@bongos/core 1.21.147 → 1.21.149

package/.bongos-core.json

@@ -2,22 +2,22 @@
   "artifact": "bongos-core",
   "manifest_schema": 1,
   "generator": "scripts/gds/package-core.js",
-  "core_version": "1.21.147",
-  "core_contract": "1.21.147",
-  "source_commit": "13137d54836ff06c25504af346ea4bd102a63f79",
+  "core_version": "1.21.149",
+  "core_contract": "1.21.149",
+  "source_commit": "59efe78dbbc530e6743f98d50abc605e2184adcc",
   "source_ref": "HEAD",
-  "built_at": "2026-10-19T15:05:58.444Z",
+  "built_at": "2026-10-19T21:44:07.784Z",
   "redaction": {
     "model": "docs-redacted+functional-verbatim",
     "docs_redacted": 608,
     "agent_docs_stubbed": 28,
-    "functional_verbatim": 3166,
+    "functional_verbatim": 3168,
     "rules": 3,
     "gate_literals": 3,
     "gate": "passed"
   },
-  "file_count": 3803,
-  "tree_sha256": "888e10ec8ed80028fa81d68f55de93405ff4ba3f7ea6adc2f61de4d94e3826ac",
+  "file_count": 3805,
+  "tree_sha256": "2fb626947478be776e71613c82d973ebf073298ea8d6e5561f4e604e1438d661",
   "files": [
     {
       "path": ".claude/skills/ask-for-help/SKILL.md",
@@ -42,7 +42,7 @@
     {
       "path": ".claude/skills/bongos-feedback/SKILL.md",
       "mode": "0000644",
-      "sha256": "14b448ca3b42daa4b97d7d699099536047163d50f778f079daa6616cd9b0dd51"
+      "sha256": "8b295d76d7cc4c9e0f2549db0f1ac857aa8e76a92b3e00898f95820a32c855ba"
     },
     {
       "path": ".claude/skills/bug-triage/SKILL.md",
@@ -312,7 +312,7 @@
     {
       "path": "bin/bongos.js",
       "mode": "0000755",
-      "sha256": "656e91004fc2236dfd121dd3f46848ba5a51331c2eb17095398eb30a5255b7ef"
+      "sha256": "10da188550dd74f74a8598b8815076cf098908196f366aad1f6ca39e16c68c33"
     },
     {
       "path": "clients/bongos-client/README.md",
@@ -2927,7 +2927,7 @@
     {
       "path": "docs/module-api-changelog.md",
       "mode": "0000644",
-      "sha256": "76717a07eeea4ba8500f793a15a62e3cbe9a31516ecd5223cdc8e6ff3c752014"
+      "sha256": "af2424a88f8836e7035c00a52637fbbf137bf1b716130a360868fa50bab54b2d"
     },
     {
       "path": "docs/modules-contract.md",
@@ -10552,12 +10552,12 @@
     {
       "path": "package-lock.json",
       "mode": "0000644",
-      "sha256": "8e87b847de2767eb834d302fa4d49688a8c725da1daee28bfa195ec2cb5da693"
+      "sha256": "d03c2a175c60400695aecccbe5c9ef87b085521c6bf92176c6d2ed08e514c8a6"
     },
     {
       "path": "package.json",
       "mode": "0000644",
-      "sha256": "2ddbcdc32b9be33b09ca6af8c0fe28b50a9e0f620f72c8e6adab1a1c054f721d"
+      "sha256": "9d6713f305cdfe492805906778e171c75c42e4fd8dff5935ad9245d185b6ce22"
     },
     {
       "path": "public-docs/index.html",
@@ -10577,7 +10577,7 @@
     {
       "path": "release-notes.json",
       "mode": "0000644",
-      "sha256": "d017350fb8de15dc36139bfac03dc0126d51ff14c632ab29c2e08a5e017102dc"
+      "sha256": "9394c3c784137020e70389b269a68f36f8f2d0757b306a1f64622b8b5886f368"
     },
     {
       "path": "scripts/cron/style_guide_audit.sh",
@@ -10954,10 +10954,15 @@
       "mode": "0000644",
       "sha256": "9dd80d2c37602c59cb75db0be02cfadc737fc64891a81d03f5be5f0ea5e35a27"
     },
+    {
+      "path": "scripts/gds/core-origin-follow.js",
+      "mode": "0000644",
+      "sha256": "5d12058796dc7373584fc8447ee83b8da0820a447e783b2462156f1ec158b8c5"
+    },
     {
       "path": "scripts/gds/core-pin-sync.js",
       "mode": "0000644",
-      "sha256": "f8a3a0ee2c0f4dbc2583603cd6e7b547140a5f8dc286b7c5f0b6dadd6096a002"
+      "sha256": "9e2e6dd476938df51bf027396df8a92e0ed2ca96a9adf59cb666ad2681cc721e"
     },
     {
       "path": "scripts/gds/coreB-carve-proof.sh",
@@ -11097,7 +11102,7 @@
     {
       "path": "scripts/gds/feedback-send.js",
       "mode": "0000644",
-      "sha256": "2ea43986744a893b0f44954926447a4c817fae8af8ef4956d149b31ea51e96c2"
+      "sha256": "e3c82d95c9412126d0c064d40267c7ae7befbc3cebdba99c496c884dceb4a750"
     },
     {
       "path": "scripts/gds/fetch-art-key.js",
@@ -12952,7 +12957,7 @@
     {
       "path": "src/module-api.js",
       "mode": "0000644",
-      "sha256": "93da702f9872966c95f6453a31c64b87d41bf6d462058749b190b69bb86d15b5"
+      "sha256": "b89f1cd4820d3d4257eabf44a666b44c722c9e159dd561bbced94784cceaf8ea"
     },
     {
       "path": "src/module-loader/catalog.js",
@@ -13974,10 +13979,15 @@
       "mode": "0000644",
       "sha256": "4612301c02a9a6f9927a49f76a2b49d2892e8266580cf31bcd47dd5b36ad71b0"
     },
+    {
+      "path": "tests/core_origin_follow.mjs",
+      "mode": "0000644",
+      "sha256": "1b136186f5d91fe9f63034559115ba505959a742712e4103a143a7ede0917869"
+    },
     {
       "path": "tests/core_pin_sync.mjs",
       "mode": "0000644",
-      "sha256": "ac3714b1b089ba2450f1125c74cbe5491deb4ddec1eec77c4c83a8a635a84d93"
+      "sha256": "34d78bb4998adaec12f5666d4ac58815ebceaccff1d560ca978c58ba64190575"
     },
     {
       "path": "tests/core_update_banner.mjs",
@@ -16087,7 +16097,7 @@
     {
       "path": "tests/instance_feedback.mjs",
       "mode": "0000644",
-      "sha256": "704a506419ff49032b9604dc039113eaa63db68ac7a57fa09e09162ce7acfae5"
+      "sha256": "a0a558b9d9e0698fa4b6078a2f2e4e2d9679e517149876809c1478743db0f6ff"
     },
     {
       "path": "tests/instance_manifest.mjs",

package/.claude/skills/bongos-feedback/SKILL.md

@@ -14,7 +14,7 @@ Sends a note about Bongos — the tool — straight to its maintainers (tasks 10
 
 **When.** File when the builder (a) labels it — "Bongos feedback: …", "tell the Bongos team" — that **is** the go; (b) wishes — "Bongos should…" (**Suggestions count**: send with `--idea`, even if you also fix it in their project); or (c) vents that Bongos is broken — **File it without being asked**, don't argue them out of it. Only about **Bongos itself** (a `bongos`/`/builder-*` command, claim, ship, grade, deploy, upgrade, hall, Settings, sign-in, credits, how it organises work). Not their own project's code, Claude, their laptop or GitHub, nor a rule working as designed. **One filing per distinct problem per session.**
 
-**Write it yourself — Never paste the rant.** First line = what went wrong, in at most twelve words (it becomes the title); then what they did, what they expected, what happened, the exact error line. A wish (`--idea`) asks the maintainers to decide something, so it opens with the card `node scripts/gds/ask.js check <file>` prints, and the rest follows as detail (agents ask like humans, task 1004704). No code, file contents, secrets or personal data.
+**Write it yourself — Never paste the rant.** First line = what went wrong, in at most twelve words (it becomes the title); then what they did, what they expected, what happened, the exact error line. A wish (`--idea`) asks the maintainers to decide something, so open it as an ask (task 1004704): one question of at most twelve words, two or three answers with what each leads to, your pick and why; the rest follows as detail. Write that shape yourself — run no helper first: a project on an older core may not have one, and a failed command before the send is noise (task 1004759). No code, file contents, secrets or personal data.
 
