@bongos/core 1.21.115 → 1.21.117

package/.bongos-core.json

@@ -2,22 +2,22 @@
   "artifact": "bongos-core",
   "manifest_schema": 1,
   "generator": "scripts/gds/package-core.js",
-  "core_version": "1.21.115",
-  "core_contract": "1.21.115",
-  "source_commit": "3574560db7e52cb19c9c39ec437ef3f0b48ef0db",
+  "core_version": "1.21.117",
+  "core_contract": "1.21.117",
+  "source_commit": "24f86969a6ea67bd13ceaa3e1a6b4193a717de4e",
   "source_ref": "HEAD",
-  "built_at": "2026-10-14T05:30:26.897Z",
+  "built_at": "2026-10-14T10:20:16.439Z",
   "redaction": {
     "model": "docs-redacted+functional-verbatim",
     "docs_redacted": 604,
     "agent_docs_stubbed": 28,
-    "functional_verbatim": 3110,
+    "functional_verbatim": 3113,
     "rules": 3,
     "gate_literals": 3,
     "gate": "passed"
   },
-  "file_count": 3743,
-  "tree_sha256": "d04d2d5e109a0185bf2d02c08ec35477e13a3c8efba86ca2a78e7b19e24726c2",
+  "file_count": 3746,
+  "tree_sha256": "a7996793fd481f433e052680171e0844fa40b4f7bd34e9a5533bba236e3979bc",
   "files": [
     {
       "path": ".claude/skills/ask-for-help/SKILL.md",
@@ -2212,7 +2212,7 @@
     {
       "path": "docs/adr/0350-the-hub-holds-a-per-project-write-deploy-key-so-a-hosted-upgrade-reaches-github.md",
       "mode": "0000644",
-      "sha256": "a2049480333d5cf3ff6890463a7381d80182ff7f934edf841a7e92c0c58990e6"
+      "sha256": "41102dae0e5743d3963386045a6071513dd81624e473085e12127630da491daa"
     },
     {
       "path": "docs/adr/0351-a-criterion-closes-on-a-uat.md",
@@ -2402,12 +2402,12 @@
     {
       "path": "docs/copy-inventory.md",
       "mode": "0000644",
-      "sha256": "f630bd5c08958ccddc8b5ed22aee8bac41c4e673f60536785ebf47c93f8c5c25"
+      "sha256": "5faccb2629a8dde143bf9ca0e8c517dbb498a77825b2e947c9c01b37b6d0edd9"
     },
     {
       "path": "docs/copy-registry.json",
       "mode": "0000644",
-      "sha256": "26c47ae079c45f78e6a9f0d58fb20bc562ec92ae6037c599f5512d1df674062e"
+      "sha256": "5d239ce9856df53342344b750e07b4d8d74b634c4d10e05c9aed4f9210825a35"
     },
     {
       "path": "docs/design/apex-pass-2-direction.md",
@@ -2917,7 +2917,7 @@
     {
       "path": "docs/module-api-changelog.md",
       "mode": "0000644",
-      "sha256": "e6c3d78ab1a522bc96116300854fbe6aa4c9e5f928b5d8106cd138a969b15333"
+      "sha256": "d8e108772dbf146ba2c2a7bc345e62c49564629e17f7ff1f155cf9bc8aa1a19b"
     },
     {
       "path": "docs/modules-contract.md",
@@ -3007,7 +3007,7 @@
     {
       "path": "docs/page-readings.json",
       "mode": "0000644",
-      "sha256": "21e6c93c062959855debba85ab7f42fd65da25a7db788363d47f49c868331b2c"
+      "sha256": "ed3f0e2bb4fbebc9dad91c09c656620095101b61d4a0693df519281786efefd1"
     },
     {
       "path": "docs/project-context.template.md",
@@ -5752,7 +5752,7 @@
     {
       "path": "modules/hall-ui/public/deploy.js",
       "mode": "0000644",
-      "sha256": "5066ca5197fb8f01f41703911f9771c41f2dc21cdec20103614b8bc1df748ab6"
+      "sha256": "2dd86dbafbaa97bfbca3ab457dc8845b788b36af3657442d28e24cb02fcbcc5b"
     },
     {
       "path": "modules/hall-ui/public/deploy.states.json",
@@ -10462,12 +10462,12 @@
     {
       "path": "package-lock.json",
       "mode": "0000644",
-      "sha256": "487e9eadbeb036ebd41eb6326f7b5603320f913847138620ca96d9a8d1a7ed79"
+      "sha256": "0ace635f24556f8dcafe05047ac751909d9059cecc2a69a0870e4bfa317265df"
     },
     {
       "path": "package.json",
       "mode": "0000644",
-      "sha256": "85223b3a5bfc4e77079adb7d66f7d99bea58e1e25dab236952d0764129871bf4"
+      "sha256": "38e0e4baa27d16b52a5e5b5ec1a142ed61c2d096b07df5ef684a33ad81e14143"
     },
     {
       "path": "public-docs/index.html",
@@ -10487,7 +10487,7 @@
     {
       "path": "release-notes.json",
       "mode": "0000644",
-      "sha256": "77d23f71dfb85ad59cdcfe750088d923d3132f76f0b26d1151aabbdaddba05f4"
