@bongos/core 1.24.84 → 1.24.85

package/.bongos-core.json

@@ -2,11 +2,11 @@
   "artifact": "bongos-core",
   "manifest_schema": 1,
   "generator": "scripts/bongos/package-core.js",
-  "core_version": "1.24.84",
-  "core_contract": "1.24.84",
-  "source_commit": "a88200c605aef1ae82a28ab04b0ab3e37ed2d007",
+  "core_version": "1.24.85",
+  "core_contract": "1.24.85",
+  "source_commit": "427e2c398053becc659baf23c101f6e8f08d321d",
   "source_ref": "HEAD",
-  "built_at": "2026-11-11T21:52:13.589Z",
+  "built_at": "2026-11-11T22:21:34.009Z",
   "redaction": {
     "model": "docs-redacted+functional-verbatim",
     "docs_redacted": 649,
@@ -17,7 +17,7 @@
     "gate": "passed"
   },
   "file_count": 4643,
-  "tree_sha256": "967fd31eb0288a656123acc767cef654f1132bfa3dafee9761410236db93f1cd",
+  "tree_sha256": "35f80ad673b03ea0315d02cce1106c6ce0cf0ee393aac0f056b2837c025f23db",
   "files": [
     {
       "path": ".claude/skills/ask-for-help/SKILL.md",
@@ -3032,7 +3032,7 @@
     {
       "path": "docs/module-api-changelog.md",
       "mode": "0000644",
-      "sha256": "1d3fff080abc60c21cd46c052ce7507fbf02f74ef6cd7e5fba5815d33c601ca4"
+      "sha256": "a7e0a193dc835e76f2bfeb2ddd97093bfed314cd98b7488a53721bf18db3b9fa"
     },
     {
       "path": "docs/modules-contract.md",
@@ -3137,7 +3137,7 @@
     {
       "path": "docs/recipes/autobongos-runner-setup.md",
       "mode": "0000644",
-      "sha256": "8d63ed509569a3bed3c036eed58a91ec3a4446fab2b71f7f0ebe3f3f395be1a3"
+      "sha256": "b69efdb3f9021b2e609602412d21acf6071008a8ffe47abb1b1e91358d982ec2"
     },
     {
       "path": "docs/recipes/autobongos-windows-host.md",
@@ -12092,12 +12092,12 @@
     {
       "path": "package-lock.json",
       "mode": "0000644",
-      "sha256": "06d33e2874668039d3ca018731234bf312bad841e4c4b4e161609a0426764d89"
+      "sha256": "a663d6a0afd78979f2de86f13e7ba781e775348a34d897fef783cc62008b7b33"
     },
     {
       "path": "package.json",
       "mode": "0000644",
-      "sha256": "eec413a19cbf85e3ba24c9777135af3d3cb16cfbb1f7f840f6314f3f348b7856"
+      "sha256": "abe3bea2dad97c4c622585e65172362a4f9abfccbc52882521f58ed17fb83ed2"
     },
     {
       "path": "public-docs/index.html",
@@ -12117,7 +12117,7 @@
     {
       "path": "release-notes.json",
       "mode": "0000644",
-      "sha256": "39ebd17eca26e71fbd43a70acf127ae5c513679f0c26197097e9993a3fd4db34"
+      "sha256": "b272c1bd53032ad7c769a92d029dda4b65737a15d2e20937b196fc1a6659dcd5"
     },
     {
       "path": "scripts/bongos/CLAUDE.md",
@@ -12242,7 +12242,7 @@
     {
       "path": "scripts/bongos/autobongos-bootstrap.sh",
       "mode": "0000755",
-      "sha256": "3a919b371e76491935049a90196d95600b3c953e4ce04c9ed77a0274b1ec0afb"
+      "sha256": "e7eff1bd58cdc4f8568862c8dfdc5e1c674eb830cae9ad46299c33533f6027e6"
     },
     {
       "path": "scripts/bongos/autobongos-digest.js",
@@ -12257,7 +12257,7 @@
     {
       "path": "scripts/bongos/autobongos-host.js",
       "mode": "0000755",
-      "sha256": "fa8cc6245fb0e6f5bd63e15314de796e396e5a0a8b7ab7817aefac2d69b26d95"
+      "sha256": "5fc39d1b1c98c23ef7cc9549de376ed2c9751575934af550194cb29a5a5f7a4d"
