@bongos/core 1.19.884 → 1.19.885

package/.bongos-core.json

@@ -2,22 +2,22 @@
   "artifact": "bongos-core",
   "manifest_schema": 1,
   "generator": "scripts/gds/package-core.js",
-  "core_version": "1.19.884",
-  "core_contract": "1.19.884",
-  "source_commit": "3f7e3ac7e91fe3fb3fdddb27aaf5b35aa5dbac69",
+  "core_version": "1.19.885",
+  "core_contract": "1.19.885",
+  "source_commit": "3fc3d4952a5f3df767b788d749535c4b5d9574d2",
   "source_ref": "HEAD",
-  "built_at": "2026-09-19T19:21:38.333Z",
+  "built_at": "2026-09-19T19:35:51.138Z",
   "redaction": {
     "model": "docs-redacted+functional-verbatim",
-    "docs_redacted": 498,
+    "docs_redacted": 497,
     "agent_docs_stubbed": 26,
-    "functional_verbatim": 2316,
+    "functional_verbatim": 2264,
     "rules": 3,
     "gate_literals": 3,
     "gate": "passed"
   },
-  "file_count": 2840,
-  "tree_sha256": "6ecb18c6aa4049ca3b7a3d42526392093f1fbf7df2dcda05ec5cb24a73783653",
+  "file_count": 2787,
+  "tree_sha256": "1f06d46b4f715ae25938179a4a59b60eb2064c18c3b651c5248ddf87a414e634",
   "files": [
     {
       "path": ".claude/skills/ask-for-help/SKILL.md",
@@ -2057,7 +2057,7 @@
     {
       "path": "docs/architecture.md",
       "mode": "0000644",
-      "sha256": "f269ba3a95f2109cfc578f7b81f5210773ec0a0b910d8a482c13533bea63361e"
+      "sha256": "845aca9c32af0d4982eba5aefae1126cb77807eb8f5452f338a79895a9a56eb8"
     },
     {
       "path": "docs/branding-contract.md",
@@ -2597,7 +2597,7 @@
     {
       "path": "docs/file-map.md",
       "mode": "0000644",
-      "sha256": "0b1b89161e2c4731dd634a0efd074dd78e85301b1e161366a94b19dd69019905"
+      "sha256": "6949109a5db028219bf76b4483ac3b160f5996586a4c4a0d903fd42c28e1ff79"
     },
     {
       "path": "docs/handoff-template.md",
@@ -2607,7 +2607,7 @@
     {
       "path": "docs/module-api-changelog.md",
       "mode": "0000644",
-      "sha256": "6b51b92e71f93545a7e272f422f229831541e92eb5c90859d3f4e1fd629a7598"
+      "sha256": "817802ecd05e04ab03536c918130316c3597dd85c5dce0f06b8e3abb05fde449"
     },
     {
       "path": "docs/modules-contract.md",
@@ -3969,231 +3969,6 @@
       "mode": "0000644",
       "sha256": "7cb9dac9cb87b679e1ae50e4112b3a7928a38ebb9902c8947a74d17bec4d9009"
     },
-    {
-      "path": "modules/dev-box/app/README.md",
-      "mode": "0000644",
-      "sha256": "2c82fe59e0f32aa5eaee94aac7ca896fbf822a85c7cd280748caa44eacdf8bd5"
-    },
-    {
-      "path": "modules/dev-box/app/assets/tray/mac-alertTemplate.png",
-      "mode": "0000644",
-      "sha256": "ad6c145e1a2d7f780c8325eb872e38f7d06e59b9c12d131b5aaa4b506795cbe0"
-    },
-    {
-      "path": "modules/dev-box/app/assets/tray/mac-alertTemplate@2x.png",
-      "mode": "0000644",
-      "sha256": "55f5416dc95caa93d8632265516658893a52b8153fea4df074a455a861529722"
-    },
-    {
-      "path": "modules/dev-box/app/assets/tray/mac-busyTemplate.png",
-      "mode": "0000644",
-      "sha256": "10acfb4c504e66f75d6cae5cd06ed0a719eda08ead4179d0e32d63b9b41e965b"
-    },
-    {
-      "path": "modules/dev-box/app/assets/tray/mac-busyTemplate@2x.png",
-      "mode": "0000644",
-      "sha256": "a2121124cd3f3a14e9668e2adee6b5984bae842c09ea4ebae8a385727adda242"
-    },
-    {
-      "path": "modules/dev-box/app/assets/tray/mac-offTemplate.png",
-      "mode": "0000644",
-      "sha256": "8bfdb408357523419dcfee47e6fee8af912289137e21544934231486d34e7c3b"
-    },
-    {
-      "path": "modules/dev-box/app/assets/tray/mac-offTemplate@2x.png",
-      "mode": "0000644",
-      "sha256": "4256e5a0a05da87ccc113e8c54036372fa3ed30ae5dbad3eeafbaf4260e10696"
-    },
-    {
-      "path": "modules/dev-box/app/assets/tray/mac-onTemplate.png",
-      "mode": "0000644",
-      "sha256": "bd440761b3d43cace0a1941fe1921b988d92e731c82b0d93f03d21ae8cce4ba7"
-    },
-    {
-      "path": "modules/dev-box/app/assets/tray/mac-onTemplate@2x.png",
-      "mode": "0000644",
