@bongos/core 1.21.60 → 1.21.62

package/modules/hall-ui/public/project-settings.css

@@ -214,3 +214,8 @@
    the 24px floor: the prose-link recipe buys the height with padding and hands it back
    with an equal negative margin, so the line does not re-space. */
 .dp-settled .ov-row__sub a { display: inline-block; min-height: 24px; padding: 3px 0; margin: -3px 0; }
+
+/* The danger zone (task 1004570) — two links out to the hosting platform, each with
+   one sentence saying what it does. Plain list, the lede's measure. */
+.ps-danger__list { margin: 10px 0 0; padding-left: 18px; line-height: 1.6; max-width: var(--measure); }
+.ps-danger__list li + li { margin-top: 8px; }

package/modules/hall-ui/public/project-settings.html

@@ -49,6 +49,18 @@
                thing this page exists to end. -->
           <div id="ps-rows"><span class="kit-skel"></span></div>
         </section>
+        <!-- Danger zone (task 1004570): where this project's OWNER takes it offline or
+             disconnects it. Both controls live on the platform that hosts the project,
+             so this only links there. Hidden unless GET /project/manage-link answers
+             with a link — an Archon on a hosted project; never on a self-hosted one. -->
+        <section class="scroll" id="ps-danger" aria-labelledby="ps-danger-h" hidden>
+          <h2 class="scroll__h" id="ps-danger-h">Danger zone</h2>
+          <p class="scroll__lede"><span id="ps-danger-lede"></span> <a id="ps-danger-manage" href="#"></a></p>
+          <ul class="ps-danger__list">
+            <li><a id="ps-danger-offline" href="#">Take it offline</a> — stops the project and its nightly backups but keeps everything: its database, its backups and your repository on GitHub. You can bring it back.</li>
+            <li><a id="ps-danger-disconnect" href="#">Disconnect from Bongos entirely</a> — erases the project’s server, its database and every backup, and releases its name and web address. Your repository on GitHub is kept. This cannot be undone.</li>
+          </ul>
+        </section>
       </main>
 
       <footer class="app-foot" id="app-foot"></footer>

package/modules/hall-ui/public/project-settings.js

@@ -245,5 +245,25 @@
     }
   }
 
+  // The danger zone (task 1004570). The server answers only an Archon — on a hosted
+  // project, its owner — and answers { link: null } where there is no hosting platform
+  // to link to, so every other outcome (refused, failed, self-hosted) leaves the section
+  // hidden: a missing link, never a dead one. The act itself stays on the platform.
+  async function loadDanger() {
+    let link = null;
+    try {
+      const res = await api.request('GET', `${API}/project/manage-link`);
+      link = res.ok && res.data ? res.data.link : null;
+    } catch (_) { link = null; }
+    if (!link || !link.offline_url || !link.disconnect_url) return;
+    $('ps-danger-lede').textContent = `This project is hosted on ${link.hub_host}, and that is where it is taken offline or removed. Both links below open this project’s page there.`;
+    $('ps-danger-manage').textContent = `Manage this project on ${link.hub_host}`;
+    $('ps-danger-manage').href = link.manage_url;
+    $('ps-danger-offline').href = link.offline_url;
+    $('ps-danger-disconnect').href = link.disconnect_url;
+    $('ps-danger').hidden = false;
+  }
+
   load();
+  loadDanger();
 })();

package/modules/hall-ui/records/project-danger-zone.md

@@ -0,0 +1,10 @@
+# The danger zone on /project-settings — a hosted project's owner reaches Take-offline and Delete (task 1004570)
+
+The owner of a hosted project could not find how to delete it: both controls live on the hub's Projects page, and nothing in the project's own hall pointed there. What this settled:
+
+- **Link-out only.** The section links to the hub's page for this project, scrolled to the `#mDelete` / `#mDisconnect` cards. The typed-name confirm and the intent queue stay on the hub (ADR 0290); the hall gains no second delete path.
+- **The server decides who sees it.** `GET /project/manage-link` is Archon-only (on a hosted project the owner is its Archon), and answers `{ link: null }` when the instance has no hub to link to — a self-hosted instance, or the hub itself. The section is `hidden` in the markup and shown only for a real link, so every other outcome is a missing section, never a dead link.
+- **The link names the project by slug.** The hall knows its hub origin and client id (which is its slug, ADR 0246) from its sign-in configuration, never a hardcoded domain. The hub's Projects page resolves `?view=manage&project=<slug>` against the visitor's OWN projects; a slug that is not theirs opens their list, not someone else's project. The slug survives a sign-in detour.
+- **The two sentences track the hub's folds.** `tests/project_manage_link.mjs` holds the hall's claims (repository kept, cannot be undone, can bring it back) against the hub's own fold copy.
+
+Tests: `tests/project_manage_link.mjs` (C1 owner link, C2 non-owner refused by the real gate, C3 self-hosted answers none). Harness fixture: `project__manage-link.json`.