+      "sha256": "4b3698521da6c1ef14a15c8e3ee3a42f6f7532c4db9f6a9cf40c0e9cd77c4d3e"
     },
     {
       "path": "scripts/cron/style_guide_audit.sh",
@@ -11057,7 +11057,7 @@
     {
       "path": "scripts/gds/fitness-lib.js",
       "mode": "0000644",
-      "sha256": "cf4a3cfb002a72b2a42466b9ebadb5463b29f22110dc4670097ffc8a3d737481"
+      "sha256": "a5866991d48c6ec5fb9c6ab09acefd299ec612cfa8507795689532fc018a50f8"
     },
     {
       "path": "scripts/gds/fitness-migration-contraction.js",
@@ -11072,7 +11072,7 @@
     {
       "path": "scripts/gds/fitness.js",
       "mode": "0000644",
-      "sha256": "0ea1beb8b23148696f9a88cfbca1b303d9299e1e8dc2da21bf86ea21b9d035e0"
+      "sha256": "88a99a1a1455477dd9f7987c0f6c48f20464cc4ab98cc2f224c1a5536483fd2d"
     },
     {
       "path": "scripts/gds/gate-review.js",
@@ -11512,7 +11512,7 @@
     {
       "path": "scripts/gds/provision-core-upgrade.js",
       "mode": "0000644",
-      "sha256": "f872595e7333304012840de5f94a631a6c4105d2753104bfa02d5e68aae7fedc"
+      "sha256": "4618801b27992e4f7300b3ba1a4e12c44e6d42d8895b4f15997b051f7dc9c0de"
     },
     {
       "path": "scripts/gds/provision-disconnect.js",
@@ -11534,6 +11534,11 @@
       "mode": "0000644",
       "sha256": "0635ec599429c8caefad80eb5947bca487d267c2f4286c72c54966815f7c679f"
     },
+    {
+      "path": "scripts/gds/provision-pin-replay.js",
+      "mode": "0000644",
+      "sha256": "db5afb35a5d1ad7dae72ea730e6b1e0add815348c7263f1b6b90c3b2112126a3"
+    },
     {
       "path": "scripts/gds/provision-process.js",
       "mode": "0000644",
@@ -12227,7 +12232,7 @@
     {
       "path": "scripts/gds/upgrade-migrate.js",
       "mode": "0000644",
-      "sha256": "f13cdc8f5f55b76a28230b1d20ed5116159106ea66dcce8db1dcb37302a41fa7"
+      "sha256": "1c3e3a90e74336acd39c41ab5571b1bba902ba82d843886e901175722e86a04f"
     },
     {
       "path": "scripts/gds/upgrade-operator.js",
@@ -12237,12 +12242,12 @@
     {
       "path": "scripts/gds/upgrade-outcome.js",
       "mode": "0000644",
-      "sha256": "c05a13867f1792cb6befee3bc3e8f6343c67372a32e14d769d49c8088d7035fa"
+      "sha256": "199eda583c51bdeb467cc9d84281c9762942e0aa4cb7e76f916fcd18093c06d2"
     },
     {
       "path": "scripts/gds/upgrade.js",
       "mode": "0000644",
-      "sha256": "63d9c0b08d061fb4b5282fcad15c15317daed7fd0ece6ad33510893608137ac0"
+      "sha256": "f4f158948ab880ceee1cf745ba0071983054c20deba885fed735b7828fe7c1ca"
     },
     {
       "path": "scripts/gds/validate-design.js",
@@ -12787,7 +12792,7 @@
     {
       "path": "src/module-api.js",
       "mode": "0000644",
-      "sha256": "941866b79cacdcd7e210c1c7a217ba9e11ed7e74353f7f29bbfa95afd6589e7e"
+      "sha256": "ad17db745ec1ff7924bd9b01437ae13fa716bd9738b8ac57dceeaa8f591ea2d7"
     },
     {
       "path": "src/module-loader/catalog.js",
@@ -13812,7 +13817,7 @@
     {
       "path": "tests/core_upgrade_runner.mjs",
       "mode": "0000644",
-      "sha256": "33507dcd145bca157be08b9c8b55ad7d2c3ebae07ab8c94af7af9e235ac60769"
+      "sha256": "91ef120cc2531c6942d5e3912bea4ef44bcd7aec926c3822ff0c346c9eb7ae0e"
     },
     {
       "path": "tests/cosmos_token_contrast.mjs",
@@ -14304,6 +14309,11 @@
       "mode": "0000644",
       "sha256": "230e532b54a69a3ee2c009b3a018a6cb920c92fb402364427cbdc244434d4c1b"
     },
+    {
+      "path": "tests/fitness_installed_core.mjs",
+      "mode": "0000644",
+      "sha256": "c3e685ff6addb1c14d6f9d5cf3fb02f82987a42ba6d1f84c52d147d9045a704a"
+    },
     {
       "path": "tests/fitness_no_raw_nul.mjs",
       "mode": "0000644",
@@ -15852,7 +15862,7 @@
     {
       "path": "tests/instance_db_migrated_on_code_move.mjs",
       "mode": "0000644",
-      "sha256": "cf92e51be46c5b0e2edab94cd1e269f69c324bacb4f512adf5c23881ca810704"
+      "sha256": "5bf41e4791b310fa5b5e6b8efb706ce59c243b40c770ae085d6151aed64d2af4"
     },
     {
