@bongos/core 1.19.510 → 1.19.512

package/scripts/gds/git-merge-regen.js

@@ -20,6 +20,24 @@
 // parts of nested docs; it succeeds ONLY if no conflict markers remain. A genuine
 // hand-written conflict falls through to a normal git conflict — it never invents a
 // resolution or clobbers a real edit.
+//
+// ⚠ THE DRIVER'S OUTPUT IS PROVISIONAL FOR ANY TREE-SCANNING ARTIFACT (task 1003546).
+// Every rule below that rebuilds by SCANNING THE WORKING TREE — copy-inventory.js's
+// registry pair, gen-repo-map's map + nested blocks, gen-file-map's sections — is
+// invoked BY git, DURING the merge, when that tree is still the PRE-merge (ours)
+// tree. So the driver writes an artifact describing the branch, git completes the
+// merge underneath it, and the merge lands CLEAN (exit 0, no unmerged paths, no
+// markers) carrying content that matches neither side nor the merged tree. Measured:
+// two branches each shifting lines in one scanned UI file merge clean and the merge
+// commit's docs/copy-registry.json is byte-identical to ours, silently dropping the
+// other side's line numbers (PR #536 / task 1003544).
+// It is still worth running — it clears the markers so the merge completes at all —
+// but it is NOT the authority. Whoever OWNS the merge must regenerate afterwards, on
+// the final tree, and commit the drift: the server does it in conflict-resolve.js
+// step 7b, and a post-merge `resolveInWorktree` call (ship-preflight-steps.js) is
+// correct for the same reason — by then git has written every cleanly-merged path.
+// Do NOT add a rule here and assume the merge is thereby correct; a line-numbered or
+// aggregate-carrying artifact cannot be resolved from the three merge sides at all.
 
 const fs = require('node:fs');
 const os = require('node:os');

package/src/branding.js

@@ -60,6 +60,11 @@ const ENV_OVERRIDES = [
   // — which is exactly why applying a change RESTARTS the instance.
   ['PLATFORM_VISIBILITY', ['project', 'platformVisibility']],
   ['JOINABILITY', ['project', 'joinability']],
+  // The join door the owner set on the platform (ADR 0182 D1, task 1002324) —
+  // public | private | stealth. Distinct from PLATFORM_VISIBILITY above, which is
+  // this instance's own sign-in door; this one is how the project stands on the
+  // platform's map, and D6 makes it the ceiling JOINABILITY may only narrow.
+  ['VISIBILITY', ['project', 'visibility']],
 ];
 
 const isObj = (v) => v && typeof v === 'object' && !Array.isArray(v);
@@ -215,6 +220,10 @@ function clientBranding(b = branding()) {
     project: {
       platformVisibility: b.project?.platformVisibility || 'public',
       joinability: b.project?.joinability || 'apply',
+      // The join door (task 1002324). Public by nature for the same reason as its
+      // two neighbours: it is how the project asks to be seen on the map, and it is
+      // the READ-BACK a manage page needs to tell a saved choice from a live one.
+      visibility: b.project?.visibility || 'public',
     },
   };
 }

package/src/module-api.js

@@ -45,7 +45,7 @@ const { validateOrRespond, LIMITS, parseId, asyncHandler, corsPublicGet, parsePa
 // there. scripts/gds/bump-version.js still rewrites the literal below; it appends
 // the entry to that file. Look for a version's history there, not here.
 // ---------------------------------------------------------------------------
-const CORE_VERSION = '1.19.510'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
+const CORE_VERSION = '1.19.512'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('dev-box'); log.info('mounted');

