b1b89161e2c4731dd634a0efd074dd78e85301b1e161366a94b19dd69019905"
+      "sha256": "6949109a5db028219bf76b4483ac3b160f5996586a4c4a0d903fd42c28e1ff79"
     },
     {
       "path": "docs/handoff-template.md",
@@ -2607,7 +2607,7 @@
     {
       "path": "docs/module-api-changelog.md",
       "mode": "0000644",
-      "sha256": "a8791c0dfacd9fb522681fa5af7ddfcc63937dd597f0c30a2fa1b42498f4ee01"
+      "sha256": "817802ecd05e04ab03536c918130316c3597dd85c5dce0f06b8e3abb05fde449"
     },
     {
       "path": "docs/modules-contract.md",
@@ -3969,231 +3969,6 @@
       "mode": "0000644",
       "sha256": "7cb9dac9cb87b679e1ae50e4112b3a7928a38ebb9902c8947a74d17bec4d9009"
     },
-    {
-      "path": "modules/dev-box/app/README.md",
-      "mode": "0000644",
-      "sha256": "2c82fe59e0f32aa5eaee94aac7ca896fbf822a85c7cd280748caa44eacdf8bd5"
-    },
-    {
-      "path": "modules/dev-box/app/assets/tray/mac-alertTemplate.png",
-      "mode": "0000644",
-      "sha256": "ad6c145e1a2d7f780c8325eb872e38f7d06e59b9c12d131b5aaa4b506795cbe0"
-    },
-    {
-      "path": "modules/dev-box/app/assets/tray/mac-alertTemplate@2x.png",
-      "mode": "0000644",
-      "sha256": "55f5416dc95caa93d8632265516658893a52b8153fea4df074a455a861529722"
-    },
-    {
-      "path": "modules/dev-box/app/assets/tray/mac-busyTemplate.png",
-      "mode": "0000644",
-      "sha256": "10acfb4c504e66f75d6cae5cd06ed0a719eda08ead4179d0e32d63b9b41e965b"
-    },
-    {
-      "path": "modules/dev-box/app/assets/tray/mac-busyTemplate@2x.png",
-      "mode": "0000644",
-      "sha256": "a2121124cd3f3a14e9668e2adee6b5984bae842c09ea4ebae8a385727adda242"
-    },
-    {
-      "path": "modules/dev-box/app/assets/tray/mac-offTemplate.png",
-      "mode": "0000644",
-      "sha256": "8bfdb408357523419dcfee47e6fee8af912289137e21544934231486d34e7c3b"
-    },
-    {
-      "path": "modules/dev-box/app/assets/tray/mac-offTemplate@2x.png",
-      "mode": "0000644",
-      "sha256": "4256e5a0a05da87ccc113e8c54036372fa3ed30ae5dbad3eeafbaf4260e10696"
-    },
-    {
-      "path": "modules/dev-box/app/assets/tray/mac-onTemplate.png",
-      "mode": "0000644",
-      "sha256": "bd440761b3d43cace0a1941fe1921b988d92e731c82b0d93f03d21ae8cce4ba7"
-    },
-    {
-      "path": "modules/dev-box/app/assets/tray/mac-onTemplate@2x.png",
-      "mode": "0000644",
-      "sha256": "c38ef2ec4200eebea8887a618ad02223ca2a9dfb377dd1df0f958f664193b0fd"
-    },
-    {
-      "path": "modules/dev-box/app/assets/tray/win-alert.png",
-      "mode": "0000644",
-      "sha256": "147cc492e6b476a53c47812abe630307d7bc09da5b7e270e93f47bf05a5ed320"
-    },
-    {
-      "path": "modules/dev-box/app/assets/tray/win-busy.png",
-      "mode": "0000644",
-      "sha256": "9acd0b763574404341fd46f27d325f04380067d815b7d88b34ea2f6ad2fdcfc7"
-    },
-    {
-      "path": "modules/dev-box/app/assets/tray/win-off.png",
-      "mode": "0000644",
-      "sha256": "b7837bf4d07f4ae6881015b86cedc3e723b4daefbe11d48f69376a627c58741a"
-    },
-    {
-      "path": "modules/dev-box/app/assets/tray/win-on.png",
-      "mode": "0000644",
-      "sha256": "2ab550b6e0e769260665c993cd46f26b099083fb8dc3ff7710c52bff5e370378"
-    },
-    {
-      "path": "modules/dev-box/app/build-resources/dmg-background.png",
-      "mode": "0000644",
-      "sha256": "4a25a6cb527c55958f05df50302622c8699e3e8a3f399fb2ca745d22922ce28a"
-    },
-    {
-      "path": "modules/dev-box/app/build-resources/dmg-background@2x.png",
