@bongos/core 1.21.116 → 1.21.117

package/.bongos-core.json

@@ -2,22 +2,22 @@
   "artifact": "bongos-core",
   "manifest_schema": 1,
   "generator": "scripts/gds/package-core.js",
-  "core_version": "1.21.116",
-  "core_contract": "1.21.116",
-  "source_commit": "7b39bf31701003913914f9526d7630f14809bee1",
+  "core_version": "1.21.117",
+  "core_contract": "1.21.117",
+  "source_commit": "24f86969a6ea67bd13ceaa3e1a6b4193a717de4e",
   "source_ref": "HEAD",
-  "built_at": "2026-10-14T09:53:49.628Z",
+  "built_at": "2026-10-14T10:20:16.439Z",
   "redaction": {
     "model": "docs-redacted+functional-verbatim",
     "docs_redacted": 604,
     "agent_docs_stubbed": 28,
-    "functional_verbatim": 3110,
+    "functional_verbatim": 3113,
     "rules": 3,
     "gate_literals": 3,
     "gate": "passed"
   },
-  "file_count": 3743,
-  "tree_sha256": "8b2466b587647bb974ae071c853e02a388da3bd36085ecea20e1e361cc2e1bf5",
+  "file_count": 3746,
+  "tree_sha256": "a7996793fd481f433e052680171e0844fa40b4f7bd34e9a5533bba236e3979bc",
   "files": [
     {
       "path": ".claude/skills/ask-for-help/SKILL.md",
@@ -2212,7 +2212,7 @@
     {
       "path": "docs/adr/0350-the-hub-holds-a-per-project-write-deploy-key-so-a-hosted-upgrade-reaches-github.md",
       "mode": "0000644",
-      "sha256": "a2049480333d5cf3ff6890463a7381d80182ff7f934edf841a7e92c0c58990e6"
+      "sha256": "41102dae0e5743d3963386045a6071513dd81624e473085e12127630da491daa"
     },
     {
       "path": "docs/adr/0351-a-criterion-closes-on-a-uat.md",
@@ -2917,7 +2917,7 @@
     {
       "path": "docs/module-api-changelog.md",
       "mode": "0000644",
-      "sha256": "b8372d70759fb3fd2d980c66313955793237882a93c267bddb259447ac4efa68"
+      "sha256": "d8e108772dbf146ba2c2a7bc345e62c49564629e17f7ff1f155cf9bc8aa1a19b"
     },
     {
       "path": "docs/modules-contract.md",
@@ -10462,12 +10462,12 @@
     {
       "path": "package-lock.json",
       "mode": "0000644",
-      "sha256": "5e764013ab3c7399a9bc784950650a8a92222ab94dec939500993844e77b3e88"
+      "sha256": "0ace635f24556f8dcafe05047ac751909d9059cecc2a69a0870e4bfa317265df"
     },
     {
       "path": "package.json",
       "mode": "0000644",
-      "sha256": "e90968f6cfc1ecaf6c96f961e9d700e21658ebfe46b6a9ada02eb5ca48c26789"
+      "sha256": "38e0e4baa27d16b52a5e5b5ec1a142ed61c2d096b07df5ef684a33ad81e14143"
     },
     {
       "path": "public-docs/index.html",
@@ -10487,7 +10487,7 @@
     {
       "path": "release-notes.json",
       "mode": "0000644",
-      "sha256": "eb67fe8d98b2f7fb0e1423a1913c927e6725c71c216acaaa27307c3bd98931dd"
+      "sha256": "4b3698521da6c1ef14a15c8e3ee3a42f6f7532c4db9f6a9cf40c0e9cd77c4d3e"
     },
     {
       "path": "scripts/cron/style_guide_audit.sh",
@@ -11057,7 +11057,7 @@
     {
       "path": "scripts/gds/fitness-lib.js",
       "mode": "0000644",
-      "sha256": "cf4a3cfb002a72b2a42466b9ebadb5463b29f22110dc4670097ffc8a3d737481"
+      "sha256": "a5866991d48c6ec5fb9c6ab09acefd299ec612cfa8507795689532fc018a50f8"
     },
     {
       "path": "scripts/gds/fitness-migration-contraction.js",
@@ -11072,7 +11072,7 @@
     {
       "path": "scripts/gds/fitness.js",
       "mode": "0000644",
-      "sha256": "0ea1beb8b23148696f9a88cfbca1b303d9299e1e8dc2da21bf86ea21b9d035e0"
+      "sha256": "88a99a1a1455477dd9f7987c0f6c48f20464cc4ab98cc2f224c1a5536483fd2d"
     },
     {
       "path": "scripts/gds/gate-review.js",
@@ -11512,7 +11512,7 @@
     {
       "path": "scripts/gds/provision-core-upgrade.js",
       "mode": "0000644",
-      "sha256": "f872595e7333304012840de5f94a631a6c4105d2753104bfa02d5e68aae7fedc"
+      "sha256": "4618801b27992e4f7300b3ba1a4e12c44e6d42d8895b4f15997b051f7dc9c0de"
     },
     {
       "path": "scripts/gds/provision-disconnect.js",
@@ -11534,6 +11534,11 @@
       "mode": "0000644",
       "sha256": "0635ec599429c8caefad80eb5947bca487d267c2f4286c72c54966815f7c679f"
     },
+    {
+      "path": "scripts/gds/provision-pin-replay.js",
+      "mode": "0000644",
+      "sha256": "db5afb35a5d1ad7dae72ea730e6b1e0add815348c7263f1b6b90c3b2112126a3"
+    },
     {
       "path": "scripts/gds/provision-process.js",
       "mode": "0000644",
@@ -12787,7 +12792,7 @@
     {
       "path": "src/module-api.js",
       "mode": "0000644",
-      "sha256": "f8d3efdb597305e379909cfd4036b8ad2e8e86a84090e1bb1a1bffca29c38474"
+      "sha256": "ad17db745ec1ff7924bd9b01437ae13fa716bd9738b8ac57dceeaa8f591ea2d7"
     },
     {
       "path": "src/module-loader/catalog.js",
@@ -14304,6 +14309,11 @@
       "mode": "0000644",
       "sha256": "230e532b54a69a3ee2c009b3a018a6cb920c92fb402364427cbdc244434d4c1b"
     },
+    {
+      "path": "tests/fitness_installed_core.mjs",
+      "mode": "0000644",
+      "sha256": "c3e685ff6addb1c14d6f9d5cf3fb02f82987a42ba6d1f84c52d147d9045a704a"
+    },
     {
       "path": "tests/fitness_no_raw_nul.mjs",
       "mode": "0000644",
@@ -16709,10 +16719,15 @@
       "mode": "0000644",
       "sha256": "cd33adb13dcaf667f98444b3df9273da9ea8de77dbe1340b281000157044c093"
     },
+    {
+      "path": "tests/pin_replay.mjs",
+      "mode": "0000644",
+      "sha256": "77f0e61c9c3ac0de2b898803c6cd90bcc498d72e1ae370b628525e379e28ee5c"
+    },
     {
       "path": "tests/pin_write_key.mjs",
       "mode": "0000644",
-      "sha256": "fa4e599a58d8ad8b2c27b9ee774d0d5e42c5c57b4943b9414be681091997f5f3"
+      "sha256": "6b8973f043a138a08a01a14f4783181c6484daac8397306e6549b00315a6145e"
     },
     {
       "path": "tests/plain_cards.mjs",

package/docs/adr/0350-the-hub-holds-a-per-project-write-deploy-key-so-a-hosted-upgrade-reaches-github.md

@@ -101,3 +101,37 @@ sets up lasting access, no longer "about an hour".