     },
     {
       "path": "scripts/bongos/autobongos-loop.js",
@@ -13807,7 +13807,7 @@
     {
       "path": "scripts/bongos/wedge-remedy.js",
       "mode": "0000644",
-      "sha256": "1f1346ddb3871a4bf21950aa8cd606f00effb0e08ef1cbb32aa70c7f6ec1cdf1"
+      "sha256": "5651d789fa741a172f2373d0cd40e770c1149ae1c2d5a8049ea29ade2a861646"
     },
     {
       "path": "scripts/bongos/worktree-claim-guard.js",
@@ -16122,7 +16122,7 @@
     {
       "path": "src/module-api.js",
       "mode": "0000644",
-      "sha256": "d16199f138decb72e60eb109eba27e5f2f2a07f67c6a17002167302fb64ea6f0"
+      "sha256": "3b61f7a829de7c225cbeec3fc711f8a5b51dcd305ef43a05273873d19f581f7c"
     },
     {
       "path": "src/module-loader/catalog.js",
@@ -16682,7 +16682,7 @@
     {
       "path": "tests/autobongos_host.mjs",
       "mode": "0000644",
-      "sha256": "76bef425e2b3adcc4317b383636bdb3e81de64ae3e9fd2ae3ab09c5483bd8171"
+      "sha256": "58a0784be92fbef91d9ea63614c23fb9d932f1c34cca2d1511b4df785ce76e91"
     },
     {
       "path": "tests/autobongos_host_access.mjs",
@@ -22197,7 +22197,7 @@
     {
       "path": "tests/shell_stat_portability.mjs",
       "mode": "0000644",
-      "sha256": "c4c0a4d3f5b41205be6abbea2a8c0892b215b008f40869c18ec30d6cd66fcd7b"
+      "sha256": "6d1fafcc33de5f489303aca892718ab5db6aa483939e34318be9e7e47af018a5"
     },
     {
       "path": "tests/ship_assurance.mjs",
@@ -22352,7 +22352,7 @@
     {
       "path": "tests/ship_vendored_instance.mjs",
       "mode": "0000644",
-      "sha256": "3a76f7c5b64471ef5c6e91e46ef21a02594b942986c7bd4a84d7934c918ee7a3"
+      "sha256": "f08ead59eeffd4572532929c1b08080a469d7ce55e3e877e6944869e7e59df09"
     },
     {
       "path": "tests/ship_visual_regrade.mjs",
@@ -22952,7 +22952,7 @@
     {
       "path": "tests/update_sweep_home.mjs",
       "mode": "0000644",
-      "sha256": "2a676bec91bded743eed048900d1ab72c375e23c7875acd11759cb299fe272d1"
+      "sha256": "38b14ecc7d9f063b54c80825f7608ab48ce13e892108f78cde81cf82d3c7ebf9"
     },
     {
       "path": "tests/upgrade.mjs",
@@ -23117,7 +23117,7 @@
     {
       "path": "tests/wedge_remedy.mjs",
       "mode": "0000644",
-      "sha256": "c3bf835dd5cf4285705f9d42a2580b92f80e99c410d93fade97214e109582c49"
+      "sha256": "8aef63e97ae564b6acb31ad86d892a122f0c7fe7f6fe7e14e9908bc9d6015f22"
     },
     {
       "path": "tests/welcome_boot.mjs",

package/docs/module-api-changelog.md

@@ -3418,5 +3418,7 @@ is load-bearing: the script throws rather than guess if it is missing, and
         landed since 1.24.82 with no explicit bump. run 43103028863. (task 1002620)
   1.24.84 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
         landed since 1.24.83 with no explicit bump. run 43106638119. (task 1002620)
+  1.24.85 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+        landed since 1.24.84 with no explicit bump. run 43110908190. (task 1002620)
 ---------------------------------------------------------------------------
 ```

package/docs/recipes/autobongos-runner-setup.md

@@ -138,6 +138,7 @@ worker decided on its own, what it cost, and where your Claude usage stands.
