diff --git a/crates/socket-patch-cli/tests/vendor_jvm_cli.rs b/crates/socket-patch-cli/tests/vendor_jvm_cli.rs
index bd75dd126..18b749a51 100644
--- a/crates/socket-patch-cli/tests/vendor_jvm_cli.rs
+++ b/crates/socket-patch-cli/tests/vendor_jvm_cli.rs
@@ -1153,6 +1153,90 @@ fn gradle_vendor_533_unpatched_classifier_copy_withholds_vex() {
     assert!(!vex.exists(), "{env}");
 }
 
+/// #513 / #459: a reactor `${prop}` version that can't be pinned with
+/// certainty (undefined in the checkout, or raised by a profile) is left
+/// as is with a warning, and `vex` does not attest the package the build
+/// still takes unpatched.
+#[test]
+fn maven_reactor_uncertain_property_version_withholds_vex() {
+    let cases = [
+        ("", "property_unresolved"),
+        (
+            "<properties><foo.version>1.0</foo.version></properties>\
+             <profiles><profile><id>new</id><properties><foo.version>1.1</foo.version>\
+             </properties></profile></profiles>",
+            "conflicting_literal_version",
+        ),
+    ];
+    // With a sibling module at the literal base, that module is rewritten
+    // and the patch is wired, yet `a` still builds the base.
+    for ((extra, reason), sibling) in cases
+        .into_iter()
+        .flat_map(|case| [(case, false), (case, true)])
+    {
+        let tmp = tempfile::tempdir().unwrap();
+        let root = tmp.path();
+        fixture(root, Shape::Reactor, &[("foo", FOO_UUID)]);
+        let pristine = std::fs::read_to_string(root.join("proj/a/pom.xml")).unwrap();
+        let a = pristine
+            .replace(
+                "<version>1.0</version></dependency>",
+                "<version>${foo.version}</version></dependency>",
+            )
+            .replace(
+                "<artifactId>a</artifactId>",
+                &format!("<artifactId>a</artifactId>{extra}"),
+            );
+        write(root, "proj/a/pom.xml", a.as_bytes());
+        if sibling {
+            let agg = std::fs::read_to_string(root.join("proj/pom.xml")).unwrap();
+            let agg = agg.replace(
+                "<module>a</module>",
+                "<module>a</module>\n    <module>b</module>",
+            );
+            write(root, "proj/pom.xml", agg.as_bytes());
+            std::fs::create_dir_all(root.join("proj/b")).unwrap();
+            let b = pristine.replace("<artifactId>a</artifactId>", "<artifactId>b</artifactId>");
+            write(root, "proj/b/pom.xml", b.as_bytes());
+        }
+        let env = ok(root, &["vendor"]);
+        assert!(
+            env.to_string().contains(&format!("reason: {reason}")),
+            "{env}"
+        );
+        assert_eq!(
+            std::fs::read_to_string(root.join("proj/a/pom.xml")).unwrap(),
+            a
+        );
+        assert_eq!(
+            wiring_text(root).contains("-socket."),
+            sibling,
+            "{reason}: wired"
+        );
+        let vex = root.join("vex.json");
+        let (_, env) = socket(
+            root,
+            &[
+                "vex",
+                "-O",
+                vex.to_str().unwrap(),
+                "--product",
+                "pkg:generic/x@1",
+            ],
+        );
+        assert_eq!(
+            events(&env),
+            [(
+                purl("foo"),
+                "skipped".to_string(),
+                "vendor_unwired".to_string()
+            )],
+            "{reason} (sibling: {sibling}): {env}"
+        );
+        assert!(!vex.exists(), "{env}");
+    }
+}
+
 /// #429 repair: a deleted owned `.gitattributes` (and nothing else) is
 /// rewritten by `repair` (no download), so the next autocrlf clone keeps the
 /// script and index LF.
diff --git a/crates/socket-patch-core/src/vendor/jvm/apply.rs b/crates/socket-patch-core/src/vendor/jvm/apply.rs
index e9d17f762..212a39a50 100644
--- a/crates/socket-patch-core/src/vendor/jvm/apply.rs
+++ b/crates/socket-patch-core/src/vendor/jvm/apply.rs
@@ -830,10 +830,11 @@ pub fn entry_references(root: &Path, entry: &VendorEntry) -> bool {
     referenced || reader.read_error.borrow().is_some()
 }
 
-/// The liveness proof `vex` needs: every half of the entry is wired, and
-/// a Gradle half's script is intact and re-plans with no refusal and no
+/// The liveness proof `vex` needs: every half of the entry is wired, a
+/// Gradle half's script is intact and re-plans with no refusal and no
 /// degraded warning (a conflicting rule or unchecked build logic added
-/// since vendoring withholds attestation).