package/tests/conflict_resolve.mjs

@@ -52,9 +52,21 @@ function mkExec(scn = {}) {
     if (cmd === 'checkout') return ret(scn.checkout ?? 0);
     if (cmd === 'rev-parse') {
       revCount += 1;
-      const sha = revCount === 1 ? (scn.before ?? 'aaaaaaa') : (scn.after ?? 'bbbbbbb');
-      return { code: 0, stdout: `${sha}\n`, stderr: '' };
+      // 1st = the pre-merge tip, 2nd = the merge commit, 3rd = the post-merge
+      // regeneration commit (task 1003546 step 7b), when there was drift to commit.
+      if (revCount === 1) return { code: 0, stdout: `${scn.before ?? 'aaaaaaa'}\n`, stderr: '' };
+      if (revCount === 2) return { code: 0, stdout: `${scn.after ?? 'bbbbbbb'}\n`, stderr: '' };
+      return { code: 0, stdout: `${scn.regenSha ?? scn.after ?? 'bbbbbbb'}\n`, stderr: '' };
     }
+    if (cmd === 'status') {
+      // --porcelain after step 7b's regeneration: a non-empty body = the merged tree
+      // disagreed with the generated artifacts the merge produced. Default OFF so the
+      // pre-1003546 cases keep asserting the plain merge-and-push path.
+      const drift = scn.drift ?? false;
+      return { code: 0, stdout: drift ? ' M docs/copy-registry.json\n' : '', stderr: '' };
+    }
+    if (cmd === 'add') return ret(0);
+    if (cmd === 'commit') return ret(scn.commit ?? 0);
     if (cmd === 'merge' && a[1] === '--abort') return ret(0);
     if (cmd === 'merge') {
       if (scn.merge === 'conflict') { mergeOutcome = 'conflict'; return { code: 1, stdout: 'CONFLICT (content)', stderr: '' }; }
@@ -79,8 +91,13 @@ function mkExec(scn = {}) {
 function mkDeps(scn = {}, over = {}) {
   const reg = [];
   const exec = mkExec(scn);
+  const genCalls = [];
   return {
     exec,
+    // task 1003546: resolveBranchConflicts regenerates on the MERGED tree before it
+    // pushes, so it takes the same runGenerators seam refreshStaleGenerated does.
+    // Stubbed for every case — the real one would spawn node against a fake clone.
+    runGenerators: over.runGenerators || (async (opts) => { genCalls.push(opts); return { code: scn.genCode ?? 0 }; }),
     githubPush: {
       isConfigured: () => (over.configured === undefined ? true : over.configured),
       isSafeBranch: (b) => (over.safeBranch === undefined ? (typeof b === 'string' && b.length > 0 && !b.startsWith('-')) : over.safeBranch),
@@ -94,6 +111,7 @@ function mkDeps(scn = {}, over = {}) {
     rmtmp: () => {},
     _exec: exec,
     _reg: reg,
+    _gen: genCalls,
   };
 }
 
@@ -377,7 +395,11 @@ test('1915 defaultRunGenerators strips *_INSTANCE_ROOT from the child env and pi
       const leaked = Object.keys(call.opts.env || {}).filter((k) => /_INSTANCE_ROOT$/.test(k));
       assert.deepEqual(leaked, [], 'no *_INSTANCE_ROOT key survives into the generator child env');
       assert.ok(call.opts.env.PATH, 'benign env (PATH) is preserved so node still resolves');
-      assert.ok(String(call.argv[0]).startsWith('/tmp/clone-xyz'), 'the generator script path is under the clone');
+      // Separator-normalised: defaultRunGenerators builds this with path.join, which
+      // emits backslashes on win32 — the bare startsWith made this assertion fail on
+      // every Windows builder for a reason unrelated to what it tests (task 1003546).
+      assert.ok(String(call.argv[0]).replace(/\\/g, '/').startsWith('/tmp/clone-xyz'),
+        'the generator script path is under the clone');
     }
   } finally {
     if (prev.g === undefined) delete process.env.GDS_INSTANCE_ROOT; else process.env.GDS_INSTANCE_ROOT = prev.g;
@@ -455,8 +477,100 @@ test('1915 defaultRunGenerators reports the worst child exit code (0 all-clean;
   assert.equal(badGen.code, 2, 'a single failing generator surfaces its non-zero code');
 });
 
