@bongos/core 1.19.902 → 1.19.903

package/.bongos-core.json

@@ -2,22 +2,22 @@
   "artifact": "bongos-core",
   "manifest_schema": 1,
   "generator": "scripts/gds/package-core.js",
-  "core_version": "1.19.902",
-  "core_contract": "1.19.902",
-  "source_commit": "2ec480ac926f1b9c899eef2576b1e6a7409e9013",
+  "core_version": "1.19.903",
+  "core_contract": "1.19.903",
+  "source_commit": "53ab83b870bf45e758ab22a2fb93103bfa42e51d",
   "source_ref": "HEAD",
-  "built_at": "2026-09-20T07:49:00.223Z",
+  "built_at": "2026-09-20T12:28:20.291Z",
   "redaction": {
     "model": "docs-redacted+functional-verbatim",
     "docs_redacted": 502,
     "agent_docs_stubbed": 26,
-    "functional_verbatim": 2284,
+    "functional_verbatim": 2278,
     "rules": 3,
     "gate_literals": 3,
     "gate": "passed"
   },
-  "file_count": 2812,
-  "tree_sha256": "e1c4784e88618bc042732cabcda2e40e5af8c8a4f21282de67baa72990fe7b6b",
+  "file_count": 2806,
+  "tree_sha256": "80c42879b74b051029afdcbf6fdcbbf26804064e32ea7abbcdc58a4fa44811fb",
   "files": [
     {
       "path": ".claude/skills/ask-for-help/SKILL.md",
@@ -342,7 +342,7 @@
     {
       "path": "bin/bongos.js",
       "mode": "0000644",
-      "sha256": "36d11612cace3d69bd2e98c8f7b5b7d737d8bba5fd8fe1a0554a85e3cb1973ca"
+      "sha256": "ba5f4b2a9e61712cd1da655265c8baffcb732b65690fb81297ce5dcf12fa93cf"
     },
     {
       "path": "clients/bongos-client/README.md",
@@ -2632,7 +2632,7 @@
     {
       "path": "docs/module-api-changelog.md",
       "mode": "0000644",
-      "sha256": "367d63ea84eaa28d8ccbadc967d41fb94a689906a8d8438e8b6a123c6ff4489e"
+      "sha256": "d6d904e3287c4286cd615dc97eb5d48295c06da5b430cb799aec003a34bdc5a1"
     },
     {
       "path": "docs/modules-contract.md",
@@ -2742,7 +2742,7 @@
     {
       "path": "docs/recipes/bongos-cli-release.md",
       "mode": "0000644",
-      "sha256": "de596822f2f5925fd9e4008cc0214c025a73f5ec3a0275aa6f9a117368ed2a76"
+      "sha256": "c8e3322e6399678c343bc45456fba2c17d9d0410af225ed7be9f9466414d3d80"
     },
     {
       "path": "docs/recipes/claude-design-loop.md",
@@ -2777,7 +2777,7 @@
     {
       "path": "docs/recipes/instance-first-run.md",
       "mode": "0000644",
-      "sha256": "259148d6e612209502b3f46e82e57c62da049fac4d883755e151be37de92fbf7"
+      "sha256": "5d20c34b8d61a72bf19ac18dbcf85545331c94d70634b7806a9d77799852e304"
     },
     {
       "path": "docs/recipes/instance-service-restart.md",
@@ -2787,7 +2787,7 @@
     {
       "path": "docs/recipes/local-dev.md",
       "mode": "0000644",
-      "sha256": "0e46f17cd96def91e202e7e4c42c54d569dca25fab2e43d5744199dd263b751f"
+      "sha256": "44ab0e2bf513149d530cd7d02d341ec12d4a902e0de8312faaee13f698a99aa0"
     },
     {
       "path": "docs/recipes/managed-settings-remote-control.md",
@@ -4857,7 +4857,7 @@
     {
       "path": "modules/hall-ui/public/hall-kit.js",
       "mode": "0000644",
-      "sha256": "febbc27ca107c7da31f997119be95a73446bab70139339c10c951440fe2e1d28"
+      "sha256": "1be3b170f1aff7e830f661c14df487bc30ec33e15499449f68748acad63794f8"
     },
     {
       "path": "modules/hall-ui/public/hall-render.js",
@@ -5012,7 +5012,7 @@
     {
       "path": "modules/hall-ui/public/profile-charts.js",
       "mode": "0000644",
-      "sha256": "809c92461d3569e431afcb9e060c687722bccfdfd7f4b028bca5133d7df0c2ab"
+      "sha256": "456f477da6893e61f66778ea5cb6a15dc3c21ea4038f0a8184a4deca840f237c"
     },
     {
       "path": "modules/hall-ui/public/profile-connections.js",
@@ -7762,12 +7762,12 @@
     {
       "path": "package-lock.json",
       "mode": "0000644",
-      "sha256": "b072b5799f9a792ea474fc50364b099b477a89037abac29f31a80a4e0afd56a4"
+      "sha256": "20d17854b6e4522308515c26c6efe033baa02b0d1b86a40c211fddc2b0cecfde"
     },
     {
       "path": "package.json",
       "mode": "0000644",