-      "mode": "0000644",
-      "sha256": "cc5f356dce2d42addf8686755613ea9bd4881364773a3a9f7a97a39c9becaba0"
-    },
-    {
-      "path": "modules/dev-box/app/build-resources/icon.png",
-      "mode": "0000644",
-      "sha256": "c0b651d0560e9d4b2d8373bcf8b9379c8a5fbb9d859bfa52c1e533ad46e336fd"
-    },
-    {
-      "path": "modules/dev-box/app/electron-builder.tmpl.yml",
-      "mode": "0000644",
-      "sha256": "72be146f3fae1904681f328f9e96e9c5da9048ff9ac7c31fe1492a16feacf59e"
-    },
-    {
-      "path": "modules/dev-box/app/electron-builder.yml",
-      "mode": "0000644",
-      "sha256": "747a13604e8560e85624d2543dc9dba0fc23cf7ad69604b9802bafdfb5d33449"
-    },
-    {
-      "path": "modules/dev-box/app/package-lock.json",
-      "mode": "0000644",
-      "sha256": "4739bd1e3f4ebe72742f30e8f97ff8415cba736c96404c6d30e04103db88795d"
-    },
-    {
-      "path": "modules/dev-box/app/package.json",
-      "mode": "0000644",
-      "sha256": "097ce00228218038afa2be0f48527016c6136da4a5a591927d3105ffb38308ce"
-    },
-    {
-      "path": "modules/dev-box/app/renderer/app.js",
-      "mode": "0000644",
-      "sha256": "8c6b71a390e7277620a274d22ae4d4dda8120c939bcbf82db69afb462fd21991"
-    },
-    {
-      "path": "modules/dev-box/app/renderer/index.html",
-      "mode": "0000644",
-      "sha256": "f1a288c30c6c31c6d8aa9bb5baed639d9b996181bad7738b117994f41fcda233"
-    },
-    {
-      "path": "modules/dev-box/app/renderer/styles.css",
-      "mode": "0000644",
-      "sha256": "d4dab0456afff72a13d525d32839c059b20011cecb3294046ef6680c9343d912"
-    },
-    {
-      "path": "modules/dev-box/app/renderer/theme.generated.css",
-      "mode": "0000644",
-      "sha256": "fd5d556295d7109b39f401d363c4c80e274e465474f5e845eba444717606a4db"
-    },
-    {
-      "path": "modules/dev-box/app/scripts/apply-dmg-backdrop.sh",
-      "mode": "0000755",
-      "sha256": "1ea82ef8d18f2f4d581329c10b05a20efa25e649cfb3c69e2384cb4d5a0b204e"
-    },
-    {
-      "path": "modules/dev-box/app/scripts/dmgbuild-settings.py",
-      "mode": "0000644",
-      "sha256": "5eacccf6c2ccf07771a8b17ad57b01ff7c1efe49994b30fc14819d137644fabc"
-    },
-    {
-      "path": "modules/dev-box/app/scripts/gen-brand.js",
-      "mode": "0000644",
-      "sha256": "1ab399cb8c5702ba3bdfc11d3ddad46b8959640afc81abf84ddc1c2f49e1252a"
-    },
-    {
-      "path": "modules/dev-box/app/scripts/gen-dmg-backdrop.py",
-      "mode": "0000644",
-      "sha256": "bc1242276dcffe414719838d44c77cc09d326321b6cabe0ca1a69eb58442ba01"
-    },
-    {
-      "path": "modules/dev-box/app/scripts/gen-icons.js",
-      "mode": "0000644",
-      "sha256": "13c75937401613a3bf45df6612718949318dc5fcd96b01791adc738d7e0d10eb"
-    },
-    {
-      "path": "modules/dev-box/app/scripts/vendor-client.js",
-      "mode": "0000644",
-      "sha256": "c3c4e228659c25f1463e31260121eef4907e272a8cded96630d9dd28f558678d"
-    },
-    {
-      "path": "modules/dev-box/app/src/box-controller.js",
-      "mode": "0000644",
-      "sha256": "36766b3705d176b202eca9808bf639e0cdcd9d8f2a39b5f03ae75db6580458fc"
-    },
-    {
-      "path": "modules/dev-box/app/src/brand.generated.json",
-      "mode": "0000644",
-      "sha256": "17f6dca05932f642adf06f7a6682784888cc9ae4401fc1da0453626a07c01da7"
-    },
-    {
-      "path": "modules/dev-box/app/src/brand.js",
-      "mode": "0000644",
-      "sha256": "0f6a3778223b936b7fd19101db8f70abac7bd576f2b354720af8afca049441cf"
-    },
-    {
