@bongos/core 1.24.70 → 1.24.72

package/modules/hall-ui/public/style.css

@@ -757,7 +757,7 @@ html[data-theme="dark"] .brand-mark__mark { --mark-ink: #e2e1e4; }
 .genesis__step-n { display: inline-grid; place-items: center; width: 16px; height: 16px; border-radius: 50%; font-size: 10px; background: var(--rule-soft); }
 .genesis__step.is-done { color: var(--ink-soft); }
 .genesis__step.is-now { color: var(--ink); border-color: color-mix(in srgb, var(--accent) 45%, transparent); background: color-mix(in srgb, var(--accent) 10%, transparent); }
-.genesis__step.is-now .genesis__step-n { background: var(--accent); color: var(--bg); }
+.genesis__step.is-now .genesis__step-n { background: var(--accent); color: var(--accent-on); }
 .genesis__plan, .genesis__stages, .genesis__tasks, .genesis__life { list-style: none; margin: 0; padding: 0; }
 .genesis__plan-row, .genesis__stage, .genesis__task { display: flex; align-items: center; gap: 12px; padding: 12px 0; border-top: 1px solid var(--rule-soft); }
 .genesis__plan-row:first-child, .genesis__stage:first-child, .genesis__task:first-child { border-top: 0; }

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.24.70",
+  "version": "1.24.72",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.24.70",
+      "version": "1.24.72",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.24.70",
+  "version": "1.24.72",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/release-notes.json

@@ -11445,5 +11445,17 @@
       "id": "1004949",
       "text": "When a shell command was blocked by one hook and another hook was missing, the warning about the missing hook vanished. Now both messages show."
     }
+  ],
+  "1.24.71": [
+    {
+      "id": "1002450",
+      "text": "New projects can no longer be born on an outdated or mislabelled copy of the core. When the hub's saved core file is stale or doesn't match the published one, provisioning now says so loudly and uses the current, published cor"
+    }
+  ],
+  "1.24.72": [
+    {
+      "id": "1005103",
+      "text": "The current step number in the project-setup steps is now dark ink on the orange dot, so it's readable in light mode too."
+    }
   ]
 }

package/scripts/bongos/provision-repo.js

@@ -533,7 +533,9 @@ function installedCoreTarball({ instanceRoot, fsImpl = fs } = {}) {
 // nothing either way. The file: pin is kept for the reason in ADR 0168 — a child is born
 // on the core its parent actually runs — not for access control.) Returns { dir, version, tarballName } or null
 // (a file: pin, an uninstalled dep, or a source checkout). fs reads only → dry-run safe.
-function installedCorePackDir({ instanceRoot, fsImpl = fs } = {}) {
+// `includeFilePins` (task 1002450): the stale-pin recovery below packs the core a
+// file:-pinned hub has INSTALLED, so it must not skip the file: spec the default does.
+function installedCorePackDir({ instanceRoot, fsImpl = fs, includeFilePins = false } = {}) {
   const root = instanceRoot || process.env.BONGOS_INSTANCE_ROOT || process.cwd();
   let pkg;
   try { pkg = JSON.parse(fsImpl.readFileSync(path.join(root, 'package.json'), 'utf8')); }
@@ -541,7 +543,7 @@ function installedCorePackDir({ instanceRoot, fsImpl = fs } = {}) {
   const deps = Object.assign({}, pkg.dependencies, pkg.devDependencies);
   for (const name of ['@bongos/core', '@cloudbongos/core']) {
     const spec = String(deps[name] || '').trim();
-    if (!spec || spec.startsWith('file:')) continue;   // file: pins belong to installedCoreTarball
+    if (!spec || (spec.startsWith('file:') && !includeFilePins)) continue;   // file: pins belong to installedCoreTarball
     const dir = path.join(root, 'node_modules', ...name.split('/'));
     try {
       const installed = JSON.parse(fsImpl.readFileSync(path.join(dir, 'package.json'), 'utf8'));
@@ -568,13 +570,113 @@ function coreCheckoutHasGit({ repoRoot = REPO_ROOT, fsImpl = fs } = {}) {
 // The core version THIS control plane runs — what the ladder below would vend: the
 // pinned tarball's version, else the registry-installed package's, else the checkout's
 // CORE_VERSION. fs reads only → dry-run safe.
+// A pinned tarball whose label disagrees with coreV is STALE (task 1002450): the hall runs
+// coreV, so that is its running version, not the leftover tarball's label.
 function runningCoreVersion({ instanceRoot, coreV }) {
   const pinned = installedCoreTarball({ instanceRoot });
-  if (pinned) return require('./upgrade').versionFromTgzPath(path.basename(pinned)) || coreV;
+  if (pinned) {
+    const pinnedV = pinnedTarballVersion(pinned);
+    return (coreV && pinnedV && pinnedV !== coreV) ? coreV : (pinnedV || coreV);
+  }
   const packSrc = installedCorePackDir({ instanceRoot });
   return packSrc ? packSrc.version : coreV;
 }
 