-      "sha256": "c38ef2ec4200eebea8887a618ad02223ca2a9dfb377dd1df0f958f664193b0fd"
-    },
-    {
-      "path": "modules/dev-box/app/assets/tray/win-alert.png",
-      "mode": "0000644",
-      "sha256": "147cc492e6b476a53c47812abe630307d7bc09da5b7e270e93f47bf05a5ed320"
-    },
-    {
-      "path": "modules/dev-box/app/assets/tray/win-busy.png",
-      "mode": "0000644",
-      "sha256": "9acd0b763574404341fd46f27d325f04380067d815b7d88b34ea2f6ad2fdcfc7"
-    },
-    {
-      "path": "modules/dev-box/app/assets/tray/win-off.png",
-      "mode": "0000644",
-      "sha256": "b7837bf4d07f4ae6881015b86cedc3e723b4daefbe11d48f69376a627c58741a"
-    },
-    {
-      "path": "modules/dev-box/app/assets/tray/win-on.png",
-      "mode": "0000644",
-      "sha256": "2ab550b6e0e769260665c993cd46f26b099083fb8dc3ff7710c52bff5e370378"
-    },
-    {
-      "path": "modules/dev-box/app/build-resources/dmg-background.png",
-      "mode": "0000644",
-      "sha256": "4a25a6cb527c55958f05df50302622c8699e3e8a3f399fb2ca745d22922ce28a"
-    },
-    {
-      "path": "modules/dev-box/app/build-resources/dmg-background@2x.png",
-      "mode": "0000644",
-      "sha256": "cc5f356dce2d42addf8686755613ea9bd4881364773a3a9f7a97a39c9becaba0"
-    },
-    {
-      "path": "modules/dev-box/app/build-resources/icon.png",
-      "mode": "0000644",
-      "sha256": "c0b651d0560e9d4b2d8373bcf8b9379c8a5fbb9d859bfa52c1e533ad46e336fd"
-    },
-    {
-      "path": "modules/dev-box/app/electron-builder.tmpl.yml",
-      "mode": "0000644",
-      "sha256": "72be146f3fae1904681f328f9e96e9c5da9048ff9ac7c31fe1492a16feacf59e"
-    },
-    {
-      "path": "modules/dev-box/app/electron-builder.yml",
-      "mode": "0000644",
-      "sha256": "747a13604e8560e85624d2543dc9dba0fc23cf7ad69604b9802bafdfb5d33449"
-    },
-    {
-      "path": "modules/dev-box/app/package-lock.json",
-      "mode": "0000644",
-      "sha256": "4739bd1e3f4ebe72742f30e8f97ff8415cba736c96404c6d30e04103db88795d"
-    },
-    {
-      "path": "modules/dev-box/app/package.json",
-      "mode": "0000644",
-      "sha256": "097ce00228218038afa2be0f48527016c6136da4a5a591927d3105ffb38308ce"
-    },
-    {
-      "path": "modules/dev-box/app/renderer/app.js",
-      "mode": "0000644",
-      "sha256": "8c6b71a390e7277620a274d22ae4d4dda8120c939bcbf82db69afb462fd21991"
-    },
-    {
-      "path": "modules/dev-box/app/renderer/index.html",
-      "mode": "0000644",
-      "sha256": "f1a288c30c6c31c6d8aa9bb5baed639d9b996181bad7738b117994f41fcda233"
-    },
-    {
-      "path": "modules/dev-box/app/renderer/styles.css",
-      "mode": "0000644",
-      "sha256": "d4dab0456afff72a13d525d32839c059b20011cecb3294046ef6680c9343d912"
-    },
-    {
-      "path": "modules/dev-box/app/renderer/theme.generated.css",
-      "mode": "0000644",
-      "sha256": "fd5d556295d7109b39f401d363c4c80e274e465474f5e845eba444717606a4db"
-    },
-    {
-      "path": "modules/dev-box/app/scripts/apply-dmg-backdrop.sh",
-      "mode": "0000755",
-      "sha256": "1ea82ef8d18f2f4d581329c10b05a20efa25e649cfb3c69e2384cb4d5a0b204e"
-    },
-    {
-      "path": "modules/dev-box/app/scripts/dmgbuild-settings.py",
-      "mode": "0000644",
-      "sha256": "5eacccf6c2ccf07771a8b17ad57b01ff7c1efe49994b30fc14819d137644fabc"
-    },
-    {
-      "path": "modules/dev-box/app/scripts/gen-brand.js",
-      "mode": "0000644",
-      "sha256": "1ab399cb8c5702ba3bdfc11d3ddad46b8959640afc81abf84ddc1c2f49e1252a"
-    },
-    {
-      "path": "modules/dev-box/app/scripts/gen-dmg-backdrop.py",
-      "mode": "0000644",
-      "sha256": "bc1242276dcffe414719838d44c77cc09d326321b6cabe0ca1a69eb58442ba01"
-    },
-    {
-      "path": "modules/dev-box/app/scripts/gen-icons.js",
-      "mode": "0000644",
-      "sha256": "13c75937401613a3bf45df6612718949318dc5fcd96b01791adc738d7e0d10eb"
-    },
-    {
