@bongos/core 1.21.60 → 1.21.62

package/src/module-api.js

@@ -75,7 +75,7 @@ const { responsibilityFor, ROLE_RESPONSIBILITIES } = require('./role-responsibil
 // MAJOR (see allowBoxScope below): passes the request through untouched.
 function deprecatedNoopMiddleware(_req, _res, next) { next(); }
 
-const CORE_VERSION = '1.21.60'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
+const CORE_VERSION = '1.21.62'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('discord'); log.info('mounted');

package/tests/merge_lock.mjs

@@ -9,6 +9,7 @@
 
 import assert from 'node:assert/strict';
 import { createRequire } from 'node:module';
+import { execSync } from 'node:child_process';
 import fs from 'node:fs';
 import os from 'node:os';
 import path from 'node:path';
@@ -292,6 +293,63 @@ test('recoverWorktree: clean reclaim → no churn (no abort, no reset)', () => {
   }
 });
 
+// ---- linked worktrees (task 1004584) ----
+// When `main` is checked out in a LINKED worktree, <root>/.git is a FILE, so the
+// old <root>/.git/otb-automerge.lock was ENOENT on every acquire. The lock now
+// lives in the common git dir — the same file from every worktree.
+
+function realRepoWithLinkedWorktree() {
+  const dir = fs.mkdtempSync(path.join(os.tmpdir(), 'otb-mergelock-linked-'));
+  const run = (cmd) => execSync(cmd, { cwd: dir, stdio: 'ignore' });
+  run('git init -q -b trunk');
+  run('git config user.email t@t.t');
+  run('git config user.name t');
+  fs.writeFileSync(path.join(dir, 'a.txt'), 'x\n');
+  run('git add a.txt');
+  run('git commit -q -m init');
+  const linked = path.join(dir, 'wt-main');
+  run(`git worktree add -q -b main "${linked}"`);
+  return { dir, linked };
+}
+
+test('lockPath: from a linked worktree, resolves to the COMMON git dir (same file as the primary)', () => {
+  const { dir, linked } = realRepoWithLinkedWorktree();
+  try {
+    assert.ok(fs.statSync(path.join(linked, '.git')).isFile(), 'precondition: .git is a gitdir pointer file');
+    assert.equal(
+      fs.realpathSync.native(path.dirname(lock.lockPath(linked))),
+      fs.realpathSync.native(path.join(dir, '.git')),
+    );
+    assert.equal(path.basename(lock.lockPath(linked)), 'otb-automerge.lock');
+  } finally {
+    cleanup(dir);
+  }
+});
+
+test('acquire/release: work from a linked main worktree, and the primary sees the hold', () => {
+  const { dir, linked } = realRepoWithLinkedWorktree();
+  try {
+    assert.equal(lock.acquire(linked, { waitMs: 0 }), true);
+    assert.equal(lock.readLock(dir).pid, process.pid, 'the primary must see the hold the linked worktree took');
+    assert.equal(lock.acquire(dir, { waitMs: 0, sleep: () => {} }), false, 'a second holder from the primary must be refused');
+    lock.release(linked);
+    assert.equal(lock.readLock(dir), null);
+  } finally {
+    cleanup(dir);
+  }
+});
+
+test('indexLockPath: a linked worktree keeps its index.lock in its OWN git dir', () => {
+  const { dir, linked } = realRepoWithLinkedWorktree();
+  try {
+    const p = lock.indexLockPath(linked);
+    assert.equal(path.basename(p), 'index.lock');
+    assert.match(p.replace(/\\/g, '/'), /\.git\/worktrees\/wt-main\/index\.lock$/);
+  } finally {
+    cleanup(dir);
+  }
+});
+
 // ---- runner ----
 
 let pass = 0;