+// ── the stale-pin guard (task 1002450) ────────────────────────────────────────────
+// Rung 1 below trusted a file:-pinned hub's own vendored tarball unconditionally ("the
+// child pins the SAME core the hub runs"). Two ways that was false, both seen live: an
+// out-of-band upgrade swaps node_modules/@bongos/core without rewriting vendor/*.tgz, so
+// the label trails the core the hub RUNS; and the same label can name different bytes —
+// an early instance was born on a 1.18.14 tarball 15 kB smaller than the published 1.18.14,
+// missing the task-1002419 poller fix, so its first ship never left 'confirmed'. Quiet
+// failure, so this guard is loud.
+//
+// The two sibling gaps are closed elsewhere, on purpose — tests/provision.mjs proves each:
+//   - PUBLISHING one version twice as different bytes: the npm registry refuses it (a
+//     version is immutable), and .github/workflows/publish.yml fails the run loudly on
+//     that refusal (task 1004886). What escaped was a LOCAL build carrying a published
+//     label — the vendoring this guard checks.
+//   - a hub BEHIND upstream: projectCoreDecision gives a new project the release when
+//     the runner is behind it (task 1004556), and that target short-circuits this ladder.
+// The integrity read costs one `npm view` on the reuse path; projectCoreTarget already
+// makes one per scaffold, and both fail open when the registry is unreachable.
+
+// The version a core tarball's FILENAME carries — both scope aliases (bongos-core-*,
+// cloudbongos-core-*), which upgrade.versionFromTgzPath (bongos-core only) would miss.
+// Digits, dots and [A-Za-z0-9.+-] only, so the result is shell-safe. PURE.
+function pinnedTarballVersion(p) {
+  const m = /(?:^|-)core-(\d+\.\d+\.\d+[A-Za-z0-9.+-]*)\.tgz$/.exec(path.basename(String(p || '')));
+  return m ? m[1] : null;
+}
+
+// A version that may enter a shell command, or null — the same character set as
+// safeVersionLabel, the file's interpolation chokepoint. PURE.
+function shellSafeVersion(v) {
+  const s = safeVersionLabel(v);
+  return s === '(unversioned)' ? null : s;
+}
+
+// npm's dist.integrity form for a file: sha512, base64. fs injectable for tests.
+function tarballIntegrity(p, fsImpl = fs) {
+  return 'sha512-' + crypto.createHash('sha512').update(fsImpl.readFileSync(p)).digest('base64');
+}
+
+// Is the pinned tarball the core this hub runs, AND the bytes the registry published
+// under that label? → { verdict, pinnedV, reason }:
+//   'stale-version' — its label is not coreV (the hub moved on, the tarball did not);
+//   'stale-bytes'   — the label matches but the registry's integrity for it differs
+//                     (the charter case: same version, different artifact);
+//   'unverifiable'  — no coreV, an unparseable label, or no registry answer: reuse it
+//                     (fail-open, never block a scaffold on a resolution gap) but SAY so;
+//   'fresh'         — both checks pass.
+// The registry read goes through the injected exec, so a dry run never hits the network.