 | **Resting** for hours | That is your Claude usage limit, and it is working as designed. It resumes at the time on the button. |
 | **Running**, but nothing ships for a long time | The tasks in the goals you chose may all be waiting on something. Run the digest above: it says what is on hold and why. |
 | You added the same device twice | Remove one card. One runner per device. |
+| **Repository not found**, and you *are* signed in to GitHub | You are signed in as more than one GitHub account, and the device is using the wrong one. Run `gh auth switch` and pick the account that can see the project, then paste the setup command again. The setup names the account it used, so you can tell which it picked. |
 
 ## An always-on PC that starts with nobody signed in
 

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.24.84",
+  "version": "1.24.85",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.24.84",
+      "version": "1.24.85",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.24.84",
+  "version": "1.24.85",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/release-notes.json

@@ -11607,5 +11607,11 @@
       "id": "1005195",
       "text": "The in-game visor is now minimal: two thin arcs, the place name, your credits, one salmon button for the current action and a quiet row of key hints. It stays readable over a bright daytime sky as well as at night."
     }
+  ],
+  "1.24.85": [
+    {
+      "id": "1005096",
+      "text": "Autobongos now runs on a Mac for real: the setup command, start, stop and remove all proven on one, and the Mac-only test failures are gone."
+    }
   ]
 }

package/scripts/bongos/autobongos-bootstrap.sh

@@ -59,6 +59,28 @@ esac
 
 have() { command -v "$1" >/dev/null 2>&1; }
 
+# github_remedy — what to actually DO when git cannot see the project (task 1005096).
+#
+# THE CIRCLE THIS BREAKS, found on a real Mac. "Sign in to GitHub" is the wrong advice for
+# the commonest way this fails: the person IS signed in — twice — and git picked the other
+# one. git asks its FIRST credential helper, which on a Mac is the login keychain, and that
+# answers with whichever GitHub account is active, not with one that can see this project.
+# A private project then 404s as "Repository not found", which reads as a typo rather than
+# as the wrong account, and `gh auth login` again changes nothing.
+#
+# So when the GitHub CLI is here, name the account that is actually active and the one
+# command that changes it. With no gh, the old advice is still the right advice.
+github_remedy() {
+  if have gh; then
+    active="$(gh auth status --active 2>/dev/null | sed -n 's/.*account \([A-Za-z0-9-]*\).*/\1/p' | head -n 1)"
+    if [ -n "${active:-}" ]; then
+      echo "git is using your '$active' GitHub account, which may not be able to see this project. Switch with  gh auth switch  (it lists the accounts signed in here), then paste the setup command again. If the right account is not listed, add it with  gh auth login  first."
+      return
+    fi
+  fi
+  echo "Sign in to GitHub on this device with an account that can see the project (the GitHub CLI's  gh auth login  is the simplest way), then paste the setup command again."
+}
+
 # The setup command is piped into bash, so the keyboard is /dev/tty, not stdin.
 # OPENED, not just tested: with no terminal at all (CI, a remote command) the
 # device node still exists and reads as readable, and opening it is what fails.
@@ -133,12 +155,12 @@ mkdir -p "$RUNNER_HOME"
 if [ -d "$REPO_DIR/.git" ]; then
   echo "The runner's copy is already here; bringing it up to date..."
   if [ "$HAVE_TTY" = 1 ]; then git -C "$REPO_DIR" fetch --quiet origin main </dev/tty; else git -C "$REPO_DIR" fetch --quiet origin main; fi \
-    || stop_setup "this device could not fetch the project's code from GitHub." "Sign in to GitHub on this device (the GitHub CLI's  gh auth login  is the simplest way), then paste the setup command again."