package/modules/lifecycle/merge-lock.js

@@ -10,7 +10,7 @@
 // ship-vs-merge-mode, and merge-mode-vs-merge-mode are all serialized.
 // (V3.R50 / #269, criterion C6.)
 //
-// The lock is a plain file at <repoRoot>/.git/otb-automerge.lock. We don't use
+// The lock is a plain file at <common git dir>/otb-automerge.lock (see lockPath). We don't use
 // flock(2): ships and merge runs happen on macOS, where flock over an
 // iCloud-synced filesystem is unreliable, and the holder may be a short-lived
 // CLI process (the manual /merge-mode case has no long-lived owner). The file
@@ -43,14 +43,54 @@
 
 const fs = require('node:fs');
 const path = require('node:path');
-const { execSync } = require('node:child_process');
+const { execSync, execFileSync } = require('node:child_process');
 
 const AUTO_STALE_MS = 10 * 60 * 1000; // crashed automated ship
 const MANUAL_STALE_MS = 30 * 60 * 1000; // operator walked away mid-merge-mode
 const INDEX_LOCK_GRACE_MS = 60 * 1000; // a git index.lock younger than this may be a LIVE op
 
+// lockPath — the lockfile lives in the repo's COMMON git dir (task 1004584).
+// When `main` is checked out in a LINKED worktree, <root>/.git is a FILE (a
+// `gitdir:` pointer), so the old <root>/.git/otb-automerge.lock was an ENOENT
+// on every acquire. The common dir is the same folder from every worktree, so
+// a ship from any of them and the merge-lock CLI all contend for ONE file.
+// A primary checkout (.git is a directory) short-circuits without spawning git;
+// when git cannot answer, the historical path is kept.
 function lockPath(repoRoot) {
-  return path.join(repoRoot, '.git', 'otb-automerge.lock');
+  return path.join(commonGitDir(repoRoot), 'otb-automerge.lock');
+}
+
+function isDir(p) {
+  try { return fs.statSync(p).isDirectory(); } catch (_) { return false; }
+}
+
+// Ask git for a path inside the repo's git dirs, absolute. `args` is the
+// rev-parse tail (['--git-common-dir'] or ['--git-path', 'index.lock']). Null
+// when the root is not a repo or git is unavailable.
+function gitRevParsePath(repoRoot, args) {
+  try {
+    const out = execFileSync('git', ['rev-parse', ...args], {
+      cwd: repoRoot, encoding: 'utf8', stdio: ['ignore', 'pipe', 'ignore'],
+    }).trim();
+    if (!out) return null;
+    return path.isAbsolute(out) ? out : path.resolve(repoRoot, out);
+  } catch (_) {
+    return null;
+  }
+}
+
+function commonGitDir(repoRoot) {
+  const dotGit = path.join(repoRoot, '.git');
+  if (isDir(dotGit)) return dotGit;
+  return gitRevParsePath(repoRoot, ['--git-common-dir']) || dotGit;
+}
+
+// The worktree's OWN index.lock — per-worktree, so a linked main keeps it in
+// .git/worktrees/<name>/, not under the common dir.
+function indexLockPath(repoRoot) {
+  const dotGit = path.join(repoRoot, '.git');
+  if (isDir(dotGit)) return path.join(dotGit, 'index.lock');
+  return gitRevParsePath(repoRoot, ['--git-path', 'index.lock']) || path.join(dotGit, 'index.lock');
 }
 
 // Synchronous sleep without spawning a process (ship.js is execSync-style and
@@ -76,9 +116,11 @@ function pidAlive(pid) {
 }
 