 - Code: `scripts/gds/provision-pin-key.js`, `pushUpgradePin` in
   `scripts/gds/provision-core-upgrade.js`, the revoke in `scripts/gds/provision-teardown.js`,
   the copy in `modules/hall-ui/public/deploy.js`; tests in `tests/pin_write_key.mjs`.
+
+## Amendment — a pin refused as "behind" is replayed on top (2026-10-14, task 1004733)
+
+**Amends D4 and the "auto-rebasing a pin … stays out of scope" consequence above.** Claude
+wrote this record; the fix was the one the task stated, and the second ruling below is the
+safe default the task asked to be recorded, not a new owner decision.
+
+**A1. GitHub ahead is the normal case, so it is no longer left split.** A project the owner
+works from a laptop almost always has commits on GitHub the box lacks, so the pin push was
+refused as "behind" on most moves, and the next deploy from GitHub could roll the core back.
+Now, when a push is refused as behind, `pushUpgradePin` hands the same credential (write key,
+owner token or `origin`) to `replayPinCommit` (`scripts/gds/provision-pin-replay.js`): fetch the
+branch, cherry-pick ONLY the move's pin commit (HEAD, subject `pin @bongos/core …`, one parent)
+onto it in a private scratch worktree outside the checkout, and push the result as an ordinary
+fast-forward. Never forced; a second refusal (someone pushed in between) is reported, not chased.
+
+**A2. The live box does not move.** The replay never touches the box's checkout, HEAD or files,
+so the box keeps running exactly what the move's health check proved. GitHub and the box then
+hold the same pin on different histories, which is harmless because nothing pulls the box.
+
+**A3. A real conflict stops.** If the owner changed the same lines of `package.json` or
+`package-lock.json`, the cherry-pick is aborted, nothing is pushed, and the move finishes done
+with the new note code `conflict`, naming the files. Choosing between the two is a person's call.
+
+**A4. The box does NOT pick up the owner's other commits (recorded default).** After
+provisioning nothing pulls a hosted box: `standalonePullCmd` runs only at provision time
+(`scripts/gds/provision.js`). Merging the owner's commits into the live checkout at this point
+would deploy their code with no install, migrate, restart or health check — a deploy riding
+inside a pin push. It is left out on purpose; if the owner wants a hosted box to follow GitHub,
+that is a deploy-path decision recorded on its own, not a side effect of a core move.
+
+Tests: `tests/pin_replay.mjs` (real bare origin ahead of the box: replayed and pushed; conflicting
+lockfile reported, nothing forced; up-to-date origin unchanged) and `tests/pin_write_key.mjs`
+(the replay rides the write key that was refused).

package/docs/module-api-changelog.md

@@ -3069,5 +3069,7 @@ is load-bearing: the script throws rather than guess if it is missing, and
         landed since 1.21.114 with no explicit bump. run 38516937959. (task 1002620)
   1.21.116 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
         landed since 1.21.115 with no explicit bump. run 38545604578. (task 1002620)
+  1.21.117 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+        landed since 1.21.116 with no explicit bump. run 38548762428. (task 1002620)
 ---------------------------------------------------------------------------
 ```

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.21.116",
+  "version": "1.21.117",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.21.116",
+      "version": "1.21.117",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.21.116",
+  "version": "1.21.117",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/release-notes.json

@@ -9670,5 +9670,15 @@
       "id": "1004734",
       "text": "When a project's update fails while updating its database, the deploy page and the auto-filed blocker now say which database change failed and why, so nobody has to log into the machine to find out."
     }
+  ],
+  "1.21.117": [
+    {
+      "id": "1004733",
+      "text": "When a project's owner has saved newer work on GitHub, an automatic platform update now adds its new version number on top of that work instead of leaving GitHub pointing at the old version, so a later deploy can no longer qui"
+    },
+    {
+      "id": "1004737",
+      "text": "Projects that install Cloud Bongos from npm can run the project health check again: it now says plainly that those checks belong to Cloud Bongos itself and skips them, instead of crashing."
+    }
   ]
 }

package/scripts/gds/fitness-lib.js

@@ -80,7 +80,42 @@ function keyTokenRe(key) {
   return new RegExp(`(^|[^\\w-])${esc}($|[^\\w-])`);
 }
 
+// Is this an INSTALLED core (task 1004737)? A project that installs the core from npm has it
+// at <project>/node_modules/@bongos/core: git there answers for the PROJECT's repo, where that
+// folder is ignored, so every git-enumerating check finds nothing and throws a "scan defect".
+//
+// Decided POSITIVELY, never from a failure: only a core under a node_modules directory can
+// be installed. Anywhere else the answer is no, whatever git says — so a core checkout with
+// git missing, no .git, or a misresolved root still runs every check and fails closed the
+// way each check always has, instead of folding an error into the skip below. Under
+// node_modules it is installed unless it is the top of its own git checkout.
+function isInstalledCore(root = CORE_ROOT) {
+  if (!path.resolve(root).split(/[\\/]/).includes('node_modules')) return false;
+  try {
+    const top = require('node:child_process').execFileSync('git', ['rev-parse', '--show-toplevel'], { cwd: root, encoding: 'utf8', stdio: ['ignore', 'pipe', 'ignore'] }).trim();
+    return fs.realpathSync.native(top) !== fs.realpathSync.native(root);
+  } catch { return true; } // a package with no repo around it at all
+}
+
+// runChecks — run every fitness check, or none (task 1004737). Every check guards the core's
+// own source, and an INSTALLED core's source is not the project's to change: the core repo's
+// CI ran this gate before publishing it (the same stance ship-merge-gate.js takes for a
+// vendored instance). Run there, the git scans enumerate nothing and the checks either throw
+// or report a "scan defect", so fitness crashed and every ship reading it stalled. One honest
+// skipped result instead — not silence, and not a pass dressed up as a measurement.