package/tests/project_manage_link.mjs

@@ -0,0 +1,111 @@
+// tests/project_manage_link.mjs — a hosted project's owner reaches Take-offline and
+// Delete from their own hall (task 1004570). These EXECUTE: the link builder against
+// real inputs, and real HTTP requests through the assembled router with only
+// requireBuilder replaced, so the Archon gate that refuses a non-owner is the real one.
+//
+// Run:  node --test tests/project_manage_link.mjs
+
+import assert from 'node:assert/strict';
+import { test } from 'node:test';
+import fs from 'node:fs';
+import path from 'node:path';
+import { createRequire } from 'node:module';
+import { fileURLToPath } from 'node:url';
+
+process.env.NODE_ENV = 'test';
+const ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
+const require_ = createRequire(import.meta.url);
+const read = (rel) => fs.readFileSync(path.join(ROOT, rel), 'utf8');
+const { hubManageLinks } = require_(path.join(ROOT, 'src/bongos/routes/core-update.js'));
+
+const HUB = { origin: 'https://hub.example.com/', clientId: 'mercury' };
+
+test('the link opens THIS project on the hub, at the two cards', () => {
+  assert.deepEqual(hubManageLinks(HUB), {
+    hub_host: 'hub.example.com',
+    manage_url: 'https://hub.example.com/projects?view=manage&project=mercury',
+    offline_url: 'https://hub.example.com/projects?view=manage&project=mercury#mDelete',
+    disconnect_url: 'https://hub.example.com/projects?view=manage&project=mercury#mDisconnect',
+  });
+});
+
+test('no hub (self-hosted, or the hub itself) means no link, never a wrong one', () => {
+  assert.equal(hubManageLinks(null), null);
+  assert.equal(hubManageLinks({ origin: 'https://hub.example.com' }), null, 'no client id');
+  assert.equal(hubManageLinks({ origin: 'javascript:alert(1)', clientId: 'x' }), null, 'not an http origin');
+  assert.equal(hubManageLinks({ origin: 'https://hub.example.com/"><script>', clientId: 'x' }), null);
+});
+
+// One server per test: requireBuilder is swapped for a stub that seats the rank the
+// request names, and the route module is re-required so it captures the stub.
+async function withServer(idp, fn) {
+  const r2 = createRequire(import.meta.url);
+  const authPath = r2.resolve(path.join(ROOT, 'src/bongos/auth.js'));
+  const routePath = r2.resolve(path.join(ROOT, 'src/bongos/routes/core-update.js'));
+  const realAuth = r2(authPath);
+  const saved = realAuth.requireBuilder;
+  realAuth.requireBuilder = (req, _res, next) => { req.builder = { id: 7, rank: req.get('x-rank') }; next(); };
+  delete r2.cache[routePath];
+  const express = r2('express');
+  const { attachFail } = r2(path.join(ROOT, 'src/bongos/middleware/error-envelope.js'));
+  const app = express();
+  app.use(attachFail);
+  app.use(r2(routePath)({ doorInputs: () => ({ provisioning: false, idp }) }));
+  const server = app.listen(0);
+  await new Promise((res) => server.once('listening', res));
+  const get = (rank) => fetch(`http://127.0.0.1:${server.address().port}/project/manage-link`, { headers: { 'x-rank': rank } });
+  try { await fn(get); } finally {
+    server.close();
+    realAuth.requireBuilder = saved;
+    delete r2.cache[routePath];
+  }
+}
+
+test('C1: the owner (the hosted project\'s Archon) gets the link', async () => {
+  await withServer(HUB, async (get) => {
+    const res = await get('archon');
+    assert.equal(res.status, 200);
+    assert.equal((await res.json()).link.offline_url, 'https://hub.example.com/projects?view=manage&project=mercury#mDelete');
+  });
+});
+
+test('C2: a builder of the same project below Archon is refused by the server', async () => {
+  await withServer(HUB, async (get) => {
+    for (const rank of ['metic', 'thetes', 'xenos']) {
+      const res = await get(rank);
+      assert.equal(res.status, 403, `${rank} is refused`);
+      assert.equal(JSON.stringify(await res.json()).includes('hub.example.com'), false, `${rank} learns nothing`);
+    }
+  });
+});
+
+test('C3: a self-hosted instance answers no link', async () => {
+  await withServer(null, async (get) => {
+    const res = await get('archon');
+    assert.equal(res.status, 200);
+    assert.equal((await res.json()).link, null);
+  });
+});
+
+test('the hall section is hidden in the markup and shown only for a real link', () => {
+  const html = read('modules/hall-ui/public/project-settings.html');
+  assert.match(html, /<section class="scroll" id="ps-danger"[^>]*\bhidden>/);
+  const js = read('modules/hall-ui/public/project-settings.js');
+  assert.match(js, /if \(!link \|\| !link\.offline_url \|\| !link\.disconnect_url\) return;/);
+  assert.match(js, /\/project\/manage-link/);
+});
+
+test('the hub resolves the slug against the visitor\'s OWN projects only', () => {
+  const page = read('modules/public-landing/public/projects.html');
+  assert.match(page, /ownedInstances\.filter\(function \(i\) \{ return i && i\.slug === slug; \}\)\[0\]/);
+  assert.match(page, /\.then\(openHandedProject\)/);
+});
+
+test('the hall\'s two sentences say what the hub\'s own folds promise', () => {
+  const hall = read('modules/hall-ui/public/project-settings.html');
+  const hub = read('modules/public-landing/public/projects.html');
+  for (const claim of ['repository on GitHub', 'cannot be undone', 'bring it back', 'Take it offline', 'Disconnect from Bongos entirely']) {
+    assert.ok(hall.includes(claim), `the hall says "${claim}"`);
+    assert.ok(hub.includes(claim), `the hub says "${claim}" too`);
+  }
+});