+function checkPinnedTarball({ pinned, coreV, exec, fsImpl = fs }) {
+  const pinnedV = shellSafeVersion(pinnedTarballVersion(pinned));
+  if (!pinnedV) return { verdict: 'unverifiable', pinnedV, reason: 'no version in its filename' };
+  if (!coreV) return { verdict: 'unverifiable', pinnedV, reason: 'the running core version is unknown' };
+  if (pinnedV !== coreV) return { verdict: 'stale-version', pinnedV, reason: `it is ${pinnedV} but this control plane runs ${coreV}` };
+  const res = exec(`npm view ${CORE_PKG}@${pinnedV} dist.integrity`, { allowFail: true });
+  const published = String((res && res.ok !== false && res.stdout) || '').trim();
+  if (!/^sha512-/.test(published)) return { verdict: 'unverifiable', pinnedV, reason: `the registry gave no integrity for ${pinnedV}` };
+  let local;
+  try { local = tarballIntegrity(pinned, fsImpl); } catch { return { verdict: 'unverifiable', pinnedV, reason: 'it could not be read' }; }
+  if (local !== published) return { verdict: 'stale-bytes', pinnedV, reason: `its bytes are not the ${pinnedV} the registry published (a different build under the same version label)` };
+  return { verdict: 'fresh', pinnedV, reason: 'matches the running core and the published bytes' };
+}
+
+// Where a stale pin goes instead. NEVER to the package-core.js rungs: on a file:-pinned
+// consumer hub those abort on an empty core set and leave the new repo empty (task 1002275).
+//   stale-bytes   → the registry's own bytes for that version (canonical by definition);
+//   stale-version → the core the hub has INSTALLED, when it is coreV; else the registry's coreV;
+//   neither       → refuse, loudly: no project is born on a core nobody can name.
+function recoverFromStalePin({ instanceRoot, exec, log, tag, coreV, check }) {
+  const fromRegistry = (raw) => {
+    const v = shellSafeVersion(raw);   // interpolated into a shell command below
+    if (!v) return null;
+    const packDest = path.join(os.tmpdir(), `bongos-core-registry-${v}`);
+    exec(`mkdir -p ${packDest}`);
+    const res = exec(`npm pack ${CORE_PKG}@${v} --pack-destination ${packDest}`, { allowFail: true });
+    if (res && res.ok === false) { exec(`rm -rf ${packDest}`); return null; }
+    log(`  ${tag} packed the published ${v} from the registry instead (task 1002450)`);
+    return { tgz: path.join(packDest, `bongos-core-${v}.tgz`), packDest };
+  };
+  if (check.verdict === 'stale-version') {
+    const installed = installedCorePackDir({ instanceRoot, includeFilePins: true });
+    const v = installed && shellSafeVersion(installed.version);   // interpolated into a shell command below
+    if (v && v === coreV) {
+      const packDest = path.join(os.tmpdir(), `bongos-core-pack-${v}`);
+      log(`  ${tag} packing the installed core this control plane runs (v${v}) instead (task 1002450)`);
+      exec(`mkdir -p ${packDest}`);
+      exec(`npm pack ${installed.dir} --pack-destination ${packDest}`);
+      return { tgz: path.join(packDest, installed.tarballName), packDest };
+    }
+  }
+  const v = check.verdict === 'stale-bytes' ? check.pinnedV : coreV;