+/// since vendoring withholds attestation), and no Maven declaration is
+/// left at a version that may still read the base.
 pub fn entry_wired_checked(root: &Path, entry: &VendorEntry) -> Result<bool, String> {
     let (g, a, v) = entry_gav(entry)?;
     let c = Coords {
@@ -856,7 +857,7 @@ pub fn entry_wired_checked(root: &Path, entry: &VendorEntry) -> Result<bool, Str
             wired = gradle::wired_checked(&read, &list, &c).map_err(|e| e.detail);
         }
         if maven && wired == Ok(true) {
-            wired = maven_reactor::wired_checked(&read, &c).map_err(|e| e.detail);
+            wired = maven_reactor::attestable_checked(&read, &c).map_err(|e| e.detail);
         }
         wired
     };
diff --git a/crates/socket-patch-core/src/vendor/jvm/maven_reactor.rs b/crates/socket-patch-core/src/vendor/jvm/maven_reactor.rs
index c8c54f681..d37809dca 100644
--- a/crates/socket-patch-core/src/vendor/jvm/maven_reactor.rs
+++ b/crates/socket-patch-core/src/vendor/jvm/maven_reactor.rs
@@ -163,6 +163,7 @@ pub fn plan_with_external(
             &mut warnings,
             &mut unpinned,
             &mut managed_roots,
+            &mut BTreeSet::new(),
         );
     }
 
@@ -460,6 +461,47 @@ pub fn wired_checked(read: ReadFn<'_>, c: &Coords<'_>) -> Result<bool, JvmRefusa
     })
 }
 
+/// [`wired_checked`], and no declaration of `c`'s g:a is left at a version
+/// that may still read the base: a `${...}` the checkout does not define
+/// or that an inheriting pom or a profile moves (#513, #459). Such a
+/// module builds the unpatched jar, so `vex` must not attest.
+pub fn attestable_checked(read: ReadFn<'_>, c: &Coords<'_>) -> Result<bool, JvmRefusal> {
+    let sv = c.suffixed_version();
+    let reactor = Reactor::discover(read)?;
+    if !reactor
+        .scope
+        .iter()
+        .any(|rel| reactor.poms[rel].doc.masked.contains(&sv))
+    {
+        return Ok(false);
+    }
+    let patch = JvmPatch {
+        group_id: c.group_id,
+        artifact_id: c.artifact_id,
+        version: c.version,
+        uuid: c.uuid,
+        jar: &[],
+        upstream_pom: &[],
+        upstream_module: None,
+        extra_artifacts: &[],
+        patched_members: &[],
+    };
+    let mut uncertain = BTreeSet::new();
+    for rel in &reactor.scope {
+        reactor.rewrite_declarations(
+            rel,
+            &patch,
+            &sv,
+            &mut BTreeMap::new(),
+            &mut Vec::new(),
+            &mut BTreeSet::new(),
+            &mut BTreeSet::new(),
+            &mut uncertain,
+        );
+    }
+    Ok(uncertain.is_empty())
+}
+
 /// `<!-- socket-patch <uuid>:` — the start of `c`'s pin comment.
 fn pin_tag(c: &Coords<'_>) -> String {
     format!("{PIN_TAG}{}:", c.uuid)
@@ -1311,8 +1353,16 @@ struct Pom {
     parent: Option<ParentRef>,
     /// Top-level `<properties>` (profiles excluded).
     props: BTreeMap<String, String>,
+    /// Each profile's id and `<properties>`, in document order.
+    profile_props: Vec<(String, BTreeMap<String, String>)>,
+    /// Model 4.1.0 (Maven 4): omitted parent coordinates are inferred
+    /// from the pom at the relative path.
+    infers_parent: bool,
 }
 
+/// A pom and one of its profiles' `<properties>`.