+function runChecks(checks, { installed = isInstalledCore() } = {}) {
+  if (!installed) return checks.map((fn) => fn());
+  return [{
+    name: 'fitness gate — skipped: the core here is an installed package (task 1004737)',
+    ok: true, hardFail: false, violations: [],
+    warnings: ['none of the checks ran: this project installs the core rather than developing it'],
+    note: `${CORE_ROOT} is an installed package inside another repo, so there is no core source here to measure; the core repo's CI ran these ${checks.length} checks before it was published.`,
+  }];
+}
+
 module.exports = {
+  isInstalledCore,
+  runChecks,
   keyTokenRe,
   CORE_ROOT,
   INSTANCE_ROOT,

package/scripts/gds/fitness.js

@@ -33,7 +33,7 @@ const { resolveCoreRoot, resolveInstanceRoot } = require('../../src/instance-con
 // live beside it — the shared roots/walkers and three check clusters. They are
 // IMPORTED (not registered by path) so the CHECKS array and module.exports below
 // stay byte-identical to the single-file version every test was written against.
-const { CORE_ROOT, INSTANCE_ROOT, MODULE_ROOTS, REPO_ROOT, keyTokenRe, rel, walkJs, walkJsAllRoots } = require('./fitness-lib.js');
+const { CORE_ROOT, INSTANCE_ROOT, MODULE_ROOTS, REPO_ROOT, keyTokenRe, rel, runChecks, walkJs, walkJsAllRoots } = require('./fitness-lib.js');
 const { IDENTITY_SCAN_ALLOWED, IDENTITY_SCAN_EXCLUDE, IDENTITY_SCAN_EXTRA_FILES, IDENTITY_SCAN_EXTS, IDENTITY_SCAN_ROOTS, IDENTITY_SCAN_SKIP_DIRS, PROMPT_IDENTITY_LITERALS, checkDesignContract, checkKernelPromptsNoHardcodedIdentity, checkNeutralConfigsNoHostIdentity, collectIdentityFiles, scanPromptIdentity, stripCommentsForIdentity } = require('./fitness-checks-identity.js');
 const { WRITE_VALIDATION_BASELINE, WRITE_VALIDATION_EXEMPT, checkWriteRoutesValidated, scanUnvalidatedWriteRoutes } = require('./fitness-checks-write-validation.js');
 const { GOAL_VOCAB_CITATION, GOAL_VOCAB_LINE_SCOPED, GOAL_VOCAB_SURFACE, LIFECYCLE_DB_FILES, PRELAUNCH_SURFACE, RENAME_IDENTITY_RE, VOCAB_ALLOW, VOCAB_BANNED, VOCAB_CITATION, VOCAB_EXTS, VOCAB_HISTORICAL_REF, VOCAB_SURFACE, checkGoalMembershipVocabulary, checkGovernmentRenameIdentity, checkPrelaunchVocabulary, checkVocabularyWall, vocabFilesToScan } = require('./fitness-checks-vocabulary.js');
@@ -1404,7 +1404,7 @@ const CHECKS = [
 ];
 
 function runAll() {
-  return CHECKS.map((fn) => fn());
+  return runChecks(CHECKS); // task 1004737: an installed core has no core source to measure — one skipped result, not a crash
 }
 
 function main() {

package/scripts/gds/provision-core-upgrade.js

@@ -36,6 +36,7 @@ const { spawnSync } = require('child_process');
 const { CONFIG, MANIFEST_VERIFY_INTERVAL_MS, MANIFEST_VERIFY_TRIES, REPO_ROOT } = require('./provision-config.js');
 const { appUser, dbName, instanceUser, parseTargetRef, resolveOwnerGithubToken, selfInstanceRoot, standaloneRoot } = require('./provision-repo.js');
 const { ensurePinWriteKey, hasOwnAccount, pinKeyPath, pinSshCommand } = require('./provision-pin-key.js');
+const { replayPinCommit } = require('./provision-pin-replay.js'); // GitHub ahead → pin on top (task 1004733)
 const { isValidSlug } = require('../../modules/provisioning/provisioning.js');
 const { RELEASE_NOTES_FILE, RELEASE_NOTES_MAX_BYTES, parseChangeRecords, notesBetween } = require('./release-notes.js');
 const outcome = require('./upgrade-outcome.js'); // how far a failed move got, as a class (task 1004446)
@@ -411,9 +412,13 @@ async function coreUpgradeInstance(inst, deps, intent) {
 // parseRepoNote in modules/provisioning/core-upgrade.js (re-stated there because a
 // module may not require a script; tests/core_upgrade_runner.mjs round-trips the two).
 //
-// NOTHING IS FORCED OR REBASED. When GitHub has commits the box does not, putting the pin
-// on top of them would change what the live box runs with no restart and no health check.
-// That is reported for an operator to reconcile, never resolved here.
+// NOTHING IS FORCED, AND THE LIVE BOX IS NEVER REBASED. When GitHub has commits the box
+// does not, moving the box onto them would change what it runs with no restart and no
+// health check. Since task 1004733 the pin commit ALONE is replayed onto GitHub's history in
+// a scratch worktree and pushed as an ordinary fast-forward (provision-pin-replay.js), so
+// GitHub names the new core and the box stays exactly what the move proved. A conflict in
+// the pin files is reported ("conflict"), never resolved here. The box still does not pick
+// up the owner's other commits — that would be a deploy, not a pin push (ADR 0350 amendment).
 //
 // WHAT MAKES IT DURABLE (task 1004291, ADR 0350). The owner's token is kept for an hour
 // after they sign in with repository access (GITHUB_TOKEN_TTL_MS in src/bongos/db.js — one
@@ -431,6 +436,7 @@ const REPO_NOTES = Object.freeze({
   needs_account: 'The hub could not set up lasting write access to the project\'s GitHub repository: this project needs its own account on the server first. Once it has one, reconnecting GitHub with repository access sets up lasting access.',
   refused: 'GitHub turned down the owner\'s GitHub access — it may have expired, or lack permission to write to the repository.',
   behind: 'GitHub has changes the server does not have, so the new version could not be added on top of them. An operator needs to bring the two back in line; the site itself is running normally.',
+  conflict: 'GitHub has its own changes to the same version files (package.json or package-lock.json), so the new version was not added on top of them and nothing there was overwritten. An operator needs to choose between the two; the site itself is running normally.',
   failed: 'The hub could not save the new version to GitHub.',
 });
 // A branch name that is safe to interpolate. Narrower than git's own ref grammar on
@@ -498,6 +504,14 @@ async function pushUpgradePin(inst, deps, { instanceDir }) {
   const at = `${repo.owner}/${repo.name}@${branch}`;
   const hardened = `git -C ${instanceDir} -c core.hooksPath=/dev/null`;
   const env = { GIT_TERMINAL_PROMPT: '0' };   // a refused credential fails; it never waits at a prompt
+  // GitHub is ahead: replay the pin commit alone on top, over the credential that was just
+  // refused as behind, and push again — never forced (task 1004733, provision-pin-replay.js).