+  const got = fromRegistry(v);
+  if (got) return got;
+  throw new Error(`refusing to give a new project a stale core: the pinned tarball ${check.reason}, and neither an installed core ${coreV} nor a published ${v} could be packed. Re-run \`bongos upgrade\` on this control plane so its vendor/ tarball matches the core it runs, then retry (task 1002450).`);
+}
+
 // Which core a hosted project is given (task 1004299, ADR 0361 D5). PURE. Since merges
 // publish as candidates, the platform hall runs ahead of the registry's `latest` label by
 // design — and the ladder below vends whatever the hall runs, so every new project would
@@ -617,7 +719,8 @@ function projectCoreTarget({ instanceRoot, coreV, exec, log, tag = '[core]' }) {
 // project gets the released version packed from the registry, not this hall's core.
 //   1. a `file:`-pinned control plane reuses its own pinned tarball (task 1002275 —
 //      rebuilding via package-core.js aborts with an EMPTY core set when this runner
-//      IS a consumer instance, leaving new repos empty);
+//      IS a consumer instance, leaving new repos empty) — unless checkPinnedTarball
+//      finds it STALE, when recoverFromStalePin replaces it (task 1002450);
 //   2. a REGISTRY-pinned consumer (the post-1002621 mothership shape) packs the core
 //      it has INSTALLED — the child pins the SAME, CURRENT core the hub runs, ending
 //      the frozen-old-tarball births (task 1002706, gap 13) without requiring the
@@ -641,8 +744,14 @@ function resolveVendorableCoreTarball({ instanceRoot, repoRoot = REPO_ROOT, exec
   }
   const pinned = installedCoreTarball({ instanceRoot });
   if (pinned) {
-    log(`  ${tag} reusing the pinned core tarball this control plane runs (${path.basename(pinned)}) — no source rebuild (task 1002275)`);
-    return { tgz: pinned, packDest: null };
+    const check = checkPinnedTarball({ pinned, coreV, exec });
+    if (check.verdict === 'fresh' || check.verdict === 'unverifiable') {
+      if (check.verdict === 'unverifiable') log(`  ${tag} WARNING: cannot verify the pinned core tarball ${path.basename(pinned)} — ${check.reason}; reusing it anyway (task 1002450)`);
+      log(`  ${tag} reusing the pinned core tarball this control plane runs (${path.basename(pinned)}) — no source rebuild (task 1002275)`);
+      return { tgz: pinned, packDest: null };
+    }
+    log(`  ${tag} STALE pinned core tarball ${path.basename(pinned)} — ${check.reason}. NOT vendoring it into a new project (task 1002450)`);
+    return recoverFromStalePin({ instanceRoot, exec, log, tag, coreV, check });
   }
   const packSrc = installedCorePackDir({ instanceRoot });
   if (packSrc) {
@@ -1294,6 +1403,7 @@ module.exports = {
   ownerLoginOf,
   asPostgres,
   buildCorePinRefreshCommit,
+  checkPinnedTarball,
   coreCheckoutHasGit,
   dbCreateCmd,
   dbName,
@@ -1318,6 +1428,7 @@ module.exports = {
   migrateCmd,
   onboardMode,
   parseTargetRef,
+  pinnedTarballVersion,
   planCorePinRefresh,
   refreshStandaloneCorePin,
   resolveOwnerGithubToken,