-      "path": "modules/dev-box/app/src/config.js",
-      "mode": "0000644",
-      "sha256": "689935bb1901be4f31877207e7885be21630b9eafa6afe5fa025b1ff1dce4f83"
-    },
-    {
-      "path": "modules/dev-box/app/src/gds-client.js",
-      "mode": "0000644",
-      "sha256": "56f9866f7dbf8241282ca2308eace0e36580d89a886a51c72cedc5af7576733a"
-    },
-    {
-      "path": "modules/dev-box/app/src/main.js",
-      "mode": "0000644",
-      "sha256": "3ea5344e31c9f11be7f489999c42eb6a7d6115785a8b3c16c9911e6a1efff4c6"
-    },
-    {
-      "path": "modules/dev-box/app/src/pairing.js",
-      "mode": "0000644",
-      "sha256": "606ddbea2202b79a41f7965c332257a2b454db424af848a86ac1fa7b5e4076ed"
-    },
-    {
-      "path": "modules/dev-box/app/src/preload.js",
-      "mode": "0000644",
-      "sha256": "7d62c353fbf1f30885c3634ecea0648f5939baf587bf2c3fe0e008af45a48c16"
-    },
-    {
-      "path": "modules/dev-box/app/src/session-store.js",
-      "mode": "0000644",
-      "sha256": "9fefb99a647184879d2960eda360b475f5ea14d6f7c78d46c4de67f2b9909baa"
-    },
-    {
-      "path": "modules/dev-box/app/src/ssh-setup.js",
-      "mode": "0000644",
-      "sha256": "b3701587b3cb198ef17d8bb34378a3a88c0ab86f4b5c89e8c4600ac3bd97fd41"
-    },
-    {
-      "path": "modules/dev-box/app/src/task-picker.js",
-      "mode": "0000644",
-      "sha256": "0625a89b676cdedffd361cb11c68cb8e74465a41877de539676ae8b31ba55acb"
-    },
-    {
-      "path": "modules/dev-box/app/src/tray.js",
-      "mode": "0000644",
-      "sha256": "8b42cfdbf693a07502d3dfcb9cc78303341ee82e5e1740141950b7715fd567ca"
-    },
-    {
-      "path": "modules/dev-box/app/src/updater.js",
-      "mode": "0000644",
-      "sha256": "b26f65434bfae2cbbdc66c69b5f773a0474d5a948aaa81ef8f68a67e5eb327b8"
-    },
-    {
-      "path": "modules/dev-box/app/src/vendor/bongos-client.cjs",
-      "mode": "0000644",
-      "sha256": "885e0606f436873e274f6ec51e93697f3854115874c982299ef8275621629f8e"
-    },
-    {
-      "path": "modules/dev-box/app/test/unit.mjs",
-      "mode": "0000644",
-      "sha256": "f90e7525a3a6032c817dfc25b130e730808e6e561695911f10fa6777f4b756b4"
-    },
     {
       "path": "modules/dev-box/box-access.js",
       "mode": "0000644",
@@ -5947,7 +5722,7 @@
     {
       "path": "modules/lifecycle/routes/tasks.js",
       "mode": "0000644",
-      "sha256": "d6b50dd007aefca08424f63b648cd07f139b98b696f470b83e7adb33bb7fc5c7"
+      "sha256": "45d897c864cea14dfc02c706c6c0b4838ad5869fad81e30843fcc5d9736340a2"
     },
     {
       "path": "modules/lifecycle/routes/version-route-authz.js",
@@ -7917,12 +7692,12 @@
     {
       "path": "package-lock.json",
       "mode": "0000644",
-      "sha256": "469884a3047b45a3ef2d4913c2316c2a8e2c7232bba7ff0c3d7ee3002b964be0"
+      "sha256": "b6272da5f8ef22a0c6470d574d3c692e42cda17ad914468b01787618a4145b47"
     },
     {
       "path": "package.json",
       "mode": "0000644",
-      "sha256": "1651df890fb2d85a35efe8281ba5c81a0c683b16db37158b2ed985d11544c683"
+      "sha256": "f1739df1c386bb39ccd39cfb98af671095b64011354060e46289042bd29a4dd1"
     },
     {
       "path": "public-docs/index.html",
@@ -9292,7 +9067,7 @@
     {
       "path": "scripts/gds/ship-land.js",
       "mode": "0000644",
-      "sha256": "805017578a7d69ca2c79d105e21add7862b41e352256e5fbdfad3e3740e69ced"
+      "sha256": "53f43c609206ea62e71f562aaceed316b6aea217612f74dcd800e30f06b17ea5"
     },
     {
       "path": "scripts/gds/ship-memory-sync.js",
@@ -9307,7 +9082,7 @@
