@bongos/core 1.21.116 → 1.21.118

package/tests/core_auto_upgrade.mjs

@@ -0,0 +1,189 @@
+// tests/core_auto_upgrade.mjs — the hub moves each hosted project's core on its own,
+// by that project's update rule (task 1004729, ADR 0381).
+//
+// The runner tick used to compute `recommended` for every cloud-host and stop; a move
+// only happened when someone pressed the button. These tests drive the new step with a
+// fake db and a fake provisioning port and assert WHAT IT QUEUES:
+//   behind on `patch`            → a preflight for `recommended`
+//   preflight passed that target → the move to it
+//   pinned / open intent / held target / control-plane row → nothing
+//   more candidates than the pace → only AUTO_MOVES_PER_TICK queued
+//   the platform-wide off switch  → nothing at all
+//
+// Run:  node tests/core_auto_upgrade.mjs
+
+import { strict as assert } from 'node:assert';
+import { autoUpgradeTick, AUTO_MOVES_PER_TICK, autoUpgradeEnabled } from '../scripts/gds/provision-auto-upgrade.js';
+
+let passed = 0;
+let failed = 0;
+const t = async (name, fn) => {
+  try { await fn(); passed += 1; console.log(`  PASS  ${name}`); }
+  catch (e) { failed += 1; console.log(`  FAIL  ${name}\n        ${e.message}`); }
+};
+
+// One hosted project, its snapshot row joined on, as the candidate query returns it.
+function row(over = {}) {
+  return {
+    id: 52, slug: 'toast', owner_builder_id: 7, hosting_shape: 'cloud-host', status: 'active',
+    update_channel: 'patch', served_version: '1.21.20', recommended: '1.21.69', preflight: null,
+    ...over,
+  };
+}
+
+// A fake world: `rows` are candidates, `intents` the provisioning_intents history.
+function makeDeps({ rows = [row()], intents = [], env = {} } = {}) {
+  const queued = [];
+  const events = [];
+  const db = {
+    async query(sql, params) {
+      if (/FROM provisioning_instances/.test(sql)) return { rows };
+      if (/FROM provisioning_intents/.test(sql)) {
+        const ids = params[0].map(Number);
+        return { rows: intents.filter((i) => ids.includes(Number(i.instance_id))) };
+      }
+      throw new Error(`unexpected query: ${sql}`);
+    },
+  };
+  const provisioning = {
+    async enqueueIntent(_db, instanceId, action, requestedBy, target) {
+      const intent = { id: 900 + queued.length, instance_id: instanceId, action, requested_by: requestedBy, target_version: target, state: 'pending' };
+      queued.push(intent);
+      return { intent, created: true };
+    },
+    async recordEvent(_db, e) { events.push(e); },
+  };
+  return { db, provisioning, env, log: () => {}, queued, events };
+}
+
+console.log('core auto-upgrade tick (task 1004729)');
+
+await t('a patch tenant behind gets a preflight queued for recommended, attributed to the runner', async () => {
+  const d = makeDeps();
+  const r = await autoUpgradeTick(d);
+  assert.equal(d.queued.length, 1);
+  assert.equal(d.queued[0].action, 'core-upgrade-preflight');
+  assert.equal(d.queued[0].target_version, '1.21.69');
+  assert.equal(d.queued[0].instance_id, 52);
+  assert.equal(d.queued[0].requested_by, 'runner:auto-upgrade');
+  assert.equal(r.queued, 1);
+});
+
+await t('a preflight that PASSED for that target queues the move to it', async () => {
+  const d = makeDeps({ rows: [row({ preflight: { target: '1.21.69', ok: true } })],
+    intents: [{ instance_id: 52, action: 'core-upgrade-preflight', state: 'done', target_version: '1.21.69' }] });
+  await autoUpgradeTick(d);
+  assert.equal(d.queued.length, 1);
+  assert.equal(d.queued[0].action, 'core-upgrade');
+  assert.equal(d.queued[0].target_version, '1.21.69');
+});
+
+await t('a passed preflight for a DIFFERENT target re-asks for the current one', async () => {
+  const d = makeDeps({ rows: [row({ preflight: { target: '1.21.50', ok: true } })] });
+  await autoUpgradeTick(d);
+  assert.equal(d.queued[0].action, 'core-upgrade-preflight');
+  assert.equal(d.queued[0].target_version, '1.21.69');
+});
+
+await t('a pinned tenant gets nothing', async () => {
+  const d = makeDeps({ rows: [row({ update_channel: 'pinned' })] });
+  await autoUpgradeTick(d);
+  assert.equal(d.queued.length, 0);
+});
+
+await t('a tenant with an open intent gets nothing new', async () => {
+  for (const state of ['pending', 'running']) {
+    const d = makeDeps({ intents: [{ instance_id: 52, action: 'restart', state, target_version: null }] });