-      "path": "modules/dev-box/app/scripts/vendor-client.js",
-      "mode": "0000644",
-      "sha256": "c3c4e228659c25f1463e31260121eef4907e272a8cded96630d9dd28f558678d"
-    },
-    {
-      "path": "modules/dev-box/app/src/box-controller.js",
-      "mode": "0000644",
-      "sha256": "36766b3705d176b202eca9808bf639e0cdcd9d8f2a39b5f03ae75db6580458fc"
-    },
-    {
-      "path": "modules/dev-box/app/src/brand.generated.json",
-      "mode": "0000644",
-      "sha256": "17f6dca05932f642adf06f7a6682784888cc9ae4401fc1da0453626a07c01da7"
-    },
-    {
-      "path": "modules/dev-box/app/src/brand.js",
-      "mode": "0000644",
-      "sha256": "0f6a3778223b936b7fd19101db8f70abac7bd576f2b354720af8afca049441cf"
-    },
-    {
-      "path": "modules/dev-box/app/src/config.js",
-      "mode": "0000644",
-      "sha256": "689935bb1901be4f31877207e7885be21630b9eafa6afe5fa025b1ff1dce4f83"
-    },
-    {
-      "path": "modules/dev-box/app/src/gds-client.js",
-      "mode": "0000644",
-      "sha256": "56f9866f7dbf8241282ca2308eace0e36580d89a886a51c72cedc5af7576733a"
-    },
-    {
-      "path": "modules/dev-box/app/src/main.js",
-      "mode": "0000644",
-      "sha256": "3ea5344e31c9f11be7f489999c42eb6a7d6115785a8b3c16c9911e6a1efff4c6"
-    },
-    {
-      "path": "modules/dev-box/app/src/pairing.js",
-      "mode": "0000644",
-      "sha256": "606ddbea2202b79a41f7965c332257a2b454db424af848a86ac1fa7b5e4076ed"
-    },
-    {
-      "path": "modules/dev-box/app/src/preload.js",
-      "mode": "0000644",
-      "sha256": "7d62c353fbf1f30885c3634ecea0648f5939baf587bf2c3fe0e008af45a48c16"
-    },
-    {
-      "path": "modules/dev-box/app/src/session-store.js",
-      "mode": "0000644",
-      "sha256": "9fefb99a647184879d2960eda360b475f5ea14d6f7c78d46c4de67f2b9909baa"
-    },
-    {
-      "path": "modules/dev-box/app/src/ssh-setup.js",
-      "mode": "0000644",
-      "sha256": "b3701587b3cb198ef17d8bb34378a3a88c0ab86f4b5c89e8c4600ac3bd97fd41"
-    },
-    {
-      "path": "modules/dev-box/app/src/task-picker.js",
-      "mode": "0000644",
-      "sha256": "0625a89b676cdedffd361cb11c68cb8e74465a41877de539676ae8b31ba55acb"
-    },
-    {
-      "path": "modules/dev-box/app/src/tray.js",
-      "mode": "0000644",
-      "sha256": "8b42cfdbf693a07502d3dfcb9cc78303341ee82e5e1740141950b7715fd567ca"
-    },
-    {
-      "path": "modules/dev-box/app/src/updater.js",
-      "mode": "0000644",
-      "sha256": "b26f65434bfae2cbbdc66c69b5f773a0474d5a948aaa81ef8f68a67e5eb327b8"
-    },
-    {
-      "path": "modules/dev-box/app/src/vendor/bongos-client.cjs",
-      "mode": "0000644",
-      "sha256": "885e0606f436873e274f6ec51e93697f3854115874c982299ef8275621629f8e"
-    },
-    {
-      "path": "modules/dev-box/app/test/unit.mjs",
-      "mode": "0000644",
-      "sha256": "f90e7525a3a6032c817dfc25b130e730808e6e561695911f10fa6777f4b756b4"
-    },
     {
       "path": "modules/dev-box/box-access.js",
       "mode": "0000644",
@@ -7917,12 +7692,12 @@
     {
       "path": "package-lock.json",
       "mode": "0000644",
-      "sha256": "b60a400b217ed94a7b0ffd2575edd06201aff6c044a5e83d7d96cdba2195f825"
+      "sha256": "b6272da5f8ef22a0c6470d574d3c692e42cda17ad914468b01787618a4145b47"
     },
     {
       "path": "package.json",
       "mode": "0000644",
-      "sha256": "c148cb29465f0fd0441a9f172d5340d973cc462fa607c4a0757681dec0b22380"
+      "sha256": "f1739df1c386bb39ccd39cfb98af671095b64011354060e46289042bd29a4dd1"
     },
     {
       "path": "public-docs/index.html",
@@ -9902,7 +9677,7 @@
     {
       "path": "src/bongos/serve-internal.js",
       "mode": "0000644",
-      "sha256": "38af1238d14afa749003c9a981e73854564aef07bcbc8a98e53999a03ad85742"
+      "sha256": "c1307be92441764ce74f41b58c3d5b0dd2a76579f0955d1dfa68c08c9a22c160"
     },
     {
       "path": "src/bongos/uptime-poller.js",
@@ -9919,11 +9694,6 @@
       "mode": "0000644",