package/src/module-api.js

@@ -81,7 +81,7 @@ const { sleep } = require('./sleep');
 // MAJOR (see allowBoxScope below): passes the request through untouched.
 function deprecatedNoopMiddleware(_req, _res, next) { next(); }
 
-const CORE_VERSION = '1.24.70'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
+const CORE_VERSION = '1.24.72'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('discord'); log.info('mounted');

package/tests/hall_tokens.mjs

@@ -406,3 +406,22 @@ test('the reduced-motion kill switch is present and closes the token layer', ()
   assert.equal(src.split('@media (prefers-reduced-motion: reduce)').length - 1, 1,
     'exactly one kill switch — a second copy is a place for the rule to rot');
 });
+
+test('ink set on an --accent fill is readable on it in both modes', () => {
+  // Task 1005103: .genesis__step.is-now .genesis__step-n painted --bg on the
+  // accent (light ~2.2:1). Any rule that fills with var(--accent) and names its
+  // own ink token must measure that ink against the fill, in both modes.
+  const fails = [];
+  const plain = src.replace(/\/\*[\s\S]*?\*\//g, '');
+  for (const m of plain.matchAll(/([^{}]+)\{([^{}]*)\}/g)) {
+    const body = m[2];
+    if (!/background(?:-color)?\s*:\s*var\(--accent\)\s*[;}]?/.test(body)) continue;
+    const ink = body.match(/(?:^|[;\s])color\s*:\s*var\((--[\w-]+)\)/);
+    if (!ink) continue;
+    for (const mode of ['light', 'dark']) {
+      const r = ratio(ink[1], '--accent', mode);
+      if (r < 4.5) fails.push(`${mode} ${m[1].trim()}: ${ink[1]} on --accent = ${r.toFixed(2)}:1`);
+    }
+  }
+  assert.deepEqual(fails, [], 'ink on an accent fill needs 4.5:1');
+});

package/tests/provision.mjs

@@ -14,6 +14,7 @@ import { strict as assert } from 'node:assert';
 import { createRequire } from 'node:module';
 import { readFileSync, mkdtempSync, mkdirSync, writeFileSync, rmSync, existsSync } from 'node:fs';
 import { tmpdir } from 'node:os';
+import { createHash } from 'node:crypto';
 import { join } from 'node:path';
 
 const require = createRequire(import.meta.url);
@@ -905,12 +906,15 @@ t('installedCoreTarball: reuses a consumer instance file: core pin; null on a so
 });
 
 await ta('scaffoldStandaloneRepo: on a consumer control plane it REUSES the pinned tarball — no package-core rebuild (task 1002275)', async () => {
-  // the control plane is itself a consumer instance: its package.json file:-pins the core
+  // the control plane is itself a consumer instance: its package.json file:-pins the core.
+  // Pinned to the REAL running CORE_VERSION — a fixed old literal would now be STALE
+  // (task 1002450) and exercise the recovery instead of the reuse this test is named for.
+  const coreV = P.coreVersionSafe();
   const cp = mkdtempSync(join(tmpdir(), 'cptgz-cp-'));
   mkdirSync(join(cp, 'vendor'));
-  const pinned = join(cp, 'vendor', 'bongos-core-1.17.4.tgz');
+  const pinned = join(cp, 'vendor', `bongos-core-${coreV}.tgz`);
   writeFileSync(pinned, 'x');
-  writeFileSync(join(cp, 'package.json'), JSON.stringify({ dependencies: { '@bongos/core': 'file:vendor/bongos-core-1.17.4.tgz' } }));
+  writeFileSync(join(cp, 'package.json'), JSON.stringify({ dependencies: { '@bongos/core': `file:vendor/bongos-core-${coreV}.tgz` } }));
   const base = mkdtempSync(join(tmpdir(), 'cptgz-standalone-'));   // FRESH base → the scaffold proceeds
   const origBase = P.CONFIG.standaloneBase;
   P.CONFIG.standaloneBase = base;
@@ -931,6 +935,127 @@ await ta('scaffoldStandaloneRepo: on a consumer control plane it REUSES the pinn
   }
 });
 