+    await autoUpgradeTick(d);
+    assert.equal(d.queued.length, 0, state);
+  }
+});
+
+await t('a target held by a failed move is not queued (retired core-upgrade)', async () => {
+  const d = makeDeps({ rows: [row({ preflight: { target: '1.21.69', ok: true } })],
+    intents: [{ instance_id: 52, action: 'core-upgrade', state: 'error', target_version: '1.21.69' }] });
+  await autoUpgradeTick(d);
+  assert.equal(d.queued.length, 0);
+});
+
+await t('a target held by a refused preflight is not queued', async () => {
+  const d = makeDeps({ rows: [row({ preflight: { target: '1.21.69', ok: false, error: 'migration would fail' } })] });
+  await autoUpgradeTick(d);
+  assert.equal(d.queued.length, 0);
+});
+
+await t('a target whose preflight intent itself errored is not re-asked', async () => {
+  const d = makeDeps({ intents: [{ instance_id: 52, action: 'core-upgrade-preflight', state: 'error', target_version: '1.21.69' }] });
+  await autoUpgradeTick(d);
+  assert.equal(d.queued.length, 0);
+});
+
+await t('a move that finished but left the box behind is not re-queued every tick', async () => {
+  const d = makeDeps({ rows: [row({ preflight: { target: '1.21.69', ok: true } })],
+    intents: [{ instance_id: 52, action: 'core-upgrade', state: 'done', target_version: '1.21.69' }] });
+  await autoUpgradeTick(d);
+  assert.equal(d.queued.length, 0);
+});
+
+await t('an older failed target does not hold a newer one', async () => {
+  const d = makeDeps({ intents: [{ instance_id: 52, action: 'core-upgrade', state: 'error', target_version: '1.21.60' }] });
+  await autoUpgradeTick(d);
+  assert.equal(d.queued.length, 1);
+  assert.equal(d.queued[0].target_version, '1.21.69');
+});
+
+await t('the control-plane row (and any non-cloud-host) gets nothing', async () => {
+  const d = makeDeps({ rows: [row({ id: 1, slug: 'hub', hosting_shape: 'control-plane' }), row({ id: 3, slug: 'ct', hosting_shape: 'co-tenant' })] });
+  await autoUpgradeTick(d);
+  assert.equal(d.queued.length, 0);
+});
+
+await t('nothing is queued when recommended is not newer than served', async () => {
+  for (const over of [{ recommended: null }, { recommended: '1.21.20' }, { recommended: '1.21.10' }, { served_version: null }]) {
+    const d = makeDeps({ rows: [row(over)] });
+    await autoUpgradeTick(d);
+    assert.equal(d.queued.length, 0, JSON.stringify(over));
+  }
+});
+
+await t('at most the pace limit is queued per tick', async () => {
+  assert.equal(AUTO_MOVES_PER_TICK, 1);
+  const d = makeDeps({ rows: [row({ id: 52 }), row({ id: 53, slug: 'b' }), row({ id: 54, slug: 'c' })] });
+  const r = await autoUpgradeTick(d);
+  assert.equal(d.queued.length, AUTO_MOVES_PER_TICK);
+  assert.equal(r.queued, AUTO_MOVES_PER_TICK);
+});
+
+await t('the pace counts only intents actually created (a lost race does not spend it)', async () => {
+  const d = makeDeps({ rows: [row({ id: 52 }), row({ id: 53, slug: 'b' })] });
+  const real = d.provisioning.enqueueIntent;
+  let first = true;
+  d.provisioning.enqueueIntent = async (...a) => {
+    if (first) { first = false; return { intent: { state: 'pending' }, created: false }; }
+    return real(...a);
+  };
+  await autoUpgradeTick(d);
+  assert.equal(d.queued.length, 1);
+  assert.equal(d.queued[0].instance_id, 53);
+});
+
+await t('the off switch stops every automatic move, and it defaults ON', async () => {
+  for (const v of ['off', '0', 'false', 'no', 'OFF']) {
+    const d = makeDeps({ env: { BONGOS_AUTO_CORE_UPGRADE: v } });
+    const r = await autoUpgradeTick(d);
+    assert.equal(d.queued.length, 0, v);
+    assert.equal(r.off, true);
+  }
+  assert.equal(autoUpgradeEnabled({}), true);
+  assert.equal(autoUpgradeEnabled({ BONGOS_AUTO_CORE_UPGRADE: 'on' }), true);
+});
+
+await t('a refusal from enqueueIntent (e.g. the control-plane guard) never fails the tick', async () => {
+  const d = makeDeps();
+  d.provisioning.enqueueIntent = async () => { throw new Error('refused'); };
+  const r = await autoUpgradeTick(d);
+  assert.equal(r.queued, 0);
+});
+
+console.log(`\n${passed} passed, ${failed} failed`);
+if (failed) process.exit(1);

package/tests/db_ownership_handover.mjs

@@ -0,0 +1,156 @@
+// tests/db_ownership_handover.mjs — the ownership handover against a REAL Postgres
+// (task 1004735).