+type Overlay<'a> = (&'a str, &'a BTreeMap<String, String>);
+
 struct ParentRef {
     group: Option<String>,
     artifact: Option<String>,
@@ -1335,13 +1385,30 @@ impl Pom {
             version: doc.child_text(p, "version"),
             relative_path: doc.child(p, "relativePath").map(|r| doc.text_of(r)),
         });
-        let mut props = BTreeMap::new();
-        if let Some(p) = doc.child(project, "properties") {
-            for &c in &doc.nodes[p].children {
-                props.insert(doc.nodes[c].name.clone(), doc.text_of(c));
+        let properties_of = |model: usize| {
+            let mut props = BTreeMap::new();
+            if let Some(p) = doc.child(model, "properties") {
+                for &c in &doc.nodes[p].children {
+                    props.insert(doc.nodes[c].name.clone(), doc.text_of(c));
+                }
             }
-        }
+            props
+        };
+        let props = properties_of(project);
+        let profile_props = doc
+            .child(project, "profiles")
+            .into_iter()
+            .flat_map(|ps| doc.children(ps, "profile"))
+            .map(|p| {
+                let id = doc.child_text(p, "id").unwrap_or_else(|| "default".into());
+                (id, properties_of(p))
+            })
+            .filter(|(_, props)| !props.is_empty())
+            .collect();
+        let infers_parent = doc.child_text(project, "modelVersion").as_deref() == Some("4.1.0")
+            || doc.masked.contains("maven.apache.org/POM/4.1.0");
         Ok(Pom {
+            infers_parent,
             dir: rel.rsplit_once('/').map_or("", |(d, _)| d).to_string(),
             group: doc.child_text(project, "groupId"),
             artifact: doc.child_text(project, "artifactId"),
@@ -1351,6 +1418,7 @@ impl Pom {
                 .unwrap_or_else(|| "jar".to_string()),
             parent,
             props,
+            profile_props,
             doc,
         })
     }
@@ -1516,6 +1584,18 @@ impl Reactor {
     /// Interpolate every `${name}` in `value` in the context of `rel`;
     /// `None` when any name is undefined in the checkout.
     fn interpolate(&self, rel: &str, value: &str, depth: usize) -> Option<String> {
+        self.interpolate_with(rel, value, depth, None)
+    }
+
+    /// [`Self::interpolate`] with `overlay`'s properties (a profile's)
+    /// layered over its pom's own, as when that profile is active.
+    fn interpolate_with(
+        &self,
+        rel: &str,
+        value: &str,
+        depth: usize,
+        overlay: Option<Overlay<'_>>,
+    ) -> Option<String> {
         if depth > MAX_INTERPOLATION_DEPTH {
             return None;
         }
@@ -1525,8 +1605,8 @@ impl Reactor {
             out.push_str(&rest[..at]);
             let after = &rest[at + 2..];
             let close = after.find('}')?;
-            let raw = self.lookup(rel, &after[..close])?;
-            out.push_str(&self.interpolate(rel, &raw, depth + 1)?);
+            let raw = self.lookup_with(rel, &after[..close], overlay)?;
+            out.push_str(&self.interpolate_with(rel, &raw, depth + 1, overlay)?);
             rest = &after[close + 1..];
         }
         out.push_str(rest);
@@ -1537,13 +1617,25 @@ impl Reactor {
     /// model's own version expressions, then `<properties>` up the local
     /// chain.
     fn lookup(&self, rel: &str, name: &str) -> Option<String> {
+        self.lookup_with(rel, name, None)
+    }
+
+    fn lookup_with(&self, rel: &str, name: &str, overlay: Option<Overlay<'_>>) -> Option<String> {
         let pom = &self.poms[rel];
+        // A Maven 4 child may omit its parent's coordinates too: they come
+        // from the inferred local parent.
+        let version = || {
+            self.chain(rel)
+                .find_map(|p| self.poms[p].effective_version())
+                .map(str::to_string)
+        };
         match name {
-            "project.version" | "pom.version" => {
-                return pom.effective_version().map(str::to_string);
-            }
+            "project.version" | "pom.version" => return version(),
             "project.groupId" | "pom.groupId" => {
-                return pom.effective_group().map(str::to_string);
+                return self
+                    .chain(rel)
+                    .find_map(|p| self.poms[p].effective_group())
+                    .map(str::to_string);
             }
             "project.artifactId" | "pom.artifactId" => return pom.artifact.clone(),
             "project.parent.version" => return pom.parent.as_ref()?.version.clone(),
@@ -1553,12 +1645,54 @@ impl Reactor {
         if let Some(v) = self.cli_props.get(name) {
             return Some(v.clone());
         }
-        if let Some(v) = self.chain(rel).find_map(|p| self.poms[p].props.get(name)) {
+        if let Some(v) = self.chain(rel).find_map(|p| {
+            overlay
+                .filter(|(at, _)| *at == p)
+                .and_then(|(_, props)| props.get(name))
+                .or_else(|| self.poms[p].props.get(name))
+        }) {
             return Some(v.clone());
         }
-        (name == "version")
-            .then(|| pom.effective_version().map(str::to_string))
-            .flatten()
+        (name == "version").then(version).flatten()
+    }
+
+    /// A version `declared` (with `${...}`) reaches in a pom that reads
+    /// it, an inheritor of `rel` or `rel` itself with a profile on its
+    /// chain active, that is neither the base nor `sv`: the version and
+    /// where. Profile activation is not evaluated, so every profile counts
+    /// (one at a time).