+// ── the stale-pin guard (task 1002450) ───────────────────────────────────────────────
+// Rung 1 reused a file:-pinned hub's own tarball with no check it was still the core the
+// hub runs — an early instance was born on a 1.18.14 tarball that was NOT the published
+// 1.18.14 (missing the task-1002419 poller fix) and its first ship never left 'confirmed'.
+// A stale pin must be replaced, loudly, and never by the package-core.js rungs (which
+// abort on a consumer hub and leave the new repo empty — task 1002275).
+const sha512 = (txt) => 'sha512-' + createHash('sha512').update(txt).digest('base64');
+function filePinnedHub(label, bytes = 'x', { installed = null, scope = 'bongos' } = {}) {
+  const cp = mkdtempSync(join(tmpdir(), 'stalepin-'));
+  mkdirSync(join(cp, 'vendor'));
+  const file = `${scope}-core-${label}.tgz`;
+  writeFileSync(join(cp, 'vendor', file), bytes);
+  writeFileSync(join(cp, 'package.json'), JSON.stringify({ dependencies: { [`@${scope}/core`]: `file:vendor/${file}` } }));
+  if (installed) {
+    mkdirSync(join(cp, 'node_modules', '@bongos', 'core'), { recursive: true });
+    writeFileSync(join(cp, 'node_modules', '@bongos', 'core', 'package.json'), JSON.stringify({ name: '@bongos/core', version: installed }));
+  }
+  return { cp, pinned: join(cp, 'vendor', file) };
+}
+function resolveWith(cp, coreV, respond = () => ({ ok: true, stdout: '' })) {
+  const cmds = [], logs = [];
+  let res, err;
+  try {
+    res = P.resolveVendorableCoreTarball({ instanceRoot: cp, exec: (c, o) => { cmds.push(c); return respond(c, o); }, log: (m) => logs.push(m), coreV });
+  } catch (e) { err = e; }
+  return { ...res, cmds, logs, err };
+}
+
+t('pinnedTarballVersion: reads both scope aliases; null when the name carries no version', () => {
+  assert.equal(PR.pinnedTarballVersion('/x/vendor/bongos-core-1.18.14.tgz'), '1.18.14');
+  assert.equal(PR.pinnedTarballVersion('cloudbongos-core-2.0.0.tgz'), '2.0.0', 'the @cloudbongos alias the ARTIFACT regex in upgrade.js misses');
+  assert.equal(PR.pinnedTarballVersion('vendor/core.tgz'), null);
+});
+
+t('stale label on a file:-pinned hub → packs the INSTALLED core it runs, loudly, never package-core.js (task 1002450)', () => {
+  const { cp, pinned } = filePinnedHub('1.18.14', 'x', { installed: '1.18.17' });
+  const r = resolveWith(cp, '1.18.17');
+  assert.ok(!r.err, String(r.err));
+  assert.ok(r.logs.some((l) => /STALE/.test(l) && /1\.18\.14/.test(l) && /1\.18\.17/.test(l)), `a loud warning naming both versions, got: ${r.logs.join(' | ')}`);
+  assert.notEqual(r.tgz, pinned, 'never vendors the stale tarball');
+  assert.ok(r.cmds.some((c) => c.startsWith('npm pack ') && c.includes(join(cp, 'node_modules', '@bongos', 'core'))), 'packs node_modules/@bongos/core despite the file: pin');
+  assert.equal(r.tgz, join(r.packDest, 'bongos-core-1.18.17.tgz'));
+  assert.ok(!r.cmds.some((c) => /package-core\.js/.test(c)), 'the empty-set abort path is never reached');
+  assert.equal(PR.runningCoreVersion({ instanceRoot: cp, coreV: '1.18.17' }), '1.18.17', 'the hall runs coreV, not the leftover label');
+  rmSync(cp, { recursive: true, force: true });
+});
+
+t('stale label and no installed match → the registry\'s coreV; no registry either → refuses loudly, never an empty repo (task 1002450)', () => {
+  const { cp } = filePinnedHub('1.18.14');
+  const ok = resolveWith(cp, '1.18.17');
+  assert.ok(ok.cmds.some((c) => c.startsWith('npm pack @bongos/core@1.18.17 ')), `packs the published coreV, got: ${ok.cmds.join(' | ')}`);