+//
+// A project with its own database account had its tables made by postgres at provisioning
+// and only GRANTed to the account. Later core moves migrate AS that account, and GRANT ALL
+// does not carry the right to ALTER TABLE or CREATE OR REPLACE FUNCTION — only ownership
+// does — so toast's first ALTERing move failed "must be owner of table tasks" and rolled
+// back. dbOwnershipSql (scripts/gds/provision-repo.js) hands everything over. It is one long
+// DO block of catalog queries, which a string test cannot prove: whether it actually runs,
+// which objects it reaches, and that it leaves extension-owned objects alone are questions
+// only a real engine answers.
+//
+// Hermetic within the database: a throwaway schema and role, both dropped at the end, so the
+// shared fixture database's public schema is never touched. Needs a superuser (CREATE ROLE,
+// giving away postgres-owned objects) — the integration lane's postgres is one.
+//
+// Real-DB integration test: self-skips without a reachable Postgres; in the INTEGRATION set
+// so the default DB-free lane never runs it.
+//
+// Run:  DATABASE_URL=... node tests/db_ownership_handover.mjs
+
+import { strict as assert } from 'node:assert';
+import { createRequire } from 'node:module';
+
+const require = createRequire(import.meta.url);
+const { Pool } = require('pg');
+const { dbOwnershipSql } = require('../scripts/gds/provision-repo.js');
+
+const pool = new Pool({ connectionString: process.env.DATABASE_URL || undefined });
+let client;
+try {
+  client = await pool.connect();
+} catch (e) {
+  console.log(`db_ownership_handover.mjs SKIPPED — no reachable Postgres (${e.code || e.message}).`);
+  await pool.end().catch(() => {});
+  process.exit(0);
+}
+const { rows: [me] } = await client.query('SELECT rolsuper FROM pg_roles WHERE rolname = current_user');
+if (!me || !me.rolsuper) {
+  console.log('db_ownership_handover.mjs SKIPPED — the connecting role is not a superuser, so it cannot stand in for postgres here.');
+  client.release();
+  await pool.end();
+  process.exit(0);
+}
+
+const SCHEMA = `own_t_${process.pid}`;
+const ROLE = `own-t-role-${process.pid}`; // a hyphen, like the real bongos-<slug> roles
+const q = (sql) => client.query(sql);
+let passed = 0;
+let failed = 0;
+const t = async (name, fn) => {
+  try { await fn(); passed += 1; console.log(`  PASS  ${name}`); }
+  catch (e) { failed += 1; console.log(`  FAIL  ${name}\n        ${e.message}`); }
+};
+
+// Every object in the schema that the handover is meant to reach, with its owner. Excludes
+// what follows something else: table row types, auto-made array types, column-owned sequences.
+const OWNERS = `
+  SELECT c.relname AS name, pg_get_userbyid(c.relowner) AS owner FROM pg_class c
+   WHERE c.relnamespace = '${SCHEMA}'::regnamespace AND c.relkind IN ('r','p','v','m','f','S')
+  UNION ALL
+  SELECT p.proname, pg_get_userbyid(p.proowner) FROM pg_proc p WHERE p.pronamespace = '${SCHEMA}'::regnamespace
+  UNION ALL
+  SELECT y.typname, pg_get_userbyid(y.typowner) FROM pg_type y
+   WHERE y.typnamespace = '${SCHEMA}'::regnamespace AND y.typtype IN ('e','d','r')`;
+
+let extension = null;
+try {
+  await q(`CREATE ROLE "${ROLE}" LOGIN`);
+  // The schema is the role's, as public is the database owner's on a real project (PG15+:
+  // pg_database_owner) — the objects INSIDE it are still postgres's, which is the bug.
+  await q(`CREATE SCHEMA ${SCHEMA} AUTHORIZATION "${ROLE}"`);
+  await q(`SET search_path = ${SCHEMA}`);
+  await q(`CREATE TABLE tasks (id serial PRIMARY KEY, n int GENERATED BY DEFAULT AS IDENTITY, title text)`);
+  await q(`CREATE TABLE events (id bigint, at date) PARTITION BY RANGE (at)`);
+  await q(`CREATE TABLE events_2026 PARTITION OF events FOR VALUES FROM ('2026-01-01') TO ('2027-01-01')`);
+  await q(`CREATE VIEW open_tasks AS SELECT * FROM tasks`);
+  await q(`CREATE MATERIALIZED VIEW task_count AS SELECT count(*) FROM tasks`);
+  await q(`CREATE SEQUENCE free_seq`);
+  await q(`CREATE FUNCTION promote_dependents_on_ship() RETURNS int LANGUAGE sql AS 'SELECT 1'`);
+  await q(`CREATE PROCEDURE tidy() LANGUAGE sql AS 'SELECT 1'`);
+  await q(`CREATE AGGREGATE total(int) (SFUNC = int4pl, STYPE = int)`);
+  await q(`CREATE TYPE mood AS ENUM ('ok', 'not')`);
+  await q(`CREATE DOMAIN positive AS int CHECK (VALUE > 0)`);
+  await q(`CREATE TYPE pair AS (a int, b int)`);
+  // An extension's objects in the same schema must be left alone (and must not make the
+  // handover error). Use whichever stock extension this server has and has not installed.