 // Parse the lockfile into { pid, ts, mode } or null if absent/unreadable.
-function readLock(repoRoot) {
+// `file` lets a caller that already resolved lockPath skip re-resolving it (for
+// a linked worktree that is a git spawn per call).
+function readLock(repoRoot, file = lockPath(repoRoot)) {
   try {
-    const [p, t, m] = fs.readFileSync(lockPath(repoRoot), 'utf8').split('\n');
+    const [p, t, m] = fs.readFileSync(file, 'utf8').split('\n');
     const pid = parseInt(p, 10);
     const ts = parseInt(t, 10) || 0;
     const mode = m && m.trim() === 'manual' ? 'manual' : 'auto';
@@ -118,7 +160,7 @@ function recoverWorktree(repoRoot, { now = Date.now, runner = execSync } = {}) {
   //    live git process could still own it. A fresh lock means a live op
   //    (possibly a holder that just acquired after us); never yank that.
   try {
-    const lk = path.join(repoRoot, '.git', 'index.lock');
+    const lk = indexLockPath(repoRoot);
     const st = fs.statSync(lk); // throws ENOENT when absent → nothing to clear
     if (now() - st.mtimeMs > INDEX_LOCK_GRACE_MS) fs.unlinkSync(lk);
   } catch (_) {
@@ -176,7 +218,7 @@ function acquire(repoRoot, opts = {}) {
       return true;
     } catch (e) {
       if (e.code !== 'EEXIST') throw e;
-      const rec = readLock(repoRoot);
+      const rec = readLock(repoRoot, p); // p resolved once, before the loop
       if (isStale(rec, now())) {
         let reclaimed = false;
         try {
@@ -206,10 +248,11 @@ function acquire(repoRoot, opts = {}) {
 function release(repoRoot, opts = {}) {
   const { pid = process.pid, force = false } = opts;
   try {
-    const rec = readLock(repoRoot);
+    const file = lockPath(repoRoot);
+    const rec = readLock(repoRoot, file);
     if (!rec) return;
     if (force || rec.mode === 'manual' || rec.pid === pid) {
-      fs.unlinkSync(lockPath(repoRoot));
+      fs.unlinkSync(file);
     }
   } catch (_) {
     /* already gone */
@@ -251,6 +294,7 @@ module.exports = {
   MANUAL_STALE_MS,
   INDEX_LOCK_GRACE_MS,
   lockPath,
+  indexLockPath,
   pidAlive,
   readLock,
   isStale,

package/modules/lifecycle/ship-preflight.js

@@ -245,6 +245,31 @@ function cleanupMacFinderDupRefs(cwd) {
   return deleted;
 }
 
+// worktreeBlocks — `git worktree list --porcelain` as [{ dir, branch, bare }], in
+// git's order (the primary checkout first). Null when git can't answer. The one
+// parser behind findMainWorktree and findPrimaryWorktree.
+function worktreeBlocks(cwd) {
+  try {
+    const out = execSync('git worktree list --porcelain', {
+      cwd,
+      encoding: 'utf8',
+      stdio: ['ignore', 'pipe', 'pipe'],
+    });
+    return out.split('\n\n').filter(Boolean).map((block) => {
+      const wt = { dir: null, branch: null, bare: false };
+      for (const raw of block.split('\n')) {
+        const line = raw.trim();
+        if (line.startsWith('worktree ')) wt.dir = line.slice('worktree '.length);
+        else if (line.startsWith('branch refs/heads/')) wt.branch = line.slice('branch refs/heads/'.length);
+        else if (line === 'bare') wt.bare = true;
+      }
+      return wt;
+    });
+  } catch (_) {
+    return null; // not a git repo, or git not available — caller falls back
+  }
+}
+
 function findMainWorktree(cwd) {
   // The auto-merge in ship.js runs git on the worktree that has `main`
   // checked out. Feature work happens in linked worktrees under
@@ -260,28 +285,20 @@ function findMainWorktree(cwd) {
   //   branch refs/heads/claude/feature
   //
   // Returns the worktree path whose branch is `main`, or null if none.
-  try {
-    const out = execSync('git worktree list --porcelain', {
-      cwd,
-      encoding: 'utf8',
-      stdio: ['ignore', 'pipe', 'pipe'],
-    });
-    const blocks = out.split('\n\n').filter(Boolean);
-    for (const block of blocks) {
-      let dir = null;
-      let branch = null;
-      for (const line of block.split('\n')) {
-        if (line.startsWith('worktree ')) dir = line.slice('worktree '.length);
-        else if (line.startsWith('branch refs/heads/')) {
-          branch = line.slice('branch refs/heads/'.length);
-        }
-      }
-      if (branch === 'main' && dir) return dir;
-    }
-  } catch (_) {
-    // Not a git repo or git not available — caller will fall back.
-  }
-  return null;
+  const main = (worktreeBlocks(cwd) || []).find((wt) => wt.branch === 'main' && wt.dir);
+  return main ? main.dir : null;
+}
+
+// findPrimaryWorktree — the repo's primary checkout (the first block of
+// `git worktree list --porcelain`), whatever branch it is on. The fallback merge
+// target when NO worktree has `main` checked out (task 1004584): it is still the
+// instance's own checkout, so ship can say "this is on X, not main" instead of
+// falling back to the core package folder — which in a vendored instance is
+// node_modules/@bongos/core, not a repo at all. Null for a bare primary or when
+// git can't answer.
+function findPrimaryWorktree(cwd) {
+  const first = (worktreeBlocks(cwd) || [])[0];
+  return first && !first.bare && first.dir ? first.dir : null;
 }
 