package/tests/ship_merge_gate.mjs

@@ -17,6 +17,7 @@
 import assert from 'node:assert/strict';
 import { test } from 'node:test';
 import { createRequire } from 'node:module';
+import { execSync } from 'node:child_process';
 import fs from 'node:fs';
 import os from 'node:os';
 import path from 'node:path';
@@ -170,3 +171,65 @@ test('an unmeasurable base blocks rather than waving the ship through', () => {
   // it could not measure, and null blocks.
   assert.equal(gate.mergeGateVerdict({ mergeClean: false, baseClean: null }).block, true);
 });
+
+// ---- gateApplies (task 1004584) ----
+// A VENDORED instance (core under node_modules/@bongos/core) carries no
+// scripts/gds/fitness.js of its own, so both sides read 'unmeasurable' and every
+// vendored land was blocked. The gate stands down ONLY when the base lacked the
+// file too — a branch that deletes fitness.js from the core is still measured.
+function gitRepo(withFitness) {
+  const dir = fs.mkdtempSync(path.join(os.tmpdir(), 'merge-gate-applies-'));
+  const run = (cmd) => execSync(cmd, { cwd: dir, stdio: 'ignore' });
+  run('git init -q -b main');
+  run('git config user.email t@t.t');
+  run('git config user.name t');
+  fs.writeFileSync(path.join(dir, 'README.md'), 'x\n');
+  if (withFitness) {
+    fs.mkdirSync(path.join(dir, 'scripts', 'gds'), { recursive: true });
+    fs.writeFileSync(path.join(dir, 'scripts', 'gds', 'fitness.js'), 'process.exit(0);\n');
+  }
+  run('git add -A');
+  run('git commit -q -m base');
+  const baseSha = execSync('git rev-parse HEAD', { cwd: dir, encoding: 'utf8' }).trim();
+  return { dir, baseSha };
+}
+
+test('gateApplies: a repo that carries fitness.js is always gated', () => {
+  const { dir, baseSha } = gitRepo(true);
+  try {
+    assert.equal(gate.gateApplies(dir, baseSha), true);
+  } finally {
+    fs.rmSync(dir, { recursive: true, force: true });
+  }
+});
+
+test('gateApplies: a vendored instance (no fitness.js on either side) stands the gate down', () => {
+  const { dir, baseSha } = gitRepo(false);
+  try {
+    assert.equal(gate.gateApplies(dir, baseSha), false);
+    const verdict = gate.gateMergeResult({ repoRoot: dir, baseSha, log: () => {} });
+    assert.deepEqual(verdict, { block: false, reason: 'not-applicable' });
+  } finally {
+    fs.rmSync(dir, { recursive: true, force: true });
+  }
+});
+
+test('gateApplies: a merge that DELETES fitness.js from a gated base is still measured (and blocked)', () => {
+  const { dir, baseSha } = gitRepo(true);
+  try {
+    fs.rmSync(path.join(dir, 'scripts', 'gds', 'fitness.js'));
+    execSync('git commit -q -am "drop the gate"', { cwd: dir, stdio: 'ignore' });
+    assert.equal(gate.gateApplies(dir, baseSha), true, 'the base had the gate, so its removal must not wave the merge through');
+  } finally {
+    fs.rmSync(dir, { recursive: true, force: true });
+  }
+});
+
+test('gateApplies: with no base sha it cannot prove the gate was never there → gated', () => {
+  const { dir } = gitRepo(false);
+  try {
+    assert.equal(gate.gateApplies(dir, null), true);
+  } finally {
+    fs.rmSync(dir, { recursive: true, force: true });
+  }
+});