+  const { rows: ext } = await q(`SELECT name FROM pg_available_extensions
+    WHERE name IN ('pg_trgm','citext','hstore','tablefunc','fuzzystrmatch') AND installed_version IS NULL ORDER BY name LIMIT 1`);
+  if (ext.length) {
+    extension = ext[0].name;
+    await q(`CREATE EXTENSION ${extension} SCHEMA ${SCHEMA}`);
+  }
+  await q(`RESET search_path`);
+
+  console.log('\nthe ownership handover against a real Postgres:');
+
+  await t('before: the account can USE the tables but cannot ALTER one — the bug, reproduced', async () => {
+    await q(`GRANT ALL ON ALL TABLES IN SCHEMA ${SCHEMA} TO "${ROLE}"`);
+    await q(`SET ROLE "${ROLE}"`);
+    try {
+      await assert.rejects(q(`ALTER TABLE ${SCHEMA}.tasks ADD COLUMN parked boolean`), /must be owner of table tasks/);
+    } finally { await q('RESET ROLE'); }
+  });
+
+  await t('the handover runs, and every table, view, sequence, function and type is the account\'s', async () => {
+    await q(dbOwnershipSql(ROLE, SCHEMA));
+    const { rows } = await q(OWNERS);
+    const extOwned = extension
+      ? new Set((await q(`SELECT p.proname AS name FROM pg_proc p JOIN pg_depend d ON d.objid = p.oid AND d.deptype = 'e'
+          WHERE p.pronamespace = '${SCHEMA}'::regnamespace
+          UNION SELECT y.typname FROM pg_type y JOIN pg_depend d ON d.objid = y.oid AND d.deptype = 'e'
+          WHERE y.typnamespace = '${SCHEMA}'::regnamespace`)).rows.map((r) => r.name))
+      : new Set();
+    const mine = rows.filter((r) => !extOwned.has(r.name));
+    for (const name of ['tasks', 'tasks_id_seq', 'tasks_n_seq', 'events', 'events_2026', 'open_tasks', 'task_count', 'free_seq',
+      'promote_dependents_on_ship', 'tidy', 'total', 'mood', 'positive']) {
+      const row = mine.find((r) => r.name === name);
+      assert.ok(row, `${name} exists`);
+      assert.equal(row.owner, ROLE, `${name} is owned by the account`);
+    }
+    const { rows: [pair] } = await q(`SELECT pg_get_userbyid(typowner) AS owner FROM pg_type WHERE typname = 'pair' AND typnamespace = '${SCHEMA}'::regnamespace`);
+    assert.equal(pair.owner, ROLE, 'a CREATE TYPE composite too');
+    const left = mine.filter((r) => r.owner !== ROLE);
+    assert.deepEqual(left, [], 'nothing of the project\'s is left with postgres');
+  });
+
+  await t('extension objects stay with the extension\'s owner — never handed over', async () => {
+    if (!extension) { console.log('        (no spare stock extension on this server — sub-case not exercised)'); return; }
+    const { rows } = await q(`SELECT pg_get_userbyid(p.proowner) AS owner FROM pg_proc p JOIN pg_depend d ON d.objid = p.oid AND d.deptype = 'e'
+      WHERE p.pronamespace = '${SCHEMA}'::regnamespace`);
+    assert.ok(rows.length > 0, `precondition: ${extension} put functions in the schema`);
+    assert.ok(rows.every((r) => r.owner !== ROLE), `${extension}'s functions are untouched`);
+  });
+
+  await t('after: the account can ALTER a table and CREATE OR REPLACE a function — what core_274 needed', async () => {
+    await q(`SET ROLE "${ROLE}"`);
+    try {
+      await q(`ALTER TABLE ${SCHEMA}.tasks ADD COLUMN parked boolean`);
+      await q(`CREATE OR REPLACE FUNCTION ${SCHEMA}.promote_dependents_on_ship() RETURNS int LANGUAGE sql AS 'SELECT 2'`);
+    } finally { await q('RESET ROLE'); }
+  });
+
+  await t('a second run is a clean no-op (provisioning re-runs it; the remedy may meet a healed project)', async () => {
+    await q(dbOwnershipSql(ROLE, SCHEMA));
+  });
+} finally {
+  await q('RESET ROLE').catch(() => {});
+  await q(`DROP SCHEMA IF EXISTS ${SCHEMA} CASCADE`).catch((e) => console.log(`  cleanup: ${e.message}`));
+  await q(`DROP ROLE IF EXISTS "${ROLE}"`).catch((e) => console.log(`  cleanup: ${e.message}`));
+  client.release();
+  await pool.end();
+}
+
+console.log(`\ndb_ownership_handover: ${passed} passed, ${failed} failed`);
+process.exit(failed ? 1 : 0);

package/tests/fitness_installed_core.mjs

@@ -0,0 +1,127 @@
+// tests/fitness_installed_core.mjs — fitness.js in a project that INSTALLS the core
+// (task 1004737).