       "sha256": "271f2bab1e1bdef9067ebdc954125a3201d4853e925580a2d4c83dd13bad188a"
     },
-    {
-      "path": "src/devbox-downloads.js",
-      "mode": "0000644",
-      "sha256": "89a7e3d909deb9dd3babb35cc0c63d6839304083af9579a8b3104000e6bf8a7a"
-    },
     {
       "path": "src/instance-config.js",
       "mode": "0000644",
@@ -9932,7 +9702,7 @@
     {
       "path": "src/module-api.js",
       "mode": "0000644",
-      "sha256": "f217dfe6e71dd6bd38f0ca7a02d4a7b85a2c49301d552dd4b1b098114db04985"
+      "sha256": "4d103e39fb2682b9472313a7714a0bff8f3d211e407240c0211fd74841485242"
     },
     {
       "path": "src/module-loader/catalog.js",
@@ -9972,7 +9742,7 @@
     {
       "path": "src/platform-server.js",
       "mode": "0000644",
-      "sha256": "ed0f3284b85d0f2b6b909832597f627b068684960ea2441f807a463946be9fd3"
+      "sha256": "daed7492737b50aa6284140e116adad0121034a196c060c3f57ffa07d1ac67b5"
     },
     {
       "path": "src/role-responsibilities.js",
@@ -11004,41 +10774,6 @@
       "mode": "0000644",
       "sha256": "87ceb07341c3b69019bbf54e1db97ccd0043c63cf94a432471234142d984d7fa"
     },
-    {
-      "path": "tests/devbox_artifact_gate.mjs",
-      "mode": "0000644",
-      "sha256": "3c437058adc726c0bc40ffa47781eb931d6adaef26eaefe1e01c6df00fb421d9"
-    },
-    {
-      "path": "tests/devbox_dmg_backdrop.mjs",
-      "mode": "0000644",
-      "sha256": "1790c24b0354cc2b6f2dc4ce72c8cd75e2f898127d0d4b8b081c8199dae90ff6"
-    },
-    {
-      "path": "tests/devbox_downloads.mjs",
-      "mode": "0000644",
-      "sha256": "d5036d01e42ef0fe629689e428e8417850af092db5b28fe2257db56c0d153165"
-    },
-    {
-      "path": "tests/devbox_icons.mjs",
-      "mode": "0000644",
-      "sha256": "1bfdc9c5e9aa6049c761d8629e53c95d216937e55c5a03bbe28d745c7168b8c2"
-    },
-    {
-      "path": "tests/devbox_installer_brand.mjs",
-      "mode": "0000644",
-      "sha256": "6129a3f7f617ca23e0c91cadc92fa3563abd18889831fa11dcf51aeab709ba8d"
-    },
-    {
-      "path": "tests/devbox_key_register.mjs",
-      "mode": "0000644",
-      "sha256": "ac0a024d96ef40af52af8b94570447ad5f1556467b68380c1b45fd3419139ad6"
-    },
-    {
-      "path": "tests/devbox_update_path.mjs",
-      "mode": "0000644",
-      "sha256": "b58e87eeca17053709a8e2bdcefd032060358cc85314d28bf816a92d465fdae8"
-    },
     {
       "path": "tests/device_flow_start.mjs",
       "mode": "0000644",
@@ -11942,7 +11677,7 @@
     {
       "path": "tests/host_topology_skips.mjs",
       "mode": "0000644",
-      "sha256": "73d41870f08c804771fff35796fcfab41b67fec27954f9434025e12d8db5fe86"
+      "sha256": "5321fc36d43b3332de0a89aba8f1712428c496ab84a880bb56fb9e6b62df91e0"
     },
     {
       "path": "tests/hub_disconnect_ui.mjs",
@@ -12132,7 +11867,7 @@
     {
       "path": "tests/instance_release_config.mjs",
       "mode": "0000644",
-      "sha256": "a7e2b9453ea73689e098894b15de8c693b3fa07704b34cb3539f14f0e67ca36c"
+      "sha256": "e8e28c9787a9d0cf3f9bd940351fe4a3eddfb17a2cd5c4ef4d937c159307ff30"
     },
     {
       "path": "tests/integration_parked_ratchet.mjs",
@@ -13467,7 +13202,7 @@
     {
       "path": "tests/session_rename_fallback.mjs",
       "mode": "0000644",
-      "sha256": "02a61cc6a9949276e88e25d65e75a752cea36fccc1f0e7cec8bf7e44c1dfc93f"
+      "sha256": "b58b5e7a75c1df7ad6bd9cd80d688dfa8adcb56ed58e8c1392a99cbe09ff14d8"
     },
     {
       "path": "tests/session_reward_on_land.mjs",

package/docs/architecture.md

@@ -248,7 +248,6 @@ markdown describes, the DB enforces.**
 - **`example.com`** — game (Phaser + Colyseus). Static files from `public/`. `/builders` + `/builders/*` now **301-redirect to `builders.example.com/<rest>`** ([#739](https://example.com/builders#/task/739) then promoted to permanent 301 in [#741](https://example.com/builders#/task/741), ADR 0036 cutover); the apex no longer serves the builder surface directly.