+  const replayed = (via, git, remote) => {
+    const rr = replayPinCommit({ exec, instanceDir, branch, git, remote, env, slug: inst.slug, tmpDir: deps.tmpDir, pushFault, gitLine, log });
+    if (!rr.ok) return miss(rr.code, rr.extra);
+    if (rr.already) log(`  ✓ ${at} already names this version — nothing to add`);
+    return { pushed: true, via, branch, ...(rr.replayed ? { replayed: true } : { already: true }) };
+  };
 
   const token = await resolveOwnerGithubToken(inst, deps, { tag: '[core-upgrade]' });
 
@@ -515,8 +529,9 @@ async function pushUpgradePin(inst, deps, { instanceDir }) {
       return { pushed: true, via: 'write-key', branch };
     }
     const fault = pushFault(r);
-    // The key WORKED and the history stopped it: no other credential changes that.
-    if (fault === 'behind') return miss('behind', gitLine(r));
+    // The key WORKED and the history stopped it: no other credential changes that, so the
+    // pin is replayed on top of GitHub's history over this same key (task 1004733).
+    if (fault === 'behind') return replayed('write-key', `${hardened} -c ${pinSshCommand(keyPath)}`, `git@github.com:${repo.owner}/${repo.name}.git`);
     log(`  • ${inst.slug}: the write key did not push (${fault}) — trying the next credential`);
   }
 
@@ -525,8 +540,11 @@ async function pushUpgradePin(inst, deps, { instanceDir }) {
     let r = null;
     try {
       writeFile(credFile, `https://x-access-token:${token}@github.com\n`, { mode: 0o600 });
-      r = exec(`${hardened} -c credential.helper= -c credential.helper='store --file=${credFile}' push https://x-access-token@github.com/${repo.owner}/${repo.name}.git HEAD:${branch}`,
-        { allowFail: true, env });
+      const viaToken = `${hardened} -c credential.helper= -c credential.helper='store --file=${credFile}'`;
+      const tokenRemote = `https://x-access-token@github.com/${repo.owner}/${repo.name}.git`;
+      r = exec(`${viaToken} push ${tokenRemote} HEAD:${branch}`, { allowFail: true, env });
+      // Behind: replayed while the credential file still exists (the finally removes it).
+      if (failedRun(r) && pushFault(r) === 'behind') return replayed('owner-token', viaToken, tokenRemote);
     } catch (e) {
       return miss('failed', `(could not stage the owner's credential: ${String((e && e.message) || e).slice(0, 160)})`);
     } finally {
@@ -547,6 +565,7 @@ async function pushUpgradePin(inst, deps, { instanceDir }) {
     return { pushed: true, via: 'origin', branch };
   }
   const fault = pushFault(r);
+  if (fault === 'behind') return replayed('origin', hardened, 'origin');
   // A refusal here is not the owner's access being turned down — there was none to turn
   // down. It is the read-only key, which is the no-access case.
   // ...unless the project has no account of its own, in which case no key CAN be minted

package/scripts/gds/provision-pin-replay.js

@@ -0,0 +1,126 @@
+'use strict';
+// provision-pin-replay.js — when GitHub is AHEAD of a hosted project's box, put the core move's
+// pin commit on top of GitHub's history instead of leaving GitHub on the old core (task 1004733,
+// ADR 0350 amendment).
+//
+// WHY. pushUpgradePin pushes the pin commit the move made on the box. For a project the owner
+// works from a laptop, GitHub almost always has commits the box does not, so that push is
+// refused as non-fast-forward ("behind"). Before this file the move then finished `done` with a
+// repo_not_updated note: the box ran the new core, GitHub still named the old one, and the next
+// deploy from GitHub could quietly roll the core back.
+//
+// WHAT IT DOES. Fetch the branch over the SAME credential that was refused, replay ONLY the pin
+// commit (package.json + package-lock.json, and any generated file upgrade.js committed with it)
+// on top of what was fetched, and push that — an ordinary fast-forward, never forced.
+//
+// THE LIVE BOX IS NOT TOUCHED. The replay happens in a scratch worktree (mode 0700, outside the
+// checkout, removed whatever happened). The box's HEAD, files and running site stay exactly what
+// the move's health check proved, which is why the old "nothing is rebased" rule (changing what
+// the box runs with no restart and no health check) still holds.
+//
+// A REAL CONFLICT STOPS. If the owner changed the same lines of those files, choosing between the
+// two is a person's call: the cherry-pick is aborted, nothing is pushed, and the note names the
+// files ("conflict"). Anything else that goes wrong reports, never retries in a loop.
+//
+// OUT OF SCOPE, ON PURPOSE: the box picking up the owner's OTHER commits. Nothing pulls them onto
+// a hosted box after provisioning (standalonePullCmd runs at provision time only, provision.js);
+// merging them into a live checkout here would deploy the owner's code with no install, migrate,
+// restart or health check — a deploy, not a pin push. ADR 0350's amendment records that ruling.
+//
+// NEVER THROWS: the caller turns a throw into a broken instance, and this instance is running.
+
+const crypto = require('node:crypto');
+const os = require('node:os');
+
+// The subject upgrade.js persistPin gives the pin commit. Anything else at HEAD is not ours to
+// replay onto someone's history.
+const PIN_SUBJECT_RE = /^pin @bongos\/core /;
+const PIN_FILES = ['package.json', 'package-lock.json'];
+const SHA_RE = /^[0-9a-f]{40,64}$/;
+// A scratch path the shell may see unquoted (the tmp dir itself is the runner's, but checked).
+const SAFE_PATH_RE = /^[A-Za-z0-9_./:~-]+$/;
+
+const failedRun = (r) => !r || r.softFailed === true || r.ok === false;
+const out = (r) => String((r && r.stdout) || '').trim();
+
+/**
+ * Replay the box's pin commit onto the branch GitHub has, and push it.