+  assert.equal(ok.tgz, join(ok.packDest, 'bongos-core-1.18.17.tgz'));
+  const down = resolveWith(cp, '1.18.17', (c) => (c.startsWith('npm pack ') ? { ok: false, stdout: '' } : { ok: true, stdout: '' }));
+  assert.ok(down.err && /refusing to give a new project a stale core/.test(down.err.message), 'a scaffold with nothing current to vendor is refused');
+  assert.ok(!down.cmds.some((c) => /package-core\.js/.test(c)));
+  rmSync(cp, { recursive: true, force: true });
+});
+
+t('same label, different bytes (the charter case) → the registry\'s own bytes for that version; matching bytes → reuse (task 1002450)', () => {
+  const { cp, pinned } = filePinnedHub('1.18.14', 'local-build');
+  const view = (published) => (c) => (c.startsWith('npm view @bongos/core@1.18.14 dist.integrity') ? { ok: true, stdout: published + '\n' } : { ok: true, stdout: '' });
+  const bad = resolveWith(cp, '1.18.14', view(sha512('published-build')));
+  assert.ok(bad.logs.some((l) => /STALE/.test(l) && /same version label/.test(l)), `loud, got: ${bad.logs.join(' | ')}`);
+  assert.ok(bad.cmds.some((c) => c.startsWith('npm pack @bongos/core@1.18.14 ')), 'repacks the canonical published artifact');
+  assert.notEqual(bad.tgz, pinned);
+  const good = resolveWith(cp, '1.18.14', view(sha512('local-build')));
+  assert.equal(good.tgz, pinned, 'identical bytes → reuse');
+  assert.equal(good.packDest, null);
+  assert.ok(!good.logs.some((l) => /STALE|WARNING/.test(l)));
+  rmSync(cp, { recursive: true, force: true });
+});
+
+t('unverifiable pin (no coreV, no registry answer) → reused, but SAID out loud; the cloudbongos alias is checked too (task 1002450)', () => {
+  const { cp, pinned } = filePinnedHub('1.18.14');
+  const noCore = resolveWith(cp, null);
+  assert.equal(noCore.tgz, pinned, 'fail-open: a resolution gap never blocks a scaffold');
+  assert.ok(noCore.logs.some((l) => /WARNING: cannot verify/.test(l)), 'but it is not silent');
+  const offline = resolveWith(cp, '1.18.14');
+  assert.equal(offline.tgz, pinned);
+  assert.ok(offline.logs.some((l) => /WARNING: cannot verify/.test(l) && /no integrity/.test(l)));
+  rmSync(cp, { recursive: true, force: true });
+  const alt = filePinnedHub('1.0.0', 'x', { scope: 'cloudbongos' });
+  const r = resolveWith(alt.cp, '1.0.1');
+  assert.ok(r.logs.some((l) => /STALE/.test(l)), 'a cloudbongos-core-* pin is not exempt from the label check');
+  assert.notEqual(r.tgz, alt.pinned);
+  rmSync(alt.cp, { recursive: true, force: true });
+});
+
+t('a stale pin\'s recovery never puts an unsafe version into a shell command (task 1002450)', () => {
+  const { cp } = filePinnedHub('1.18.14');
+  const r = resolveWith(cp, '1.18.17;touch pwn');
+  assert.ok(!r.cmds.some((c) => /pwn/.test(c)), `no command carries the label, got: ${r.cmds.join(' | ')}`);
+  assert.ok(r.err && /refusing to give a new project a stale core/.test(r.err.message), 'nothing safe to pack → refused');
+  rmSync(cp, { recursive: true, force: true });
+  // the INSTALLED core's version (read off node_modules) is held to the same rule
+  const inst = filePinnedHub('1.18.14', 'x', { installed: '1.18.17;touch pwn' });
+  const r2 = resolveWith(inst.cp, '1.18.17;touch pwn');
+  assert.ok(!r2.cmds.some((c) => /pwn/.test(c)), `no command carries the installed label, got: ${r2.cmds.join(' | ')}`);
+  assert.ok(r2.err, 'refused');
+  rmSync(inst.cp, { recursive: true, force: true });