 **Send** (stdin, so nothing in the text is mangled by the shell):
 
@@ -24,7 +24,7 @@ bongos feedback --message-file - <<'EOF'
 EOF
 ```
 
-Add `--idea` for a wish. The command prints one line — relay it, then carry on. Proactive filing: one short sentence, e.g. *"I've sent that to the Bongos team."* If it says the project runs only on this computer, tell the builder in one line; never retry.
+Add `--idea` for a wish. The command prints one line — relay it, then carry on. Proactive filing: one short sentence, e.g. *"I've sent that to the Bongos team."* If it says "Not sent", relay that in one line and never retry: "runs only on your computer" and "older Bongos" both mean this project cannot send yet, and the second names the file the note is saved in — send it with `--message-file <that file>` after the project is upgraded. Don't send the builder to GitHub or "the Bongos team" elsewhere instead, and don't call it sent.
 
 ## Files this skill touches
 

package/bin/bongos.js

@@ -195,8 +195,11 @@ function main(argv) {
   // of its own, so after a core update lands it resolves the main checkout's older core
   // and the ship fails on a bug the pin already fixed. `ship` installs the pinned core
   // into the checkout and re-runs under it; scripts/gds/core-pin-sync.js.
-  if (!COMPILED && verb === 'ship') {
-    const synced = require('../scripts/gds/core-pin-sync.js').ensurePinnedCore({ coreRoot: REPO_ROOT, argv });
+  // First, both `ship` and `start` (an instance's session start) follow a core move the
+  // hub pushed to GitHub: one line saying so, and on a clean main a fast-forward plus
+  // install (task 1004732; scripts/gds/core-origin-follow.js).
+  if (!COMPILED && (verb === 'ship' || verb === 'start')) {
+    const synced = require('../scripts/gds/core-origin-follow.js').ensureCurrentCore({ coreRoot: REPO_ROOT, argv, verb });
     if (synced != null) return synced;
   }
 

package/docs/module-api-changelog.md

@@ -3131,5 +3131,9 @@ is load-bearing: the script throws rather than guess if it is missing, and
         landed since 1.21.145 with no explicit bump. run 39077391288. (task 1002620)
   1.21.147 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
         landed since 1.21.146 with no explicit bump. run 39274828902. (task 1002620)
+  1.21.148 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+        landed since 1.21.147 with no explicit bump. run 39286989989. (task 1002620)
+  1.21.149 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+        landed since 1.21.148 with no explicit bump. run 39329687123. (task 1002620)
 ---------------------------------------------------------------------------
 ```

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.21.147",
+  "version": "1.21.149",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.21.147",
+      "version": "1.21.149",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.21.147",
+  "version": "1.21.149",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/release-notes.json

@@ -9896,5 +9896,17 @@
       "id": "1004731",
       "text": "After a project's software is updated, its owner now sees a one-time note saying which version it moved to, when, and what changed, and the Software update page lists the recent updates, including any that failed and were undo"
     }
+  ],
+  "1.21.148": [
+    {
+      "id": "1004732",
+      "text": "When the hub upgrades a project's core, your laptop now notices at the next session start or ship, says so in one line, and on a clean main catches up and reinstalls the new core by itself."
+    }
+  ],
+  "1.21.149": [
+    {
+      "id": "1004759",
+      "text": "When a project's site is too old to send Bongos feedback, the command now says 'Not sent' and keeps the note, instead of claiming it was sent."
+    }
   ]
 }