 // task 932: post-ship working-tree CLOSE-OUT plan (pure). The mirror image of
@@ -308,5 +325,6 @@ module.exports = {
   cleanupMacFinderDupRefs,
   gitDirFor,
   findMainWorktree,
+  findPrimaryWorktree,
   closeoutPlan,
 };

package/modules/public-landing/public/projects.html

@@ -2477,6 +2477,13 @@ summary{min-height:24px;padding:3px 0;}
      the ?view=manage&id=N deep link, read by loadManage() */
   var manageId = null;
   var manageInst = null;
+  /* a project's own hall links here by SLUG (task 1004570): it knows its slug, not
+     this page's instance id. Held until the visitor's own projects load, then
+     resolved against THOSE only — a slug that is not yours opens nothing. The
+     section (#mDelete / #mDisconnect) is held too, because setView rewrites the
+     URL and drops the hash before the manage view has painted. */
+  var handedProject = null;
+  var handedSection = null;
 
   function viewFromUrl() {
     var v;
@@ -2486,6 +2493,8 @@ summary{min-height:24px;padding:3px 0;}
       var id = null;
       try { id = new URLSearchParams(location.search).get('id'); } catch (e) {}
       if (id) { manageId = String(id); return 'manage'; }
+      try { handedProject = new URLSearchParams(location.search).get('project') || null; } catch (e) {}
+      if (handedProject && /^#m(Delete|Disconnect)$/.test(location.hash || '')) handedSection = location.hash.slice(1);
       return 'mine';
     }
     return VIEWS[v] ? v : 'map';
@@ -2526,8 +2535,10 @@ summary{min-height:24px;padding:3px 0;}
        sign-in door on the hub's own pages carries the repo scope (task 1004549,
        ADR 0364): it is asked once, at sign-in, and held for the whole session, so
        no flow ever stops halfway to ask for it */
-    $('signinTop').href = '/api/bongos/auth/web/start?return=/projects%3Fview%3D' + v +
-      idPart.replace('&', '%26').replace('=', '%3D') + '&repos=1';
+    /* a hand-off that is still waiting on sign-in keeps its slug through the door */
+    var backPart = handedProject ? encodeURIComponent('?view=manage&project=' + handedProject)
+      : '%3Fview%3D' + v + idPart.replace('&', '%26').replace('=', '%3D');
+    $('signinTop').href = '/api/bongos/auth/web/start?return=/projects' + backPart + '&repos=1';
     /* the mine view is the only one that polls; it re-reads on entry so a
        card that changed while you were on the map is not stale — including
        the membership + invitations lists (task 1003774), the same re-read
@@ -3324,6 +3335,16 @@ summary{min-height:24px;padding:3px 0;}
      opens that project's own manage view — the per-project page the
      manage-wave tasks fill in. It replaced the scroll-anchor-into-the-list
      this function used to do. ── */
+  /* the hall's hand-off (task 1004570): the slug becomes one of YOUR projects or
+     nothing — this page stays on your list rather than guessing */
+  function openHandedProject() {
+    if (!handedProject) return;
+    var slug = handedProject;
+    handedProject = null;
+    var inst = ownedInstances.filter(function (i) { return i && i.slug === slug; })[0];
+    if (inst) goToManage(inst.id);
+    else handedSection = null;
+  }
   function goToManage(instId) {
     manageId = String(instId || '');
     manageInst = null;
@@ -8609,6 +8630,12 @@ summary{min-height:24px;padding:3px 0;}
         var inst = data.instance || {};
         inst.open_intent = data.open_intent || null;
         renderManage(inst);
+        /* the hall's hand-off named a card — land on it once the page has its content */
+        if (handedSection) {
+          var target = $(handedSection);
+          handedSection = null;
+          if (target && target.scrollIntoView) target.scrollIntoView({ block: 'start' });
+        }
         /* the SECOND, GitHub-backed read — fired only here (entry + tab
            return), never from renderManage, which the fetch-free tick calls */
         if (!keepRepo) loadRepoVisibility(inst);
@@ -10841,7 +10868,7 @@ summary{min-height:24px;padding:3px 0;}
       $('gate').hidden = true;
       $('mine').hidden = false;
       load();
-      return Promise.all([loadMemberships(), loadOwnedInstances(), loadInvites()]);
+      return Promise.all([loadMemberships(), loadOwnedInstances(), loadInvites()]).then(openHandedProject);
     })
     .catch(function (err) {
       me = null;