-      "sha256": "70ca20ce45a63886eff37d367e9574ab1ecc6d77191d500bc9c080ac80e71f8a"
+      "sha256": "8ee9f9ba3532c45ffd794bbdcae1c6d8d38fad130d73cf9c5275787ccfb60e53"
     },
     {
       "path": "public-docs/index.html",
@@ -7862,7 +7862,7 @@
     {
       "path": "scripts/gds/api.js",
       "mode": "0000644",
-      "sha256": "d36fa664267d64796faf071278437cb7cfa8c2b1c7ae2140bcb01d7c2ddf16e1"
+      "sha256": "6f6db1b581ac3a56bd8be0c5e8bee7189ee1621608f6c8751f908228c6325b21"
     },
     {
       "path": "scripts/gds/api.ps1",
@@ -8034,11 +8034,6 @@
       "mode": "0000644",
       "sha256": "9ae0402d6bec0d746ec6b09effe8165a237ed9dc8983de8613b969f82aa3a2c1"
     },
-    {
-      "path": "scripts/gds/box-connect-lib.js",
-      "mode": "0000644",
-      "sha256": "dbc4dd22d858a7d17c34ebf211edbd6d885afa39ab7b9e3032a7390cd5526638"
-    },
     {
       "path": "scripts/gds/box-infra.js",
       "mode": "0000644",
@@ -8072,7 +8067,7 @@
     {
       "path": "scripts/gds/build-cli-package.js",
       "mode": "0000644",
-      "sha256": "fcb5bdfe3341b177018a080c2cd7295bad3b1772696e61bef6154ec1e5767300"
+      "sha256": "a7a19db7b156f7e411e2a77146c2f9418b5b9ff7fa52be1e3dca56848307f98d"
     },
     {
       "path": "scripts/gds/bump-version.js",
@@ -8117,7 +8112,7 @@
     {
       "path": "scripts/gds/claude-materialize.js",
       "mode": "0000644",
-      "sha256": "8ac759488eef696a18a0035f51deed3b537c44f28d0191a108692b2399ae1787"
+      "sha256": "37cbab033c9ba88ae557e8569fcabca9d361b4e26fc335ed5adacddf245ab38d"
     },
     {
       "path": "scripts/gds/claude-md-template.js",
@@ -8132,18 +8127,13 @@
     {
       "path": "scripts/gds/cli-lib.js",
       "mode": "0000644",
-      "sha256": "d320945b629ad20f4e6cc272f3b531d6f98ed2dae2f07286b459db5b15d2c07a"
+      "sha256": "cbe71309f4e100b096eee7d91b90a4cc9e549caa3df51473f2ca3029ca4c8ba5"
     },
     {
       "path": "scripts/gds/client-baseurl-guard.js",
       "mode": "0000644",
       "sha256": "8ac4c8909b75aa5e2022a967ba9ac0cbcdac60da9d75757603827b86964c825b"
     },
-    {
-      "path": "scripts/gds/code.js",
-      "mode": "0000644",
-      "sha256": "6a726d269ec9a44fac6bdc7bdeb74bafbc2e3f303755296959b3a08642f98943"
-    },
     {
       "path": "scripts/gds/codemod-rename-src-gds.js",
       "mode": "0000644",
@@ -8457,7 +8447,7 @@
     {
       "path": "scripts/gds/go-live.js",
       "mode": "0000644",
-      "sha256": "f246947d973eec84ea174736bc87bf52b4716c939fc86bff4037b330f6790f9a"
+      "sha256": "3ff8b2370bd93c5469708900ba3d36066aa82f4858831ce6e4b1b7e817e29dcb"
     },
     {
       "path": "scripts/gds/goal-names.js",
@@ -8572,7 +8562,7 @@
     {
       "path": "scripts/gds/login.js",
       "mode": "0000644",
-      "sha256": "5699ace73061de80bfc44213775cdecefc6d597f656abe76f67061eb43fd440c"
+      "sha256": "fcb70ddb8175d4cbbfd3217dcb9352e6280d5597c8caffe88a6399b54041e93b"
     },
     {
       "path": "scripts/gds/main-audit.js",
@@ -8677,7 +8667,7 @@
     {
       "path": "scripts/gds/plain-cards.js",
       "mode": "0000644",
-      "sha256": "63344839b3cb2cba39757b5501759aaef8e1bf100468d7304a56d4e709f2f8cf"
+      "sha256": "e65a6264bbf4e28da17a46c0f8400e53207e141ed57e0e4826d7320f91b25f46"
     },
     {
       "path": "scripts/gds/portability-smoke-art.sh",
@@ -9084,11 +9074,6 @@
       "mode": "0000644",
       "sha256": "79027b353a20b02c363d691ba30eda7d3456b8a081199ddc2c2559162523d66c"
     },
-    {
-      "path": "scripts/gds/shell.js",
-      "mode": "0000644",
-      "sha256": "087def1396283b19cb8a6deea4cc7f362d7a2f164d496a587220f0a48568aae6"
-    },
     {
       "path": "scripts/gds/ship-check.js",
       "mode": "0000644",
@@ -9142,7 +9127,7 @@
     {
       "path": "scripts/gds/ship-land.js",
       "mode": "0000644",
-      "sha256": "53f43c609206ea62e71f562aaceed316b6aea217612f74dcd800e30f06b17ea5"
+      "sha256": "1a659cdc35cfda09e6e28cff97313871c648cfca24c08c6c97116e84649e6f67"