+    || stop_setup "this device could not fetch the project's code from GitHub." "$(github_remedy)"
   git -C "$REPO_DIR" reset --quiet --hard origin/main
 else
   echo "Making the runner's own copy of the project (GitHub may ask you to sign in)..."
   if [ "$HAVE_TTY" = 1 ]; then git clone --quiet "$REPO" "$REPO_DIR" </dev/tty; else git clone --quiet "$REPO" "$REPO_DIR"; fi \
-    || stop_setup "this device could not copy the project from GitHub." "Sign in to GitHub on this device with an account that can see the project (the GitHub CLI's  gh auth login  is the simplest way), then paste the setup command again."
+    || stop_setup "this device could not copy the project from GitHub." "$(github_remedy)"
 fi
 
 HOST_JS="$REPO_DIR/scripts/bongos/autobongos-host.js"

package/scripts/bongos/autobongos-host.js

@@ -125,6 +125,28 @@ class Stop extends Error {
   constructor(what, fix) { super(what); this.name = 'Stop'; this.fix = fix || null; }
 }
 
+// githubRemedy — what to DO when git cannot see the project (task 1005096). The JS twin of
+// autobongos-bootstrap.sh's github_remedy; the two say the same thing because a person can
+// meet either one, and the bootstrap's own header carries the full reasoning.
+//
+// IN SHORT: "sign in to GitHub" is the wrong advice for the commonest failure. git asks its
+// FIRST credential helper — on a Mac, the login keychain — which answers with whichever
+// GitHub account is ACTIVE, not with one that can see this project. A private project then
+// 404s as "Repository not found", which reads as a typo rather than as the wrong account,
+// and signing in again changes nothing. So name the active account when the GitHub CLI can
+// tell us, and give the one command that changes it.
+const GITHUB_REMEDY_GENERIC = 'Sign in to GitHub on this device with an account that can see the project (the GitHub CLI\'s  gh auth login  is the simplest way), then run the setup command again.';
+function githubRemedy(run = spawnSync) {
+  try {
+    const r = run('gh', ['auth', 'status', '--active'], { encoding: 'utf8', windowsHide: true, timeout: 10000 });
+    const m = /account ([A-Za-z0-9-]+)/.exec(String((r && r.stdout) || '') + String((r && r.stderr) || ''));
+    if (m) {
+      return `git is using your '${m[1]}' GitHub account, which may not be able to see this project. Switch with  gh auth switch  (it lists the accounts signed in here), then run the setup command again. If the right account is not listed, add it with  gh auth login  first.`;
+    }
+  } catch (_) { /* no gh, or it could not answer — the generic line is still right */ }
+  return GITHUB_REMEDY_GENERIC;
+}
+
 // ── the runner's own copy ──────────────────────────────────────────────────
 
 function runnerCopyMarkPath(repoRoot = REPO_ROOT) { return path.join(repoRoot, '.git', RUNNER_COPY_MARK); }
@@ -289,7 +311,14 @@ function git(args, opts = {}) {
 function refreshCheckout(log = () => {}) {
   assertRunnerCopy();
   const f = git(['fetch', '--quiet', 'origin', 'main']);
-  if (f.status !== 0) { log(`git fetch failed — running the code already here (${String(f.stderr || '').trim().slice(0, 200)})`); return false; }
+  if (f.status !== 0) {
+    // The log is the ONLY place this is said (the card reads check-ins, not fetches), so it
+    // carries the remedy too — a fetch that fails for a credential reason fails every loop,
+    // and the runner then works forever on the code it happens to have (task 1005096).