package/scripts/gds/core-origin-follow.js

@@ -0,0 +1,185 @@
+// scripts/gds/core-origin-follow.js — the laptop follows a core move the hub made (task 1004732)
+//
+// WHY. When the hub moves a hosted project's core (provision-core-upgrade.js), it commits
+// the new pin — package.json + lockfile, usually a vendored `file:vendor/bongos-core-X.tgz`
+// rewritten to an exact registry version — on the box and pushes it to the project's
+// GitHub repo. The owner's laptop checkout never hears of it: the next session runs the
+// old core, and the next ship merges against the old pin. Seen on toast (1.21.20 on the
+// laptop while fixes sat in newer releases).
+//
+// THE FIX. Before `bongos start` (an instance's session start: its CLAUDE.md opens every
+// session with it, and a package-installed instance carries no SessionStart hooks) and
+// before `bongos ship`, the dispatcher calls ensureCurrentCore(). It fetches origin/main
+// (bounded; allowed to fail) and compares the checkout's @bongos/core pin with
+// origin/main's. When ORIGIN moved it, the builder gets one plain line saying so. On a
+// clean `main` with no local commits, the checkout is fast-forwarded and the pinned core
+// is installed through core-pin-sync.js (task 1004632) — whose gates (the pin's shape,
+// and the pin having landed on main) still decide what may be installed — then the
+// command re-runs under the new core. A dirty tree, a feature branch or local commits get
+// the line and the command to run, never a forced change. So does a move that is not
+// pin-only (notPinOnly): the fast-forward installs and runs what it brings in, so it is
+// taken only for the hub's commit shape — the pin, the lockfile, a removed tarball — onto
+// a published registry release; anything wider waits for the owner to look.
+//
+// Silent and fail-open: in the core repo itself (the running package is not
+// @bongos/core) it returns before any git spawn; outside git, with no pin, when origin
+// cannot be read, or when the pins already agree it says nothing. A pin the LOCAL side
+// moved (origin's pin is still the one this branch forked from) is not a hub move.
+
+'use strict';
+
+const fs = require('node:fs');
+const path = require('node:path');
+const { spawnSync } = require('node:child_process');
+const pinSync = require('./core-pin-sync.js');
+
+const FETCH_TIMEOUT_MS = 5000;
+
+function readJson(file, fsImpl = fs) {
+  try { return JSON.parse(String(fsImpl.readFileSync(file, 'utf8')).replace(/^/, '')); } catch { return null; }
+}
+
+function gitOut(args, cwd, run, extra = {}) {
+  try {
+    const r = run('git', args, { cwd, encoding: 'utf8', ...extra });
+    return r && r.status === 0 ? String(r.stdout || '').trim() : null;
+  } catch { return null; }
+}
+
+function specOf(pkg) {
+  if (!pkg) return null;
+  return (pkg.dependencies || {})[pinSync.CORE_PKG] || (pkg.devDependencies || {})[pinSync.CORE_PKG] || null;
+}
+
+// The core pin package.json carries at `rev`, or null when that file cannot be read there.
+function specAt(root, rev, run) {
+  const body = gitOut(['show', `${rev}:package.json`], root, run, { maxBuffer: 8 * 1024 * 1024 });
+  if (body == null) return null;
+  try { return specOf(JSON.parse(body.replace(/^/, ''))); } catch { return null; }
+}
+
+const shown = (spec) => pinSync.versionFromSpec(spec) || spec;
+
+// Why the move cannot be applied to this checkout automatically, or null when it can.
+function blockedReason({ branch, dirty, ahead }) {
+  if (!branch) return 'this checkout is not on a branch';
+  if (branch !== 'main') return `you are on branch ${branch}, which picks the move up when it merges main`;
+  if (dirty == null || dirty !== '') return 'this checkout has uncommitted changes';
+  if (!Number.isFinite(ahead) || ahead !== 0) return 'main has local commits GitHub does not have';
+  return null;
+}
+
+const REMEDY = 'On a clean main: `git pull --ff-only origin main`, then `npm ci`.';
+const REVIEW_REMEDY = 'Review what GitHub has (`git log HEAD..origin/main`), then `git pull --ff-only origin main` and `npm ci`.';
+const REGISTRY = 'https://registry.npmjs.org/';
+const EXACT_SEMVER = /^\d+\.\d+\.\d+(-[A-Za-z0-9.]+)?$/;
+
+function jsonAt(root, rev, file, run) {
+  const body = gitOut(['show', `${rev}:${file}`], root, run, { maxBuffer: 64 * 1024 * 1024 });
+  if (body == null) return null;
+  try { return JSON.parse(body.replace(/^/, '')); } catch { return null; }
+}
+
+// The fast-forward installs and then RUNS what it brings in, unattended — so it is taken
+// only when what GitHub has is the hub's pin move and nothing else (the shape
+// provision-core-upgrade.js pushes). Anything wider is reported, never applied. Returns
+// null when the move is pin-only, else the reason it is not.
+//   - the only files that differ are package.json, package-lock.json and a removed
+//     vendored tarball;
+//   - package.json differs ONLY in the @bongos/core spec;
+//   - the new spec is an exact version, i.e. a published release (a tarball brought in
+//     from GitHub is code nobody released);
+//   - the lockfile pins that version from the public registry, and every lockfile
+//     source it adds is the public registry too.
+function notPinOnly(root, run) {
+  const diff = gitOut(['diff', '--name-status', '--no-renames', 'HEAD', 'origin/main'], root, run, { maxBuffer: 16 * 1024 * 1024 });
+  if (diff == null) return 'the change on GitHub could not be read';
+  for (const line of diff.split('\n').filter(Boolean)) {
+    const [status, file] = line.split('\t');
+    const ok = file === 'package.json' || file === 'package-lock.json' ||
+      (status === 'D' && /^vendor\/bongos-core-[^/]+\.tgz$/.test(file));
+    if (!ok) return 'GitHub has other changes besides the core move';
+  }
+  const before = jsonAt(root, 'HEAD', 'package.json', run);
+  const after = jsonAt(root, 'origin/main', 'package.json', run);
+  if (!before || !after) return 'package.json could not be read';
+  const spec = specOf(after);
+  const strip = (pkg) => {
+    const c = JSON.parse(JSON.stringify(pkg));
+    for (const k of ['dependencies', 'devDependencies']) if (c[k]) delete c[k][pinSync.CORE_PKG];
+    return JSON.stringify(c);
+  };
+  if (strip(before) !== strip(after)) return 'package.json changed beyond the core pin';
+  if (!EXACT_SEMVER.test(String(spec || ''))) return 'the new pin is not a published release';
+  const lock = jsonAt(root, 'origin/main', 'package-lock.json', run);
+  const entry = lock && lock.packages && lock.packages[`node_modules/${pinSync.CORE_PKG}`];
+  if (!entry || entry.version !== spec || !String(entry.resolved || '').startsWith(`${REGISTRY}${pinSync.CORE_PKG}/-/`)) {
+    return 'the lockfile does not pin that release from the public registry';
+  }
+  const prior = new Set(Object.values(((jsonAt(root, 'HEAD', 'package-lock.json', run) || {}).packages) || {}).map((p) => p && p.resolved));
+  for (const p of Object.values(lock.packages)) {
+    const r = p && p.resolved;
+    if (r && !prior.has(r) && !String(r).startsWith(REGISTRY)) return 'the lockfile adds a source outside the public registry';
+  }
+  return null;
+}
+
+// Returns { action: 'none' | 'reported' | 'fast-forwarded', reason, from?, to? }.
+function followOriginPin({ coreRoot, cwd = process.cwd(), env = process.env, run = spawnSync, fsImpl = fs, log, fetchTimeoutMs = FETCH_TIMEOUT_MS } = {}) {
+  const none = (reason) => ({ action: 'none', reason });
+  if (env && (env.BONGOS_SKIP_CORE_SYNC || env[pinSync.SYNCED_ENV])) return none('skipped');
+  const running = readJson(path.join(coreRoot, 'package.json'), fsImpl);
+  if (!running || running.name !== pinSync.CORE_PKG) return none('core-repo'); // no git spawn
+  const top = gitOut(['rev-parse', '--show-toplevel'], cwd, run);
+  if (!top) return none('no-git');
+  const root = path.resolve(top);
+  const local = specOf(readJson(path.join(root, 'package.json'), fsImpl));
+  if (!local) return none('no-pin');
+
+  // Bounded, quiet, never prompts; a failure is fine — the ref below decides.
+  gitOut(['fetch', '--quiet', 'origin', 'main'], root, run, {
+    timeout: fetchTimeoutMs, env: { ...process.env, ...env, GIT_TERMINAL_PROMPT: '0' },
+  });
+  const origin = specAt(root, 'origin/main', run);
+  if (!origin) return none('origin-unreadable');
+  if (origin === local) return none('in-step');
+  const forkPoint = gitOut(['merge-base', 'HEAD', 'origin/main'], root, run);
+  if (forkPoint && specAt(root, forkPoint, run) === origin) return none('local-change');
+
+  const say = log || ((s) => process.stderr.write(s + '\n'));
+  const move = { from: local, to: origin };
+  say(`bongos: this project was upgraded to core ${shown(origin)} on GitHub (this checkout has ${shown(local)}).`);
+  const why = blockedReason({
+    branch: gitOut(['symbolic-ref', '--short', '-q', 'HEAD'], root, run),
+    dirty: gitOut(['status', '--porcelain', '--untracked-files=no'], root, run),
+    ahead: Number(gitOut(['rev-list', '--count', 'origin/main..HEAD'], root, run)),
+  });
+  if (why) {
+    say(`  Not updated here: ${why}. ${REMEDY}`);
+    return { action: 'reported', reason: why, ...move };
+  }
+  const wider = notPinOnly(root, run);
+  if (wider) {
+    say(`  Not updated automatically: ${wider}. ${REVIEW_REMEDY}`);
+    return { action: 'reported', reason: wider, ...move };
+  }
+  if (gitOut(['merge', '--ff-only', '--quiet', 'origin/main'], root, run) == null) {
+    say(`  The fast-forward did not go through. ${REMEDY}`);
+    return { action: 'reported', reason: 'ff-failed', ...move };
+  }
+  say('  Fast-forwarded this checkout to it; installing that core next.');
+  return { action: 'fast-forwarded', reason: 'origin-moved', ...move };
+}
+
+// The dispatcher's one call, for `ship` and `start`. Returns an exit code when it handled
+// the command (installed and re-ran, or refused), or null to run the verb as it is.
+// `ship` always checks the running core against the pin (task 1004632); `start` only
+// after a fast-forward actually moved the pin, so a normal session start pays no more
+// than the fetch.
+function ensureCurrentCore({ coreRoot, argv, verb, cwd = process.cwd(), env = process.env, run = spawnSync, fsImpl = fs, log, npmCli } = {}) {
+  const followed = followOriginPin({ coreRoot, cwd, env, run, fsImpl, log });
+  if (verb !== 'ship' && followed.action !== 'fast-forwarded') return null;
+  return pinSync.ensurePinnedCore({ coreRoot, argv, cwd, env, run, fsImpl, log, ...(npmCli !== undefined ? { npmCli } : {}) });
+}
+
+module.exports = { followOriginPin, ensureCurrentCore };

package/scripts/gds/core-pin-sync.js

@@ -172,6 +172,28 @@ function unlinkLink(linkPath, { platform = process.platform, fsImpl = fs } = {})
   }
 }
 