+// ── task 1003546: the merged tree is regenerated BEFORE the push ────────────────
+// The `otb-regen` driver runs DURING the merge and rebuilds by scanning the working
+// tree, which at that moment is still the PRE-merge tree. So a merge can come out
+// clean — exit 0, no unmerged paths, no markers — carrying a generated artifact that
+// describes neither side nor the merged tree, and nothing downstream can see it.
+// resolveBranchConflicts must therefore regenerate on the FINAL tree and commit the
+// drift before pushing (PR #536 / task 1003544: the registry kept the branch's line
+// numbers and `unit` stayed red through the heal).
+
+test('1003546 clean merge → generators run on the merged tree, drift committed, head_sha is the regen commit', async () => {
+  const deps = mkDeps({ merge: 'clean', before: 'oldsha1', after: 'mergesha', drift: true, regenSha: 'regensha' });
+  const r = await cr.resolveBranchConflicts({ branch: 'claude/wt-cr1' }, deps);
+  assert.equal(r.resolved, true);
+  assert.equal(deps._gen.length, 1, 'generators ran exactly once against the merged tree');
+  assert.ok(ran(deps._exec, 'commit'), 'post-merge generator drift is committed');
+  assert.equal(r.regenerated, true, 'the result reports that a regeneration was needed');
+  assert.equal(r.head_sha, 'regensha', 'head_sha is the regen commit, not the bare merge commit');
+});
+
+test('1003546 the regeneration happens AFTER the merge and its commit BEFORE the push (ordering is the whole point)', async () => {
+  const order = [];
+  const deps = mkDeps({ merge: 'clean', drift: true });
+  const baseExec = deps.exec;
+  deps.exec = async (args) => {
+    const a = args[0] === '-C' ? args.slice(2) : args;
+    if (['merge', 'commit', 'push'].includes(a[0])) order.push(a[0]);
+    return baseExec(args);
+  };
+  deps.runGenerators = async () => { order.push('__generators__'); return { code: 0 }; };
+  const r = await cr.resolveBranchConflicts({ branch: 'claude/wt-cr2' }, deps);
+  assert.equal(r.resolved, true);
+  assert.deepEqual(order, ['merge', '__generators__', 'commit', 'push'],
+    'a pre-merge regeneration (or a push before the regen commit) is exactly the bug');
+});
+
+test('1003546 no post-merge drift → the merge alone is pushed, nothing extra committed', async () => {
+  const deps = mkDeps({ merge: 'clean', after: 'mergesha', drift: false });
+  const r = await cr.resolveBranchConflicts({ branch: 'claude/wt-cr3' }, deps);
+  assert.equal(r.resolved, true);
+  assert.equal(r.regenerated, false);
+  assert.equal(r.head_sha, 'mergesha', 'the merge commit is the head when regen is a no-op');
+  assert.ok(!ran(deps._exec, 'commit'), 'nothing is committed when the merge was already correct');
+  assert.ok(ran(deps._exec, 'push'), 'the resolved branch still lands');
+});
+
+test('1003546 a failing generator never pushes an uncertifiable merged tree', async () => {
+  const deps = mkDeps({ merge: 'clean', drift: true, genCode: 2 });
+  const r = await cr.resolveBranchConflicts({ branch: 'claude/wt-cr4' }, deps);
+  assert.equal(r.resolved, false);
+  assert.equal(r.skipped, 'generator_failed');
+  assert.ok(!ran(deps._exec, 'push'), 'a tree we cannot certify is left for a human, never pushed');
+});
+
+test('1003546 a failing post-merge commit is reported, not pushed', async () => {
+  const deps = mkDeps({ merge: 'clean', drift: true, commit: 1 });
+  const r = await cr.resolveBranchConflicts({ branch: 'claude/wt-cr5' }, deps);
+  assert.equal(r.resolved, false);
+  assert.equal(r.skipped, 'commit_failed');
+  assert.ok(!ran(deps._exec, 'push'), 'no push without the regeneration commit');
+});
+
+// THE INVARIANT THAT WOULD HAVE CAUGHT #536 ON DAY ONE. Two hand-maintained lists
+// name the same artifacts: REGENERABLE (what the merge driver claims to heal) and
+// GENERATOR_SCRIPTS (what the server actually re-runs). copy-inventory.js was added
+// to the first and not the second, so the copy registry was "covered" by the driver
+// and regenerated by nobody. Pin them as one set, via each artifact's PRODUCER.
+test('1003546 every REGENERABLE artifact has a producer, and every producer is in GENERATOR_SCRIPTS', async () => {
+  const regen = require('../scripts/gds/git-merge-regen.js');
+  const G = require('../scripts/gds/gen-repo-map.js');
+  const CI = require('../scripts/gds/copy-inventory.js');
+
+  // Derived from each generator's own exports where it publishes them, so this map
+  // cannot silently drift from the generator it names.
+  const PRODUCED_BY = new Map([
+    ['docs/repo-map.md', 'scripts/gds/gen-repo-map.js'],
+    ['docs/file-map.md', 'scripts/gds/gen-file-map.js'],
+    ['docs/session-log-index.md', 'scripts/gds/gen-session-index.js'],
+    [CI.REGISTRY_REL, 'scripts/gds/copy-inventory.js'],
+    [CI.REPORT_REL, 'scripts/gds/copy-inventory.js'],
+    ...G.NESTED_DIRS.map((d) => [`${d}/CLAUDE.md`, 'scripts/gds/gen-repo-map.js']),
+  ]);
+
+  for (const p of regen.REGENERABLE) {
+    const producer = PRODUCED_BY.get(p);
+    assert.ok(producer, `REGENERABLE knows ${p} but this test has no producer for it — name the generator that writes it`);
+    assert.ok(
+      cr.GENERATOR_SCRIPTS.includes(producer),
+      `${p} is healed by the merge driver but ${producer} is not in GENERATOR_SCRIPTS, so the server never re-runs it on the merged tree (the task 1003544 strand)`
+    );
+  }
+});
+
 // Drain the microtask queue, then report + exit with the right code.
 setTimeout(() => {
-  console.log(`\nconflict-resolve (task 1385 + 1915) tests: ${passed} passed, ${failed} failed`);
+  console.log(`\nconflict-resolve (task 1385 + 1915 + 1003546) tests: ${passed} passed, ${failed} failed`);
   process.exit(failed > 0 ? 1 : 0);
 }, 100);