+//
+// There the core sits at <project>/node_modules/@bongos/core: not a git checkout of its
+// own, just an ignored folder inside the project's repo. Every fitness check guards the
+// core's own source and enumerates it with git, so each scan found nothing and either
+// threw ("docs-entropy: scan defect — enumerated 0 tracked markdown files") or reported
+// a scan defect — `bongos exec scripts/gds/fitness.js` crashed on toast, on 1.21.20 and
+// again on 1.21.115. The core repo's CI already ran this gate before publishing, so in an
+// installed core it steps aside, and says so.
+import assert from 'node:assert/strict';
+import { test } from 'node:test';
+import { createRequire } from 'node:module';
+import { execFileSync } from 'node:child_process';
+import fs from 'node:fs';
+import os from 'node:os';
+import path from 'node:path';
+import { fileURLToPath } from 'node:url';
+
+const require = createRequire(import.meta.url);
+const ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
+const lib = require(path.join(ROOT, 'scripts', 'gds', 'fitness-lib.js'));
+
+const git = (cwd, ...args) => execFileSync('git', args, { cwd, encoding: 'utf8', stdio: ['ignore', 'pipe', 'pipe'] });
+
+function tempDir(t) {
+  const dir = fs.mkdtempSync(path.join(os.tmpdir(), 'fitness-installed-'));
+  t.after(() => fs.rmSync(dir, { recursive: true, force: true }));
+  return dir;
+}
+
+test('isInstalledCore: yes only for a core under node_modules that is not its own checkout', (t) => {
+  const base = tempDir(t);
+  const repo = path.join(base, 'project');
+  const nested = path.join(repo, 'node_modules', '@bongos', 'core');
+  const vendored = path.join(repo, 'vendor', 'core');
+  const looseInstalled = path.join(base, 'bare', 'node_modules', '@bongos', 'core');
+  const loose = path.join(base, 'loose');
+  for (const d of [nested, vendored, looseInstalled, loose]) fs.mkdirSync(d, { recursive: true });
+  git(repo, 'init', '-q');
+  assert.equal(lib.isInstalledCore(nested), true, 'an installed package inside a project repo is installed');
+  assert.equal(lib.isInstalledCore(looseInstalled), true, 'so is one under node_modules with no repo around it');
+  assert.equal(lib.isInstalledCore(ROOT), false, 'this checkout (main or a worktree) is not — the gate keeps running here');
+  assert.equal(lib.isInstalledCore(repo), false, 'nor is the root of any checkout');
+});
+
+// The grader's finding on the first cut: deciding "installed" from a git FAILURE let any git
+// trouble in the core's own checkout (git off PATH, no .git, a misresolved root) skip the whole
+// gate — rank guards and the core/host boundary included — and go green. Outside node_modules
+// the answer is now no regardless of git, so those trees run every check and fail closed.
+test('isInstalledCore: a git failure or a nested folder OUTSIDE node_modules never reads as installed (fail closed)', (t) => {
+  const base = tempDir(t);
+  const repo = path.join(base, 'project');
+  const vendored = path.join(repo, 'vendor', 'core');
+  const loose = path.join(base, 'loose');
+  fs.mkdirSync(vendored, { recursive: true });
+  fs.mkdirSync(loose);
+  git(repo, 'init', '-q');
+  assert.equal(lib.isInstalledCore(loose), false, 'no repo at all (git fails) outside node_modules: run the checks');
+  assert.equal(lib.isInstalledCore(vendored), false, 'a folder inside another repo but not under node_modules: run the checks');
+  assert.equal(lib.isInstalledCore(path.join(base, 'does-not-exist')), false, 'a misresolved root: run the checks');
+  const savedPath = process.env.PATH;
+  process.env.PATH = '';
+  try {
+    assert.equal(lib.isInstalledCore(ROOT), false, 'git missing from PATH in the core checkout: run the checks');
+  } finally {
+    process.env.PATH = savedPath;
+  }
+});
+
+test('runChecks: in the core\'s own checkout every check runs, and a throw still crashes (fail closed)', () => {
+  const ran = [];
+  const out = lib.runChecks([() => { ran.push(1); return { hardFail: false }; }, () => { ran.push(2); return { hardFail: true }; }], { installed: false });
+  assert.deepEqual(ran, [1, 2]);
+  assert.equal(out.length, 2);
+  assert.throws(() => lib.runChecks([() => { throw new Error('scan defect'); }], { installed: false }), /scan defect/);
+});
+
+test('runChecks: in an installed core no check runs, and one non-failing result says why', () => {
+  let ran = 0;
+  const out = lib.runChecks([() => { ran++; throw new Error('scan defect'); }, () => { ran++; return { hardFail: true }; }], { installed: true });
+  assert.equal(ran, 0, 'no check is run against a tree with no core source in it');
+  assert.equal(out.length, 1);
+  assert.equal(out[0].hardFail, false);
+  assert.match(out[0].name, /skipped/);
+  assert.match(out[0].name, /installed package/);
+  assert.ok(out[0].warnings.length > 0, 'the skip surfaces as a warning, not a silent pass');
+  assert.match(out[0].note, /2 checks/, 'and counts what it did not run');
+});
+
+test('end to end: fitness.js run from <project>/node_modules/@bongos/core exits 0 with the skip, instead of crashing', (t) => {
+  const project = tempDir(t);
+  const core = path.join(project, 'node_modules', '@bongos', 'core');
+  // The working tree as the package would ship it (tracked + new files), copied — not
+  // linked — so git inside it answers for the PROJECT, exactly as on toast.