     {
       "path": "scripts/gds/ship-merge.js",
       "mode": "0000644",
-      "sha256": "b85dd18d8214f1e732d4bd584fbad037c5505a16703e867e18e42bafef0bed33"
+      "sha256": "dae19af925b80dfb2755fbf5f854ae29d04050f3b2217d99c3619e6debf067ee"
     },
     {
       "path": "scripts/gds/ship-preflight-steps.js",
@@ -9347,7 +9122,7 @@
     {
       "path": "scripts/gds/ship.js",
       "mode": "0000644",
-      "sha256": "9c279a8852e46758e498334fbeb25e94be2895930a6c65b400c2c1baaac1c270"
+      "sha256": "d17284c5e00afe793c967c3ef0a1ef34b53fa6495ae137fb2724d8f7ebeb6afc"
     },
     {
       "path": "scripts/gds/skill-lint.js",
@@ -9902,7 +9677,7 @@
     {
       "path": "src/bongos/serve-internal.js",
       "mode": "0000644",
-      "sha256": "38af1238d14afa749003c9a981e73854564aef07bcbc8a98e53999a03ad85742"
+      "sha256": "c1307be92441764ce74f41b58c3d5b0dd2a76579f0955d1dfa68c08c9a22c160"
     },
     {
       "path": "src/bongos/uptime-poller.js",
@@ -9919,11 +9694,6 @@
       "mode": "0000644",
       "sha256": "271f2bab1e1bdef9067ebdc954125a3201d4853e925580a2d4c83dd13bad188a"
     },
-    {
-      "path": "src/devbox-downloads.js",
-      "mode": "0000644",
-      "sha256": "89a7e3d909deb9dd3babb35cc0c63d6839304083af9579a8b3104000e6bf8a7a"
-    },
     {
       "path": "src/instance-config.js",
       "mode": "0000644",
@@ -9932,7 +9702,7 @@
     {
       "path": "src/module-api.js",
       "mode": "0000644",
-      "sha256": "b64003ea52fe47207f7723521aba5b1bec5b7286f3e545a4b323d379259b99ab"
+      "sha256": "4d103e39fb2682b9472313a7714a0bff8f3d211e407240c0211fd74841485242"
     },
     {
       "path": "src/module-loader/catalog.js",
@@ -9972,7 +9742,7 @@
     {
       "path": "src/platform-server.js",
       "mode": "0000644",
-      "sha256": "ed0f3284b85d0f2b6b909832597f627b068684960ea2441f807a463946be9fd3"
+      "sha256": "daed7492737b50aa6284140e116adad0121034a196c060c3f57ffa07d1ac67b5"
     },
     {
       "path": "src/role-responsibilities.js",
@@ -11004,41 +10774,6 @@
       "mode": "0000644",
       "sha256": "87ceb07341c3b69019bbf54e1db97ccd0043c63cf94a432471234142d984d7fa"
     },
-    {
-      "path": "tests/devbox_artifact_gate.mjs",
-      "mode": "0000644",
-      "sha256": "3c437058adc726c0bc40ffa47781eb931d6adaef26eaefe1e01c6df00fb421d9"
-    },
-    {
-      "path": "tests/devbox_dmg_backdrop.mjs",
-      "mode": "0000644",
-      "sha256": "1790c24b0354cc2b6f2dc4ce72c8cd75e2f898127d0d4b8b081c8199dae90ff6"
-    },
-    {
-      "path": "tests/devbox_downloads.mjs",
-      "mode": "0000644",
-      "sha256": "d5036d01e42ef0fe629689e428e8417850af092db5b28fe2257db56c0d153165"
-    },
-    {
-      "path": "tests/devbox_icons.mjs",
-      "mode": "0000644",
-      "sha256": "1bfdc9c5e9aa6049c761d8629e53c95d216937e55c5a03bbe28d745c7168b8c2"
-    },
-    {
-      "path": "tests/devbox_installer_brand.mjs",
-      "mode": "0000644",
-      "sha256": "6129a3f7f617ca23e0c91cadc92fa3563abd18889831fa11dcf51aeab709ba8d"
-    },
-    {
-      "path": "tests/devbox_key_register.mjs",
-      "mode": "0000644",
-      "sha256": "ac0a024d96ef40af52af8b94570447ad5f1556467b68380c1b45fd3419139ad6"
-    },
-    {
-      "path": "tests/devbox_update_path.mjs",
-      "mode": "0000644",
-      "sha256": "b58e87eeca17053709a8e2bdcefd032060358cc85314d28bf816a92d465fdae8"
-    },
     {
       "path": "tests/device_flow_start.mjs",
       "mode": "0000644",
@@ -11942,7 +11677,7 @@
     {