package/tests/currency_label.mjs

@@ -48,10 +48,11 @@ test('R57: clientBranding exposes theme.ui (web), NOT theme.palette (server-only
 });
 
 test('clientBranding exposes project policy — the settings read-back (task 1003140), defaulting to today\'s behavior', () => {
-  assert.deepEqual(clientBranding({}).project, { platformVisibility: 'public', joinability: 'apply' });
+  // `visibility` — the join door — joined the block in task 1002324 (ADR 0182 D1)
+  assert.deepEqual(clientBranding({}).project, { platformVisibility: 'public', joinability: 'apply', visibility: 'public' });
   assert.deepEqual(
-    clientBranding({ project: { platformVisibility: 'gated', joinability: 'invite_only' } }).project,
-    { platformVisibility: 'gated', joinability: 'invite_only' },
+    clientBranding({ project: { platformVisibility: 'gated', joinability: 'invite_only', visibility: 'stealth' } }).project,
+    { platformVisibility: 'gated', joinability: 'invite_only', visibility: 'stealth' },
     'what the instance actually resolved (env override included) is what it publishes');
 });
 
@@ -70,7 +71,7 @@ test('clientBranding is a SMALL allow-list — no server-only field leaks to the
   // `project` joined the allow-list in task 1003140: the per-project policy is public
   // by nature and is the settings read-back a manage page needs (see clientBranding).
   assert.deepEqual(Object.keys(projected).sort(), ['copy', 'currency', 'identity', 'project', 'rankLabels', 'reward', 'theme']);
-  assert.deepEqual(Object.keys(projected.project).sort(), ['joinability', 'platformVisibility']);
+  assert.deepEqual(Object.keys(projected.project).sort(), ['joinability', 'platformVisibility', 'visibility']);
   for (const leak of ['domains', 'repo', 'db', 'envPrefix', 'llmProjectName']) {
     assert.equal(projected[leak], undefined, `${leak} must not reach the client`);
   }

package/tests/git_merge_regen.mjs

@@ -22,6 +22,12 @@
 //   9. END-TO-END for docs/copy-registry.json: two branches that each regenerate
 //      it differently merge without conflict markers via the real .gitattributes +
 //      git-config wiring, and the result equals a fresh regeneration.
+//  10. REGRESSION (task 1003546) — the driver runs MID-merge, so a tree-scanning
+//      artifact heals to the PRE-merge tree: two branches shifting line numbers in
+//      the same scanned UI file merge CLEAN and leave the registry STALE. Pins why
+//      the merge's OWNER must regenerate afterwards (conflict-resolve.js step 7b).
+//      Needs a real clone (the driver's __dirname must BE the merging tree), so it
+//      skips where the environment cannot host that.
 //
 // Run:  node tests/git_merge_regen.mjs
 