+    fn version_override(
+        &self,
+        rel: &str,
+        declared: &str,
+        base: &str,
+        sv: &str,
+    ) -> Option<(String, String)> {
+        let moved = |v: &str| !is_base_like(v, base) && v != sv;
+        std::iter::once(rel)
+            .chain(self.inheritors(rel))
+            .find_map(|reader| {
+                // `rel` resolves it, so a reader or profile that does not
+                // has redefined something it names: that moves it too.
+                let undefined = || "an undefined value".to_string();
+                let plain = (reader != rel)
+                    .then(|| {
+                        self.interpolate(reader, declared, 0)
+                            .unwrap_or_else(undefined)
+                    })
+                    .filter(|v| moved(v))
+                    .map(|v| (v, reader.to_string()));
+                plain.or_else(|| {
+                    self.chain(reader).find_map(|at| {
+                        self.poms[at].profile_props.iter().find_map(|(id, props)| {
+                            let v = self
+                                .interpolate_with(reader, declared, 0, Some((at, props)))
+                                .unwrap_or_else(undefined);
+                            moved(&v).then(|| (v, format!("{reader} under profile {id} of {at}")))
+                        })
+                    })
+                })
+            })
     }
 
     /// Every pom in scope that inherits from `rel` (has it on its chain).
@@ -1570,8 +1704,9 @@ impl Reactor {
     }
 
     /// Rewrite the base declarations of `rel` and record the
-    /// warnings, the local roots not to pin, and the local roots whose own
-    /// top-level management already covers g:a.
+    /// warnings, the local roots not to pin, the local roots whose own
+    /// top-level management already covers g:a, and the declarations left
+    /// at a version that may still read the base (`uncertain`).
     #[allow(clippy::too_many_arguments)]
     fn rewrite_declarations(
         &self,
@@ -1582,10 +1717,11 @@ impl Reactor {
         warnings: &mut Vec<JvmWarning>,
         unpinned: &mut BTreeSet<String>,
         managed_roots: &mut BTreeSet<String>,
+        uncertain: &mut BTreeSet<String>,
     ) {
         let doc = &self.poms[rel].doc;
         let ga = format!("{}:{}", patch.group_id, patch.artifact_id);
-        self.warn_unresolved_coordinates(rel, patch, warnings);
+        self.warn_unresolved_coordinates(rel, patch, warnings, unpinned, uncertain);
         for (dep, key) in self.keyed_declarations(rel, patch.group_id, patch.artifact_id) {
             if doc
                 .child_text(dep, "type")
@@ -1624,6 +1760,7 @@ impl Reactor {
                         ),
                     ));
                     unpinned.insert(root);
+                    uncertain.insert(at);
                     continue;
                 }
             }
@@ -1643,9 +1780,12 @@ impl Reactor {
                             "property_unresolved",
                             format!(
                                 "{at}: {ga} version {declared} is not defined in the checkout; \
-                                 left as is, probably unpatched"
+                                 left as is, probably unpatched, and {root} is not pinned"
                             ),
                         ));
+                        // The explicit version beats any pin of the root.
+                        unpinned.insert(root);
+                        uncertain.insert(at);
                         continue;
                     }
                 }
@@ -1656,16 +1796,15 @@ impl Reactor {
                 continue;
             }
             if is_base_like(&resolved, patch.version) {
-                // Maven interpolates after inheritance: a pom that inherits
-                // this declaration and overrides the property must keep its
-                // own version, so the literal SV cannot go here.