+    log(`git fetch failed — running the code already here (${String(f.stderr || '').trim().slice(0, 200)})`);
+    log(`  if that keeps happening, it is not transient: ${githubRemedy()}`);
+    return false;
+  }
   const r = git(['reset', '--quiet', '--hard', 'origin/main']);
   if (r.status !== 0) { log(`git reset failed (${String(r.stderr || '').trim().slice(0, 200)})`); return false; }
   return true;
@@ -726,7 +755,7 @@ async function setup(argv, { paths = hostPaths(), say = console.log } = {}) {
 
   say('4/5  Checking this device can fetch the project’s code…');
   if (git(['ls-remote', 'origin', 'refs/heads/main'], { timeout: 60000 }).status !== 0) {
-    throw new Stop('This device could not fetch the project’s code from GitHub.', 'Sign in to GitHub on this device (run  git fetch  in the runner’s folder and follow the sign-in), then run the setup command again.');
+    throw new Stop('This device could not fetch the project’s code from GitHub.', githubRemedy());
   }
 
   say('5/5  Starting the runner…');
@@ -895,4 +924,5 @@ module.exports = {
   windowsRunArgv, windowsRunCommand, windowsStartSpawn, legacyBootTaskInstalled, launchdPlist,
   stopRunner, stopReport, exchangeCode, claudeState, waitForCheckIn,
   signIn, cleanBase, install, removeStartEntry, installedState, status, digestArgv,
+  githubRemedy, GITHUB_REMEDY_GENERIC,
 };

package/scripts/bongos/wedge-remedy.js

@@ -90,12 +90,19 @@ function planRemedy(inst, reason, o = {}) {
     if (!SHELL_SAFE_RE.test(backupDir)) return { refused: 'the backup folder is not a path this runner will put in a command' };
     // EXACTLY db-backup-nightly.sh's name, so this never touches a sibling project's dumps
     // (`test` must not prune `test-nk`'s — task 1003948). The timestamp sorts by name, so
-    // `sort | head -n -K` drops all but the newest K. Nothing is deleted when K or fewer exist.
+    // dropping all but the last K leaves the newest K. Nothing is deleted when K or fewer exist.
+    //
+    // ALL-BUT-THE-LAST-K IN POSIX awk, NOT `head -n -K` (task 1005096). `head -n -K` is a GNU
+    // extension: BSD/macOS head answers `illegal line count`, exits 1, and the pipeline then
+    // deletes nothing — and `xargs -r` is GNU-only too. Same family as the `stat -c` sweep
+    // (task 1004170): the command runs on a Linux box, but the test that runs it for real runs
+    // wherever a builder builds, so on a Mac it could never pass. POSIX `xargs` with no input
+    // may still run `rm -f --`, which succeeds with no operands, so `-r` is not needed.
     const D = '[0-9]';
     const glob = `${db}-${D}${D}${D}${D}-${D}${D}-${D}${D}T${D}${D}${D}${D}${D}${D}Z.sql.gz`;
     return {
       reason, cwd: null, env: null,
-      cmd: `find ${backupDir} -maxdepth 1 -type f -name '${glob}' | sort | head -n -${DUMP_KEEP_FLOOR} | xargs -r rm -f --`,
+      cmd: `find ${backupDir} -maxdepth 1 -type f -name '${glob}' | sort | awk -v k=${DUMP_KEEP_FLOOR} '{a[NR]=$0} END{for(i=1;i<=NR-k;i++) print a[i]}' | xargs rm -f --`,
       describe: `pruned ${db}'s old database backups in ${backupDir}, keeping the newest ${DUMP_KEEP_FLOOR}`,
     };
   }

package/src/module-api.js

@@ -81,7 +81,7 @@ const { sleep } = require('./sleep');
 // MAJOR (see allowBoxScope below): passes the request through untouched.
 function deprecatedNoopMiddleware(_req, _res, next) { next(); }
 
-const CORE_VERSION = '1.24.84'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
+const CORE_VERSION = '1.24.85'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('discord'); log.info('mounted');

package/tests/autobongos_host.mjs

@@ -663,3 +663,36 @@ test('the digest is read from the RUNNER’s run log: bare, the digest CLI looks
   assert.equal(bare.status, 0, 'the digest never fails a morning');
   assert.equal(bare.stdout.includes('424242'), false, 'which is why the guide sends people through the device program');
 });
+
+// --- "sign in to GitHub" is the wrong advice when you already are (task 1005096) -------
+//
+// Found by running the real setup on a real Mac. The device had TWO GitHub accounts signed
+// in through the GitHub CLI; git asks its first credential helper — the login keychain —
+// which answers with whichever is ACTIVE, and that one could not see the private project.