+  const files = git(ROOT, 'ls-files', '-z', '--cached', '--others', '--exclude-standard').split('\0').filter(Boolean);
+  for (const f of files) {
+    const src = path.join(ROOT, f);
+    let st;
+    try { st = fs.lstatSync(src); } catch { continue; } // deleted in the working tree
+    if (!st.isFile()) continue;
+    fs.mkdirSync(path.dirname(path.join(core, f)), { recursive: true });
+    fs.copyFileSync(src, path.join(core, f));
+  }
+  fs.writeFileSync(path.join(project, '.gitignore'), 'node_modules\n');
+  fs.writeFileSync(path.join(project, 'CLAUDE.md'), '# project\n');
+  git(project, 'init', '-q');
+  git(project, 'add', '-A');
+  git(project, '-c', 'user.email=t@example.com', '-c', 'user.name=t', 'commit', '-qm', 'init');
+
+  let out = '';
+  let status = 0;
+  try {
+    out = execFileSync(process.execPath, [path.join(core, 'scripts', 'gds', 'fitness.js')], {
+      cwd: project,
+      encoding: 'utf8',
+      stdio: ['ignore', 'pipe', 'pipe'],
+      env: { ...process.env, NODE_PATH: path.join(ROOT, 'node_modules') },
+    });
+  } catch (e) {
+    status = e.status;
+    out = `${e.stdout || ''}${e.stderr || ''}`;
+  }
+  assert.equal(status, 0, `fitness must not fail an installed core's project:\n${out.slice(0, 2000)}`);
+  assert.match(out, /skipped: the core here is an installed package/);
+  assert.doesNotMatch(out, /scan defect/);
+});

package/tests/pin_replay.mjs

@@ -0,0 +1,147 @@
+// tests/pin_replay.mjs — a core move whose pin push is refused as "behind" replays the pin
+// commit onto GitHub's newer history instead of leaving GitHub on the old core (task 1004733).
+//
+// The normal case for a project worked from a laptop: the owner has pushed commits the box
+// does not have, so the box's pin commit cannot fast-forward GitHub. Before this task the move
+// finished `done` with a `repo_not_updated:behind` note and GitHub kept naming the old core, so
+// the next deploy from GitHub could quietly roll the core back. What these pin, against REAL
+// git repositories (a bare "GitHub", the box's checkout, the owner's laptop clone):
+//   * origin ahead → only the pin commit is replayed on top of it and pushed; the owner's
+//     commits stay, nothing is forced, and the live box's checkout is not touched
+//   * the owner changed the lockfile too → reported in plain words, GitHub left as it was
+//   * origin already up to date → the ordinary push, no replay at all
+//
+// Run:  node tests/pin_replay.mjs
+
+import { strict as assert } from 'node:assert';
+import { spawnSync } from 'node:child_process';
+import { mkdtempSync, writeFileSync, readFileSync, rmSync } from 'node:fs';
+import { tmpdir } from 'node:os';
+import { join } from 'node:path';
+import { pushUpgradePin } from '../scripts/gds/provision-core-upgrade.js';
+
+let passed = 0, failed = 0;
+const t = async (name, fn) => {
+  try { await fn(); passed += 1; console.log(`  PASS  ${name}`); }
+  catch (e) { failed += 1; console.log(`  FAIL  ${name}\n        ${e.message}`); }
+};
+
+// Forward slashes: the commands run through bash, which would eat a Windows backslash.
+const fwd = (p) => p.replace(/\\/g, '/');
+const ID = '-c user.name=tester -c user.email=tester@example.invalid';
+
+// The control plane's executor, for real: a shell command, the allowFail result shape
+// provision-config.js softFailResult returns (output kept, softFailed set).
+function realExec(ran) {
+  return (cmd, opts = {}) => {
+    ran.push(cmd);
+    const r = spawnSync('bash', ['-c', cmd], { encoding: 'utf8', env: { ...process.env, ...(opts.env || {}) } });
+    if (r.status === 0) return { ok: true, stdout: r.stdout || '', stderr: r.stderr || '' };
+    if (!opts.allowFail) throw new Error(`command failed: ${cmd}\n${r.stderr}`);
+    return { ok: true, stdout: r.stdout || '', stderr: r.stderr || '', softFailed: true };
+  };
+}
+const sh = (cmd) => {
+  const r = spawnSync('bash', ['-c', cmd], { encoding: 'utf8' });
+  if (r.status !== 0) throw new Error(`setup failed: ${cmd}\n${r.stderr}`);
+  return String(r.stdout || '').trim();
+};
+
+const pkg = (core, extra = {}) => `${JSON.stringify({ name: 'site', dependencies: { '@bongos/core': core, ...extra } }, null, 2)}\n`;
+const lock = (core, extra = '') => `${JSON.stringify({ name: 'site', lockfileVersion: 3, packages: { 'node_modules/@bongos/core': { version: core } }, note: extra }, null, 2)}\n`;
+
+// A bare "GitHub", the box's checkout (holding an unpushed pin commit, as upgrade.js
+// --commit-pin --pin-no-push leaves it), and the owner's laptop clone.