+// A vendored instance keeps an untracked `scripts -> node_modules/@bongos/core/scripts`
+// link in its main checkout (grading needs it; task 1004728). After an install it must
+// still resolve (task 1004732): a link left dangling is re-pointed at the installed core.
+// Only ever a LINK — a real scripts/ directory (the core repo) is never touched.
+// Returns 'absent' | 'not-a-link' | 'ok' | 'repointed' | 'unresolved'.
+function healScriptsLink(root, { fsImpl = fs, log = (s) => process.stderr.write(s + '\n'), platform = process.platform } = {}) {
+  const link = path.join(root, 'scripts');
+  let st = null;
+  try { st = fsImpl.lstatSync(link); } catch { return 'absent'; }
+  if (!st.isSymbolicLink()) return 'not-a-link';
+  if (fsImpl.existsSync(path.join(link, 'gds'))) return 'ok';
+  const target = path.join(root, 'node_modules', '@bongos', 'core', 'scripts');
+  const fix = `bongos: the \`scripts\` link in ${root} no longer resolves; point it at ${target}.`;
+  if (!fsImpl.existsSync(target)) { log(fix); return 'unresolved'; }
+  try {
+    unlinkLink(link, { platform, fsImpl });
+    fsImpl.symlinkSync(target, link, 'junction');
+  } catch { log(fix); return 'unresolved'; }
+  log('bongos: re-pointed the `scripts` link at the installed core.');
+  return 'repointed';
+}
+
 // Install the pinned core into `root` and re-run the same bongos command under it.
 // Returns the exit code to use.
 function syncAndRerun(plan, { argv, run = spawnSync, fsImpl = fs, log = (s) => process.stderr.write(s + '\n'), env = process.env, platform = process.platform, npmCli = npmCliPath(process.execPath, fsImpl) } = {}) {
@@ -192,10 +214,13 @@ function syncAndRerun(plan, { argv, run = spawnSync, fsImpl = fs, log = (s) => p
   // npm's JS entry under this node — no shell. Fallback: `npm`, which on win32 is
   // npm.cmd and needs a shell (Node refuses a .cmd without one); the args are fixed
   // strings, never branch data.
+  // npm's output goes to stderr (task 1004732): `bongos start --widget` hands stdout to
+  // the renderer verbatim, so an install must never print there.
   const cli = npmCli;
+  const stdio = ['ignore', 2, 2];
   const inst = cli
-    ? run(process.execPath, [cli, ...installArgs(hasLock)], { cwd: root, stdio: 'inherit', env })
-    : run('npm', installArgs(hasLock), { cwd: root, stdio: 'inherit', env, ...(platform === 'win32' ? { shell: true } : {}) });
+    ? run(process.execPath, [cli, ...installArgs(hasLock)], { cwd: root, stdio, env })
+    : run('npm', installArgs(hasLock), { cwd: root, stdio, env, ...(platform === 'win32' ? { shell: true } : {}) });
   if (!inst || inst.error || inst.status !== 0) {
     log(`bongos: installing core ${pinned} failed.`);
     remedy();
@@ -203,6 +228,7 @@ function syncAndRerun(plan, { argv, run = spawnSync, fsImpl = fs, log = (s) => p
   }
   const bin = path.join(nm, '@bongos', 'core', 'bin', 'bongos.js');
   if (!fsImpl.existsSync(bin)) { remedy(); return 1; }
+  healScriptsLink(root, { fsImpl, log, platform });
   const res = run(process.execPath, [bin, ...argv.slice(2)], { stdio: 'inherit', env: { ...env, [SYNCED_ENV]: '1' } });
   if (!res || res.error) return 1;
   return res.status == null ? 1 : res.status;
@@ -210,7 +236,7 @@ function syncAndRerun(plan, { argv, run = spawnSync, fsImpl = fs, log = (s) => p
 
 // The dispatcher's one call. Returns an exit code when it handled the command (synced
 // and re-ran, or refused), or null to run the verb on the current core.
-function ensurePinnedCore({ coreRoot, argv, cwd = process.cwd(), env = process.env, run = spawnSync, fsImpl = fs, log } = {}) {
+function ensurePinnedCore({ coreRoot, argv, cwd = process.cwd(), env = process.env, run = spawnSync, fsImpl = fs, log, npmCli } = {}) {
   if (env && env.BONGOS_SKIP_CORE_SYNC) return null;
   const runningPkg = readJson(path.join(coreRoot, 'package.json'), fsImpl);
   if (!runningPkg || runningPkg.name !== CORE_PKG) return null; // fast path: the core repo itself
@@ -227,7 +253,7 @@ function ensurePinnedCore({ coreRoot, argv, cwd = process.cwd(), env = process.e
     say(remedyLine({ ...plan, hasLock: fsImpl.existsSync(path.join(root, 'package-lock.json')) }));
     return 1;
   }
-  return syncAndRerun(plan, { argv, run, fsImpl, log: say, env });
+  return syncAndRerun(plan, { argv, run, fsImpl, log: say, env, ...(npmCli !== undefined ? { npmCli } : {}) });
 }
 
-module.exports = { CORE_PKG, SYNCED_ENV, LANDED_REFS, pinLanded, npmCliPath, parseSpec, versionFromSpec, installArgs, pinnedCoreVersion, planCoreSync, remedyLine, syncAndRerun, ensurePinnedCore };
+module.exports = { CORE_PKG, SYNCED_ENV, LANDED_REFS, pinLanded, npmCliPath, parseSpec, versionFromSpec, installArgs, pinnedCoreVersion, planCoreSync, remedyLine, syncAndRerun, healScriptsLink, ensurePinnedCore };

package/scripts/gds/feedback-send.js

@@ -14,8 +14,12 @@
 // signed-in builder does nothing extra.
 //
 // Fast and quiet by design (the owner, 2026-10-06): the command prints one line
-// and returns at once; a detached background process does the network. No task
-// number comes back. Only the typed text (secret-scrubbed) and version stamps travel.
+// and returns at once; a detached background process sends to the hub. The one
+// call made in the foreground is the receipt from the builder's own project, so
+// "Sent" is never printed for a report the project could not vouch for (task
+// 1004759: a project on an older core has no receipt door, and the background
+// 404 was invisible). No task number comes back. Only the typed text
+// (secret-scrubbed) and version stamps travel.
 