+ *
+ * @param {object} o
+ *   exec        the CONTROL PLANE executor (the one pushUpgradePin pushed with)
+ *   instanceDir the project's checkout on the hub
+ *   branch      the branch pushUpgradePin pushed (already BRANCH_RE-checked)
+ *   git         the credentialed, hardened git prefix that was refused as behind
+ *   remote      the remote that same push named
+ *   env         that push's env (GIT_TERMINAL_PROMPT=0)
+ *   slug        the project's (validated) slug, for the scratch path's name
+ *   tmpDir      where the scratch worktree goes (default os.tmpdir())
+ *   pushFault, gitLine  pushUpgradePin's own readers of a git refusal
+ * @returns {{ ok:true, replayed?:true, already?:true } | { ok:false, code:string, extra:string }}
+ */
+function replayPinCommit(o) {
+  try { return replay(o); } catch (e) {
+    return { ok: false, code: 'failed', extra: `(the pin could not be replayed: ${String((e && e.message) || e).slice(0, 160)})` };
+  }
+}
+
+function replay({ exec, instanceDir, branch, git, remote, env, slug, tmpDir, pushFault, gitLine, log = () => {} }) {
+  const plain = `git -C ${instanceDir} -c core.hooksPath=/dev/null`;
+  const run = (cmd, extraEnv) => exec(cmd, { allowFail: true, env: { ...env, ...(extraEnv || {}) } });
+
+  // 1. HEAD must be the move's own pin commit, with one parent, or there is nothing of ours to replay.
+  const head = run(`${plain} log -1 --format=%H%n%P%n%cn%n%ce%n%s HEAD`);
+  const [sha, parents, cn, ce, subject] = out(head).split('\n');
+  if (failedRun(head) || !SHA_RE.test(sha || '') || String(parents || '').split(' ').length !== 1 || !PIN_SUBJECT_RE.test(subject || '')) {
+    return { ok: false, code: 'behind', extra: '(the newest change on the server is not the version change, so it was not added on top)' };
+  }
+
+  // 2. What GitHub has now, over the same credential. Only FETCH_HEAD is written for it.
+  const fetched = run(`${git} fetch --no-tags ${remote} ${branch}`);
+  if (failedRun(fetched)) return { ok: false, code: 'behind', extra: gitLine(fetched) };
+  const upR = run(`${plain} rev-parse FETCH_HEAD`);
+  const up = out(upR);
+  if (failedRun(upR) || !SHA_RE.test(up)) return { ok: false, code: 'behind', extra: '(could not read what GitHub has)' };
+
+  // Already pinned the same way upstream (the owner bumped it by hand): nothing to add.
+  const same = run(`${plain} diff --quiet ${up} ${sha} -- ${PIN_FILES.join(' ')}`);
+  if (!failedRun(same)) return { ok: true, already: true };
+
+  // 3. Replay in a private scratch worktree, so the live checkout never moves.
+  const base = String(tmpDir || os.tmpdir()).replace(/\\/g, '/').replace(/\/+$/, '');
+  const wt = `${base}/bongos-pin-replay-${slug}-${process.pid}-${crypto.randomBytes(6).toString('hex')}`;
+  if (!SAFE_PATH_RE.test(wt)) return { ok: false, code: 'failed', extra: '(no safe scratch folder to replay the version change in)' };
+  try {
+    const made = run(`umask 077 && mkdir ${wt}`);
+    const added = failedRun(made) ? made : run(`${plain} worktree add --detach ${wt} ${up}`);
+    if (failedRun(added)) return { ok: false, code: 'failed', extra: gitLine(added) };
+    const at = `git -C ${wt} -c core.hooksPath=/dev/null`;
+    // The pin commit keeps its author and message; its committer stays who committed it on the
+    // box (env, not argv — a name is never shell-interpolated).
+    const who = cn && ce ? { GIT_COMMITTER_NAME: cn, GIT_COMMITTER_EMAIL: ce } : {};
+    const picked = run(`${at} cherry-pick ${sha}`, who);
+    if (failedRun(picked)) {
+      const both = out(run(`${at} diff --name-only --diff-filter=U`)).split('\n').filter(Boolean);
+      run(`${at} cherry-pick --abort`);
+      if (both.length) return { ok: false, code: 'conflict', extra: `(changed on both sides: ${both.join(', ').slice(0, 200)})` };
+      return { ok: false, code: 'failed', extra: gitLine(picked) };
+    }
+    const nextR = run(`${at} rev-parse HEAD`);
+    const next = out(nextR);
+    if (failedRun(nextR) || !SHA_RE.test(next)) return { ok: false, code: 'failed', extra: '(the replayed version change could not be read back)' };
+
+    // 4. A plain fast-forward of GitHub's branch to the replayed commit. A second refusal
+    // (someone pushed in between) is reported, not chased.
+    const pushed = run(`${git} push ${remote} ${next}:refs/heads/${branch}`);
+    if (failedRun(pushed)) return { ok: false, code: pushFault(pushed), extra: gitLine(pushed) };
+    log(`  ✓ GitHub had newer commits: the pin was added on top of them (${next.slice(0, 12)})`);
+    return { ok: true, replayed: true };
+  } finally {
+    // Not --force: the abort above leaves it clean, and the rm + prune catch anything left.
+    run(`${plain} worktree remove ${wt}`);
+    run(`rm -rf ${wt}`);
+    run(`${plain} worktree prune`);
+  }
+}
+
+module.exports = { replayPinCommit };

package/src/module-api.js

@@ -75,7 +75,7 @@ const { responsibilityFor, ROLE_RESPONSIBILITIES } = require('./role-responsibil
 // MAJOR (see allowBoxScope below): passes the request through untouched.
 function deprecatedNoopMiddleware(_req, _res, next) { next(); }
 
-const CORE_VERSION = '1.21.116'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
+const CORE_VERSION = '1.21.117'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('discord'); log.info('mounted');

package/tests/fitness_installed_core.mjs

@@ -0,0 +1,127 @@
+// tests/fitness_installed_core.mjs — fitness.js in a project that INSTALLS the core
+// (task 1004737).
+//
+// There the core sits at <project>/node_modules/@bongos/core: not a git checkout of its
+// own, just an ignored folder inside the project's repo. Every fitness check guards the
+// core's own source and enumerates it with git, so each scan found nothing and either
+// threw ("docs-entropy: scan defect — enumerated 0 tracked markdown files") or reported
+// a scan defect — `bongos exec scripts/gds/fitness.js` crashed on toast, on 1.21.20 and
+// again on 1.21.115. The core repo's CI already ran this gate before publishing, so in an
+// installed core it steps aside, and says so.