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.21.60",
+  "version": "1.21.62",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.21.60",
+      "version": "1.21.62",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.21.60",
+  "version": "1.21.62",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/release-notes.json

@@ -9132,5 +9132,21 @@
       "id": "1004553",
       "text": "Builders can now save their filter settings on the Goals and Tasks pages as named views, pick one to open the page with, and find them again on any device. Each builder's views are private to them."
     }
+  ],
+  "1.21.61": [
+    {
+      "id": "1004570",
+      "text": "A project owner now sees a Danger zone in their project's settings, with links straight to the place where they can take the project offline or delete it. Nobody else sees it, and self-hosted projects don't show it."
+    }
+  ],
+  "1.21.62": [
+    {
+      "id": "1003461",
+      "text": "Decided how planning works in the hall: simple forms for creating tasks, goals and criteria, while version planning stays a guided Claude session. A goal made in the hall now comes with its own 'spec this goal' task that the r"
+    },
+    {
+      "id": "1004584",
+      "text": "Shipping finished tasks now works for projects that install Bongos as a package, so their work lands instead of getting stuck halfway."
+    }
   ]
 }

package/scripts/gds/ship-grade.js

@@ -9,6 +9,7 @@
 'use strict';
 
 const crypto = require('node:crypto');
+const path = require('node:path');
 const { spawn } = require('node:child_process');
 const { cliClient } = require('./cli-lib');
 const grader = require('../../modules/grading/grader');
@@ -22,7 +23,10 @@ const grader = require('../../modules/grading/grader');
 const { hasCopyOrVisualWork } = require('../../modules/lifecycle/cascade.js');
 const { resolveBuilderModel } = require('./ship-memory-sync.js');
 const { argvOut, gitArgvOk, gitOk, shellOk } = require('./ship-git.js');
-const { GRADER_DIFF_CHAR_CAP, GRADER_TIMEOUT_MS, REPO_ROOT, noteServerReward } = require('./ship-state.js');
+const { GRADER_DIFF_CHAR_CAP, GRADER_TIMEOUT_MS, CORE_ROOT, REPO_ROOT, noteServerReward } = require('./ship-state.js');
+
+// The core's smoke suite, by absolute path from the package dir (task 1004584).
+const SMOKE_SCRIPT = path.join(CORE_ROOT, 'scripts', 'gds', 'smoke-gds.js');
 