 'use strict';
 
@@ -47,6 +51,8 @@ const REFUSALS = {
   too_long: 'That is too long to send — keep it under 4,000 characters, or split it into two.',
   local_only: 'This project runs only on your computer, so Cloud Bongos cannot confirm who sent the report. Nothing was sent.',
   no_scrubber: 'Feedback was not sent: the secret filter that checks every report is missing from this install.',
+  project_too_old: "Not sent: this project's live site runs an older Bongos that cannot send feedback yet. It will work once the project is upgraded.",
+  receipt_failed: "Not sent: this project's live site did not confirm who sent it",
 };
 
 function stateDir() { return path.join(os.homedir(), '.config', ic.FALLBACK_DIR || 'cloudbongos'); }
@@ -98,12 +104,15 @@ function repeatKey(message) {
   const first = String(message).split('\n').map((l) => l.trim().toLowerCase()).find(Boolean) || '';
   return crypto.createHash('sha256').update(first).digest('hex').slice(0, 16);
 }
-function checkAndRecordRepeat(message, { file = path.join(stateDir(), 'feedback-sent.json'), now = Date.now() } = {}) {
+// `record: false` only looks: the CLI records a report once its project has
+// vouched for it, so a report that never left is not "already sent" (task 1004759).
+function checkAndRecordRepeat(message, { file = path.join(stateDir(), 'feedback-sent.json'), now = Date.now(), record = true } = {}) {
   let seen = {};
   try { seen = JSON.parse(fs.readFileSync(file, 'utf8')) || {}; } catch { /* first report */ }
   for (const [k, t] of Object.entries(seen)) if (!(now - t < REPEAT_WINDOW_MS)) delete seen[k];
   const key = repeatKey(message);
   if (Object.prototype.hasOwnProperty.call(seen, key)) return true;
+  if (!record) return false;
   seen[key] = now;
   try {
     fs.mkdirSync(path.dirname(file), { recursive: true });
@@ -112,22 +121,29 @@ function checkAndRecordRepeat(message, { file = path.join(stateDir(), 'feedback-
   return false;
 }
 
-// deliver — the network half: receipt from the project, then the report to the
-// hub. Returns an outcome object; never prints. Runs in the background child.
-async function deliver({ message, kind }, deps = {}) {
+// requestReceipt — the project vouches for this exact text. Foreground: one call
+// to the builder's own project. A 404 means the project's core predates the
+// receipt door (task 1004591), which no retry fixes until it is upgraded.
+async function requestReceipt({ message, kind }, deps = {}) {
   const api = deps.api || await cliClient();
   const base = deps.base || ic.resolveApiBase({ session: loadSessionSync() });
-  const doFetch = deps.fetchImpl || fetch;
   const sha256 = crypto.createHash('sha256').update(message, 'utf8').digest('hex');
   const r = await api.request('POST', '/feedback/receipt', { body: { sha256, kind } });
-  if (!r.ok) return { ok: false, step: 'receipt', code: errCode(r.data) || `http_${r.status}` };
+  if (!r.ok) return { ok: false, step: 'receipt', code: r.status === 404 ? 'project_too_old' : (errCode(r.data) || `http_${r.status}`) };
   const origin = new URL(base).origin;
   const hub = String((r.data && r.data.hub) || origin).replace(/\/+$/, '');
+  return { ok: true, receipt: r.data.receipt, origin, hub };
+}
+
+// sendToHub — the vouched report straight to the hub. Returns an outcome
+// object; never prints. Runs in the background child.
+async function sendToHub({ message, kind, receipt, origin, hub }, deps = {}) {
+  const doFetch = deps.fetchImpl || fetch;
   const res = await doFetch(`${hub}/api/bongos/sso/feedback/direct`, {
     method: 'POST',
     headers: { 'Content-Type': 'application/json', Accept: 'application/json' },
     body: JSON.stringify({
-      origin, receipt: r.data.receipt, message, kind,
+      origin, receipt, message, kind,
       context: { cli_version: cliVersion(), os: `${os.platform()} ${os.release()}` },
     }),
     signal: AbortSignal.timeout(15000),
@@ -138,13 +154,31 @@ async function deliver({ message, kind }, deps = {}) {
   return { ok: false, step: 'hub', code: errCode(body) || `http_${res.status}` };
 }
 
+// deliver — both halves in one go.
+async function deliver(job, deps = {}) {
+  const r = await requestReceipt(job, deps);
+  if (!r.ok) return r;
+  return sendToHub({ ...job, receipt: r.receipt, origin: r.origin, hub: r.hub }, deps);
+}
+
+// A report the project could not vouch for is kept, so it can be sent after the
+// upgrade (`--message-file <it>`) instead of being written again.
+function keepUnsent(message, { dir = stateDir(), now = new Date() } = {}) {
+  try {
+    fs.mkdirSync(dir, { recursive: true });
+    const file = path.join(dir, `feedback-unsent-${now.toISOString().replace(/[:.]/g, '-')}.md`);
+    fs.writeFileSync(file, message, { mode: 0o600 });
+    return file;
+  } catch { return null; }
+}
+
 // The background child: read the queued report, deliver it, record the outcome
 // where a curious builder (or a maintainer helping them) can look.
 async function runDeliverChild(file) {
   let job;
   try { job = JSON.parse(fs.readFileSync(file, 'utf8')); } finally { fs.rmSync(path.dirname(file), { recursive: true, force: true }); }
   let outcome;
-  try { outcome = await deliver(job); } catch (e) { outcome = { ok: false, step: 'network', code: String(e && e.message || e).slice(0, 200) }; }
+  try { outcome = job.receipt ? await sendToHub(job) : await deliver(job); } catch (e) { outcome = { ok: false, step: 'network', code: String(e && e.message || e).slice(0, 200) }; }
   try {
     fs.writeFileSync(path.join(stateDir(), 'feedback-last.json'), JSON.stringify({ at: new Date().toISOString(), ...outcome }), { mode: 0o600 });
   } catch { /* nowhere to record — the report itself is what mattered */ }
@@ -177,16 +211,27 @@ async function main(argv = process.argv.slice(2), deps = {}) {
   if (isLocalBase(base)) { console.error(REFUSALS.local_only); return 1; }
 
   const job = { message: scrubbed.text, kind };
-  if ((deps.checkRepeat || checkAndRecordRepeat)(job.message)) {
+  const checkRepeat = deps.checkRepeat || checkAndRecordRepeat;
+  if (checkRepeat(job.message, { record: false })) {
     console.log('Already sent — the Bongos team has this one.');
     return 0;
   }
+  // The receipt in the foreground: "Sent" only once the project has vouched.
+  const r = await (deps.requestReceipt || requestReceipt)(job, { base });
+  if (!r.ok) {
+    const kept = (deps.keepUnsent || keepUnsent)(job.message);
+    const why = r.code === 'project_too_old' ? REFUSALS.project_too_old : `${REFUSALS.receipt_failed} (${r.code}).`;
+    console.error(kept ? `${why} Your note is saved in ${kept}` : why);
+    return 1;
+  }
+  checkRepeat(job.message);
+  const vouched = { ...job, receipt: r.receipt, origin: r.origin, hub: r.hub };
   if (hasFlag('--wait', argv)) {
-    const outcome = await (deps.deliver || deliver)(job);
+    const outcome = await (deps.sendToHub || sendToHub)(vouched);
     console.log(outcome.ok ? SENT_LINE : `Not sent (${outcome.step}: ${outcome.code}).`);
     return outcome.ok ? 0 : 1;
   }
-  (deps.spawnDelivery || spawnDelivery)(job);
+  (deps.spawnDelivery || spawnDelivery)(vouched);
   console.log(SENT_LINE);
   return 0;
 }
@@ -201,4 +246,4 @@ if (require.main === module) {
   });
 }
 
-module.exports = { main, deliver, readMessage, REFUSALS, scrubReport, isLocalBase, repeatKey, checkAndRecordRepeat, SENT_LINE };
+module.exports = { main, deliver, requestReceipt, sendToHub, keepUnsent, readMessage, REFUSALS, scrubReport, isLocalBase, repeatKey, checkAndRecordRepeat, SENT_LINE };

package/src/module-api.js

@@ -75,7 +75,7 @@ const { responsibilityFor, ROLE_RESPONSIBILITIES } = require('./role-responsibil
 // MAJOR (see allowBoxScope below): passes the request through untouched.
 function deprecatedNoopMiddleware(_req, _res, next) { next(); }
 