+import assert from 'node:assert/strict';
+import { test } from 'node:test';
+import { createRequire } from 'node:module';
+import { execFileSync } from 'node:child_process';
+import fs from 'node:fs';
+import os from 'node:os';
+import path from 'node:path';
+import { fileURLToPath } from 'node:url';
+
+const require = createRequire(import.meta.url);
+const ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
+const lib = require(path.join(ROOT, 'scripts', 'gds', 'fitness-lib.js'));
+
+const git = (cwd, ...args) => execFileSync('git', args, { cwd, encoding: 'utf8', stdio: ['ignore', 'pipe', 'pipe'] });
+
+function tempDir(t) {
+  const dir = fs.mkdtempSync(path.join(os.tmpdir(), 'fitness-installed-'));
+  t.after(() => fs.rmSync(dir, { recursive: true, force: true }));
+  return dir;
+}
+
+test('isInstalledCore: yes only for a core under node_modules that is not its own checkout', (t) => {
+  const base = tempDir(t);
+  const repo = path.join(base, 'project');
+  const nested = path.join(repo, 'node_modules', '@bongos', 'core');
+  const vendored = path.join(repo, 'vendor', 'core');
+  const looseInstalled = path.join(base, 'bare', 'node_modules', '@bongos', 'core');
+  const loose = path.join(base, 'loose');
+  for (const d of [nested, vendored, looseInstalled, loose]) fs.mkdirSync(d, { recursive: true });
+  git(repo, 'init', '-q');
+  assert.equal(lib.isInstalledCore(nested), true, 'an installed package inside a project repo is installed');
+  assert.equal(lib.isInstalledCore(looseInstalled), true, 'so is one under node_modules with no repo around it');
+  assert.equal(lib.isInstalledCore(ROOT), false, 'this checkout (main or a worktree) is not — the gate keeps running here');
+  assert.equal(lib.isInstalledCore(repo), false, 'nor is the root of any checkout');
+});
+
+// The grader's finding on the first cut: deciding "installed" from a git FAILURE let any git
+// trouble in the core's own checkout (git off PATH, no .git, a misresolved root) skip the whole
+// gate — rank guards and the core/host boundary included — and go green. Outside node_modules
+// the answer is now no regardless of git, so those trees run every check and fail closed.
+test('isInstalledCore: a git failure or a nested folder OUTSIDE node_modules never reads as installed (fail closed)', (t) => {
+  const base = tempDir(t);
+  const repo = path.join(base, 'project');
+  const vendored = path.join(repo, 'vendor', 'core');
+  const loose = path.join(base, 'loose');
+  fs.mkdirSync(vendored, { recursive: true });
+  fs.mkdirSync(loose);
+  git(repo, 'init', '-q');
+  assert.equal(lib.isInstalledCore(loose), false, 'no repo at all (git fails) outside node_modules: run the checks');
+  assert.equal(lib.isInstalledCore(vendored), false, 'a folder inside another repo but not under node_modules: run the checks');
+  assert.equal(lib.isInstalledCore(path.join(base, 'does-not-exist')), false, 'a misresolved root: run the checks');
+  const savedPath = process.env.PATH;
+  process.env.PATH = '';
+  try {
+    assert.equal(lib.isInstalledCore(ROOT), false, 'git missing from PATH in the core checkout: run the checks');
+  } finally {
+    process.env.PATH = savedPath;
+  }
+});
+
+test('runChecks: in the core\'s own checkout every check runs, and a throw still crashes (fail closed)', () => {
+  const ran = [];
+  const out = lib.runChecks([() => { ran.push(1); return { hardFail: false }; }, () => { ran.push(2); return { hardFail: true }; }], { installed: false });
+  assert.deepEqual(ran, [1, 2]);
+  assert.equal(out.length, 2);
+  assert.throws(() => lib.runChecks([() => { throw new Error('scan defect'); }], { installed: false }), /scan defect/);
+});
+
+test('runChecks: in an installed core no check runs, and one non-failing result says why', () => {
+  let ran = 0;
+  const out = lib.runChecks([() => { ran++; throw new Error('scan defect'); }, () => { ran++; return { hardFail: true }; }], { installed: true });
+  assert.equal(ran, 0, 'no check is run against a tree with no core source in it');
+  assert.equal(out.length, 1);
+  assert.equal(out[0].hardFail, false);
+  assert.match(out[0].name, /skipped/);
+  assert.match(out[0].name, /installed package/);
+  assert.ok(out[0].warnings.length > 0, 'the skip surfaces as a warning, not a silent pass');
+  assert.match(out[0].note, /2 checks/, 'and counts what it did not run');
+});
+
+test('end to end: fitness.js run from <project>/node_modules/@bongos/core exits 0 with the skip, instead of crashing', (t) => {
+  const project = tempDir(t);
+  const core = path.join(project, 'node_modules', '@bongos', 'core');
+  // The working tree as the package would ship it (tracked + new files), copied — not
+  // linked — so git inside it answers for the PROJECT, exactly as on toast.
+  const files = git(ROOT, 'ls-files', '-z', '--cached', '--others', '--exclude-standard').split('\0').filter(Boolean);
+  for (const f of files) {
+    const src = path.join(ROOT, f);
+    let st;
+    try { st = fs.lstatSync(src); } catch { continue; } // deleted in the working tree
+    if (!st.isFile()) continue;
+    fs.mkdirSync(path.dirname(path.join(core, f)), { recursive: true });
+    fs.copyFileSync(src, path.join(core, f));
+  }
+  fs.writeFileSync(path.join(project, '.gitignore'), 'node_modules\n');
+  fs.writeFileSync(path.join(project, 'CLAUDE.md'), '# project\n');
+  git(project, 'init', '-q');
+  git(project, 'add', '-A');
+  git(project, '-c', 'user.email=t@example.com', '-c', 'user.name=t', 'commit', '-qm', 'init');
+
+  let out = '';
+  let status = 0;
+  try {
+    out = execFileSync(process.execPath, [path.join(core, 'scripts', 'gds', 'fitness.js')], {
+      cwd: project,
+      encoding: 'utf8',
+      stdio: ['ignore', 'pipe', 'pipe'],
+      env: { ...process.env, NODE_PATH: path.join(ROOT, 'node_modules') },
+    });
+  } catch (e) {
+    status = e.status;
+    out = `${e.stdout || ''}${e.stderr || ''}`;
+  }
+  assert.equal(status, 0, `fitness must not fail an installed core's project:\n${out.slice(0, 2000)}`);
+  assert.match(out, /skipped: the core here is an installed package/);
+  assert.doesNotMatch(out, /scan defect/);
+});

package/tests/pin_replay.mjs

@@ -0,0 +1,147 @@
+// tests/pin_replay.mjs — a core move whose pin push is refused as "behind" replays the pin
+// commit onto GitHub's newer history instead of leaving GitHub on the old core (task 1004733).
