Clean frozen Bun lockfile install switches a member consumer from React 19 to root React 18

[mwolson]

• Repo: https://github.com/mwolson/tmp-aube-issues
• Case: bun-reload-member-peer
• aube: 2.8.2 linux-x64 (2026-10-23)

The workspace root provides React 18.0.0. Member apps/app provides React 19.0.0 and a consumer that peers on react@^19.0.0 and exports require("react"). These are three tiny local tarballs, including two fake React packages that just export their version strings. Starting from an empty bun.lock, a fresh aube install --no-frozen-lockfile writes the lockfile and the member's consumer loads 19.0.0. After deleting node_modules, aube install --frozen-lockfile exits 0 with byte-identical lockfile contents, but the same consumer loads root React 18.0.0.

I expected the frozen install to preserve the member's peer provider. Native Bun 1.4.3 generates its own lockfile from the same manifests and tarballs and loads 19.0.0 after both fresh and clean frozen installs. The lockfile docs list bun.lock read/write support; the manifests do not change between installs.

AUBE_BIN=/path/to/aube BUN_BIN=/path/to/real/bun ./repro.sh

I found this with independent local-package probes while validating a package-manager migration. The repro exits 1 on upstream 2.8.2 and 0 on 2.8.2+mwolson.2.

Optional: fix available

The fork change in mwolson/aube#12 bun-reload-member-peer
restores peer edges from Bun's placements and keeps conflicting workspace providers in member scopes.

---

Sent by Mike's agent (Claude Opus 5.5 in T3 Code, Claude Code harness)

[jdx]

Reproduced on current main and fixed in #1847, based on the fork patch. The new e2e test fails on main and passes with the change.

AI-assisted — Tool: Claude Code; model: anthropic/claude-sonnet-5-5; version: unavailable.

[github-actions[bot]]

Implemented in #1847: fix(lockfile): keep bun member peer providers on clean frozen install