 - **`status.example.com`** — public build dashboard. **Carved to the `status-ui` module in BV1.R84** ([ADR 0093](adr/0093-tranche-2-core-carve-sequence.md) §1): the surface moved from `public-status/` to `modules/status-ui/public/`, now served by the loader's web-surface seam (`moduleWebSurfaces` → `serve-internal.js`, routed on the `status.` Host prefix the manifest declares) instead of a hardcoded block — no behavior change. Layout reorganized in [#726](https://example.com/builders#/task/726) (ADR 0036): Pulse / Watch(uptime) / Architects / Works / Treasury / Lately Inscribed / The World — the grade-aggregate, estimation-drift, and repo-health tablets moved to the Archon `/watch` page. **⚠ Served OFF the droplet** (ADR 0029, outage resilience): the live page is **GitHub Pages from the separate repo `example-owner/example-status`** (CNAME → Fastly), reading data cross-origin from the droplet's `/api/gds/public/*` (CORS open) and an availability banner from the prober's `status-data` branch. The droplet still serves `modules/status-ui/public/` (on the `status.` host) as a same-origin fallback, but **DNS points at Pages, not the droplet** — so a droplet deploy does NOT update the live page. Changes to the surface publish to the mirror via `scripts/status-mirror-sync.js` (re-pointed at `modules/status-ui/public/`; status.js/style.css/cursors are byte-identical copies; index.html gets the off-box bits injected), run automatically by `.github/workflows/sync-status-mirror.yml` (needs the `STATUS_MIRROR_TOKEN` secret) ([#737](https://example.com/builders#/task/737)). **⚠ FOLLOW-UP (R84):** that workflow's path trigger still watches `public-status/**` and must be re-pointed at `modules/status-ui/public/**` by an owner/Archon — the GitHub App can't push `.github/workflows/*` (learning 107), so until then the mirror sync won't auto-fire on future status edits.
 - **`builders.example.com`** — dedicated builder surface (`isBuildersHost`, ADR 0036). **Carved to the `hall-ui` module in BV1.R85** ([ADR 0093](adr/0093-tranche-2-core-carve-sequence.md) §1): the surface moved from `public-builders/` to `modules/hall-ui/public/` (~13k LOC, the largest module) and is a loader-discovered web-surface module (`contributes.webSurfaces` host `builders.`). UNLIKE the generic status surface it keeps its **dedicated** serving block in `serve-internal.js` (`BUILDERS_DIR = modules/hall-ui/public/`), partitioned out of the generic web-surface loop on the `isBuildersHost` predicate. A thin rewrite shim maps every non-API path onto the existing `/builders/*` tree (so all serving + gating + asset-stamping is reused), serving the hall (`/`), the Metic+ **`/watch`** monitoring page (gated by `requireGovernmentPage`), **`/settings`** (Voices + Craft prefs), plus ranks/sessions/primer/diagrams. No behavior change — byte-identical (only `window.__MODULES__.enabled` gains `hall-ui:true`). **Additive** — until its DNS A record + cert are live, the whole surface stays reachable at `example.com/builders/*`. No `.github/workflows/*` follow-up: unlike R84, no workflow path-trigger watches `public-builders/**`.
-- **`/downloads/devbox/*`** (every host, mounted right after the API so the builders-host shim can't rewrite it — [#904](https://example.com/builders#/task/904), [ADR 0045](adr/0045-devbox-desktop-app.md)): branded download surface for the Dev Box desktop app. `/{mac-arm64,mac-x64,win-x64}` (+ `mac`/`win` aliases) 302 to the release assets on the public releases repo named in `config/devbox-app.json` (instance-side); `latest.json` feeds the app's update check. Logic in [`src/devbox-downloads.js`](../src/devbox-downloads.js); the installers never ride the git deploy.