+// git then says "Repository not found", which reads as a typo, and the setup answered
+// "Sign in to GitHub … gh auth login is the simplest way" — advice that changes nothing,
+// because the person is signed in. The remedy has to NAME the account git is using.
+test('githubRemedy names the active GitHub account, and the command that changes it', () => {
+  const said = host.githubRemedy(() => ({ stdout: 'github.com\n  ✓ Logged in to github.com account mcip-labs (keyring)\n', stderr: '' }));
+  assert.match(said, /'mcip-labs'/, 'the account git is actually using must be named, or the advice is a circle');
+  assert.match(said, /gh auth switch/, 'and the one command that changes it');
+  assert.notEqual(said, host.GITHUB_REMEDY_GENERIC);
+});
+
+test('githubRemedy falls back to the plain advice when gh cannot answer', () => {
+  // No GitHub CLI on the device, it failed, or it is signed in to nothing: there is no
+  // account to name, and "sign in" is then exactly the right thing to say.
+  assert.equal(host.githubRemedy(() => ({ stdout: '', stderr: 'command not found' })), host.GITHUB_REMEDY_GENERIC);
+  assert.equal(host.githubRemedy(() => { throw new Error('ENOENT'); }), host.GITHUB_REMEDY_GENERIC);
+  assert.equal(host.githubRemedy(() => ({ stdout: 'You are not logged into any GitHub hosts.\n', stderr: '' })), host.GITHUB_REMEDY_GENERIC);
+});
+
+test('the shell bootstrap gives the same remedy, so either half says the same thing', () => {
+  const sh = readFileSync(fileURLToPath(new URL('../scripts/bongos/autobongos-bootstrap.sh', import.meta.url)), 'utf8');
+  assert.match(sh, /github_remedy\(\)/, 'the bootstrap has the twin');
+  assert.match(sh, /gh auth switch/);
+  // Both clone/fetch stops route through it rather than re-typing the old line.
+  const stops = sh.split('\n').filter((l) => /stop_setup "this device could not (copy|fetch)/.test(l));
+  assert.equal(stops.length, 2, 'the two GitHub stops');
+  for (const l of stops) assert.match(l, /\$\(github_remedy\)/, l.trim());
+});

package/tests/shell_stat_portability.mjs

@@ -47,3 +47,37 @@ test('the rule catches a lone GNU or BSD stat, and passes the paired form and pr
   assert.equal(offending('U=$(stat -c %U "$d" 2>/dev/null || stat -f %Su "$d" 2>/dev/null)').length, 0);
   assert.equal(offending("  # was stat -c '%s', which BSD refuses").length, 0, 'a comment is not a call');
 });
+
+// --- `head -n -K` — the same bug, a different GNU extension (task 1005096) ------------
+//
+// `head -n -K` means "all but the last K" to GNU and is an ERROR to BSD/macOS head
+// ("illegal line count", exit 1). wedge-remedy.js's disk-full prune used it, so on a Mac
+// the pipeline deleted nothing and the test that runs that command for real could never
+// pass. The command itself runs on a Linux box — but a builder builds wherever they are,
+// so a one-dialect idiom still reds their suite. POSIX awk answers it everywhere:
+//   … | sort | awk -v k=K '{a[NR]=$0} END{for(i=1;i<=NR-k;i++) print a[i]}'
+//
+// Scanned in the .js files too, not only *.sh: this one lived inside a shell string a
+// Node script builds, which the stat scan above would never have seen.