package/tests/ship_preflight.mjs

@@ -13,7 +13,7 @@ import path from 'node:path';
 
 const require = createRequire(import.meta.url);
 const {
-  parsePorcelain, trackedDirty, classifyEmptyShip, cleanupMacFinderDupRefs, findMainWorktree, closeoutPlan,
+  parsePorcelain, trackedDirty, classifyEmptyShip, cleanupMacFinderDupRefs, findMainWorktree, findPrimaryWorktree, closeoutPlan,
   untrackedPaths, untrackedLeftBehind, untrackedWarningLines,
 } = require('../modules/lifecycle/ship-preflight.js');
 // task 1001436: the preflight step itself + the ship-input resolver it is handed.
@@ -318,6 +318,51 @@ test('findMainWorktree: returns null outside any git repo', () => {
   }
 });
 
+// ---- findPrimaryWorktree (task 1004584) ----
+// The merge target when NO worktree has main: the primary checkout, whatever it
+// is on — so ship can say "check out main there" instead of falling back to the
+// core package dir (a vendored instance's node_modules/@bongos/core).
+
+test('findPrimaryWorktree: from a linked worktree, returns the primary checkout even when it is off main', () => {
+  const tmp = fs.mkdtempSync(path.join(os.tmpdir(), 'otb-primarywt-'));
+  try {
+    execSync('git init -q -b trunk', { cwd: tmp });
+    execSync('git config user.email t@t.t && git config user.name t', { cwd: tmp });
+    fs.writeFileSync(path.join(tmp, 'a.txt'), 'x');
+    execSync('git add a.txt && git commit -q -m init', { cwd: tmp });
+    execSync('git branch feature', { cwd: tmp });
+    const wt = path.join(tmp, 'linked');
+    execSync(`git worktree add -q "${wt}" feature`, { cwd: tmp });
+
+    assert.equal(findMainWorktree(wt), null, 'precondition: no worktree is on main');
+    const found = findPrimaryWorktree(wt);
+    assert.ok(found, 'expected a path');
+    assert.equal(fs.realpathSync.native(found), fs.realpathSync.native(tmp));
+  } finally {
+    fs.rmSync(tmp, { recursive: true, force: true });
+  }
+});
+
+test('findPrimaryWorktree: a BARE primary is not a checkout to merge in → null', () => {
+  const tmp = fs.mkdtempSync(path.join(os.tmpdir(), 'otb-primarywt-bare-'));
+  try {
+    const bare = path.join(tmp, 'repo.git');
+    execSync(`git init -q --bare -b main "${bare}"`, { cwd: tmp });
+    assert.equal(findPrimaryWorktree(bare), null);
+  } finally {
+    fs.rmSync(tmp, { recursive: true, force: true });
+  }
+});
+
+test('findPrimaryWorktree: returns null outside any git repo', () => {
+  const tmp = fs.mkdtempSync(path.join(os.tmpdir(), 'otb-primarywt-nogit-'));
+  try {
+    assert.equal(findPrimaryWorktree(tmp), null);
+  } finally {
+    fs.rmSync(tmp, { recursive: true, force: true });
+  }
+});
+
 // ---- closeoutPlan (task 932) ----
 