 // ---------- Step 1+2: local verification ----------
 
@@ -380,10 +384,13 @@ async function runNoArtifactGrader({ task, valueSummary, notes, runOpts: extraOp
 }
 
 function runSmoke() {
-  // `cwd: REPO_ROOT` + a relative script path is robust to spaces or other
-  // shell metacharacters that may appear in the absolute repo path on some
-  // machines.
-  const okPms = shellOk(`"${process.execPath}" scripts/gds/smoke-gds.js`, { cwd: REPO_ROOT });
+  // The script is addressed from CORE_ROOT, never cwd-relative: in a vendored
+  // instance it lives under node_modules/@bongos/core, not under the instance
+  // checkout, and the relative form died MODULE_NOT_FOUND after a clean merge —
+  // which then reset main and stranded the task at confirmed (task 1004584).
+  // cwd stays the instance checkout so instance config resolves as before; the
+  // JSON.stringify quoting survives spaces in either path.
+  const okPms = shellOk(`"${process.execPath}" ${JSON.stringify(SMOKE_SCRIPT)}`, { cwd: REPO_ROOT });
   return { ran: true, clean: okPms };
 }
 
@@ -394,7 +401,7 @@ function runSmoke() {
 // post-merge smoke call keeps the sync form (nothing overlaps there).
 function runSmokeAsync() {
   return new Promise((resolve) => {
-    const child = spawn(process.execPath, ['scripts/gds/smoke-gds.js'], {
+    const child = spawn(process.execPath, [SMOKE_SCRIPT], {
       cwd: REPO_ROOT, stdio: 'inherit', windowsHide: true,
     });
     child.on('error', () => resolve({ ran: true, clean: false }));

package/scripts/gds/ship-merge-gate.js

@@ -168,7 +168,32 @@ function removeProbe(repoRoot, dir) {
 // tip as it stood BEFORE the branch was merged in (in ship-merge.js that is
 // origin/main, since the ff-only step immediately above it guarantees the two
 // are the same commit).
+// gateApplies — does this repo carry the fitness gate at all? A VENDORED
+// instance (core under node_modules/@bongos/core) has no scripts/gds/fitness.js
+// of its own — fitness is the core's architecture gate, and the core ran it in
+// its own CI before it was published. Without this the gate read the missing
+// file as 'unmeasurable' on BOTH sides and blocked every vendored land
+// (task 1004584). It only stands down when the pre-merge base lacks the file
+// too, so a branch that DELETES fitness.js from the core is still measured
+// (and blocked as unmeasurable) rather than waved through.
+function gateApplies(repoRoot, baseSha) {
+  if (fs.existsSync(path.join(repoRoot, 'scripts', 'gds', 'fitness.js'))) return true;
+  if (!baseSha) return true;
+  try {
+    execFileSync('git', ['cat-file', '-e', `${baseSha}:scripts/gds/fitness.js`], {
+      cwd: repoRoot, stdio: 'ignore', shell: false,
+    });
+    return true; // the base had it — this merge removed it; measure (and block)
+  } catch (_) {
+    return false; // neither side carries the gate — nothing to run
+  }
+}
+
 function gateMergeResult({ repoRoot, baseSha, log = console.log }) {
+  if (!gateApplies(repoRoot, baseSha)) {
+    log('  fitness: this repo carries no scripts/gds/fitness.js (a vendored instance) — gate not applicable');
+    return { block: false, reason: 'not-applicable' };
+  }
   log('  fitness against post-merge state...');
   const mergeClean = runFitnessAt(repoRoot);
   const baseClean = mergeClean ? true : probeBaseClean(repoRoot, baseSha);
@@ -179,6 +204,7 @@ function gateMergeResult({ repoRoot, baseSha, log = console.log }) {
 
 module.exports = {
   fitnessOutcome,
+  gateApplies,
   gateMergeResult,
   gateMessage,
   mergeGateVerdict,

package/scripts/gds/ship-merge.js

@@ -31,7 +31,7 @@ const { runSmoke } = require('./ship-grade.js');
 const { gateMergeResult } = require('./ship-merge-gate.js');
 const { dbOnlyIgnoredNotice } = require('./ship-honesty.js');
 const { currentBranch, mainWorktreeBusy, regenerateApiClient, regenerateApiDocs, regenerateCopyInventory, regenerateDiagrams, regenerateFileMap, regenerateRepoMap, regenerateSessionIndex } = require('./ship-regen.js');
-const { REPO_ROOT } = require('./ship-state.js');
+const { MAIN_CHECKED_OUT, REPO_ROOT } = require('./ship-state.js');
 const { envPrefix } = require('../../src/instance-config');
 