     },
     {
       "path": "scripts/gds/ship-memory-sync.js",
@@ -9777,7 +9762,7 @@
     {
       "path": "src/module-api.js",
       "mode": "0000644",
-      "sha256": "46c60fef08ac1cdeedec15a52a867d37f30a61e0ddbf9092a489fc7f5eae3a01"
+      "sha256": "565add1bbddcccee0c1b0e3e748b36d607af667350a541338faf48025cbfb904"
     },
     {
       "path": "src/module-loader/catalog.js",
@@ -10309,11 +10294,6 @@
       "mode": "0000644",
       "sha256": "786a97b9cb24ed38c8703113533d733eb475ed671e3fc5b5ca5ce679b8d4a4a4"
     },
-    {
-      "path": "tests/bongos_box_connect.mjs",
-      "mode": "0000644",
-      "sha256": "6ca9d015de848e7a96a47bbe7f12564c7b8f9652339674f5e127068800ebb21c"
-    },
     {
       "path": "tests/bongos_cli.mjs",
       "mode": "0000644",
@@ -10322,7 +10302,7 @@
     {
       "path": "tests/bongos_dispatch.mjs",
       "mode": "0000644",
-      "sha256": "f378b55969f723290ead5e959eef038745ba24e628418ed04c88671ead7354d3"
+      "sha256": "befc2f51a56d220107e825453148203a0cb7d9877bd8ab17bc71c8e93658efee"
     },
     {
       "path": "tests/bongos_downloads.mjs",
@@ -10389,11 +10369,6 @@
       "mode": "0000644",
       "sha256": "59b8fb0907125768a87a1ee24d74b1e0fa6b3e6ca6bed823fdd4db176e65b03a"
     },
-    {
-      "path": "tests/box_scope_predicate.mjs",
-      "mode": "0000644",
-      "sha256": "9dc459d61e6d47311609ff4639bb5ff9c9c36172ef5441204731a4a7818be0cd"
-    },
     {
       "path": "tests/box_scope_session.mjs",
       "mode": "0000644",
@@ -10562,18 +10537,13 @@
     {
       "path": "tests/claude_materialize.mjs",
       "mode": "0000644",
-      "sha256": "6354cd31332b41d64ada0c89363c5a17b9bbb5e5589e3bcf993afc7614591782"
+      "sha256": "60eb54f19f26f3557afd6b12f0f2867208638a2b6547f58abd192b6f07e805c3"
     },
     {
       "path": "tests/clawback_confirmed_backlog.mjs",
       "mode": "0000644",
       "sha256": "dca080c2976cdde34584a823aaae08d0175f34694c10897adb777a3f0ffb8cab"
     },
-    {
-      "path": "tests/cli_box_scope.mjs",
-      "mode": "0000644",
-      "sha256": "b9258f690d5dc7c87bcbb12d510b3071a38669777ae9a92a99e683e76ea15e83"
-    },
     {
       "path": "tests/cli_dispatcher.mjs",
       "mode": "0000644",
@@ -10592,7 +10562,7 @@
     {
       "path": "tests/cli_package.mjs",
       "mode": "0000644",
-      "sha256": "e16f3fd835e440bad8a24ea1807663f08709bfe21b65cc25772b7d707bbba540"
+      "sha256": "e7839e6ac47b12fe4decd50e31d37fba3bad7ac475e8f24e948bb49b52a3e83e"
     },
     {
       "path": "tests/cli_sessions.mjs",
@@ -10602,7 +10572,7 @@
     {
       "path": "tests/cli_surface.mjs",
       "mode": "0000644",
-      "sha256": "1475bff8f7e51244f451401f92ac647ddf859eacecf277a8b3f9990a23b84059"
+      "sha256": "cc10440e148e19a157cd18f0325e121f5492484e09550578e98870dba61090a9"
     },
     {
       "path": "tests/cli_token_reissue.mjs",
@@ -11627,7 +11597,7 @@
     {
       "path": "tests/hall_kit_charts.mjs",
       "mode": "0000644",
-      "sha256": "5654f4366ddcfcb61848a119a2dba3827f3fe19c0151005558a803c2e09db573"
+      "sha256": "d9d37e08fb0293f83a7d218edd789de9eb63aca1e9cd7f910c5ffba41639918e"
     },
     {
       "path": "tests/hall_landing_boot.mjs",
@@ -12527,7 +12497,7 @@
     {
       "path": "tests/plain_cards.mjs",
       "mode": "0000644",
-      "sha256": "925f4ffa450b2eddff31712b8ea1cd3e7853110f156d8fd4574f1ba1d05d16a8"
+      "sha256": "7549965b77f59c63fc2ac5fe5eb6cb4d292da9140bff5d589c47f99b784ab579"
     },
     {
       "path": "tests/planning_session_skill.mjs",
@@ -12967,7 +12937,7 @@
     {
       "path": "tests/rank_tier_single_source.mjs",
       "mode": "0000644",
-      "sha256": "fa78ebe4b9be867c6fc546ab53cd6cc4b76c532ae4effcce6bce83f6386e1ab3"
+      "sha256": "c6c5832636160010eb44af6a5fb049756d778e413d532643f2d3be4d69651303"
     },
     {
       "path": "tests/rate_limit_public.mjs",