-                let overridden = declared.contains("${").then(|| {
-                    self.inheritors(rel).find_map(|p| {
-                        let v = self.interpolate(p, &declared, 0)?;
-                        (!is_base_like(&v, patch.version) && v != sv).then(|| (p.to_string(), v))
-                    })
-                });
-                if let Some((p, v)) = overridden.flatten() {
+                // Maven interpolates after inheritance and with the active
+                // profiles: a pom that inherits this declaration and
+                // overrides the property, or a profile that does, must keep
+                // its own version, so the literal SV cannot go here.
+                let overridden = declared
+                    .contains("${")
+                    .then(|| self.version_override(rel, &declared, patch.version, sv))
+                    .flatten();
+                if let Some((v, p)) = overridden {
                     warnings.push(degraded(
                         "conflicting_literal_version",
                         format!(
@@ -1675,6 +1814,7 @@ impl Reactor {
                         ),
                     ));
                     unpinned.insert(root);
+                    uncertain.insert(at);
                     continue;
                 }
                 let span = doc.value_span(version);
@@ -1710,12 +1850,15 @@ impl Reactor {
 impl Reactor {
     /// Warn for each declaration of `rel` that could be `patch`'s g:a but
     /// names a `${...}` groupId or artifactId undefined in the checkout:
-    /// it is left as is, probably unpatched.
+    /// it is left as is, probably unpatched. One with its own version
+    /// beats any pin, so its local root is not pinned.
     fn warn_unresolved_coordinates(
         &self,
         rel: &str,
         patch: &JvmPatch<'_>,
         warnings: &mut Vec<JvmWarning>,
+        unpinned: &mut BTreeSet<String>,
+        uncertain: &mut BTreeSet<String>,
     ) {
         let doc = &self.poms[rel].doc;
         let resolve = |v: &str| self.interpolate(rel, v, 0);
@@ -1749,16 +1892,29 @@ impl Reactor {
                 continue;
             }
             let at = format!("{rel}:{}", doc.line_of(doc.nodes[dep].start));
+            let versioned = doc
+                .child_text(dep, "version")
+                .is_some_and(|v| !v.is_empty());
+            let root = self.local_root(rel);
+            let unpin = if versioned {
+                format!(", and {root} is not pinned")
+            } else {
+                String::new()
+            };
             warnings.push(degraded(
                 "property_unresolved",
                 format!(
                     "{at}: {g}:{a} may be {}:{} but {} is not defined in the checkout; \
-                     left as is, probably unpatched",
+                     left as is, probably unpatched{unpin}",
                     patch.group_id,
                     patch.artifact_id,
                     unresolved.join(", ")
                 ),
             ));
+            if versioned {
+                unpinned.insert(root);
+                uncertain.insert(at);
+            }
         }
     }
 }
@@ -1910,9 +2066,16 @@ fn local_parent_of(
         (Some(a), Some(b)) => a == b,
         _ => true,
     };
-    let matches = want_group.as_deref() == candidate.effective_group()
-        && want_artifact == candidate.artifact
-        && versions_agree;
+    // Maven 4 (model 4.1.0) infers omitted parent coordinates from the
+    // pom at the relative path.
+    let infers = poms[rel].infers_parent;
+    let matches = match want_group.as_deref() {
+        None => infers,
+        Some(g) => Some(g) == candidate.effective_group(),
+    } && match want_artifact.as_deref() {
+        None => infers,
+        Some(a) => Some(a) == candidate.artifact.as_deref(),
+    } && versions_agree;
     Ok(matches.then_some(parent_rel))
 }
 
@@ -4043,10 +4206,8 @@ mod tests {
             plan.warnings[0].detail
         );
         assert_eq!(text(&after, "a/pom.xml"), a);
-        assert!(
-            text(&after, "pom.xml").contains("<dependencyManagement>"),
-            "still pinned"
-        );
+        // a's explicit `${remote.prop}` beats any pin (#513).
+        assert!(!text(&after, "pom.xml").contains("<dependencyManagement>"));
     }
 
     #[test]
@@ -5141,6 +5302,305 @@ mod tests {
         assert!(text(&after, "pom.xml").contains(&format!("<version>{SV}</version></dependency>")));
     }
 
+    // ── uncertain property versions (#513, #459) ──
+
+    /// No pom of the reactor names the suffixed version: `vex` sees the
+    /// patch as unwired.