       "path": "tests/host_topology_skips.mjs",
       "mode": "0000644",
-      "sha256": "73d41870f08c804771fff35796fcfab41b67fec27954f9434025e12d8db5fe86"
+      "sha256": "5321fc36d43b3332de0a89aba8f1712428c496ab84a880bb56fb9e6b62df91e0"
     },
     {
       "path": "tests/hub_disconnect_ui.mjs",
@@ -12132,7 +11867,7 @@
     {
       "path": "tests/instance_release_config.mjs",
       "mode": "0000644",
-      "sha256": "a7e2b9453ea73689e098894b15de8c693b3fa07704b34cb3539f14f0e67ca36c"
+      "sha256": "e8e28c9787a9d0cf3f9bd940351fe4a3eddfb17a2cd5c4ef4d937c159307ff30"
     },
     {
       "path": "tests/integration_parked_ratchet.mjs",
@@ -13072,7 +12807,7 @@
     {
       "path": "tests/publish_branch_route.mjs",
       "mode": "0000644",
-      "sha256": "f688f5da9bfc392ce203ee3b89dfa9ba23fd66ca4ebac603f6fb6faedb83b5c7"
+      "sha256": "27bf0ca4f9a5a2067e584d91fecf11da8daadea70fccf5e3fb48ee3bbbed39a4"
     },
     {
       "path": "tests/publish_gate.mjs",
@@ -13467,7 +13202,7 @@
     {
       "path": "tests/session_rename_fallback.mjs",
       "mode": "0000644",
-      "sha256": "02a61cc6a9949276e88e25d65e75a752cea36fccc1f0e7cec8bf7e44c1dfc93f"
+      "sha256": "b58b5e7a75c1df7ad6bd9cd80d688dfa8adcb56ed58e8c1392a99cbe09ff14d8"
     },
     {
       "path": "tests/session_reward_on_land.mjs",
@@ -13579,6 +13314,11 @@
       "mode": "0000644",
       "sha256": "a3b7858c255f1c7ea692866dbadd7321f77bd88c8380c429b7cb5f6b1b65496b"
     },
+    {
+      "path": "tests/ship_land_proof.mjs",
+      "mode": "0000644",
+      "sha256": "53ed4c14be08e332622708f79e7bc856b6cc81ee3f14f561f39edd23bca378c3"
+    },
     {
       "path": "tests/ship_merge_gate.mjs",
       "mode": "0000644",

package/clients/bongos-client/index.d.ts

@@ -410,7 +410,7 @@ export interface PostSsoTokenResponse { github_id: unknown; github_login: unknow
 export interface PostTaskRecommendationsRequest { task_id: number; recommended_to: number; reason: string }
 export interface PostTaskRecommendationsResponse { ok: boolean; recommendation: unknown }
 export interface PostTasksIdAttestGateRequest { head_sha: string }
-export interface PostTasksIdAttestGateResponse { ok: boolean; attested: unknown; reason: unknown }
+export interface PostTasksIdAttestGateResponse { ok: boolean; attested: unknown; reason: unknown; tip_recorded: unknown }
 export interface PostTasksIdConfirmRequest { verified?: unknown }
 export interface PostTasksIdCriteriaRequest { criterion_ids?: unknown[]; criterion_id?: StringifiableId }
 export interface PostTasksIdCriteriaResponse { ok: boolean; added: unknown; criteria: unknown }

package/docs/api/openapi.json

@@ -24632,12 +24632,14 @@
             "type": "boolean"
           },
           "attested": {},
-          "reason": {}
+          "reason": {},
+          "tip_recorded": {}
         },
         "required": [
           "ok",
           "attested",
-          "reason"
+          "reason",
+          "tip_recorded"
         ]
       },
       "PostTasksIdConfirmRequest": {

package/docs/architecture.md

@@ -248,7 +248,6 @@ markdown describes, the DB enforces.**
 - **`example.com`** — game (Phaser + Colyseus). Static files from `public/`. `/builders` + `/builders/*` now **301-redirect to `builders.example.com/<rest>`** ([#739](https://example.com/builders#/task/739) then promoted to permanent 301 in [#741](https://example.com/builders#/task/741), ADR 0036 cutover); the apex no longer serves the builder surface directly.