+function world({ ownerChanges = null } = {}) {
+  const root = fwd(mkdtempSync(join(tmpdir(), 'pin-replay-')));
+  const origin = `${root}/origin.git`, box = `${root}/box`, laptop = `${root}/laptop`, scratch = `${root}/scratch`;
+  sh(`git init -q --bare ${origin} && git -C ${origin} symbolic-ref HEAD refs/heads/main`);
+  sh(`git init -q ${laptop} && git -C ${laptop} checkout -q -b main`);
+  writeFileSync(`${laptop}/package.json`, pkg('1.0.0'));
+  writeFileSync(`${laptop}/package-lock.json`, lock('1.0.0'));
+  writeFileSync(`${laptop}/index.html`, '<p>v1</p>\n');
+  sh(`git -C ${laptop} add -A && git -C ${laptop} ${ID} commit -q -m init && git -C ${laptop} remote add origin ${origin} && git -C ${laptop} push -q origin main`);
+  sh(`git clone -q ${origin} ${box}`);
+  // The move's pin commit, on the box.
+  writeFileSync(`${box}/package.json`, pkg('1.1.0'));
+  writeFileSync(`${box}/package-lock.json`, lock('1.1.0'));
+  sh(`git -C ${box} add package.json package-lock.json && git -C ${box} ${ID} commit -q -m "pin @bongos/core 1.1.0 (was 1.0.0)"`);
+  if (ownerChanges) {
+    ownerChanges(laptop);
+    sh(`git -C ${laptop} add -A && git -C ${laptop} ${ID} commit -q -m "owner work" && git -C ${laptop} push -q origin main`);
+  }
+  return { root, origin, box, laptop, scratch, done: () => { try { rmSync(root, { recursive: true, force: true }); } catch { /* best effort */ } } };
+}
+
+const inst = { id: 9, slug: 'acme-site', hosting_shape: 'cloud-host', status: 'active', owner_builder_id: 5, target_ref: 'acme/site' };
+function run(w) {
+  const ran = [], logs = [];
+  const deps = {
+    controlExec: realExec(ran), log: (l) => logs.push(String(l)),
+    getGithubToken: async () => null,                    // no owner token: the box's own remote pushes
+    fsImpl: { existsSync: () => false },                 // and no write key on this hub
+    pinKeyDir: `${w.root}/keys`, tmpDir: w.scratch,
+  };
+  sh(`mkdir -p ${w.scratch}`);
+  return pushUpgradePin(inst, deps, { instanceDir: w.box }).then((out) => ({ out, ran, logs }));
+}
+const at = (dir, ref) => sh(`git -C ${dir} rev-parse ${ref}`);
+const show = (dir, ref, file) => sh(`git -C ${dir} show ${ref}:${file}`);
+
+console.log('origin AHEAD of the box: the pin commit is replayed on top and pushed');
+
+await t('the owner\'s commits stay, the pin lands on top of them, and nothing is forced', async () => {
+  const w = world({ ownerChanges: (d) => writeFileSync(`${d}/index.html`, '<p>v2 from the laptop</p>\n') });
+  try {
+    const ownerTip = at(w.origin, 'main');
+    const boxHead = at(w.box, 'HEAD');
+    const { out, ran } = await run(w);
+    assert.equal(out.pushed, true, `pushed — got ${JSON.stringify(out)}`);
+    assert.equal(out.replayed, true, 'by replaying the pin, not by the first push');
+    assert.equal(out.via, 'origin', 'over the same credential that was refused as behind');
+    const tip = at(w.origin, 'main');
+    assert.equal(at(w.origin, 'main^'), ownerTip, 'the replayed pin sits directly on the owner\'s newest commit');
+    assert.match(show(w.origin, 'main', 'package.json'), /"@bongos\/core": "1\.1\.0"/, 'GitHub now names the new core');
+    assert.match(show(w.origin, 'main', 'package-lock.json'), /"version": "1\.1\.0"/);
+    assert.match(show(w.origin, 'main', 'index.html'), /v2 from the laptop/, 'the owner\'s work is still there');
+    assert.equal(sh(`git -C ${w.origin} log -1 --format=%s main`), 'pin @bongos/core 1.1.0 (was 1.0.0)', 'the pin commit\'s own message');
+    assert.notEqual(tip, boxHead, 'a new commit, not the box\'s');
+    assert.equal(at(w.box, 'HEAD'), boxHead, 'the live box\'s checkout was NOT moved');
+    assert.match(readFileSync(`${w.box}/index.html`, 'utf8'), /v1/, 'nor its files changed under the running site');
+    assert.equal(sh(`git -C ${w.box} worktree list`).split('\n').length, 1, 'the scratch copy was cleaned up');
+    assert.ok(!ran.some((c) => /--force|\s\+\S|reset --hard|rebase/.test(c)), `never forced: ${ran.join('\n')}`);
+  } finally { w.done(); }