 test('closeoutPlan: clean tree → clean:true, no leftover', () => {

package/tests/ship_vendored_instance.mjs

@@ -0,0 +1,259 @@
+// tests/ship_vendored_instance.mjs
+//
+// task 1004584 — `bongos ship` could not land a task in a VENDORED instance (the
+// core installed as node_modules/@bongos/core). Reported from mercury on core
+// 1.21.20, Windows, laptop deploy mode. One REPO_ROOT meant both "the instance
+// repo" (merge target, lock) and "where the core's scripts live" (smoke), and in a
+// vendored instance those are two different folders:
+//
+//   1. no worktree had `main` checked out → REPO_ROOT fell back to the package
+//      dir → the merge lock opened node_modules/@bongos/core/.git/… → ENOENT;
+//   2. `main` checked out in a LINKED worktree → <root>/.git is a FILE → the same
+//      ENOENT on the lock;
+//   3. `main` in the primary checkout → the merge succeeded, then the post-merge
+//      smoke ran `node scripts/gds/smoke-gds.js` cwd-relative to the instance →
+//      MODULE_NOT_FOUND → ship reset main and the task stuck at `confirmed`.
+//
+// This builds the real layout and runs ship's real local merge leg in it: a bare
+// origin, an instance clone whose node_modules/@bongos/core holds a COPY of the
+// core files ship loads, a per-task linked worktree on the task branch, and a
+// child process that requires the vendored copy of ship-merge.js and calls
+// mergeLocally from the feature worktree — the shape `bongos ship` runs in.
+//
+// What is stubbed, and why: smoke-gds.js (the real one probes a live server — the
+// stub only proves it was found at the CORE path and run), and cli-lib's
+// cliClient (the land-proof POST). The deploy mode is pinned to laptop by env so
+// no gh probe runs. Everything else — git, the lock, the fitness gate, the push
+// to origin — is the real code against real repos.
+//
+// Run:  node tests/ship_vendored_instance.mjs
+
+import { strict as assert } from 'node:assert';
+import { createRequire } from 'node:module';
+import { execFileSync, spawnSync } from 'node:child_process';
+import fs from 'node:fs';
+import os from 'node:os';
+import path from 'node:path';
+import { fileURLToPath } from 'node:url';
+
+const require = createRequire(import.meta.url);
+const REPO = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
+const TASK = 4242;
+const BRANCH = `task-${TASK}`;
+
+// The core as an install would carry it: every tracked file under the paths the
+// package ships code from (media skipped — nothing on the merge leg reads it).
+// Read from the working tree, so the test exercises the code being changed.
+// Built ONCE into a template and copied into each fixture.
+const CORE_FILES = execFileSync('git', ['ls-files', '-z', 'src', 'scripts', 'modules', 'config', 'package.json', '.claude/sounds'], {
+  cwd: REPO, encoding: 'utf8',
+}).split('\0').filter((f) => f && !/\.(png|jpe?g|webp|gif|svg|mp3|wav|ogg)$/i.test(f) && fs.existsSync(path.join(REPO, f)));
+const CORE_TEMPLATE = fs.mkdtempSync(path.join(os.tmpdir(), 'bongos-vendored-core-'));
+for (const rel of CORE_FILES) {
+  const dst = path.join(CORE_TEMPLATE, rel);
+  fs.mkdirSync(path.dirname(dst), { recursive: true });
+  fs.copyFileSync(path.join(REPO, rel), dst);
+}
+
+// A git env that ignores the developer's own config (hooks, signing, drivers).
+const emptyCfg = path.join(fs.mkdtempSync(path.join(os.tmpdir(), 'bongos-vendored-cfg-')), 'gitconfig');
+fs.writeFileSync(emptyCfg, '');
+const GIT_ENV = {
+  ...process.env,
+  GIT_CONFIG_NOSYSTEM: '1',
+  GIT_CONFIG_GLOBAL: emptyCfg,