+const GNU_HEAD = /(^|[^\w-])head\s+(-n\s*-\d|--lines[\s=]-\d|-\s*-\d)/;
+
+test('no tracked script asks for `head -n -K`, which BSD/macOS head refuses', () => {
+  const files = execFileSync('git', ['ls-files', '*.sh', 'scripts/*.js', 'scripts/**/*.js'], { cwd: ROOT, encoding: 'utf8' })
+    .split('\n').filter(Boolean);
+  assert.ok(files.length > 20, `the scan must see the scripts, got ${files.length}`);
+  const hits = files.flatMap((f) => fs.readFileSync(path.join(ROOT, f), 'utf8')
+    .split('\n').map((l, i) => ({ n: i + 1, l }))
+    .filter(({ l }) => !/^\s*(#|\/\/)/.test(l) && GNU_HEAD.test(l))
+    .map(({ n, l }) => `${f}:${n}: ${l.trim()}`));
+  assert.deepEqual(hits, [], "all but the last K: sort | awk -v k=K '{a[NR]=$0} END{for(i=1;i<=NR-k;i++) print a[i]}'");
+});
+
+test('the head rule catches the GNU forms and leaves an ordinary head alone', () => {
+  const hit = (s) => GNU_HEAD.test(s);
+  assert.equal(hit("… | head -n -7 | xargs rm -f --"), true);
+  assert.equal(hit('… | head -n-7'), true);
+  assert.equal(hit('… | head --lines=-7'), true);
+  assert.equal(hit('… | head -n 7'), false, 'the ordinary form is portable');
+  assert.equal(hit('… | head -7'), false);
+  assert.equal(hit('git log | head -n 20'), false);
+});

package/tests/ship_vendored_instance.mjs

@@ -76,7 +76,11 @@ function writeFile(p, body) {
 
 // Build one fixture. `mainAt`: 'primary' | 'linked' | 'none'.
 function buildFixture(mainAt) {
-  const root = fs.mkdtempSync(path.join(os.tmpdir(), `bongos-vendored-${mainAt}-`));
+  // realpath'd (task 1005096): on a Mac os.tmpdir() is /var/folders/…, a symlink to
+  // /private/var/folders/…, and resolveRoots answers with git's own answer — the /private
+  // form. Comparing the two spellings failed on every Mac and passed on CI's Linux, which
+  // has no such link. The fixture names the path the code under test will name.
+  const root = fs.realpathSync(fs.mkdtempSync(path.join(os.tmpdir(), `bongos-vendored-${mainAt}-`)));
   const origin = path.join(root, 'origin.git');
   const inst = path.join(root, 'instance');
   git(root, 'init', '--bare', '-b', 'main', origin);

package/tests/update_sweep_home.mjs

@@ -14,7 +14,7 @@ import { test } from 'node:test';
 import assert from 'node:assert/strict';
 import { createRequire } from 'node:module';
 import { spawnSync } from 'node:child_process';
-import { mkdtempSync, mkdirSync, writeFileSync, readFileSync } from 'node:fs';
+import { mkdtempSync, mkdirSync, writeFileSync, readFileSync, realpathSync } from 'node:fs';
 import { tmpdir } from 'node:os';
 import path from 'node:path';
 import { fileURLToPath } from 'node:url';
@@ -23,6 +23,12 @@ const require = createRequire(import.meta.url);
 const ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
 const SWEEP = path.join(ROOT, 'scripts', 'bongos', 'update-sweep.js');
 const sweep = require(SWEEP);
+
+// A temp folder the code under test and this test can BOTH name the same way (task 1005096).
+// On a Mac os.tmpdir() is /var/folders/…, a symlink to /private/var/folders/…: anything that
+// resolves a real path — as the sweep's resolver and git both do — answers the /private form,
+// and the comparison failed on every Mac while passing on CI's Linux, which has no such link.