@@ -135,7 +141,15 @@ function withBlockBody(src, body) {
   try {
     g('init', '-q');
     g('config', 'user.email', 't@t'); g('config', 'user.name', 't');
-    g('config', 'merge.otb-regen.driver', `node ${driver} %O %A %B %P`);
+    // The fixture repo carries none of the repo's eol rules, so on a Windows box
+    // with the usual global core.autocrlf=true git would check the merge result out
+    // as CRLF while the generators render LF — a byte comparison below would fail on
+    // line endings alone. Pin it so the fixture is platform-neutral (task 1003546).
+    g('config', 'core.autocrlf', 'false');
+    // Forward slashes: `git config` strips backslashes from the value, so a win32
+    // path.join() driver path reaches node with its separators gone and the driver
+    // never loads — this fixture was silently dead on Windows (task 1003546).
+    g('config', 'merge.otb-regen.driver', `node ${driver.replace(/\\/g, '/')} %O %A %B %P`);
     fs.writeFileSync(path.join(tmp, '.gitattributes'), 'docs/repo-map.md merge=otb-regen\n');
     fs.mkdirSync(path.join(tmp, 'docs'));
     writeMap('base\n'); g('add', '-A'); g('commit', '-qm', 'base');
@@ -213,7 +227,15 @@ function withBlockBody(src, body) {
   try {
     g('init', '-q');
     g('config', 'user.email', 't@t'); g('config', 'user.name', 't');
-    g('config', 'merge.otb-regen.driver', `node ${driver} %O %A %B %P`);
+    // The fixture repo carries none of the repo's eol rules, so on a Windows box
+    // with the usual global core.autocrlf=true git would check the merge result out
+    // as CRLF while the generators render LF — a byte comparison below would fail on
+    // line endings alone. Pin it so the fixture is platform-neutral (task 1003546).
+    g('config', 'core.autocrlf', 'false');
+    // Forward slashes: `git config` strips backslashes from the value, so a win32
+    // path.join() driver path reaches node with its separators gone and the driver
+    // never loads — this fixture was silently dead on Windows (task 1003546).
+    g('config', 'merge.otb-regen.driver', `node ${driver.replace(/\\/g, '/')} %O %A %B %P`);
     fs.writeFileSync(path.join(tmp, '.gitattributes'), 'docs/copy-registry.json merge=otb-regen\n');
     fs.mkdirSync(path.join(tmp, 'docs'));
     writeReg('{"schema":0}\n'); g('add', '-A'); g('commit', '-qm', 'base');
@@ -235,4 +257,108 @@ function withBlockBody(src, body) {
   }
 }
 