+  GIT_AUTHOR_NAME: 'Vendored Test', GIT_AUTHOR_EMAIL: 'vendored@example.test',
+  GIT_COMMITTER_NAME: 'Vendored Test', GIT_COMMITTER_EMAIL: 'vendored@example.test',
+};
+function git(cwd, ...args) {
+  return execFileSync('git', args, { cwd, env: GIT_ENV, encoding: 'utf8', stdio: ['ignore', 'pipe', 'pipe'] }).trim();
+}
+
+function writeFile(p, body) {
+  fs.mkdirSync(path.dirname(p), { recursive: true });
+  fs.writeFileSync(p, body);
+}
+
+// Build one fixture. `mainAt`: 'primary' | 'linked' | 'none'.
+function buildFixture(mainAt) {
+  const root = fs.mkdtempSync(path.join(os.tmpdir(), `bongos-vendored-${mainAt}-`));
+  const origin = path.join(root, 'origin.git');
+  const inst = path.join(root, 'instance');
+  git(root, 'init', '--bare', '-b', 'main', origin);
+  git(root, 'clone', '-q', origin, inst);
+  git(inst, 'checkout', '-q', '-b', 'main');
+  writeFile(path.join(inst, '.gitignore'), 'node_modules/\n');
+  writeFile(path.join(inst, 'README.md'), '# a vendored instance\n');
+  git(inst, 'add', '.');
+  git(inst, 'commit', '-q', '-m', 'instance: initial');
+  git(inst, 'push', '-q', '-u', 'origin', 'main');
+
+  // The vendored core, where `npm install` would put it.
+  const core = path.join(inst, 'node_modules', '@bongos', 'core');
+  fs.cpSync(CORE_TEMPLATE, core, { recursive: true });
+  // The smoke stub records WHERE it was run from — the bug was it not being found.
+  writeFile(path.join(core, 'scripts', 'gds', 'smoke-gds.js'),
+    "require('fs').writeFileSync(process.env.SMOKE_MARKER, JSON.stringify({ script: __filename, cwd: process.cwd() }));\n");
+
+  // The task's own worktree + branch, carrying one commit.
+  const feature = path.join(root, 'wt-task');
+  git(inst, 'worktree', 'add', '-q', '-b', BRANCH, feature, 'main');
+  writeFile(path.join(feature, 'feature.txt'), 'the work\n');
+  git(feature, 'add', 'feature.txt');
+  git(feature, 'commit', '-q', '-m', 'the task work');
+
+  // Where `main` lives.
+  let mainDir = inst;
+  if (mainAt !== 'primary') {
+    git(inst, 'checkout', '-q', '-b', 'scratch'); // the primary checkout leaves main
+    if (mainAt === 'linked') {
+      mainDir = path.join(root, 'wt-main');
+      git(inst, 'worktree', 'add', '-q', mainDir, 'main');
+    } else {
+      mainDir = null;
+    }
+  }
+  return { root, origin, inst, core, feature, mainDir };
+}
+
+// Run ship's local merge leg from the vendored copy, in the feature worktree.
+function runMergeLeg(fx) {
+  const marker = path.join(fx.root, 'smoke-ran.json');
+  const runner = path.join(fx.root, 'run-merge.js');
+  fs.writeFileSync(runner, `
+    const path = require('path');
+    const core = ${JSON.stringify(fx.core)};
+    const cli = require(path.join(core, 'scripts', 'gds', 'cli-lib.js'));
+    cli.cliClient = async () => ({ tasks: { postTasksIdAttestGate: async () => ({ ok: true, status: 200, data: { tip_recorded: true } }) } });
+    const state = require(path.join(core, 'scripts', 'gds', 'ship-state.js'));
+    const { mergeLocally } = require(path.join(core, 'scripts', 'gds', 'ship-merge.js'));
+    mergeLocally(${TASK}, 'vendored land').then(
+      (o) => { console.log('ROOTS ' + JSON.stringify({ core: state.CORE_ROOT, instance: state.INSTANCE_ROOT, main: state.MAIN_CHECKED_OUT })); console.log('RESULT ' + JSON.stringify(o)); },
+      (e) => { console.log('THREW ' + JSON.stringify({ code: e.code, message: e.message })); process.exitCode = 1; },
+    );
+  `);
+  const env = { ...GIT_ENV, SMOKE_MARKER: marker, BONGOS_DEPLOY_MODE: 'laptop'};