       "path": "tests/instance_feedback.mjs",
@@ -16709,10 +16719,15 @@
       "mode": "0000644",
       "sha256": "cd33adb13dcaf667f98444b3df9273da9ea8de77dbe1340b281000157044c093"
     },
+    {
+      "path": "tests/pin_replay.mjs",
+      "mode": "0000644",
+      "sha256": "77f0e61c9c3ac0de2b898803c6cd90bcc498d72e1ae370b628525e379e28ee5c"
+    },
     {
       "path": "tests/pin_write_key.mjs",
       "mode": "0000644",
-      "sha256": "fa4e599a58d8ad8b2c27b9ee774d0d5e42c5c57b4943b9414be681091997f5f3"
+      "sha256": "6b8973f043a138a08a01a14f4783181c6484daac8397306e6549b00315a6145e"
     },
     {
       "path": "tests/plain_cards.mjs",
@@ -18507,7 +18522,7 @@
     {
       "path": "tests/upgrade_migrate.mjs",
       "mode": "0000644",
-      "sha256": "47048521bb37c9debc02ef5c366bfe863450eb944023cce60ba182b9640563ee"
+      "sha256": "7f9ca799ee14a5b501ed8446e682d67c43c132738c047ba8752e3f20bda3d030"
     },
     {
       "path": "tests/upgrade_operator.mjs",

package/docs/adr/0350-the-hub-holds-a-per-project-write-deploy-key-so-a-hosted-upgrade-reaches-github.md

@@ -101,3 +101,37 @@ sets up lasting access, no longer "about an hour".
 - Code: `scripts/gds/provision-pin-key.js`, `pushUpgradePin` in
   `scripts/gds/provision-core-upgrade.js`, the revoke in `scripts/gds/provision-teardown.js`,
   the copy in `modules/hall-ui/public/deploy.js`; tests in `tests/pin_write_key.mjs`.
+
+## Amendment — a pin refused as "behind" is replayed on top (2026-10-14, task 1004733)
+
+**Amends D4 and the "auto-rebasing a pin … stays out of scope" consequence above.** Claude
+wrote this record; the fix was the one the task stated, and the second ruling below is the
+safe default the task asked to be recorded, not a new owner decision.
+
+**A1. GitHub ahead is the normal case, so it is no longer left split.** A project the owner
+works from a laptop almost always has commits on GitHub the box lacks, so the pin push was
+refused as "behind" on most moves, and the next deploy from GitHub could roll the core back.
+Now, when a push is refused as behind, `pushUpgradePin` hands the same credential (write key,
+owner token or `origin`) to `replayPinCommit` (`scripts/gds/provision-pin-replay.js`): fetch the
+branch, cherry-pick ONLY the move's pin commit (HEAD, subject `pin @bongos/core …`, one parent)
+onto it in a private scratch worktree outside the checkout, and push the result as an ordinary
+fast-forward. Never forced; a second refusal (someone pushed in between) is reported, not chased.
+
+**A2. The live box does not move.** The replay never touches the box's checkout, HEAD or files,
+so the box keeps running exactly what the move's health check proved. GitHub and the box then
+hold the same pin on different histories, which is harmless because nothing pulls the box.
+
+**A3. A real conflict stops.** If the owner changed the same lines of `package.json` or
+`package-lock.json`, the cherry-pick is aborted, nothing is pushed, and the move finishes done
+with the new note code `conflict`, naming the files. Choosing between the two is a person's call.
+
+**A4. The box does NOT pick up the owner's other commits (recorded default).** After
+provisioning nothing pulls a hosted box: `standalonePullCmd` runs only at provision time
+(`scripts/gds/provision.js`). Merging the owner's commits into the live checkout at this point
+would deploy their code with no install, migrate, restart or health check — a deploy riding
+inside a pin push. It is left out on purpose; if the owner wants a hosted box to follow GitHub,
+that is a deploy-path decision recorded on its own, not a side effect of a core move.
+
+Tests: `tests/pin_replay.mjs` (real bare origin ahead of the box: replayed and pushed; conflicting
+lockfile reported, nothing forced; up-to-date origin unchanged) and `tests/pin_write_key.mjs`
+(the replay rides the write key that was refused).