-const CORE_VERSION = '1.21.147'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
+const CORE_VERSION = '1.21.149'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('discord'); log.info('mounted');

package/tests/core_origin_follow.mjs

@@ -0,0 +1,287 @@
+// tests/core_origin_follow.mjs — the laptop picks up a core move the hub made (task 1004732)
+//
+// The bug: when the hub moves a hosted project's core it commits the new pin on the box
+// and pushes it to the project's GitHub repo. The owner's laptop checkout never heard of
+// it, so the next session and the next ship ran — and merged against — the old pin.
+//
+// Each case is a REAL temp git setup: a bare "GitHub" origin, a "box" clone that makes
+// the hub's pin commit and pushes it, and a "laptop" clone that is the checkout under
+// test. npm is stubbed (it lays down a fake installed core); git is real.
+//
+// Run:  node tests/core_origin_follow.mjs
+
+import { strict as assert } from 'node:assert';
+import { createRequire } from 'node:module';
+import fs from 'node:fs';
+import os from 'node:os';
+import path from 'node:path';
+import { spawnSync } from 'node:child_process';
+
+const require = createRequire(import.meta.url);
+const follow = require('../scripts/gds/core-origin-follow.js');
+const pinSync = require('../scripts/gds/core-pin-sync.js');
+
+let passed = 0;
+let failed = 0;
+function test(name, fn) {
+  try { fn(); passed++; console.log(`  ok  ${name}`); }
+  catch (err) { failed++; console.log(`  FAIL ${name}`); console.log(`     ${err.stack || err.message}`); }
+}
+
+function git(cwd, ...args) {
+  const r = spawnSync('git', ['-c', 'user.email=t@t', '-c', 'user.name=t', '-c', 'commit.gpgsign=false', ...args], { cwd, encoding: 'utf8' });
+  assert.equal(r.status, 0, `git ${args.join(' ')}: ${r.stderr}`);
+  return r.stdout;
+}
+
+const OLD = '1.21.20';
+const NEW = '1.21.115';
+
+function writePin(dir, spec, version) {
+  fs.writeFileSync(path.join(dir, 'package.json'), JSON.stringify({ name: 'toast', private: true, dependencies: { '@bongos/core': spec } }, null, 2) + '\n');
+  fs.writeFileSync(path.join(dir, 'package-lock.json'), JSON.stringify({
+    name: 'toast', lockfileVersion: 3,
+    packages: { 'node_modules/@bongos/core': { version, resolved: spec.startsWith('file:') ? spec : `https://registry.npmjs.org/@bongos/core/-/core-${version}.tgz` } },
+  }, null, 2) + '\n');
+}
+
+// A fake installed core in `root`: what npm would leave behind.
+function installCore(root, version) {
+  const core = path.join(root, 'node_modules', '@bongos', 'core');
+  fs.rmSync(path.join(root, 'node_modules'), { recursive: true, force: true });
+  fs.mkdirSync(path.join(core, 'bin'), { recursive: true });
+  fs.mkdirSync(path.join(core, 'scripts', 'gds'), { recursive: true });
+  fs.writeFileSync(path.join(core, 'package.json'), JSON.stringify({ name: '@bongos/core', version }));
+  fs.writeFileSync(path.join(core, 'bin', 'bongos.js'), '');
+  fs.writeFileSync(path.join(core, 'scripts', 'gds', 'fitness.js'), '');
+  return core;
+}
+
+// origin (bare) ← box pushes the hub's move; laptop is a clone made BEFORE the move.
+// `move` makes the hub's commit: vendored tgz pin → exact registry pin, tgz removed.
+function setup({ move = true, alsoOnBox = null } = {}) {
+  const base = fs.mkdtempSync(path.join(os.tmpdir(), 'core-origin-follow-'));
+  const origin = path.join(base, 'origin.git');
+  const box = path.join(base, 'box');
+  const laptop = path.join(base, 'laptop');
+  git(base, 'init', '-q', '--bare', '-b', 'main', origin);
+  fs.mkdirSync(box);
+  git(box, 'init', '-q', '-b', 'main');
+  writePin(box, `file:vendor/bongos-core-${OLD}.tgz`, OLD);
+  fs.mkdirSync(path.join(box, 'vendor'));
+  fs.writeFileSync(path.join(box, 'vendor', `bongos-core-${OLD}.tgz`), 'old-tarball');
+  fs.writeFileSync(path.join(box, '.gitignore'), 'node_modules/\n');
+  git(box, 'add', '-A');
+  git(box, 'commit', '-qm', 'init: vendored core');
+  git(box, 'remote', 'add', 'origin', origin);
+  git(box, 'push', '-q', 'origin', 'main');
+  git(base, 'clone', '-q', origin, laptop);
+  // The laptop has the old core installed and the untracked, excluded scripts link.
+  installCore(laptop, OLD);
+  fs.symlinkSync(path.join(laptop, 'node_modules', '@bongos', 'core', 'scripts'), path.join(laptop, 'scripts'), 'junction');
+  fs.appendFileSync(path.join(laptop, '.git', 'info', 'exclude'), 'scripts\n');
+  if (move) {
+    writePin(box, NEW, NEW);
+    git(box, 'rm', '-q', `vendor/bongos-core-${OLD}.tgz`);
+    if (alsoOnBox) alsoOnBox(box);
+    git(box, 'add', '-A');
+    git(box, 'commit', '-qm', `core: upgrade @bongos/core to ${NEW}`);
+    git(box, 'push', '-q', 'origin', 'main');
+  }
+  // The core the laptop runs (node_modules/@bongos/core) — the dispatcher's REPO_ROOT.
+  const coreRoot = path.join(laptop, 'node_modules', '@bongos', 'core');
+  return { base, origin, box, laptop, coreRoot };
+}
+
+// git → real; npm → lay down the pinned core; the re-run of bongos → recorded.
+function stubRun(root) {
+  const calls = { installs: [], reruns: [], git: 0 };
+  const run = (cmd, args, opts) => {
+    if (cmd === 'git') { calls.git++; return spawnSync(cmd, args, opts); }
+    if (cmd === 'npm' || String(args[0] || '').endsWith('npm-cli.js')) {
+      calls.installs.push(cmd === 'npm' ? args : args.slice(1));
+      const lock = JSON.parse(fs.readFileSync(path.join(root, 'package-lock.json'), 'utf8'));
+      installCore(root, lock.packages['node_modules/@bongos/core'].version);
+      return { status: 0 };
+    }
+    if (String(args[0] || '').endsWith('bongos.js')) { calls.reruns.push(args.slice(1)); return { status: 0 }; }
+    return { status: 1 };
+  };
+  return { run, calls };
+}
+
+const pinOf = (dir) => JSON.parse(fs.readFileSync(path.join(dir, 'package.json'), 'utf8')).dependencies['@bongos/core'];
+const head = (dir) => git(dir, 'rev-parse', 'HEAD').trim();
+
+test('clean main: says the project moved, fast-forwards, reinstalls, re-runs, scripts link resolves', () => {
+  const { laptop, coreRoot } = setup();
+  const { run, calls } = stubRun(laptop);
+  const logs = [];
+  const code = follow.ensureCurrentCore({ coreRoot, argv: ['node', 'bongos', 'start'], verb: 'start', cwd: laptop, env: {}, run, log: (s) => logs.push(s), npmCli: null });
+  assert.equal(code, 0, 'the re-run exit code: ' + logs.join('\n'));
+  assert.ok(logs.some((l) => l.includes(`upgraded to core ${NEW} on GitHub`) && l.includes(OLD)), logs.join('\n'));
+  assert.equal(pinOf(laptop), NEW, 'fast-forwarded onto the hub commit');
+  assert.equal(calls.installs.length, 1, 'npm ran once');
+  assert.equal(calls.installs[0][0], 'ci');
+  assert.deepEqual(calls.reruns, [['start']], 'start re-ran under the new core');
+  assert.ok(fs.existsSync(path.join(laptop, 'scripts', 'gds', 'fitness.js')), 'the scripts link still resolves');
+  const installed = JSON.parse(fs.readFileSync(path.join(laptop, 'node_modules', '@bongos', 'core', 'package.json'), 'utf8'));
+  assert.equal(installed.version, NEW);
+});
+
+test('vendored → registry pin: no tgz left referenced after the follow', () => {
+  const { laptop, coreRoot } = setup();
+  const { run } = stubRun(laptop);
+  follow.ensureCurrentCore({ coreRoot, argv: ['node', 'bongos', 'ship', '7'], verb: 'ship', cwd: laptop, env: {}, run, log: () => {}, npmCli: null });
+  assert.equal(pinOf(laptop), NEW);
+  for (const f of ['package.json', 'package-lock.json']) {
+    assert.ok(!/bongos-core-[\d.]+\.tgz/.test(fs.readFileSync(path.join(laptop, f), 'utf8')), `${f} still names a tarball`);
+  }
+  assert.ok(!fs.existsSync(path.join(laptop, 'vendor', `bongos-core-${OLD}.tgz`)), 'the hub removed the old tarball; the follow carried that');
+});
+