+});
+
+await t('a conflicting LOCKFILE is reported in plain words, and GitHub is left exactly as it was', async () => {
+  const w = world({ ownerChanges: (d) => writeFileSync(`${d}/package-lock.json`, lock('1.0.1', 'the owner reinstalled')) });
+  try {
+    const ownerTip = at(w.origin, 'main');
+    const boxHead = at(w.box, 'HEAD');
+    const { out, ran } = await run(w);
+    assert.equal(out.pushed, false);
+    assert.equal(out.code, 'conflict');
+    assert.match(out.note, /^repo_not_updated:conflict: /, 'the note the web tier reads');
+    assert.match(out.note, /package-lock\.json/, 'it names the file');
+    assert.equal(at(w.origin, 'main'), ownerTip, 'nothing was pushed over the owner\'s commit');
+    assert.equal(at(w.box, 'HEAD'), boxHead, 'the box is untouched');
+    assert.equal(sh(`git -C ${w.box} status --porcelain`), '', 'and its tree is clean');
+    assert.equal(sh(`git -C ${w.box} worktree list`).split('\n').length, 1, 'the scratch copy was cleaned up');
+    assert.ok(!ran.some((c) => /--force|\s\+\S|reset --hard/.test(c)), 'never forced');
+  } finally { w.done(); }
+});
+
+await t('origin UP TO DATE: the ordinary push, no fetch and no replay', async () => {
+  const w = world();
+  try {
+    const boxHead = at(w.box, 'HEAD');
+    const { out, ran } = await run(w);
+    assert.equal(out.pushed, true);
+    assert.ok(!out.replayed, 'nothing to replay');
+    assert.equal(at(w.origin, 'main'), boxHead, 'GitHub fast-forwarded to the box\'s own pin commit');
+    assert.ok(!ran.some((c) => / fetch | worktree | cherry-pick /.test(c)), `no replay machinery ran: ${ran.join('\n')}`);
+  } finally { w.done(); }
+});
+
+console.log(`\n${passed} passed, ${failed} failed`);
+if (failed) process.exit(1);

package/tests/pin_write_key.mjs

@@ -262,6 +262,32 @@ await t('GitHub AHEAD of the box (rejected non-fast-forward) on the write key: r
   assert.ok(!call(r, /x-access-token@/) && !call(r, / push origin /));
 });
 
+await t('GitHub AHEAD on the write key: the pin is replayed and pushed over THAT key, never forced (task 1004733)', async () => {
+  const SHA = 'a'.repeat(40), UP = 'b'.repeat(40), NEXT = 'c'.repeat(40);
+  const r = pushRig();
+  let keyPushes = 0;
+  const inner = r.deps.exec;
+  r.deps.exec = (cmd, opts) => {
+    if (/core\.sshCommand=.* push /.test(cmd) && keyPushes++ === 0) { r.ran.push({ cmd, env: opts && opts.env }); return refused(' ! [rejected]        HEAD -> main (fetch first)'); }
+    if (/log -1 --format=/.test(cmd)) { r.ran.push({ cmd }); return { ok: true, stdout: `${SHA}\n${'d'.repeat(40)}\nbox\nbox@x.invalid\npin @bongos/core 1.2.0 (was 1.1.0)\n` }; }
+    if (/rev-parse FETCH_HEAD/.test(cmd)) { r.ran.push({ cmd }); return { ok: true, stdout: `${UP}\n` }; }
+    if (/diff --quiet /.test(cmd)) { r.ran.push({ cmd }); return refused(''); }
+    if (/rev-parse HEAD/.test(cmd)) { r.ran.push({ cmd }); return { ok: true, stdout: `${NEXT}\n` }; }
+    return inner(cmd, opts);
+  };
+  const out = await push(r);
+  assert.equal(out.pushed, true);
+  assert.equal(out.via, 'write-key');
+  assert.equal(out.replayed, true);
+  const fetch = call(r, / fetch /);
+  assert.ok(fetch && fetch.cmd.includes('core.sshCommand=') && fetch.cmd.includes('git@github.com:acme/site.git main'), `fetched over the key: ${fetch && fetch.cmd}`);
+  const again = r.ran.filter((c) => /core\.sshCommand=.* push /.test(c.cmd)).pop();
+  assert.ok(again.cmd.includes(`push git@github.com:acme/site.git ${NEXT}:refs/heads/main`), `the replayed commit, over the key: ${again.cmd}`);
+  assert.ok(call(r, new RegExp(`cherry-pick ${SHA}`)), 'only the pin commit is replayed');
+  assert.ok(!r.ran.some((c) => /--force|\s\+\S|reset --hard|rebase/.test(c.cmd)), 'never forced');
+  assert.ok(!call(r, /x-access-token@/) && !call(r, / push origin /), 'no other credential');
+});
+
 await t('NO KEY yet but a FRESH TOKEN: the key is minted first (reconnecting is enough), then used', async () => {
   const r = pushRig({ hasKey: false });
   const out = await push(r);