 // zeroCommitVerdict — dbOnly is deliberately consulted ONLY at zero commits
@@ -265,9 +265,14 @@ async function mergeLocally(taskId, valueSummary, { dbOnly = false } = {}) {
       // — the branch lands fine via a PR. Tagged PR-recoverable so autoMerge falls
       // back instead of parking the task at 'confirmed' unpaid. The reason +
       // nextStep are kept for the case where the fallback itself bails.
+      // task 1004584: when NO worktree holds main at all, say exactly that and
+      // how to fix it — REPO_ROOT is then the primary checkout by fallback, and
+      // "work in your own worktree" is advice the builder already followed.
       return landBailed(
-        `the main checkout is on ${onMain}, not main — work a task in its own worktree so the main checkout stays on main`,
-        '/merge-mode',
+        MAIN_CHECKED_OUT
+          ? `the main checkout is on ${onMain}, not main — work a task in its own worktree so the main checkout stays on main`
+          : `no worktree of this repo has main checked out (the main checkout ${REPO_ROOT} is on ${onMain}) — run \`git checkout main\` there, then re-ship`,
+        MAIN_CHECKED_OUT ? '/merge-mode' : `git -C "${REPO_ROOT}" checkout main && node scripts/gds/ship.js ${taskId}`,
         LAND_BAIL_MAIN_CHECKOUT_ON_BRANCH,
       );
     }
@@ -448,6 +453,10 @@ async function mergeLocally(taskId, valueSummary, { dbOnly = false } = {}) {
 
 module.exports = {
   autoMerge,
+  // task 1004584: the local merge leg on its own, so the vendored-instance
+  // regression test can read a bail's reason without the PR fallback (which
+  // needs an authed gh) swallowing it.
+  mergeLocally,
   // task 1004322: the held page tweak's publish-only path.
   publishHeld,
   // task 1002572 (PART 2): the pure recovery command for a ship run from main —

package/scripts/gds/ship-state.js

@@ -18,7 +18,7 @@
 'use strict';
 
 const path = require('node:path');
-const { findMainWorktree } = require('../../modules/lifecycle/ship-preflight');
+const { findMainWorktree, findPrimaryWorktree } = require('../../modules/lifecycle/ship-preflight');
 
 // The instance's reward policy, as reported by the server on GET /me (ADR 0146 /
 // task 1002469). Cached module-level because the credits print + the completion
@@ -43,10 +43,43 @@ function getServerReward() {
 const GRADER_DIFF_CHAR_CAP = 250_000;
 const GRADER_TIMEOUT_MS = 240_000; // 4 min — Opus on a big diff with Read tool calls
 
-// Where auto-merge runs — the worktree that has `main` checked out, not the
-// feature worktree this script lives in. Falls back to two-levels-up if we
-// can't ask git (e.g. fresh clone with no `main` worktree set up yet).
-const REPO_ROOT = findMainWorktree(__dirname) || path.resolve(__dirname, '..', '..');
+// TWO ROOTS, not one (task 1004584). In the core's own repo they are the same
+// folder, which is how a single REPO_ROOT served both jobs for so long. In a
+// VENDORED instance — the core installed as node_modules/@bongos/core — they are
+// not, and conflating them broke every land (mercury, core 1.21.20):
+//   CORE_ROOT     — where the core's own scripts live (the package dir). Every
+//                   core script ship spawns (smoke-gds.js, …) is addressed from
+//                   here, never by a cwd-relative path.
+//   INSTANCE_ROOT — the instance repo's checkout that auto-merge runs in: the
+//                   worktree with `main` checked out (primary OR linked). With no
+//                   `main` anywhere it is the primary checkout, so the merge leg
+//                   bails with "on X, not main" — never the package dir, which is
+//                   not a repo and turned the bail into an ENOENT on the lock.
+// Git is asked from __dirname first (unchanged for the core repo), then from the
+// process cwd (the feature worktree ship is run from) as a backstop.
+const CORE_ROOT = path.resolve(__dirname, '..', '..');
+
+// resolveRoots — the pure resolution, with git injected so the vendored layouts
+// are unit-testable. `mainCheckedOut` is false when no worktree holds `main`;
+// ship-merge names that case in its bail instead of a generic "on X".
+function resolveRoots({
+  dirname = __dirname,
+  cwd = process.cwd(),
+  findMain = findMainWorktree,
+  findPrimary = findPrimaryWorktree,
+} = {}) {
+  const core = path.resolve(dirname, '..', '..');
+  const main = findMain(dirname) || findMain(cwd);
+  if (main) return { coreRoot: core, instanceRoot: main, mainCheckedOut: true };
+  const primary = findPrimary(dirname) || findPrimary(cwd);
+  return { coreRoot: core, instanceRoot: primary || core, mainCheckedOut: false };
+}
+
+const { instanceRoot: INSTANCE_ROOT, mainCheckedOut: MAIN_CHECKED_OUT } = resolveRoots();
+// The historical name every ship phase imports. It always meant "the checkout
+// auto-merge runs in", i.e. the instance root — kept as an alias so the phases
+// that only ever wanted that do not churn.
+const REPO_ROOT = INSTANCE_ROOT;
 