+test('dirty tree: reports the move only — no fast-forward, no install', () => {
+  const { laptop, coreRoot } = setup();
+  fs.writeFileSync(path.join(laptop, '.gitignore'), 'node_modules/\nlocal-edit\n');
+  const before = head(laptop);
+  const { run, calls } = stubRun(laptop);
+  const logs = [];
+  const code = follow.ensureCurrentCore({ coreRoot, argv: ['node', 'bongos', 'start'], verb: 'start', cwd: laptop, env: {}, run, log: (s) => logs.push(s), npmCli: null });
+  assert.equal(code, null, 'carry on with the command');
+  assert.ok(logs.some((l) => l.includes(`upgraded to core ${NEW} on GitHub`)), logs.join('\n'));
+  assert.ok(logs.some((l) => /uncommitted/.test(l)), 'says why it was not applied: ' + logs.join('\n'));
+  assert.equal(head(laptop), before);
+  assert.equal(pinOf(laptop), `file:vendor/bongos-core-${OLD}.tgz`);
+  assert.equal(calls.installs.length, 0);
+  assert.match(fs.readFileSync(path.join(laptop, '.gitignore'), 'utf8'), /local-edit/, 'the edit is untouched');
+});
+
+test('feature branch: reports only, never moves the branch', () => {
+  const { laptop, coreRoot } = setup();
+  git(laptop, 'checkout', '-qb', 'task-49');
+  const before = head(laptop);
+  const { run, calls } = stubRun(laptop);
+  const logs = [];
+  const r = follow.followOriginPin({ coreRoot, cwd: laptop, env: {}, run, log: (s) => logs.push(s) });
+  assert.equal(r.action, 'reported');
+  assert.ok(logs.some((l) => l.includes('task-49')), logs.join('\n'));
+  assert.equal(head(laptop), before);
+  assert.equal(calls.installs.length, 0);
+});
+
+// The fast-forward installs and RUNS what it brings in, so only the hub's pin-only commit
+// shape onto a published release is applied unattended; anything wider is reported.
+function expectReportedOnly(alsoOnBox, why) {
+  const { laptop, coreRoot } = setup({ alsoOnBox });
+  const before = head(laptop);
+  const { run, calls } = stubRun(laptop);
+  const logs = [];
+  const code = follow.ensureCurrentCore({ coreRoot, argv: ['node', 'bongos', 'start'], verb: 'start', cwd: laptop, env: {}, run, log: (s) => logs.push(s), npmCli: null });
+  assert.equal(code, null);
+  assert.ok(logs.some((l) => l.includes('upgraded to core') ), logs.join('\n'));
+  assert.ok(logs.some((l) => why.test(l)), `names why (${why}): ` + logs.join('\n'));
+  assert.equal(head(laptop), before, 'not fast-forwarded');
+  assert.equal(calls.installs.length, 0, 'nothing installed');
+}
+
+test('a move that carries other code too is reported, never applied', () => {
+  expectReportedOnly((box) => fs.writeFileSync(path.join(box, 'postinstall.js'), 'evil()'), /other changes besides the core move/);
+});
+
+test('a move whose package.json changes more than the core pin is reported, never applied', () => {
+  expectReportedOnly((box) => {
+    const p = JSON.parse(fs.readFileSync(path.join(box, 'package.json'), 'utf8'));
+    p.scripts = { prestart: 'evil' };
+    fs.writeFileSync(path.join(box, 'package.json'), JSON.stringify(p, null, 2) + '\n');
+  }, /package\.json changed beyond the core pin/);
+});
+
+test('a move onto a tarball from GitHub (not a published release) is reported, never applied', () => {
+  // the pin alone names a tarball (the spec gate) …
+  expectReportedOnly((box) => writePin(box, `file:vendor/bongos-core-${NEW}.tgz`, NEW), /not a published release/);
+  // … and a tarball file brought in with it is caught by the file gate first
+  expectReportedOnly((box) => {
+    writePin(box, `file:vendor/bongos-core-${NEW}.tgz`, NEW);
+    fs.mkdirSync(path.join(box, 'vendor'), { recursive: true });
+    fs.writeFileSync(path.join(box, 'vendor', `bongos-core-${NEW}.tgz`), 'unreleased');
+  }, /other changes besides the core move/);
+});
+
+test('a lockfile that resolves from outside the public registry is reported, never applied', () => {
+  expectReportedOnly((box) => {
+    const lock = JSON.parse(fs.readFileSync(path.join(box, 'package-lock.json'), 'utf8'));
+    lock.packages['node_modules/left-pad'] = { version: '1.0.0', resolved: 'https://evil.example/left-pad.tgz' };
+    fs.writeFileSync(path.join(box, 'package-lock.json'), JSON.stringify(lock, null, 2) + '\n');
+  }, /source outside the public registry/);
+});
+
+test('the core repo itself: a no-op, without a single git spawn', () => {
+  const { laptop } = setup();
+  const coreRepo = fs.mkdtempSync(path.join(os.tmpdir(), 'core-origin-follow-core-'));
+  fs.writeFileSync(path.join(coreRepo, 'package.json'), JSON.stringify({ name: 'cloud-bongos', version: '0.0.2' }));
+  const { run, calls } = stubRun(laptop);
+  const logs = [];
+  assert.equal(follow.ensureCurrentCore({ coreRoot: coreRepo, argv: ['node', 'bongos', 'start'], verb: 'start', cwd: laptop, env: {}, run, log: (s) => logs.push(s) }), null);
+  assert.equal(calls.git, 0);
+  assert.deepEqual(logs, []);
+});
+
+test('origin unreadable: silent no-op', () => {
+  const { laptop, coreRoot, origin } = setup();
+  // Drop the remote-tracking ref and point origin at nothing: the fetch fails and there is no origin/main.
+  git(laptop, 'update-ref', '-d', 'refs/remotes/origin/main');
+  git(laptop, 'remote', 'set-url', 'origin', origin + '-gone');
+  const before = head(laptop);
+  const { run, calls } = stubRun(laptop);
+  const logs = [];
+  assert.equal(follow.ensureCurrentCore({ coreRoot, argv: ['node', 'bongos', 'start'], verb: 'start', cwd: laptop, env: {}, run, log: (s) => logs.push(s) }), null);
+  assert.deepEqual(logs, [], 'nothing said');
+  assert.equal(head(laptop), before);
+  assert.equal(calls.installs.length, 0);
+});
+
+test('no move on origin: silent, and start pays no install', () => {
+  const { laptop, coreRoot } = setup({ move: false });
+  const { run, calls } = stubRun(laptop);
+  const logs = [];
+  assert.equal(follow.ensureCurrentCore({ coreRoot, argv: ['node', 'bongos', 'start'], verb: 'start', cwd: laptop, env: {}, run, log: (s) => logs.push(s) }), null);
+  assert.deepEqual(logs, []);
+  assert.equal(calls.installs.length, 0);
+});
+
+test('a pin the LAPTOP moved (not pushed yet) is not reported as a hub move', () => {
+  const { laptop, coreRoot } = setup({ move: false });
+  writePin(laptop, '1.21.99', '1.21.99');
+  git(laptop, 'commit', '-qam', 'local pin bump');
+  const { run } = stubRun(laptop);
+  const logs = [];
+  const r = follow.followOriginPin({ coreRoot, cwd: laptop, env: {}, run, log: (s) => logs.push(s) });
+  assert.equal(r.action, 'none');
+  assert.deepEqual(logs, []);
+});
+
+test('a scripts link left dangling after the install is re-pointed at the installed core', () => {
+  const { laptop } = setup({ move: false });
+  const link = path.join(laptop, 'scripts');
+  fs.rmSync(link, { force: true, recursive: false });
+  const gone = path.join(laptop, 'old-core-scripts');
+  fs.mkdirSync(gone);
+  fs.symlinkSync(gone, link, 'junction');
+  fs.rmSync(gone, { recursive: true });
+  const logs = [];
+  assert.equal(pinSync.healScriptsLink(laptop, { log: (s) => logs.push(s) }), 'repointed');
+  assert.ok(fs.existsSync(path.join(link, 'gds', 'fitness.js')));
+  // a real scripts/ directory (the core repo shape) is never touched
+  const real = fs.mkdtempSync(path.join(os.tmpdir(), 'core-origin-follow-real-'));
+  fs.mkdirSync(path.join(real, 'scripts'));
+  assert.equal(pinSync.healScriptsLink(real, { log: () => {} }), 'not-a-link');
+});
+
+test('the dispatcher runs the follow before ship and start', () => {
+  const src = fs.readFileSync(new URL('../bin/bongos.js', import.meta.url), 'utf8');
+  assert.match(src, /verb === 'ship' \|\| verb === 'start'/);
+  assert.match(src, /require\('\.\.\/scripts\/gds\/core-origin-follow\.js'\)\.ensureCurrentCore/);
+});
+
+console.log(`\n${passed} passed, ${failed} failed`);
+if (failed) process.exit(1);