 - The `/api/gds/*` surface is reachable from every host. **Cross-subdomain sign-in:** the `gds_session` cookie is scoped to `.example.com` on the production hosts (apex/www/builders/status) and host-only on localhost/staging (no cross-env token bleed); the OAuth handshake runs on the canonical origin with a validated `?return=` (open-redirect-guarded) so the subdomain can land a builder back on itself.
 - Caddy gets a site block per host (`infra/Caddyfile` (instance-side)), all reverse-proxying to `127.0.0.1:3000`.
 

package/docs/file-map.md

@@ -267,7 +267,6 @@
 │   (public-builders/ moved to modules/hall-ui/public/ in BV1.R85 — the authenticated builders' hall; see the modules/ block above. It keeps its DEDICATED serving block in src/bongos/serve-internal.js: the builders.<apex> + apex /builders/* shim, canonical redirects, the citizen/Archon page gates, asset-stamping, and the module hall-widget injection — partitioned out of the generic web-surface loop. index.html=the hall dashboard; work/board/roadmap/goals/watch/gate/settings/ranks/sessions/primer/diagrams/atlas pages (harbor + pair left with the dev box, task 1003890); ideas.{html,js,css}=the Full Idea composer (task 1002928 / R152 of goal 1000062 — the five R141 fields with a live R142 completeness meter, both fetched from the server so the page carries no copy of the rules; drafts in localStorage so navigation costs nothing. Task 1002930 / R154 added the SPARK QUEUE above it and a second mode: `?develop=<id>` reuses the same form to develop a spark — the spark's words shown above the fields, its title read-only, and the file routed to POST /inbox/:id/develop instead of POST /inbox, under its own per-idea draft key); idea.html/idea.js=the idea-detail PAGE (/idea/:id, task 1002929 / R153 — the SECOND two-segment hall page after /task/:id: grade, the five answers in template order, the score, and both attributions. The GRADE decides what the page contains — a quick idea gets no five-field skeleton. task-detail.js keeps the #/idea/N overlay because ~320 of its lines are the Metic+ triage panel; the overlay now links here); profile.html/profile.js=the public, shareable builder profile page (/profile?id=N — rank, works, credits, karma, achievements; task 1467); profile-connections.js=section 6 of that page, the hub-only connections block (task 1002296 / R20 of goal 1000045 — the viewer-relative 1st/2nd/3rd/out-of-network label, the mutuals it was computed from, the connect button, and on your own profile both request queues plus your connections ledger. Loaded BEFORE profile.js, which calls window.OTBConnections.render behind a guard, so a page that omits the script simply has no section; the section reveals only when the hub's /connections routes answer, exactly as the cross-project record does. ADR 0212 records why it is on this page rather than the not-yet-built /u/&lt;handle&gt;, and why it addresses a builder by github_login and then uses the canonical handle the API echoes back); profile-canonical.js=the canonical-profile wiring for that page (task 1002804 / P08, ADR 0214 — on a FEDERATED instance the rel=canonical plus the visible "see the cross-project record" link-out ADR 0171 D1 asks for; on the HUB the numeric ?id= form redirects to the handle URL instead, because a page cannot both redirect to a URL and declare it canonical. All three read ONE resolver, modules/platform-identity/canonical-profile.js, which answers null while /u/&lt;handle&gt; does not exist — so everything is dark today and one boolean turns it all on together); task.html/task.js=the task-detail page (/task/:id, task 751 — replaced the old #/task/N overlay); builders.js=the controller; dom-utils.js/hall-widgets.js=the widget+settings-panel registries.)
 │
 ├── infra/                          ← ON-BOX scripts (task 1002699): the four reporter/heartbeat crons every dev box runs from its /workspace clone — box-heartbeat.sh (idle-sweep activity signal), box-report-version.sh (HEAD → POST /box/version), box-report-host-keys.sh (SSH host keys → POST /box/host-keys), box-report-terminal.sh (ttyd URL+credential → POST /box/terminal). Delivered by the workspace clone itself (modules/dev-box/box-access.js sparse scope includes infra/); crons self-installed by box-source-fetch.sh's per-tick bring-up. API base resolves GDS_BASE env → session-file api_base → skip (no hardcoded host in the neutral core).