+  for (const k of ['BONGOS_DEPLOY_SSH_TARGET', 'OTB_DEPLOY_SSH_TARGET', 'BONGOS_DEPLOY_HEALTHZ_URL', 'OTB_DEPLOY_HEALTHZ_URL']) delete env[k];
+  const r = spawnSync(process.execPath, [runner], { cwd: fx.feature, env, encoding: 'utf8', timeout: 120000 });
+  const out = `${r.stdout || ''}\n${r.stderr || ''}`;
+  const line = (tag) => {
+    const l = out.split('\n').find((s) => s.startsWith(`${tag} `));
+    return l ? JSON.parse(l.slice(tag.length + 1)) : null;
+  };
+  return { out, result: line('RESULT'), roots: line('ROOTS'), threw: line('THREW'), marker };
+}
+
+// The two failure signatures from the report. (Not a blanket ENOENT match: ship's
+// best-effort doc regenerators also run on this leg and grumble about the core's
+// docs/ folder in a vendored layout — non-fatal by design, and not this bug.)
+const LOCK_ENOENT = /ENOENT[^\n]*otb-automerge\.lock/;
+const SMOKE_MISSING = /Cannot find module[^\n]*smoke-gds/;
+const same = (a, b) => path.resolve(a).toLowerCase() === path.resolve(b).toLowerCase();
+const commonLock = (fx) => path.join(fx.inst, '.git', 'otb-automerge.lock');
+
+let passed = 0;
+let failed = 0;
+const fixtures = [];
+async function t(name, fn) {
+  try { await fn(); passed++; console.log(`  PASS  ${name}`); }
+  catch (e) { failed++; console.log(`  FAIL  ${name}\n        ${e.message}`); }
+}
+
+function assertLanded(fx, run) {
+  assert.equal(run.threw, null, `the merge leg threw: ${JSON.stringify(run.threw)}\n${run.out}`);
+  assert.ok(run.result, `no result line:\n${run.out}`);
+  assert.equal(run.result.ok, true, `expected a land, got ${JSON.stringify(run.result)}\n${run.out}`);
+  assert.ok(!LOCK_ENOENT.test(run.out), `the merge lock hit ENOENT:\n${run.out}`);
+  assert.ok(!SMOKE_MISSING.test(run.out), `smoke-gds.js was not found:\n${run.out}`);
+  // the smoke ran — from the CORE package, with the instance checkout as cwd
+  const smoke = JSON.parse(fs.readFileSync(run.marker, 'utf8'));
+  assert.ok(same(path.dirname(smoke.script), path.join(fx.core, 'scripts', 'gds')), `smoke ran from ${smoke.script}`);
+  assert.ok(same(smoke.cwd, fx.mainDir), `smoke cwd was ${smoke.cwd}, expected the main checkout ${fx.mainDir}`);
+  // the work is on origin/main, and the lock is gone
+  git(fx.inst, 'fetch', '-q', 'origin');
+  const files = git(fx.inst, 'ls-tree', '--name-only', 'origin/main');
+  assert.ok(files.split('\n').includes('feature.txt'), `origin/main lacks the task's file:\n${files}`);
+  assert.ok(!fs.existsSync(commonLock(fx)), 'the merge lock was left behind');
+}
+
+console.log('ship merge leg in a vendored instance (task 1004584)');
+
+// ---- resolveRoots, pure: git answers injected, no repo needed ----
+const { resolveRoots } = require(path.join(REPO, 'scripts', 'gds', 'ship-state.js'));
+const VENDORED_DIR = path.join('/inst', 'node_modules', '@bongos', 'core', 'scripts', 'gds');
+const VENDORED_CORE = path.resolve(VENDORED_DIR, '..', '..'); // drive-qualified on Windows, as resolveRoots returns it
+
+await t('resolveRoots: CORE_ROOT is the package dir, INSTANCE_ROOT the worktree with main', () => {
+  const r = resolveRoots({ dirname: VENDORED_DIR, cwd: '/wt-task', findMain: () => '/wt-main', findPrimary: () => '/inst' });
+  assert.deepEqual(r, { coreRoot: VENDORED_CORE, instanceRoot: '/wt-main', mainCheckedOut: true });
+});
+
+await t('resolveRoots: asks from the script dir first, then the process cwd', () => {
+  const asked = [];
+  const r = resolveRoots({
+    dirname: VENDORED_DIR, cwd: '/wt-task',
+    findMain: (d) => { asked.push(d); return d === '/wt-task' ? '/inst' : null; },