 - **`status.example.com`** — public build dashboard. **Carved to the `status-ui` module in BV1.R84** ([ADR 0093](adr/0093-tranche-2-core-carve-sequence.md) §1): the surface moved from `public-status/` to `modules/status-ui/public/`, now served by the loader's web-surface seam (`moduleWebSurfaces` → `serve-internal.js`, routed on the `status.` Host prefix the manifest declares) instead of a hardcoded block — no behavior change. Layout reorganized in [#726](https://example.com/builders#/task/726) (ADR 0036): Pulse / Watch(uptime) / Architects / Works / Treasury / Lately Inscribed / The World — the grade-aggregate, estimation-drift, and repo-health tablets moved to the Archon `/watch` page. **⚠ Served OFF the droplet** (ADR 0029, outage resilience): the live page is **GitHub Pages from the separate repo `example-owner/example-status`** (CNAME → Fastly), reading data cross-origin from the droplet's `/api/gds/public/*` (CORS open) and an availability banner from the prober's `status-data` branch. The droplet still serves `modules/status-ui/public/` (on the `status.` host) as a same-origin fallback, but **DNS points at Pages, not the droplet** — so a droplet deploy does NOT update the live page. Changes to the surface publish to the mirror via `scripts/status-mirror-sync.js` (re-pointed at `modules/status-ui/public/`; status.js/style.css/cursors are byte-identical copies; index.html gets the off-box bits injected), run automatically by `.github/workflows/sync-status-mirror.yml` (needs the `STATUS_MIRROR_TOKEN` secret) ([#737](https://example.com/builders#/task/737)). **⚠ FOLLOW-UP (R84):** that workflow's path trigger still watches `public-status/**` and must be re-pointed at `modules/status-ui/public/**` by an owner/Archon — the GitHub App can't push `.github/workflows/*` (learning 107), so until then the mirror sync won't auto-fire on future status edits.
 - **`builders.example.com`** — dedicated builder surface (`isBuildersHost`, ADR 0036). **Carved to the `hall-ui` module in BV1.R85** ([ADR 0093](adr/0093-tranche-2-core-carve-sequence.md) §1): the surface moved from `public-builders/` to `modules/hall-ui/public/` (~13k LOC, the largest module) and is a loader-discovered web-surface module (`contributes.webSurfaces` host `builders.`). UNLIKE the generic status surface it keeps its **dedicated** serving block in `serve-internal.js` (`BUILDERS_DIR = modules/hall-ui/public/`), partitioned out of the generic web-surface loop on the `isBuildersHost` predicate. A thin rewrite shim maps every non-API path onto the existing `/builders/*` tree (so all serving + gating + asset-stamping is reused), serving the hall (`/`), the Metic+ **`/watch`** monitoring page (gated by `requireGovernmentPage`), **`/settings`** (Voices + Craft prefs), plus ranks/sessions/primer/diagrams. No behavior change — byte-identical (only `window.__MODULES__.enabled` gains `hall-ui:true`). **Additive** — until its DNS A record + cert are live, the whole surface stays reachable at `example.com/builders/*`. No `.github/workflows/*` follow-up: unlike R84, no workflow path-trigger watches `public-builders/**`.