-├── devbox-app/                     ← OTB Dev Box — Electron menu-bar/tray switch for the builder's box (#904, ADR 0045; internal). SELF-CONTAINED: own package.json (never feeds the droplet's npm ci); built by .github/workflows/build-devbox-app.yml; published to the public releases repo per config/devbox-app.json
 │   ├── src/                        ← main process: main.js (tray/window/IPC), brand.js (ADR 0004 — the ONE civ-name string), pairing.js, box-controller.js, gds-client.js, session-store.js (shares ~/.config/otb/gds-session.json with the CLI), ssh-setup.js (key 600 + known_hosts replace + managed-settings install w/ elevation), tray.js, preload.js
 │   ├── renderer/                   ← the panel UI (sandboxed; parchment theme)
 │   ├── assets/tray/ + build-resources/ ← generated icons (scripts/gen-icons.js; build-resources name dodges the global build/ gitignore)

package/docs/module-api-changelog.md

@@ -2242,5 +2242,7 @@ is load-bearing: the script throws rather than guess if it is missing, and
         landed since 1.19.882 with no explicit bump. run 35463573638. (task 1002620)
   1.19.884 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
         landed since 1.19.883 with no explicit bump. run 35464075741. (task 1002620)
+  1.19.885 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+        landed since 1.19.884 with no explicit bump. run 35464802278. (task 1002620)
 ---------------------------------------------------------------------------
 ```

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.884",
+  "version": "1.19.885",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.19.884",
+      "version": "1.19.885",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.884",
+  "version": "1.19.885",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/src/bongos/serve-internal.js

@@ -3,7 +3,6 @@
 // Mounts every non-game surface the platform serves onto an Express app:
 //   * /healthz + /version          — liveness + deployed-build info
 //   * /api/bongos/*                    — the GDS API (buildGdsRouter)
-//   * /downloads/devbox/*           — Dev Box installer redirect surface (#904)
 //   * generic module web-surface   — each enabled module's contributes.webSurfaces
 //     hosts                          served on its Host prefix by ONE generic static
 //                                     loop (the status dashboard at status.<apex>,
@@ -28,9 +27,7 @@
 // import boundary (scripts/gds/fitness.js §1) — it imports nothing from the host
 // game runtime (no src/db.js, no src/rooms/, no src/world/, no Colyseus). It
 // serves only static files + the GDS router, so a non-game Cloud Bongos instance
-// runs it unchanged. (The /downloads/devbox/* surface is an instance feature that
-// R54's module system, task 1193, will gate per-instance; it is benign on a
-// vanilla boot — it only redirects to whatever config/devbox-app.json names.)
+// runs it unchanged.
 
 const path = require('path');
 const fs = require('fs');
@@ -44,7 +41,6 @@ const gdsAuth = require('./auth');
 const { loadIdpConfig } = require('./auth-config');
 const { buildStampedHtml } = require('../asset-version');
 const { buildInfo } = require('../build-info');
-const { buildDevboxDownloads } = require('../devbox-downloads');
 const { buildBongosDownloads } = require('../bongos-downloads');
 const { clientBranding, branding, applyBrandConditionals } = require('../branding');
 const { prelaunchGate } = require('./prelaunch-gate');
@@ -59,7 +55,7 @@ const { API_PREFIX, LEGACY_API_PREFIXES, API_VERSION, VERSIONED_API_PREFIX, ALL_
 // is byte-identical for the live instance.
 const ROOT = resolveCoreRoot();
 
-// Instance-only RELEASE config (config/devbox-app.json, config/bongos-cli.json) is
+// Instance-only RELEASE config (config/bongos-cli.json) is
 // boundary-excluded from the portable core (publish-manifest INSTANCE_EXCLUDE), so it is
 // HOST content: it lives at the INSTANCE root, which on a vendored instance is NOT the
 // package dir this file sits under. A core-relative require therefore looked in
@@ -532,38 +528,6 @@ function isApexOnlyPath(p) {
 // Call this ONCE, right after app setup (trust proxy etc.) and BEFORE any
 // entrypoint-specific tail (the game static + themed 404 in server.js; the plain
 // 404 in platform-server.js).
-// The Dev Box download/manifest mini-router (#904, ADR 0045), extracted so the
-// ACTUAL route handlers are hermetically testable (tests/devbox_update_path.mjs
-// mounts them on a throwaway app — the docs_openapi_route pattern) instead of
-// only their pure builder. task 1002649: the manifest is served under BOTH
-// /latest.json and an extensionless /latest twin — a front proxy with a
-// file-matcher can eat *.json paths before Node (the live pre-ADR-0152 vhost
-// 404'd latest.json empty while extensionless siblings worked), so every
-// manifest consumer has a path that survives that class. Registration order
-// matters: the literal routes must precede the `:target` catch-all.
-function mountDevboxDownloads(app, devboxDownloads) {
-  const manifest = (_req, res) => {
-    // Short TTL: a release bump (config change + deploy) is visible within a
-    // minute, same posture as the hall's HTML.
-    res.set('Cache-Control', 'public, max-age=60');
-    res.json(devboxDownloads.latestJson());
-  };
-  app.get('/downloads/devbox/latest.json', manifest);
-  app.get('/downloads/devbox/latest', manifest);
-  // #924: the lightweight update-check endpoint the Dev Box app polls + the hall
-  // /settings courtesy line reads.