+    fn unwired(files: &Fs) -> bool {
+        files
+            .iter()
+            .filter(|(rel, _)| rel.ends_with(".xml"))
+            .all(|(_, bytes)| !String::from_utf8_lossy(bytes).contains(SV))
+    }
+
+    /// `profile` as a profile of `pom`, placed before its `<dependencies>`
+    /// (or `<modules>`).
+    fn with_profile(pom: &str, id: &str, props: &str) -> String {
+        let profile = format!(
+            "<profiles><profile><id>{id}</id><activation><activeByDefault>true\
+             </activeByDefault></activation><properties>{props}</properties></profile>\
+             </profiles>\n  "
+        );
+        let at = pom
+            .find("<dependencies>")
+            .or_else(|| pom.find("<modules>"))
+            .unwrap();
+        format!("{}{profile}{}", &pom[..at], &pom[at..])
+    }
+
+    /// #513 case 1: a property only an external parent defines keeps the
+    /// module's explicit version over any pin, so the root is not pinned.
+    #[test]
+    fn a_property_from_an_external_parent_leaves_the_root_unpinned() {
+        let parent = "<parent><groupId>com.corp</groupId><artifactId>corp-parent</artifactId>\
+            <version>3</version><relativePath/></parent>";
+        let mut files = external_reactor(parent, "");
+        let a = text(&files, "a/pom.xml").replace(
+            "</artifactId></dependency>",
+            "</artifactId><version>${ct.version}</version></dependency>",
+        );
+        files.insert("a/pom.xml".into(), a.clone().into_bytes());
+        let plan = run(&files).unwrap();
+        assert_eq!(reasons(&plan), ["property_unresolved"]);
+        let after = applied(&files, &plan);
+        assert_eq!(text(&after, "a/pom.xml"), a);
+        assert!(!root_pinned(&plan, &files));
+        assert!(unwired(&after));
+    }
+
+    /// #513 case 2: Maven 4.1.0 infers an empty `<parent/>` from
+    /// `../pom.xml`, so the root's property resolves and is rewritten.
+    #[test]
+    fn a_maven_4_inferred_parent_is_local() {
+        let root = "<project xmlns=\"http://maven.apache.org/POM/4.1.0\">\n  \
+            <modelVersion>4.1.0</modelVersion>\n  <groupId>com.example</groupId>\n  \
+            <artifactId>root</artifactId>\n  <version>1.0.0</version>\n  \
+            <packaging>pom</packaging>\n  <subprojects><subproject>a</subproject></subprojects>\n  \
+            <properties><ct.version>1.10.0</ct.version></properties>\n</project>\n";
+        let a = format!(
+            "<project xmlns=\"http://maven.apache.org/POM/4.1.0\">\n  \
+             <modelVersion>4.1.0</modelVersion>\n  <parent/>\n  <artifactId>a</artifactId>\n  \
+             <dependencies>\n    {}\n  </dependencies>\n</project>\n",
+            dep("${ct.version}")
+        );
+        let files = fs(&[("pom.xml", root), ("a/pom.xml", &a)]);
+        let (plan, after) = vendor(&files);
+        assert!(plan.warnings.is_empty(), "{:?}", plan.warnings);
+        assert_eq!(text(&after, "a/pom.xml"), a.replace("${ct.version}", SV));
+        assert!(root_pinned(&plan, &files));
+    }
+
+    /// #459: a profile of the declaring module raising the property keeps
+    /// the declaration and leaves the root unpinned.
+    #[test]
+    fn a_profile_overriding_the_version_property_is_left_alone() {
+        let root = ROOT.replace(
+            "  <modules>",
+            "  <properties><ct.version>1.10.0</ct.version></properties>\n  <modules>",
+        );
+        let a = with_profile(
+            &module("a", &dep("${ct.version}")),
+            "modern-jdk",
+            "<ct.version>1.11.0</ct.version>",
+        );
+        let files = fs(&[
+            ("pom.xml", &root),
+            ("a/pom.xml", &a),
+            ("b/pom.xml", &module("b", "")),
+        ]);
+        let plan = run(&files).unwrap();
+        assert_eq!(reasons(&plan), ["conflicting_literal_version"]);
+        assert!(
+            plan.warnings[0].detail.contains("profile modern-jdk"),
+            "{:?}",
+            plan.warnings
+        );
+        let after = applied(&files, &plan);
+        assert_eq!(text(&after, "a/pom.xml"), a);
+        assert!(!root_pinned(&plan, &files));
+        assert!(unwired(&after));
+    }
+
+    /// #459: the same through the parent's profile, and through a profile
+    /// overriding a property the version is built from.