 // Sound playback is COSMETIC — the ship pipeline must NEVER depend on it. Guard
 // the require so a missing/broken player (e.g. .claude/sounds/ absent on a fresh
@@ -68,6 +101,10 @@ module.exports = {
   GRADER_DIFF_CHAR_CAP,
   GRADER_TIMEOUT_MS,
   REPO_ROOT,
+  CORE_ROOT,
+  INSTANCE_ROOT,
+  MAIN_CHECKED_OUT,
+  resolveRoots,
   playSound,
   BEHIND_MAIN_LIMIT,
 };

package/src/bongos/routes/core-update.js

@@ -50,6 +50,23 @@ function hubDeployUrl(config) {
   return `${config.origin.replace(/\/+$/, '')}/deploy?project=${encodeURIComponent(String(config.clientId))}`;
 }
 
+// WHERE THIS PROJECT'S OWNER TAKES IT OFFLINE OR DISCONNECTS IT (task 1004570). Both
+// controls live on the hub's Projects page for this project — the typed-name confirm and
+// the intent queue are there (ADR 0290) — so the hall only links to them and gains no
+// second delete path. Same two inputs as hubDeployUrl (the hub origin and this project's
+// client id, which is its slug); null on a self-hosted instance or the hub itself, so the
+// hall shows no section rather than a dead link. The page resolves ?project=<slug>
+// against the visitor's OWN projects, so the link opens nothing for anyone else.
+function hubManageLinks(config) {
+  if (!config || typeof config.origin !== 'string' || !config.clientId) return null;
+  if (!/^https?:\/\/[^\s"'<>]+$/i.test(config.origin)) return null;
+  const origin = config.origin.replace(/\/+$/, '');
+  const page = `${origin}/projects?view=manage&project=${encodeURIComponent(String(config.clientId))}`;
+  let host = origin;
+  try { host = new URL(origin).host; } catch { /* keep the origin as written */ }
+  return { hub_host: host, manage_url: page, offline_url: `${page}#mDelete`, disconnect_url: `${page}#mDisconnect` };
+}
+
 // WHERE THIS PROJECT'S UPDATE BUTTON GOES (task 1004296). The act itself never happens in
 // Settings: it is the deploy door's two-step confirm and auto-rollback (ADR 0293), and that
 // door is the provisioning module's — so only a hall that runs provisioning has one.
@@ -216,9 +233,25 @@ function buildCoreUpdateRouter({
     }, { errorCode: 'software_update_failed', message: false }),
   );
 
+  // GET /project/manage-link — the hub's page for THIS project, where its owner takes it
+  // offline or disconnects it (task 1004570). On a hosted project the owner is its Archon,
+  // so the read is Archon-only: a builder below that is refused and the hall draws no
+  // section. { link: null } on a self-hosted instance (no hub to link to).
+  // rank: archon — the project's owner; it names where the project can be ended.
+  router.get(
+    '/project/manage-link',
+    auth.requireBuilder,
+    auth.requireRank('archon'),
+    asyncHandler('GET /project/manage-link', async (_req, res) => {
+      const { idp } = doorInputs();
+      res.json({ ok: true, link: hubManageLinks(idp) });
+    }, { errorCode: 'manage_link_failed', message: false }),
+  );
+
   return router;
 }
 
 module.exports = buildCoreUpdateRouter;
+module.exports.hubManageLinks = hubManageLinks;
 module.exports.hubDeployUrl = hubDeployUrl;
 module.exports.coreUpdateDocketMatters = coreUpdateDocketMatters;