package/bin/bongos.js

@@ -11,9 +11,10 @@
 // code. No auth/API logic lives here; the target scripts already share
 // scripts/gds/cli-lib.js.
 //
-// Phases 2-4 extend this same CLI with `shell`/`code` (VS Code Remote-SSH into
-// the dev box), a one-line installer + standalone binary, and instance-agnostic
-// `login`/`init`/`upgrade`.
+// Phases 2-4 extend this same CLI with a one-line installer + standalone binary
+// and instance-agnostic `login`/`init`/`upgrade`. (They also added `shell`/`code`,
+// VS Code Remote-SSH into a per-builder dev box; the dev box was retired and
+// those verbs removed with it — task 1003889.)
 
 'use strict';
 
@@ -52,8 +53,6 @@ const BUNDLED_RUNNERS = {
   // bare laptop has the standalone binary and nothing else (task 1003961).
   'paste-token.js': () => require('../scripts/gds/paste-token.js'),
   'api.js': () => require('../scripts/gds/api.js'),
-  'shell.js': () => require('../scripts/gds/shell.js'),
-  'code.js': () => require('../scripts/gds/code.js'),
   'init.js': () => require('../scripts/gds/init.js'),
   'onboard.js': () => require('../scripts/gds/onboard.js'),
 };
@@ -70,7 +69,7 @@ if (VERSION === '0.0.0') { try { VERSION = require('../package.json').version ||
 //   `script`     a file under scripts/gds/ (or api.js for actions with no
 //                dedicated builder script yet).
 //   `prefixArgs` inserted before the user's args — used to drive the generic
-//                api.js caller (e.g. waking your box is just POST /box/ensure).
+//                api.js caller for an action with no dedicated script.
 //   `selfHelp`   the script prints its own (richer) usage on --help/-h, so the
 //                dispatcher forwards the flag instead of answering it (task
 //                1002625). Only set it after verifying the script really does —
@@ -96,9 +95,6 @@ const VERBS = {
   // name, the way claim/ship/release already are (ADR 0104).
   'paste-token': { script: 'paste-token.js', group: 'account', summary: 'Finish re-auth: store the token copied from Settings  (bongos paste-token <token>)' },
   doctor:  { script: 'doctor.js', group: 'account', summary: 'Check your local toolchain + session' },
-  box:     { script: 'api.js', prefixArgs: ['POST', '/api/gds/box/ensure'], group: 'account', summary: 'Turn on / wake your cloud dev box' },
-  shell:   { script: 'shell.js', group: 'account', summary: 'Open a terminal on your dev box  (--local for a local clone)' },
-  code:    { script: 'code.js',  group: 'account', summary: 'Open VS Code on your dev box over Remote-SSH  (--local for a local clone)' },
 
   init:    { script: 'init.js', group: 'instance', summary: 'Scaffold a new instance (config + first version + kickoff tasks)' },
   dev:     { script: 'dev.js', group: 'instance', summary: 'Run THIS instance locally in one command (Postgres + migrate + server + sign-in)', selfHelp: true },
@@ -245,12 +241,10 @@ function runBundled(verb, def, forwarded) {
   if (!runner) {
     process.stderr.write(
       `bongos: "${verb}" needs the full project (git + a repo clone), which the standalone binary doesn't carry.\n\n` +
-        `Get onto a real environment first, then run it there:\n` +
+        `Get a checkout of the project repo, then run it there:\n` +
         `  bongos login <instance-url>   sign in to an instance\n` +
-        `  bongos code                   open VS Code on your cloud dev box (has everything)\n` +
-        `  bongos shell                  open a terminal on your cloud dev box\n` +
         `  bongos init                   scaffold a new instance here\n\n` +
-        `The standalone binary covers the on-ramp: login, box, shell, code, init, reauth, paste-token.\n`
+        `The standalone binary covers the on-ramp: login, init, reauth, paste-token.\n`
     );
     return 2;
   }

package/docs/module-api-changelog.md

@@ -2278,5 +2278,7 @@ is load-bearing: the script throws rather than guess if it is missing, and
         landed since 1.19.900 with no explicit bump. run 35494090938. (task 1002620)
   1.19.902 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
         landed since 1.19.901 with no explicit bump. run 35497860558. (task 1002620)
+  1.19.903 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+        landed since 1.19.902 with no explicit bump. run 35510679104. (task 1002620)
 ---------------------------------------------------------------------------
 ```

package/docs/recipes/bongos-cli-release.md

@@ -30,7 +30,8 @@ brew install example-owner/bongos/bongos          # macOS/Linux
 scoop bucket add bongos https://github.com/example-owner/scoop-bongos; scoop install bongos
 ```
 
-Then: `bongos login <instance-url>` → `bongos code` / `bongos shell` onto a dev box.
+Then: `bongos login <instance-url>` → `bongos start`. Writing code needs a checkout of the
+project repo, where the full CLI is installed.
 
 ## One-time owner setup (tracked as the open blocker on [#1248](https://example.com/builders#/task/1248))
 
@@ -61,6 +62,6 @@ Verify: `curl -fsSL https://example.com/downloads/bongos/version` shows the new
 `bin/bongos.js` is one dispatcher with two runtimes ([task 1248](https://example.com/builders#/task/1248)):
 