+    #[test]
+    fn a_profile_up_the_chain_or_on_a_nested_property_is_weighed() {
+        let a = module("a", &dep("${ct.version}"));
+        for (props, profile) in [
+            (
+                "<ct.version>1.10.0</ct.version>",
+                "<ct.version>1.11.0</ct.version>",
+            ),
+            (
+                "<ct.minor>10</ct.minor><ct.version>1.${ct.minor}.0</ct.version>",
+                "<ct.minor>11</ct.minor>",
+            ),
+            // A profile pointing the property at a name the checkout
+            // does not define (Bugbot on #1787).
+            (
+                "<ct.version>1.10.0</ct.version>",
+                "<ct.version>${corp.ct.version}</ct.version>",
+            ),
+        ] {
+            let root = with_profile(
+                &ROOT.replace(
+                    "  <modules>",
+                    &format!("  <properties>{props}</properties>\n  <modules>"),
+                ),
+                "corp",
+                profile,
+            );
+            let files = fs(&[
+                ("pom.xml", &root),
+                ("a/pom.xml", &a),
+                ("b/pom.xml", &module("b", "")),
+            ]);
+            let plan = run(&files).unwrap();
+            assert_eq!(reasons(&plan), ["conflicting_literal_version"], "{props}");
+            let after = applied(&files, &plan);
+            assert_eq!(text(&after, "a/pom.xml"), a);
+            assert!(unwired(&after), "{props}");
+        }
+    }
+
+    /// #459: a module's profile overriding the property an inherited
+    /// management declaration reads keeps that declaration.
+    #[test]
+    fn an_inheriting_modules_profile_keeps_the_managed_property() {
+        let root = ROOT.replace(
+            "  <build>",
+            "  <properties><ct.version>1.10.0</ct.version></properties>\n  \
+             <dependencyManagement>\n    <dependencies>\n      \
+             <dependency><groupId>org.apache.commons</groupId><artifactId>commons-text</artifactId>\
+             <version>${ct.version}</version></dependency>\n    </dependencies>\n  \
+             </dependencyManagement>\n  <build>",
+        );
+        let bare = "<dependency><groupId>org.apache.commons</groupId>\
+                    <artifactId>commons-text</artifactId></dependency>";
+        let a = with_profile(&module("a", bare), "new", "<ct.version>1.12.0</ct.version>");
+        let files = fs(&[
+            ("pom.xml", &root),
+            ("a/pom.xml", &a),
+            ("b/pom.xml", &module("b", bare)),
+        ]);
+        let plan = run(&files).unwrap();
+        assert_eq!(reasons(&plan), ["conflicting_literal_version"]);
+        assert!(unwired(&applied(&files, &plan)));
+    }
+
+    fn attestable(files: &Fs) -> (bool, bool) {
+        let read = |p: &str| files.get(p).cloned();
+        let c = Coords {
+            group_id: "org.apache.commons",
+            artifact_id: "commons-text",
+            version: "1.10.0",
+            uuid: UUID,
+        };
+        (
+            wired_checked(&read, &c).unwrap(),
+            attestable_checked(&read, &c).unwrap(),
+        )
+    }
+
+    /// A sibling rewritten to SV wires the patch, but a module left at an
+    /// uncertain `${...}` still builds the base: not attestable.
+    #[test]
+    fn an_uncertain_module_beside_a_rewritten_one_is_not_attestable() {
+        let profiled = with_profile(
+            &module("a", &dep("${ct.version}")),
+            "new",
+            "<ct.version>1.11.0</ct.version>",
+        );
+        let root = ROOT.replace(
+            "  <modules>",
+            "  <properties><ct.version>1.10.0</ct.version></properties>\n  <modules>",
+        );
+        for (root, a) in [
+            (ROOT.to_string(), module("a", &dep("${remote.prop}"))),
+            (root, profiled),
+        ] {
+            let files = fs(&[
+                ("pom.xml", &root),
+                ("a/pom.xml", &a),
+                ("b/pom.xml", &module("b", &dep("1.10.0"))),
+            ]);
+            let (_, after) = vendor(&files);
+            assert_eq!(text(&after, "b/pom.xml"), module("b", &dep(SV)));
+            assert_eq!(attestable(&after), (true, false), "{a}");
+        }
+        // Without the uncertain module the same reactor attests.