+// ── 10) REGRESSION (task 1003546): the driver runs MID-merge, so a tree-scanning ──
+// artifact heals to the PRE-merge tree and the merge lands clean but STALE.
+//
+// Cases 8 + 9 prove the copy-registry rule regenerates and that a real merge comes
+// out marker-free — but their fixture repos contain no scanned SOURCE, so the scan
+// returns the same bytes whichever tree it reads and they are blind to WHEN it runs.
+// This case supplies the missing half: two branches that each shift line numbers in
+// the SAME scanned UI file, in a real clone where the driver's own `__dirname` is
+// the merging tree. The merge exits 0 with no unmerged paths and no markers — and
+// keeps OUR registry verbatim, silently discarding the other side's line numbers.
+// Measured before the fix: `"line": 464` where the merged tree says 466; that is the
+// PR #536 / task 1003544 strand, and the reason conflict-resolve.js regenerates
+// AFTER the merge (step 7b) instead of trusting the driver.
+//
+// It SKIPS rather than fails where the environment cannot host the fixture (no local
+// clone, the scanned file moved, or a base whose registry is already stale) — a
+// characterization test must never red for a reason it cannot attribute.
+{
+  const SCANNED = 'modules/hall-ui/public/task-detail.js';
+  const REGEN_PATHS = ['docs/copy-registry.json', 'docs/copy-inventory.md'];
+  // Short clone path: a deep temp dir blows Windows' MAX_PATH on the clone's
+  // .git/objects/info/commit-graphs entries.
+  const root = fs.mkdtempSync(path.join(os.tmpdir(), 'otb-regen-e2e-'));
+  const work = path.join(root, 'w');
+  const g = (...a) => spawnSync('git', a, { cwd: work, encoding: 'utf8' });
+  const gen = (...a) => spawnSync('node', [path.join(work, 'scripts/gds/copy-inventory.js'), ...a],
+    { cwd: work, encoding: 'utf8' });
+  // "Does regeneration change tracked CONTENT?" — `git diff` applies .gitattributes
+  // (`*.json text eol=lf`), so it ignores the worktree line endings that make a raw
+  // byte comparison stale on a Windows checkout.
+  const regenDirty = () => { gen(); return g('diff', '--quiet', '--', ...REGEN_PATHS).status !== 0; };
+  const scannedFile = () => path.join(work, SCANNED);
+
+  let skip = null;
+  try {
+    if (spawnSync('git', ['clone', '--local', '-q', repo, work], { encoding: 'utf8' }).status !== 0) {
+      skip = 'the repo could not be locally cloned';
+    }
+    if (!skip) {
+      g('config', 'user.email', 't@t');
+      g('config', 'user.name', 't');
+      g('config', 'core.autocrlf', 'false');
+      g('config', 'merge.otb-regen.name', 'regen');
+      g('config', 'merge.otb-regen.driver',
+        `node ${path.join(work, 'scripts/gds/git-merge-regen.js').replace(/\\/g, '/')} %O %A %B %P`);
+
+      if (!fs.existsSync(scannedFile())) skip = `${SCANNED} is gone — repoint this fixture at another scanned surface`;
+      else if (fs.readFileSync(scannedFile(), 'utf8').split('\n').length < 420) skip = `${SCANNED} is too short for two distant edits`;
+    }
+    if (!skip && regenDirty()) {
+      skip = 'the committed copy registry is already stale at this base — nothing could be attributed to the merge';
+    }
+
+    if (!skip) {
+      g('checkout', '--', ...REGEN_PATHS);
+      const pad = (atLine, tag) => {
+        const lines = fs.readFileSync(scannedFile(), 'utf8').split('\n');
+        lines.splice(atLine, 0, `// pad ${tag}`, `// pad ${tag}`);
+        fs.writeFileSync(scannedFile(), lines.join('\n'));
+      };
+
+      // Base is HEAD itself — never a branch NAME, which does not exist in a CI
+      // detached checkout.
+      const base = g('rev-parse', 'HEAD').stdout.trim();
+      g('checkout', '-q', '-B', 'fixture-ours', base);
+      pad(10, 'OURS');
+      gen();
+      g('add', '-A'); g('commit', '-qm', 'ours: shift copy lines near the top + regen');
+
+      g('checkout', '-q', '-B', 'fixture-theirs', base);
+      pad(400, 'THEIRS');
+      gen();
+      g('add', '-A'); g('commit', '-qm', 'theirs: shift copy lines far below + regen');
+
+      g('checkout', '-q', 'fixture-ours');
+      const m = g('merge', '--no-edit', 'fixture-theirs');
+
+      // 1. The merge lands CLEAN — the driver did clear the textual conflict.
+      assert.equal(m.status, 0, `the driver must resolve the registry conflict; got ${m.status} :: ${m.stdout}${m.stderr}`);
+      assert.equal(g('diff', '--name-only', '--diff-filter=U').stdout.trim(), '', 'no path may be left unmerged');
+      const healed = fs.readFileSync(path.join(work, 'docs', 'copy-registry.json'), 'utf8');
+      assert.ok(!MARKERS.test(healed), 'the merged registry must carry no conflict markers');
+
+      // 2. THE HAZARD: it kept OURS verbatim, because the scan ran before the merge.
+      assert.equal(
+        g('diff', '--quiet', 'HEAD^1', 'HEAD', '--', 'docs/copy-registry.json').status, 0,
+        'expected the merge to keep ours byte-for-byte (the mid-merge scan)'
+      );
+      assert.equal(regenDirty(), true,
+        'expected the merged tree to be STALE — the driver cannot see the merged tree, which is WHY '
+        + 'conflict-resolve.js regenerates after the merge (step 7b). If this assertion now fails, git has '
+        + 'begun running merge drivers against the merged tree: re-read step 7b, it may be simplifiable.');
+
+      // 3. THE CURE step 7b relies on: a post-merge regeneration is sufficient.
+      g('add', '-A'); g('commit', '-qm', 'regenerate from the merged tree');
+      assert.equal(regenDirty(), false, 'a post-merge regeneration must leave the registry fresh');
+    } else {
+      console.log(`git_merge_regen: case 10 SKIPPED — ${skip}`);
+    }
+  } finally {
+    try { fs.rmSync(root, { recursive: true, force: true }); } catch (_) { /* best effort */ }
+  }
+}
+
 console.log('git_merge_regen: all assertions passed');