+    findPrimary: () => { throw new Error('primary must not be consulted when main was found'); },
+  });
+  assert.deepEqual(asked, [VENDORED_DIR, '/wt-task']);
+  assert.equal(r.instanceRoot, '/inst');
+});
+
+await t('resolveRoots: no main anywhere → the PRIMARY checkout, flagged, never the package dir', () => {
+  const r = resolveRoots({ dirname: VENDORED_DIR, cwd: '/wt-task', findMain: () => null, findPrimary: () => '/inst' });
+  assert.deepEqual(r, { coreRoot: VENDORED_CORE, instanceRoot: '/inst', mainCheckedOut: false });
+});
+
+await t('resolveRoots: git cannot answer at all → the package dir (the core repo itself, pre-git)', () => {
+  const r = resolveRoots({ dirname: VENDORED_DIR, cwd: '/x', findMain: () => null, findPrimary: () => null });
+  assert.deepEqual(r, { coreRoot: VENDORED_CORE, instanceRoot: VENDORED_CORE, mainCheckedOut: false });
+});
+
+// ---- the real merge leg, in a real vendored layout ----
+
+await t('main in the PRIMARY checkout: lands, smoke found under the core package', () => {
+  const fx = buildFixture('primary'); fixtures.push(fx);
+  const run = runMergeLeg(fx);
+  assert.ok(same(run.roots.core, fx.core), `CORE_ROOT ${run.roots.core}`);
+  assert.ok(same(run.roots.instance, fx.inst), `INSTANCE_ROOT ${run.roots.instance}`);
+  assertLanded(fx, run);
+});
+
+await t('main in a LINKED worktree: lands, lock lives in the common git dir', () => {
+  const fx = buildFixture('linked'); fixtures.push(fx);
+  const run = runMergeLeg(fx);
+  assert.ok(same(run.roots.instance, fx.mainDir), `INSTANCE_ROOT ${run.roots.instance}, expected ${fx.mainDir}`);
+  assert.equal(run.roots.main, true);
+  assertLanded(fx, run);
+  // and the lock path ship used is the one the merge-lock CLI uses from anywhere
+  const lock = require(path.join(fx.core, 'modules', 'lifecycle', 'merge-lock.js'));
+  assert.ok(same(lock.lockPath(fx.mainDir), commonLock(fx)), `lockPath(linked main) = ${lock.lockPath(fx.mainDir)}`);
+  assert.ok(same(lock.lockPath(fx.inst), commonLock(fx)));
+});
+
+await t('NO worktree has main: a clear bail naming the fix, never ENOENT, nothing pushed', () => {
+  const fx = buildFixture('none'); fixtures.push(fx);
+  const run = runMergeLeg(fx);
+  assert.equal(run.threw, null, `the merge leg threw: ${JSON.stringify(run.threw)}\n${run.out}`);
+  assert.ok(!LOCK_ENOENT.test(run.out), `the merge lock hit ENOENT:\n${run.out}`);
+  assert.equal(run.roots.main, false);
+  assert.ok(same(run.roots.instance, fx.inst), `fell back to ${run.roots.instance}, not the primary checkout`);
+  assert.ok(!same(run.roots.instance, fx.core), 'fell back to the core package dir');
+  assert.equal(run.result.ok, false);
+  assert.match(run.result.reason, /no worktree of this repo has main checked out/);
+  assert.match(run.result.nextStep, /checkout main/);
+  assert.ok(!fs.existsSync(run.marker), 'smoke ran although nothing was merged');
+  const files = git(fx.inst, 'ls-tree', '--name-only', 'origin/main');
+  assert.ok(!files.split('\n').includes('feature.txt'), 'origin/main changed on a bail');
+  assert.ok(!fs.existsSync(commonLock(fx)), 'the merge lock was left behind');
+});
+
+for (const fx of fixtures) {
+  try { fs.rmSync(fx.root, { recursive: true, force: true }); } catch (_) { /* best-effort */ }
+}
+for (const dir of [path.dirname(emptyCfg), CORE_TEMPLATE]) {
+  try { fs.rmSync(dir, { recursive: true, force: true }); } catch (_) { /* best-effort */ }
+}
+
+console.log(`\n${passed} passed, ${failed} failed`);
+process.exit(failed ? 1 : 0);