+//
+// The normal case for a project worked from a laptop: the owner has pushed commits the box
+// does not have, so the box's pin commit cannot fast-forward GitHub. Before this task the move
+// finished `done` with a `repo_not_updated:behind` note and GitHub kept naming the old core, so
+// the next deploy from GitHub could quietly roll the core back. What these pin, against REAL
+// git repositories (a bare "GitHub", the box's checkout, the owner's laptop clone):
+//   * origin ahead → only the pin commit is replayed on top of it and pushed; the owner's
+//     commits stay, nothing is forced, and the live box's checkout is not touched
+//   * the owner changed the lockfile too → reported in plain words, GitHub left as it was
+//   * origin already up to date → the ordinary push, no replay at all
+//
+// Run:  node tests/pin_replay.mjs
+
+import { strict as assert } from 'node:assert';
+import { spawnSync } from 'node:child_process';
+import { mkdtempSync, writeFileSync, readFileSync, rmSync } from 'node:fs';
+import { tmpdir } from 'node:os';
+import { join } from 'node:path';
+import { pushUpgradePin } from '../scripts/gds/provision-core-upgrade.js';
+
+let passed = 0, failed = 0;
+const t = async (name, fn) => {
+  try { await fn(); passed += 1; console.log(`  PASS  ${name}`); }
+  catch (e) { failed += 1; console.log(`  FAIL  ${name}\n        ${e.message}`); }
+};
+
+// Forward slashes: the commands run through bash, which would eat a Windows backslash.
+const fwd = (p) => p.replace(/\\/g, '/');
+const ID = '-c user.name=tester -c user.email=tester@example.invalid';
+
+// The control plane's executor, for real: a shell command, the allowFail result shape
+// provision-config.js softFailResult returns (output kept, softFailed set).
+function realExec(ran) {
+  return (cmd, opts = {}) => {
+    ran.push(cmd);
+    const r = spawnSync('bash', ['-c', cmd], { encoding: 'utf8', env: { ...process.env, ...(opts.env || {}) } });
+    if (r.status === 0) return { ok: true, stdout: r.stdout || '', stderr: r.stderr || '' };
+    if (!opts.allowFail) throw new Error(`command failed: ${cmd}\n${r.stderr}`);
+    return { ok: true, stdout: r.stdout || '', stderr: r.stderr || '', softFailed: true };
+  };
+}
+const sh = (cmd) => {
+  const r = spawnSync('bash', ['-c', cmd], { encoding: 'utf8' });
+  if (r.status !== 0) throw new Error(`setup failed: ${cmd}\n${r.stderr}`);
+  return String(r.stdout || '').trim();
+};
+
+const pkg = (core, extra = {}) => `${JSON.stringify({ name: 'site', dependencies: { '@bongos/core': core, ...extra } }, null, 2)}\n`;
+const lock = (core, extra = '') => `${JSON.stringify({ name: 'site', lockfileVersion: 3, packages: { 'node_modules/@bongos/core': { version: core } }, note: extra }, null, 2)}\n`;
+
+// A bare "GitHub", the box's checkout (holding an unpushed pin commit, as upgrade.js
+// --commit-pin --pin-no-push leaves it), and the owner's laptop clone.
+function world({ ownerChanges = null } = {}) {
+  const root = fwd(mkdtempSync(join(tmpdir(), 'pin-replay-')));
+  const origin = `${root}/origin.git`, box = `${root}/box`, laptop = `${root}/laptop`, scratch = `${root}/scratch`;
+  sh(`git init -q --bare ${origin} && git -C ${origin} symbolic-ref HEAD refs/heads/main`);
+  sh(`git init -q ${laptop} && git -C ${laptop} checkout -q -b main`);
+  writeFileSync(`${laptop}/package.json`, pkg('1.0.0'));
+  writeFileSync(`${laptop}/package-lock.json`, lock('1.0.0'));
+  writeFileSync(`${laptop}/index.html`, '<p>v1</p>\n');
+  sh(`git -C ${laptop} add -A && git -C ${laptop} ${ID} commit -q -m init && git -C ${laptop} remote add origin ${origin} && git -C ${laptop} push -q origin main`);
+  sh(`git clone -q ${origin} ${box}`);
+  // The move's pin commit, on the box.
+  writeFileSync(`${box}/package.json`, pkg('1.1.0'));
+  writeFileSync(`${box}/package-lock.json`, lock('1.1.0'));
+  sh(`git -C ${box} add package.json package-lock.json && git -C ${box} ${ID} commit -q -m "pin @bongos/core 1.1.0 (was 1.0.0)"`);
+  if (ownerChanges) {
+    ownerChanges(laptop);
+    sh(`git -C ${laptop} add -A && git -C ${laptop} ${ID} commit -q -m "owner work" && git -C ${laptop} push -q origin main`);
+  }
+  return { root, origin, box, laptop, scratch, done: () => { try { rmSync(root, { recursive: true, force: true }); } catch { /* best effort */ } } };
+}
+
+const inst = { id: 9, slug: 'acme-site', hosting_shape: 'cloud-host', status: 'active', owner_builder_id: 5, target_ref: 'acme/site' };
+function run(w) {
+  const ran = [], logs = [];
+  const deps = {
+    controlExec: realExec(ran), log: (l) => logs.push(String(l)),
+    getGithubToken: async () => null,                    // no owner token: the box's own remote pushes
+    fsImpl: { existsSync: () => false },                 // and no write key on this hub
+    pinKeyDir: `${w.root}/keys`, tmpDir: w.scratch,
+  };
+  sh(`mkdir -p ${w.scratch}`);
+  return pushUpgradePin(inst, deps, { instanceDir: w.box }).then((out) => ({ out, ran, logs }));
+}
+const at = (dir, ref) => sh(`git -C ${dir} rev-parse ${ref}`);
+const show = (dir, ref, file) => sh(`git -C ${dir} show ${ref}:${file}`);
+
+console.log('origin AHEAD of the box: the pin commit is replayed on top and pushed');
+
+await t('the owner\'s commits stay, the pin lands on top of them, and nothing is forced', async () => {
+  const w = world({ ownerChanges: (d) => writeFileSync(`${d}/index.html`, '<p>v2 from the laptop</p>\n') });
+  try {
+    const ownerTip = at(w.origin, 'main');