 - **repo / `npm i -g`** → runs under `node`; spawns each sibling `scripts/gds/*.js` (unchanged).
-- **compiled binary** → `process.execPath` is the `bongos` binary (no `node`, no scripts on disk), so it dispatches the **bundled on-ramp verbs in-process**: `login`/`setup`, `reauth`, `box`, `shell`, `code`, `init`. The heavy work verbs (`ship`/`claim`/`start`/`status`/`recall`/`cost`/`release`/`module`/`package-core`) and `doctor` are **not** bundled — they need a full repo + git to run, and pulling their dependency trees in would bloat the binary. Run those on a dev box (`bongos code`/`shell`) or in a clone (where `npm i -g` gives the full CLI). A bare-binary user who invokes one gets a clear "get onto a real environment first" message.
+- **compiled binary** → `process.execPath` is the `bongos` binary (no `node`, no scripts on disk), so it dispatches the **bundled on-ramp verbs in-process**: `login`/`setup`, `reauth`, `paste-token`, `api`, `init`, `onboard`. The heavy work verbs (`ship`/`claim`/`start`/`status`/`recall`/`cost`/`release`/`module`/`package-core`) and `doctor` are **not** bundled — they need a full repo + git to run, and pulling their dependency trees in would bloat the binary. Run those in a clone, where `npm i -g` gives the full CLI. A bare-binary user who invokes one gets a clear "get onto a real environment first" message.
 
 Follow-ups (not blocking the first release): SHA-pin `oven-sh/setup-bun`, code-sign the mac/win binaries, and expand the bundled verb set if a self-host workflow needs more offline.