+const tmpRoot = (prefix) => realpathSync(mkdtempSync(path.join(tmpdir(), prefix)));
 const { isPublishable } = require('../scripts/bongos/publish-manifest.js');
 
 test('the sweep and every core file it requires are in the published package', () => {
@@ -50,7 +56,7 @@ test('its target-instance resolver searches the same packages, in the same order
 });
 
 test('coreModulePathFrom finds a target instance\'s INSTALLED core, root first', () => {
-  const inst = mkdtempSync(path.join(tmpdir(), 'sweep-home-'));
+  const inst = tmpRoot('sweep-home-');
   const pkg = path.join(inst, 'node_modules', '@bongos', 'core', 'scripts', 'bongos');
   mkdirSync(pkg, { recursive: true });
   writeFileSync(path.join(pkg, 'upgrade.js'), '');
@@ -62,11 +68,11 @@ test('coreModulePathFrom finds a target instance\'s INSTALLED core, root first',
 });
 
 test('run from elsewhere, it reads the roster named by --instance and says which core is sweeping', () => {
-  const rosterRoot = mkdtempSync(path.join(tmpdir(), 'sweep-roster-'));
+  const rosterRoot = tmpRoot('sweep-roster-');
   mkdirSync(path.join(rosterRoot, 'config'));
   writeFileSync(path.join(rosterRoot, 'config', 'update-subscriptions.json'),
     JSON.stringify({ instances: [{ slug: 'held', dir: path.join(rosterRoot, 'nowhere'), channel: 'pinned' }] }));
-  const cwd = mkdtempSync(path.join(tmpdir(), 'sweep-cwd-'));
+  const cwd = tmpRoot('sweep-cwd-');
   const r = spawnSync(process.execPath, [SWEEP, '--instance', rosterRoot], { cwd, encoding: 'utf8', env: { ...process.env, DATABASE_URL: '', PGDATABASE: '' } });
   assert.equal(r.status, 0, r.stderr);
   assert.match(r.stdout, new RegExp(`update-sweep · running from .+ \\(core \\d+\\.\\d+\\.\\d+\\) · roster ${rosterRoot.replace(/[\\^$.*+?()[\]{}|]/g, '\\$&')}`));
@@ -75,7 +81,7 @@ test('run from elsewhere, it reads the roster named by --instance and says which
 });
 
 test('without --instance it reads the roster in its working directory (the unit\'s WorkingDirectory)', () => {
-  const cwd = mkdtempSync(path.join(tmpdir(), 'sweep-cwd-'));
+  const cwd = tmpRoot('sweep-cwd-');
   const r = spawnSync(process.execPath, [SWEEP], { cwd, encoding: 'utf8', env: { ...process.env, DATABASE_URL: '', PGDATABASE: '' } });
   assert.equal(r.status, 0, r.stderr);
   assert.match(r.stdout, /no roster file — nothing subscribed/);

package/tests/wedge_remedy.mjs

@@ -75,7 +75,11 @@ await t('a cloud-host project is fixed in ITS folder, not the control plane\'s',
 await t('disk full: prunes only THIS database\'s dumps, keeping the newest week', () => {
   const p = W.planRemedy(inst(), 'disk_full', { selfRoot, backupDir: '/var/backups/gds' });
   assert.match(p.cmd, /^find \/var\/backups\/gds -maxdepth 1 -type f -name 'charter-\[0-9\]/);
-  assert.match(p.cmd, new RegExp(`head -n -${W.DUMP_KEEP_FLOOR} \\| xargs -r rm -f --$`));
+  // All-but-the-last-K in POSIX awk, never `head -n -K`: that is a GNU extension BSD/macOS
+  // head refuses outright, so the pipeline deleted nothing on a Mac (task 1005096).
+  assert.match(p.cmd, new RegExp(`awk -v k=${W.DUMP_KEEP_FLOOR} `));
+  assert.match(p.cmd, /\| xargs rm -f --$/);
+  assert.doesNotMatch(p.cmd, /head -n -/, 'GNU-only; BSD head answers "illegal line count"');
   assert.equal(W.DUMP_KEEP_FLOOR, 7);
 });