-- **`/downloads/devbox/*`** (every host, mounted right after the API so the builders-host shim can't rewrite it — [#904](https://example.com/builders#/task/904), [ADR 0045](adr/0045-devbox-desktop-app.md)): branded download surface for the Dev Box desktop app. `/{mac-arm64,mac-x64,win-x64}` (+ `mac`/`win` aliases) 302 to the release assets on the public releases repo named in `config/devbox-app.json` (instance-side); `latest.json` feeds the app's update check. Logic in [`src/devbox-downloads.js`](../src/devbox-downloads.js); the installers never ride the git deploy.
 - The `/api/gds/*` surface is reachable from every host. **Cross-subdomain sign-in:** the `gds_session` cookie is scoped to `.example.com` on the production hosts (apex/www/builders/status) and host-only on localhost/staging (no cross-env token bleed); the OAuth handshake runs on the canonical origin with a validated `?return=` (open-redirect-guarded) so the subdomain can land a builder back on itself.
 - Caddy gets a site block per host (`infra/Caddyfile` (instance-side)), all reverse-proxying to `127.0.0.1:3000`.
 

package/docs/file-map.md

@@ -267,7 +267,6 @@
 │   (public-builders/ moved to modules/hall-ui/public/ in BV1.R85 — the authenticated builders' hall; see the modules/ block above. It keeps its DEDICATED serving block in src/bongos/serve-internal.js: the builders.<apex> + apex /builders/* shim, canonical redirects, the citizen/Archon page gates, asset-stamping, and the module hall-widget injection — partitioned out of the generic web-surface loop. index.html=the hall dashboard; work/board/roadmap/goals/watch/gate/settings/ranks/sessions/primer/diagrams/atlas pages (harbor + pair left with the dev box, task 1003890); ideas.{html,js,css}=the Full Idea composer (task 1002928 / R152 of goal 1000062 — the five R141 fields with a live R142 completeness meter, both fetched from the server so the page carries no copy of the rules; drafts in localStorage so navigation costs nothing. Task 1002930 / R154 added the SPARK QUEUE above it and a second mode: `?develop=<id>` reuses the same form to develop a spark — the spark's words shown above the fields, its title read-only, and the file routed to POST /inbox/:id/develop instead of POST /inbox, under its own per-idea draft key); idea.html/idea.js=the idea-detail PAGE (/idea/:id, task 1002929 / R153 — the SECOND two-segment hall page after /task/:id: grade, the five answers in template order, the score, and both attributions. The GRADE decides what the page contains — a quick idea gets no five-field skeleton. task-detail.js keeps the #/idea/N overlay because ~320 of its lines are the Metic+ triage panel; the overlay now links here); profile.html/profile.js=the public, shareable builder profile page (/profile?id=N — rank, works, credits, karma, achievements; task 1467); profile-connections.js=section 6 of that page, the hub-only connections block (task 1002296 / R20 of goal 1000045 — the viewer-relative 1st/2nd/3rd/out-of-network label, the mutuals it was computed from, the connect button, and on your own profile both request queues plus your connections ledger. Loaded BEFORE profile.js, which calls window.OTBConnections.render behind a guard, so a page that omits the script simply has no section; the section reveals only when the hub's /connections routes answer, exactly as the cross-project record does. ADR 0212 records why it is on this page rather than the not-yet-built /u/&lt;handle&gt;, and why it addresses a builder by github_login and then uses the canonical handle the API echoes back); profile-canonical.js=the canonical-profile wiring for that page (task 1002804 / P08, ADR 0214 — on a FEDERATED instance the rel=canonical plus the visible "see the cross-project record" link-out ADR 0171 D1 asks for; on the HUB the numeric ?id= form redirects to the handle URL instead, because a page cannot both redirect to a URL and declare it canonical. All three read ONE resolver, modules/platform-identity/canonical-profile.js, which answers null while /u/&lt;handle&gt; does not exist — so everything is dark today and one boolean turns it all on together); task.html/task.js=the task-detail page (/task/:id, task 751 — replaced the old #/task/N overlay); builders.js=the controller; dom-utils.js/hall-widgets.js=the widget+settings-panel registries.)