package/docs/recipes/instance-first-run.md

@@ -48,8 +48,7 @@ npm install
 npx bongos dev        # Postgres → createdb → migrate → server → sign-in, in one step
 ```
 
-Full guide: [`docs/recipes/local-dev.md`](local-dev.md) (ADR 0149). Prefer a cloud dev box
-over running locally? Use `bongos box` + `bongos code`.
+Full guide: [`docs/recipes/local-dev.md`](local-dev.md) (ADR 0149).
 
 ## Notes
 

package/docs/recipes/local-dev.md

@@ -77,8 +77,6 @@ the Client ID + secret to `~/.config/<configDir>/gds-github.json` as
   go back to a hosted instance later, `bongos login https://<that-instance>`.
 - **Multiple projects at once** each get their own database + port, so their `bongos dev`
   servers don't collide.
-- **Prefer the cloud?** `bongos box` + `bongos code` give you a remote dev box instead — no
-  local database or server to run.
 - **Ready for a real host?** `bongos serve` runs this *same* boot path on a server —
   systemd-supervised, bind address derived from your public origin, no browser needed. See
   [`server-bring-up.md`](server-bring-up.md) ([ADR 0169](../adr/0169-bongos-serve-server-bring-up.md)).

package/modules/hall-ui/public/hall-kit.js

@@ -1141,7 +1141,13 @@
       activeDays += 1;
       totalShips += c;
     }
-    return { counts, startSun, endOrd, weeks, activeDays, totalShips };
+    // The window's NAME belongs with the window (task 1003621, artist review of 1003583).
+    // The aria summary described it as "the last year" while the caption under the same
+    // grid said "this year" — a rolling 53 weeks and a calendar year are not the same
+    // span, and V3 asks the accessible line and the visible one to state the same fact.
+    // Both now read this.
+    const spanLabel = weeks === 53 ? 'the last year' : `the last ${weeks} week${weeks === 1 ? '' : 's'}`;
+    return { counts, startSun, endOrd, weeks, activeDays, totalShips, spanLabel };
   }
 
   // calendarGridHtml(days, opts) — a year of ship-days as a contribution calendar:
@@ -1168,7 +1174,7 @@
   function calendarGridHtml(days, opts = {}) {
     const win = calendarWindow(days, opts);
     if (!win) return ''; // nothing real to draw → caller's empty state
-    const { counts, startSun, endOrd, weeks, activeDays, totalShips } = win;
+    const { counts, startSun, endOrd, weeks, activeDays, totalShips, spanLabel } = win;
     const ordToYmd = calOrdToYmd;
 
     // level 0 = empty; 1..5 map to the anti-gaming daily cap (streak.js caps a day at
@@ -1188,10 +1194,10 @@
     }
 
     // The window is DESCRIBED, not assumed: a caller passing weeks:6 used to be handed
-    // an aria label saying "over the last year" (task 1003583).
-    const span = weeks === 53 ? 'the last year' : `the last ${weeks} week${weeks === 1 ? '' : 's'}`;
+    // an aria label saying "over the last year" (task 1003583). The phrase now comes from
+    // calendarWindow so the caption beneath the grid can say the same words.
     const summary = opts.ariaLabel
-      || `Ships per day over ${span}: ${totalShips} ship${totalShips === 1 ? '' : 's'} across ${activeDays} day${activeDays === 1 ? '' : 's'}.`;
+      || `Ships per day over ${spanLabel}: ${totalShips} ship${totalShips === 1 ? '' : 's'} across ${activeDays} day${activeDays === 1 ? '' : 's'}.`;
     // The legend is aria-hidden: it decorates the bands, it carries no fact the cell
     // titles and the summary do not already state in words.
     const legend = '<div class="kit-cal__key" aria-hidden="true"><span class="kit-cal__key-label">less</span>'