package/tests/core_pin_sync.mjs

@@ -228,9 +228,14 @@ test('ensurePinnedCore end to end: deleting the lockfile or adding an .npmrc on
   }
 });
 
-test('the dispatcher runs the check for ship only', () => {
+test('the dispatcher runs the check for ship (and start only after a followed core move)', () => {
+  // Since task 1004732 the dispatcher goes through core-origin-follow.ensureCurrentCore,
+  // which calls ensurePinnedCore for `ship` always and for `start` only after it
+  // fast-forwarded a hub pin move (tests/core_origin_follow.mjs drives both).
   const src = fs.readFileSync(new URL('../bin/bongos.js', import.meta.url), 'utf8');
-  assert.match(src, /if \(!COMPILED && verb === 'ship'\) \{\s*const synced = require\('\.\.\/scripts\/gds\/core-pin-sync\.js'\)\.ensurePinnedCore/);
+  assert.match(src, /if \(!COMPILED && \(verb === 'ship' \|\| verb === 'start'\)\) \{\s*const synced = require\('\.\.\/scripts\/gds\/core-origin-follow\.js'\)\.ensureCurrentCore/);
+  const follow = fs.readFileSync(new URL('../scripts/gds/core-origin-follow.js', import.meta.url), 'utf8');
+  assert.match(follow, /if \(verb !== 'ship' && followed\.action !== 'fast-forwarded'\) return null;\s*return pinSync\.ensurePinnedCore/);
 });
 
 console.log(`\n${passed} passed, ${failed} failed`);

package/tests/instance_feedback.mjs

@@ -326,6 +326,8 @@ async function runCli(argv, extra = {}) {
       requireSession: async () => ({ token: 't' }),
       base: 'https://mercury.cloudbongos.com',
       checkRepeat: () => false,
+      requestReceipt: async () => ({ ok: true, receipt: 'R'.repeat(24), origin: 'https://mercury.cloudbongos.com', hub: 'https://cloudbongos.com' }),
+      keepUnsent: () => null,
       spawnDelivery: (job) => spawned.push(job),
       ...extra,
     });
@@ -337,7 +339,49 @@ test('the CLI prints one line and hands the network to the background', async ()
   const r = await runCli(['claim', 'hung']);
   assert.equal(r.code, 0);
   assert.deepEqual(r.out, ['Sent to the Bongos team.']);
-  assert.deepEqual(r.spawned, [{ message: 'claim hung', kind: 'bug' }]);
+  assert.deepEqual(r.spawned, [{ message: 'claim hung', kind: 'bug', receipt: 'R'.repeat(24), origin: 'https://mercury.cloudbongos.com', hub: 'https://cloudbongos.com' }]);
+});
+
+// Task 1004759 (toast, core 1.21.20): the project's live site had no receipt
+// door, the background child got a 404, and the builder had been told "Sent".
+test('a project too old to vouch: "Not sent" in the foreground, the note kept, nothing recorded as sent', async () => {
+  const kept = []; const recorded = [];
+  const r = await runCli(['--idea', 'one', 'skill', 'for', 'project', 'purpose'], {
+    requestReceipt: async () => ({ ok: false, step: 'receipt', code: 'project_too_old' }),
+    keepUnsent: (m) => { kept.push(m); return '/home/x/.config/cloudbongos/feedback-unsent-1.md'; },
+    checkRepeat: (m, o = {}) => { if (o.record !== false) recorded.push(m); return false; },
+  });
+  assert.equal(r.code, 1);
+  assert.deepEqual(r.out, [], 'never says Sent');
+  assert.equal(r.spawned.length, 0);
+  assert.match(r.err.join('\n'), /older Bongos/);
+  assert.match(r.err.join('\n'), /feedback-unsent-1\.md/, 'says where the note is');
+  assert.deepEqual(kept, ['one skill for project purpose']);
+  assert.deepEqual(recorded, [], 'a report that never left is not "already sent"');
+  const other = await runCli(['x'], { requestReceipt: async () => ({ ok: false, step: 'receipt', code: 'not_signed_in' }) });
+  assert.equal(other.code, 1);
+  assert.match(other.err.join('\n'), /did not confirm.*not_signed_in/);
+});
+
+test('the repeat guard records only after the project vouched', async () => {
+  const calls = [];
+  await runCli(['x'], { checkRepeat: (m, o = {}) => { calls.push(o.record === false ? 'look' : 'record'); return false; } });
+  assert.deepEqual(calls, ['look', 'record']);
+});
+
+test('requestReceipt: a 404 from the project reads as project_too_old', async () => {
+  const { requestReceipt } = require_(path.join(ROOT, 'scripts/gds/feedback-send.js'));
+  const api = { request: async () => ({ ok: false, status: 404, data: { error: 'Not found' } }) };
+  const r = await requestReceipt({ message: 'x', kind: 'idea' }, { api, base: 'https://toast.cloudbongos.com' });
+  assert.deepEqual(r, { ok: false, step: 'receipt', code: 'project_too_old' });
+});
+
+test('keepUnsent writes the note where the builder can send it again', () => {
+  const { keepUnsent } = require_(path.join(ROOT, 'scripts/gds/feedback-send.js'));
+  const dir = fs.mkdtempSync(path.join(os.tmpdir(), 'fb-unsent-'));
+  const file = keepUnsent('the note', { dir, now: new Date('2026-10-19T10:00:00Z') });
+  assert.equal(fs.readFileSync(file, 'utf8'), 'the note');
+  assert.match(path.basename(file), /^feedback-unsent-2026-10-19T10-00-00-000Z\.md$/);
 });
 
 test('the CLI refuses a project only this computer can reach, and sends nothing', async () => {