 │
 ├── infra/                          ← ON-BOX scripts (task 1002699): the four reporter/heartbeat crons every dev box runs from its /workspace clone — box-heartbeat.sh (idle-sweep activity signal), box-report-version.sh (HEAD → POST /box/version), box-report-host-keys.sh (SSH host keys → POST /box/host-keys), box-report-terminal.sh (ttyd URL+credential → POST /box/terminal). Delivered by the workspace clone itself (modules/dev-box/box-access.js sparse scope includes infra/); crons self-installed by box-source-fetch.sh's per-tick bring-up. API base resolves GDS_BASE env → session-file api_base → skip (no hardcoded host in the neutral core).
-├── devbox-app/                     ← OTB Dev Box — Electron menu-bar/tray switch for the builder's box (#904, ADR 0045; internal). SELF-CONTAINED: own package.json (never feeds the droplet's npm ci); built by .github/workflows/build-devbox-app.yml; published to the public releases repo per config/devbox-app.json
 │   ├── src/                        ← main process: main.js (tray/window/IPC), brand.js (ADR 0004 — the ONE civ-name string), pairing.js, box-controller.js, gds-client.js, session-store.js (shares ~/.config/otb/gds-session.json with the CLI), ssh-setup.js (key 600 + known_hosts replace + managed-settings install w/ elevation), tray.js, preload.js
 │   ├── renderer/                   ← the panel UI (sandboxed; parchment theme)
 │   ├── assets/tray/ + build-resources/ ← generated icons (scripts/gen-icons.js; build-resources name dodges the global build/ gitignore)

package/docs/module-api-changelog.md

@@ -2240,5 +2240,9 @@ is load-bearing: the script throws rather than guess if it is missing, and
         landed since 1.19.881 with no explicit bump. run 35463113839. (task 1002620)
   1.19.883 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
         landed since 1.19.882 with no explicit bump. run 35463573638. (task 1002620)
+  1.19.884 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+        landed since 1.19.883 with no explicit bump. run 35464075741. (task 1002620)
+  1.19.885 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+        landed since 1.19.884 with no explicit bump. run 35464802278. (task 1002620)
 ---------------------------------------------------------------------------
 ```

package/modules/lifecycle/routes/tasks.js

@@ -1357,17 +1357,31 @@ module.exports = function buildTasksRouter() {
     // it here too. Sits BEFORE the credential 503 on purpose: the tip is true
     // regardless, and a later-provisioned credential lets the sweep heal
     // retroactively. Best-effort, mirroring publish-branch.
+    //
+    // task 1004055: and SAY whether it took. setClaimPublishedSha returns null when
+    // no claim row matched, which read identically to success — so a caller that had
+    // just merged to main was told nothing, and only found out one call later as an
+    // opaque ship_land_not_proven 409, with the work already on main and the task
+    // parked at 'confirmed'. `tip_recorded` travels on BOTH exits, so the answer does
+    // not depend on which one the request happens to take.
+    let tipRecorded = false;
     try {
-      await db.setClaimPublishedSha({ taskId: id, builderId: req.builder.id, sha: headSha });
+      const claimId = await db.setClaimPublishedSha({ taskId: id, builderId: req.builder.id, sha: headSha });
+      tipRecorded = claimId != null;
+      if (!tipRecorded) log.warn('[gds] attest-gate: no claim row to record the published tip on', id);
     } catch (e) {
       log.error('[gds] setClaimPublishedSha via attest-gate (non-blocking)', id, e && e.message);
     }
     if (!githubPush.isConfigured()) {
-      return res.fail('push_unconfigured', { status: 503, message: 'No server push credential (GitHub App / GITHUB_PUSH_TOKEN) to post the gate attestation. ' +
-          'A gate-surface PR will need an owner review until the operator provisions it.' });
+      return res.fail('push_unconfigured', {
+        status: 503,
+        message: 'No server push credential (GitHub App / GITHUB_PUSH_TOKEN) to post the gate attestation. ' +
+          'A gate-surface PR will need an owner review until the operator provisions it.',
+        details: { tip_recorded: tipRecorded },
+      });
     }
     const { attested, reason } = await postGateAuthorTrust({ rank: req.builder.rank, sha: headSha, taskId: id });
-    return res.json({ ok: true, attested, reason });
+    return res.json({ ok: true, attested, reason, tip_recorded: tipRecorded });
   });
 
   // GET /override-requests?status=open — Archon queue. Status defaults to open;

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.883",
+  "version": "1.19.885",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.19.883",
+      "version": "1.19.885",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.883",
+  "version": "1.19.885",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",