package/modules/hall-ui/public/profile-charts.js

@@ -284,7 +284,7 @@
     // The scalars in words, in the .pchart__read slot the other figures use for their
     // crosshair readout — here it is static because the calendar's reading is per-cell.
     const read = `Current streak ${cur} day${cur === 1 ? '' : 's'} \u00b7 longest ${lng} \u00b7 `
-      + `${active} day${active === 1 ? '' : 's'} shipped this year`;
+      + `${active} day${active === 1 ? '' : 's'} shipped in ${win ? win.spanLabel : 'the last year'}`;
     const html = `<figure class="pchart" id="${esc(id)}">
       <figcaption class="pchart__title">Your shipping year</figcaption>
       <p class="pchart__read">${esc(read)}</p>

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.902",
+  "version": "1.19.903",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.19.902",
+      "version": "1.19.903",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.902",
+  "version": "1.19.903",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/scripts/gds/api.js

@@ -18,9 +18,7 @@
 // on a 2xx, 1 on any non-2xx or transport error, 2 on bad invocation.
 
 const fs = require('node:fs');
-const { cliClient, arg, stripBom, resolveQuiet, isBoxScope, printBoxScopeGuidanceAndExit, cliExit, repairMsysMangledPath,
-  instanceDevBoxSupport, devBoxUnavailableMessage } = require('./cli-lib');
-const { plainCardLines } = require('./plain-cards');
+const { cliClient, arg, stripBom, resolveQuiet, cliExit, repairMsysMangledPath } = require('./cli-lib');
 
 
 (async () => {
@@ -77,31 +75,9 @@ const { plainCardLines } = require('./plain-cards');
     return cliExit(1); // task 1002734: never process.exit() after a request
   }
   if (!quiet) console.error(`${method} ${urlPath} → ${res.status}`);
-  // task 1501: on a dev box the baked session is box-scoped (ADR 0053) and every
-  // non-bootstrap call (e.g. /me, /inbox) returns 403 box_scope. We pass
-  // allowUnauthenticated above (so a 401 stays a plain error, not the setup
-  // short-circuit), which ALSO suppresses apiCall's own box_scope guidance — so
-  // surface it here. Without this the raw {error:'box_scope'} body was dumped and
-  // rank-gated skills (/idea-triage, /blocker-review, …) read the missing `rank`
-  // as "pre-rank passthrough" and silently did nothing (reported an empty inbox
-  // on a dev box). The guided message tells the builder to /builder-reauth.
-  if (isBoxScope(res)) {
-    printBoxScopeGuidanceAndExit(); // prints the re-auth guidance + exit(10)
-  }
   if (res.data !== undefined && res.data !== null) {
     console.log(JSON.stringify(res.data, null, 2));
   }
-  // task 1003730: `bongos box` in the public CLI is this passthrough aimed at
-  // POST /box/ensure, so on an instance without the dev-box module a builder got a raw
-  // 404 body and no idea why. api.js stays generic — it just adds the one explanation
-  // that a /box/ 404 always means — and only for a reader who typed a box command.
-  if (res.status === 404 && /^\/api\/(?:bongos\/v1|bongos|gds)\/box\b/.test(urlPath)) {
-    const { available } = await instanceDevBoxSupport();
-    if (!available) {
-      console.error(`\n✖ ${devBoxUnavailableMessage()}`);
-      for (const line of plainCardLines('dev_box_unavailable')) console.error(line);
-    }
-  }
   // task 1002734: process.exit() here aborted node 5/5 on Windows —
   // "Assertion failed: !(handle->flags & UV_HANDLE_CLOSING), file src\win\async.c"
   // — AFTER the JSON had already printed, so every caller that checks the exit code