+    const boxHead = at(w.box, 'HEAD');
+    const { out, ran } = await run(w);
+    assert.equal(out.pushed, true, `pushed — got ${JSON.stringify(out)}`);
+    assert.equal(out.replayed, true, 'by replaying the pin, not by the first push');
+    assert.equal(out.via, 'origin', 'over the same credential that was refused as behind');
+    const tip = at(w.origin, 'main');
+    assert.equal(at(w.origin, 'main^'), ownerTip, 'the replayed pin sits directly on the owner\'s newest commit');
+    assert.match(show(w.origin, 'main', 'package.json'), /"@bongos\/core": "1\.1\.0"/, 'GitHub now names the new core');
+    assert.match(show(w.origin, 'main', 'package-lock.json'), /"version": "1\.1\.0"/);
+    assert.match(show(w.origin, 'main', 'index.html'), /v2 from the laptop/, 'the owner\'s work is still there');
+    assert.equal(sh(`git -C ${w.origin} log -1 --format=%s main`), 'pin @bongos/core 1.1.0 (was 1.0.0)', 'the pin commit\'s own message');
+    assert.notEqual(tip, boxHead, 'a new commit, not the box\'s');
+    assert.equal(at(w.box, 'HEAD'), boxHead, 'the live box\'s checkout was NOT moved');
+    assert.match(readFileSync(`${w.box}/index.html`, 'utf8'), /v1/, 'nor its files changed under the running site');
+    assert.equal(sh(`git -C ${w.box} worktree list`).split('\n').length, 1, 'the scratch copy was cleaned up');
+    assert.ok(!ran.some((c) => /--force|\s\+\S|reset --hard|rebase/.test(c)), `never forced: ${ran.join('\n')}`);
+  } finally { w.done(); }
+});
+
+await t('a conflicting LOCKFILE is reported in plain words, and GitHub is left exactly as it was', async () => {
+  const w = world({ ownerChanges: (d) => writeFileSync(`${d}/package-lock.json`, lock('1.0.1', 'the owner reinstalled')) });
+  try {
+    const ownerTip = at(w.origin, 'main');
+    const boxHead = at(w.box, 'HEAD');
+    const { out, ran } = await run(w);
+    assert.equal(out.pushed, false);
+    assert.equal(out.code, 'conflict');
+    assert.match(out.note, /^repo_not_updated:conflict: /, 'the note the web tier reads');
+    assert.match(out.note, /package-lock\.json/, 'it names the file');
+    assert.equal(at(w.origin, 'main'), ownerTip, 'nothing was pushed over the owner\'s commit');
+    assert.equal(at(w.box, 'HEAD'), boxHead, 'the box is untouched');
+    assert.equal(sh(`git -C ${w.box} status --porcelain`), '', 'and its tree is clean');
+    assert.equal(sh(`git -C ${w.box} worktree list`).split('\n').length, 1, 'the scratch copy was cleaned up');
+    assert.ok(!ran.some((c) => /--force|\s\+\S|reset --hard/.test(c)), 'never forced');
+  } finally { w.done(); }
+});
+
+await t('origin UP TO DATE: the ordinary push, no fetch and no replay', async () => {
+  const w = world();
+  try {
+    const boxHead = at(w.box, 'HEAD');
+    const { out, ran } = await run(w);
+    assert.equal(out.pushed, true);
+    assert.ok(!out.replayed, 'nothing to replay');
+    assert.equal(at(w.origin, 'main'), boxHead, 'GitHub fast-forwarded to the box\'s own pin commit');
+    assert.ok(!ran.some((c) => / fetch | worktree | cherry-pick /.test(c)), `no replay machinery ran: ${ran.join('\n')}`);
+  } finally { w.done(); }
+});
+
+console.log(`\n${passed} passed, ${failed} failed`);
+if (failed) process.exit(1);

package/tests/pin_write_key.mjs

@@ -262,6 +262,32 @@ await t('GitHub AHEAD of the box (rejected non-fast-forward) on the write key: r
   assert.ok(!call(r, /x-access-token@/) && !call(r, / push origin /));
 });
 
+await t('GitHub AHEAD on the write key: the pin is replayed and pushed over THAT key, never forced (task 1004733)', async () => {
+  const SHA = 'a'.repeat(40), UP = 'b'.repeat(40), NEXT = 'c'.repeat(40);
+  const r = pushRig();
+  let keyPushes = 0;
+  const inner = r.deps.exec;
+  r.deps.exec = (cmd, opts) => {
+    if (/core\.sshCommand=.* push /.test(cmd) && keyPushes++ === 0) { r.ran.push({ cmd, env: opts && opts.env }); return refused(' ! [rejected]        HEAD -> main (fetch first)'); }
+    if (/log -1 --format=/.test(cmd)) { r.ran.push({ cmd }); return { ok: true, stdout: `${SHA}\n${'d'.repeat(40)}\nbox\nbox@x.invalid\npin @bongos/core 1.2.0 (was 1.1.0)\n` }; }
+    if (/rev-parse FETCH_HEAD/.test(cmd)) { r.ran.push({ cmd }); return { ok: true, stdout: `${UP}\n` }; }
+    if (/diff --quiet /.test(cmd)) { r.ran.push({ cmd }); return refused(''); }
+    if (/rev-parse HEAD/.test(cmd)) { r.ran.push({ cmd }); return { ok: true, stdout: `${NEXT}\n` }; }
+    return inner(cmd, opts);
+  };
+  const out = await push(r);
+  assert.equal(out.pushed, true);
+  assert.equal(out.via, 'write-key');
+  assert.equal(out.replayed, true);
+  const fetch = call(r, / fetch /);
+  assert.ok(fetch && fetch.cmd.includes('core.sshCommand=') && fetch.cmd.includes('git@github.com:acme/site.git main'), `fetched over the key: ${fetch && fetch.cmd}`);
+  const again = r.ran.filter((c) => /core\.sshCommand=.* push /.test(c.cmd)).pop();
+  assert.ok(again.cmd.includes(`push git@github.com:acme/site.git ${NEXT}:refs/heads/main`), `the replayed commit, over the key: ${again.cmd}`);
+  assert.ok(call(r, new RegExp(`cherry-pick ${SHA}`)), 'only the pin commit is replayed');
+  assert.ok(!r.ran.some((c) => /--force|\s\+\S|reset --hard|rebase/.test(c.cmd)), 'never forced');
+  assert.ok(!call(r, /x-access-token@/) && !call(r, / push origin /), 'no other credential');
+});
+
 await t('NO KEY yet but a FRESH TOKEN: the key is minted first (reconnecting is enough), then used', async () => {
   const r = pushRig({ hasKey: false });
   const out = await push(r);