+        let files = fs(&[
+            ("pom.xml", ROOT),
+            ("a/pom.xml", &module("a", "")),
+            ("b/pom.xml", &module("b", &dep("1.10.0"))),
+        ]);
+        let (_, after) = vendor(&files);
+        assert_eq!(attestable(&after), (true, true));
+    }
+
+    /// #513: a possibly-matching declaration named through an undefined
+    /// `${...}` groupId with its own version beats any pin.
+    #[test]
+    fn an_unresolved_coordinate_with_a_version_leaves_the_root_unpinned() {
+        let a = module(
+            "a",
+            "<dependency><groupId>${ext.group}</groupId>\
+             <artifactId>commons-text</artifactId><version>1.10.0</version></dependency>",
+        );
+        let files = fs(&[
+            ("pom.xml", ROOT),
+            ("a/pom.xml", &a),
+            ("b/pom.xml", &module("b", "")),
+        ]);
+        let plan = run(&files).unwrap();
+        assert_eq!(reasons(&plan), ["property_unresolved"]);
+        assert!(!root_pinned(&plan, &files));
+        assert!(unwired(&applied(&files, &plan)));
+    }
+
+    /// Maven 4 children also inherit the inferred parent's version, and a
+    /// model 4.0.0 pom does not infer a parent.
+    #[test]
+    fn maven_4_parent_inference_is_4_1_only_and_carries_the_version() {
+        let root = "<project xmlns=\"http://maven.apache.org/POM/4.1.0\">\n  \
+            <modelVersion>4.1.0</modelVersion>\n  <groupId>org.apache.commons</groupId>\n  \
+            <artifactId>root</artifactId>\n  <version>1.10.0</version>\n  \
+            <packaging>pom</packaging>\n  <subprojects><subproject>a</subproject></subprojects>\n\
+            </project>\n";
+        let a41 = format!(
+            "<project xmlns=\"http://maven.apache.org/POM/4.1.0\">\n  \
+             <modelVersion>4.1.0</modelVersion>\n  <parent/>\n  <artifactId>a</artifactId>\n  \
+             <dependencies>\n    {}\n  </dependencies>\n</project>\n",
+            dep("${project.version}")
+        );
+        let files = fs(&[("pom.xml", root), ("a/pom.xml", &a41)]);
+        let (plan, after) = vendor(&files);
+        assert!(plan.warnings.is_empty(), "{:?}", plan.warnings);
+        assert_eq!(
+            text(&after, "a/pom.xml"),
+            a41.replace("${project.version}", SV)
+        );
+        let a40 = a41
+            .replace("POM/4.1.0", "POM/4.0.0")
+            .replace(">4.1.0<", ">4.0.0<");
+        let files = fs(&[("pom.xml", root), ("a/pom.xml", &a40)]);
+        let plan = run(&files).unwrap();
+        assert_eq!(reasons(&plan), ["property_unresolved"]);
+    }
+
+    /// A profile that sets the base version (or a user property that wins
+    /// over every profile) changes nothing.
+    #[test]
+    fn a_profile_agreeing_with_the_base_or_beaten_by_maven_config_is_rewritten() {
+        let root = ROOT.replace(
+            "  <modules>",
+            "  <properties><ct.version>1.10.0</ct.version></properties>\n  <modules>",
+        );
+        let agreeing = with_profile(
+            &module("a", &dep("${ct.version}")),
+            "same",
+            "<ct.version>1.10.0</ct.version>",
+        );
+        let raising = with_profile(
+            &module("a", &dep("${ct.version}")),
+            "new",
+            "<ct.version>1.11.0</ct.version>",
+        );
+        for (a, config) in [(&agreeing, None), (&raising, Some("-Dct.version=1.10.0\n"))] {
+            let mut files = fs(&[
+                ("pom.xml", &root),
+                ("a/pom.xml", a),
+                ("b/pom.xml", &module("b", "")),
+            ]);
+            if let Some(config) = config {
+                files.insert(".mvn/maven.config".into(), config.as_bytes().to_vec());
+            }
+            let (plan, after) = vendor(&files);
+            assert!(plan.warnings.is_empty(), "{:?}", plan.warnings);
+            assert_eq!(text(&after, "a/pom.xml"), a.replace("${ct.version}", SV));
+        }
+    }
+
     #[test]
     fn plugin_configuration_modules_do_not_make_a_reactor() {
         let ear = "<project><modelVersion>4.0.0</modelVersion><groupId>t</groupId>\