-  app.get('/downloads/devbox/version', (_req, res) => {
-    res.set('Cache-Control', 'public, max-age=60');
-    res.json(devboxDownloads.versionJson());
-  });
-  app.get('/downloads/devbox/:target', (req, res) => {
-    const url = devboxDownloads.redirectFor(req.params.target);
-    if (!url) return res.fail('unknown_target', 404, { targets: Object.keys(devboxDownloads.latestJson().assets) });
-    res.set('Cache-Control', 'public, max-age=60');
-    res.redirect(302, url);
-  });
-}
-
 function mountInternalSurfaces(app) {
   // Prometheus instrumentation (task #1680, V4.R28a). The counting middleware
   // mounts FIRST so it wraps every surface registered below (and, since
@@ -691,24 +655,14 @@ function mountInternalSurfaces(app) {
     app.use(prefix, gdsRouter);
   }
 
-  // Dev Box desktop app downloads (#904, ADR 0045). Branded redirect surface:
-  // the installers live as release assets on the public releases repo (they
-  // can't ride the git deploy — see src/devbox-downloads.js), and these routes
-  // keep every builder-facing URL on the apex. Mounted right after the API and
-  // BEFORE the host shims so the same paths work on the apex AND on
-  // builders.<apex> (the builders rewrite shim below only prefixes non-/api
-  // paths, so without this placement /downloads/* would be rewritten to
-  // /builders/downloads/* and 404).
-  const devboxCfg = tryLoadInstanceConfig('devbox-app.json');
-  if (devboxCfg) {
-    mountDevboxDownloads(app, buildDevboxDownloads(devboxCfg));
-  }
-
   // Standalone `bongos` CLI downloads + the one-line installer (task 1248,
-  // V4.R81). Same off-repo release pattern as the Dev Box block above: the
-  // compiled per-platform binaries live as release assets on the public releases
-  // repo (config/bongos-cli.json → src/bongos-downloads.js), and these routes keep
-  // every user-facing URL on the apex. The installer scripts are served with the
+  // V4.R81). Off-repo release pattern: the compiled per-platform binaries live
+  // as release assets on the public releases repo (config/bongos-cli.json →
+  // src/bongos-downloads.js), and these routes keep every user-facing URL on the
+  // apex. Mounted right after the API and BEFORE the host shims so the same
+  // paths work on the apex AND on builders.<apex> (the builders rewrite shim
+  // below only prefixes non-/api paths, so without this placement /downloads/*
+  // would be rewritten to /builders/downloads/* and 404). The installer scripts are served with the
   // server's PINNED origin substituted for __GDS_API_BASE__ — never a request
   // header, so a spoofed Host can't redirect a `curl | sh` (the box-connect.sh rule).
   const bongosCfg = tryLoadInstanceConfig('bongos-cli.json');
@@ -1357,4 +1311,4 @@ function mountInternalSurfaces(app) {
   return app;
 }
 
-module.exports = { mountInternalSurfaces, mountDevboxDownloads, isStatusHost, isBuildersHost, injectBrandingGlobal, injectBrandingInto, injectModuleHallWidgets, themeMarkup, applyBrandTokens, resolveOpenapiJson, openapiJson, tryLoadInstanceConfig };
+module.exports = { mountInternalSurfaces, isStatusHost, isBuildersHost, injectBrandingGlobal, injectBrandingInto, injectModuleHallWidgets, themeMarkup, applyBrandTokens, resolveOpenapiJson, openapiJson, tryLoadInstanceConfig };

package/src/module-api.js

@@ -71,7 +71,7 @@ const { responsibilityFor, ROLE_RESPONSIBILITIES } = require('./role-responsibil
 // there. scripts/gds/bump-version.js still rewrites the literal below; it appends
 // the entry to that file. Look for a version's history there, not here.
 // ---------------------------------------------------------------------------
-const CORE_VERSION = '1.19.884'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
+const CORE_VERSION = '1.19.885'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('dev-box'); log.info('mounted');

package/src/platform-server.js

@@ -13,7 +13,6 @@
 //   * the builders' hall host    — modules/hall-ui/public/ (the hall-ui module's
 //                                  web surface, BV1.R85 — served by its dedicated
 //                                  block in serve-internal)
-//   * /downloads/devbox/*        — the Dev Box installer redirects
 //
 // WHAT IT DELIBERATELY DOES NOT CONSTRUCT — the host game runtime:
 //   * NO Colyseus server, NO WebSocketTransport

package/tests/host_topology_skips.mjs

@@ -37,7 +37,6 @@ const ALLOWED = {
   box_ship_permissions: '.claude/settings.json (package-excluded)',
   conductor: '.claude/hooks/conductor.js (package-excluded)',
   deploy_instance: 'scripts/deploy/deploy-instance.sh (host topology)',
-  devbox_downloads: 'config/devbox-app.json (instance content)',
   eviction_policy: '.claude/hooks/eviction-policy.js (package-excluded)',
   first_run_engine_check: '.claude/hooks/session-start.js (package-excluded)',
   hook_core_resolve: '.claude/hooks/_core-resolve.js (package-excluded)',