+});
+
+t('a file:-pinned hub BEHIND the release gives the new project the release, not its own pin (hub-vs-upstream drift, tasks 1004556 + 1002450)', () => {
+  const { cp, pinned } = filePinnedHub('1.18.14');
+  const cmds = [];
+  const exec = (c) => { cmds.push(c); return { ok: true, stdout: /dist-tags\.latest/.test(c) ? '1.18.17\n' : '' }; };
+  const target = PR.projectCoreTarget({ instanceRoot: cp, coreV: '1.18.14', exec, log: () => {} });
+  assert.deepEqual([target.version, target.source], ['1.18.17', 'released']);
+  const r = P.resolveVendorableCoreTarball({ instanceRoot: cp, exec, log: () => {}, coreV: '1.18.14', target });
+  assert.notEqual(r.tgz, pinned, 'the hub\'s own (older) pin is not vendored');
+  assert.ok(cmds.some((c) => c.startsWith('npm pack @bongos/core@1.18.17 ')), 'the release is packed from the registry');
+  rmSync(cp, { recursive: true, force: true });
+});
+
+t('publishing one version twice as different bytes is refused loudly by the publish workflow (the publish half of the build-identity guard, task 1002450)', () => {
+  const wf = readFileSync(new URL('../.github/workflows/publish.yml', import.meta.url), 'utf8');
+  assert.match(wf, /npm publish "\$TGZ"/, 'the workflow publishes to the npm registry, where a version is immutable');
+  assert.match(wf, /cannot publish over\|previously published\|EPUBLISHCONFLICT/, 'it recognises the registry\'s refusal');
+  assert.match(wf, /::error title=version already on the registry/, 'and fails the run loudly on it');
+});
+
 // ── registry-pinned consumer control plane (task 1002706) ─────────────────────────
 // After the mothership's registry cutover (task 1002621) its package.json pins
 // "@bongos/core": "1.19.x" — NO file: pin — so installedCoreTarball returns null and,
@@ -1001,10 +1126,10 @@ t('resolveVendorableCoreTarball: the ladder picks file: pin → registry pack
   // One helper per rung so the ONLY thing varying between cases is which shape the
   // control-plane root presents. Asserting on the recorded commands is what proves the
   // ORDER: a rung that fires early leaves the later rung's command unrun.
-  const run = (instanceRoot, repoRoot) => {
+  const run = (instanceRoot, repoRoot, coreV = '9.9.9') => {
     const cmds = [];
     const res = P.resolveVendorableCoreTarball({
-      instanceRoot, repoRoot, exec: (c) => { cmds.push(c); }, log: () => {}, coreV: '9.9.9',
+      instanceRoot, repoRoot, exec: (c) => { cmds.push(c); }, log: () => {}, coreV,
     });
     return { cmds, ...res };
   };
@@ -1017,9 +1142,9 @@ t('resolveVendorableCoreTarball: the ladder picks file: pin → registry pack
   mkdirSync(join(filePinned, 'vendor'));
   writeFileSync(join(filePinned, 'vendor', 'bongos-core-1.2.3.tgz'), 'x');
   writeFileSync(join(filePinned, 'package.json'), JSON.stringify({ dependencies: { '@bongos/core': 'file:vendor/bongos-core-1.2.3.tgz' } }));
-  const r1 = run(filePinned, bareRoot);
+  const r1 = run(filePinned, bareRoot, '1.2.3');
   assert.equal(r1.tgz, join(filePinned, 'vendor', 'bongos-core-1.2.3.tgz'));
-  assert.deepEqual(r1.cmds, [], 'rung 1 runs no command — it reuses bytes already on disk');
+  assert.ok(r1.cmds.every((c) => c.startsWith('npm view ')), 'rung 1 builds and packs nothing — it reuses bytes already on disk (only the read-only integrity check runs)');
 
   // Rung 2 — a registry-installed core packs, still without touching package-core.js.
   const reg = mkdtempSync(join(tmpdir(), 'rvct-reg-'));