@bongos/core 1.21.61 → 1.21.63

package/modules/public-landing/public/projects.probes.json

@@ -187,6 +187,24 @@
     { "name": "guild cards: the invited card applies on its own, with no note", "continue": true,
       "steps": [["click","#engageList .engageRow:nth-child(2) .btn"],["wait",400]],
       "expect": { "text": [["#engageList .engageRow:nth-child(2) .btn", "Applied"]], "hasClass": [["#engageList .engageRow:nth-child(2) .projMsg", "ok"]] } },
+    {"name": "guild invite cards (task 1004583): each says what joining shows and, before accept, that your numbers count — with the switch right there, set to count", "auth": true, "width": 1440, "url": "/projects?view=mine",
+      "steps": [["wait",900]],
+      "expect": {"visible": ["#guildInviteList", "#guildInviteList .guildRow:first-child .guildCount"], "count": [["#guildInviteList .guildRow", 2], ["#guildInviteList .guildRow:first-child a.linklike:not([hidden])", 1], ["#guildInviteList .guildRow:nth-child(2) a.linklike:not([hidden])", 0]], "text": [["#guildInviteList .guildRow:first-child .mineRow__name", "You’re invited to join Open Hands"], ["#guildInviteList .guildRow:first-child .guildCount__what", "Your numbers count toward this guild’s rounded totals — even while your record is hidden or your account is private. They are never shown on their own: only inside totals rounded down to a band (10+, 20+, 50+ …) and counted once a week. Leave them out of any guild you’d rather not share them with."]], "checked": "#guildInviteList .guildRow:first-child input[value=\"on\"]"} },
+    {"name": "guild invite: Leave them out says what that means before anything is sent", "continue": true,
+      "steps": [["click","#guildInviteList .guildRow:first-child .guildCount__opt:nth-child(2)"],["wait",150]],
+      "expect": {"checked": "#guildInviteList .guildRow:first-child input[value=\"off\"]", "text": [["#guildInviteList .guildRow:first-child .guildCount__what", "Your numbers are left out of this guild’s totals, from its next weekly count."]]} },
+    {"name": "guild invite: Accept sends the card's visibility and the switch (the stub refuses an accept without the card's visibility) and the card says where your numbers went", "continue": true,
+      "steps": [["click","#guildInviteList .guildRow:first-child .btn"],["wait",400]],
+      "expect": {"hasClass": [["#guildInviteList .guildRow:first-child .projMsg", "ok"], ["#guildInviteList .guildRow:first-child .btn", "ghost"]], "text": [["#guildInviteList .guildRow:first-child .btn", "Joined"], ["#guildInviteList .guildRow:first-child .projMsg", "You’ve joined Open Hands, and your numbers are left out of its totals."]]} },
+    {"name": "guild invite: Decline drops the card, silently", "continue": true,
+      "steps": [["click","#guildInviteList .guildRow:nth-child(2) .btn.ghost"],["wait",400]],
+      "expect": {"count": [["#guildInviteList .guildRow", 1]]} },
+    {"name": "join request (task 1004583): the owner of Night Shift accepts one and declines the other, from the hub", "continue": true,
+      "steps": [["click","#guildRequestList .guildRow:first-child .btn"],["wait",400],["click","#guildRequestList .guildRow:nth-child(2) .btn.ghost"],["wait",400]],
+      "expect": {"count": [["#guildRequestList .guildRow", 1]], "hasClass": [["#guildRequestList .guildRow:first-child .projMsg", "ok"]], "text": [["#guildRequestList .guildRow:first-child .btn", "Accepted"], ["#guildRequestList .guildRow:first-child .projMsg", "Tomás Ek is in Night Shift now."]]} },
+    {"name": "guild cards at 320: the switch stacks and nothing scrolls sideways", "auth": true, "width": 320, "url": "/projects?view=mine",
+      "steps": [["wait",900]],
+      "expect": {"noOverflow": true, "visible": ["#guildInviteList .guildRow:first-child .guildCount"]} },
     { "name": "invite a guild (task 1002303, R27): a /g/ address gives one pending line per member on its public page, each a link to the hall", "auth": true, "width": 1440, "url": "/projects?view=manage&id=101",
       "steps": [["wait",900],["fill","#mInviteGuild","/g/forge-crew"],["click","#mInvite [data-invite-guild]"],["wait",400]],
       "expect": { "count": [["#mInviteList li", 4]], "value": [["#mInviteGuild", ""]],

package/modules/public-landing/public/projects.states.json

@@ -30,6 +30,9 @@
     "in-mine-engagements": { "auth": true, "url": "/projects?view=mine", "actions": [["wait",900],["focus","#engageList .engageRow:first-child .btn"],["wait",200]], "expect": { "visible": ["#mineInvites", "#invitesList", "#engageList"], "count": [["#engageList .engageRow", 2], ["#engageList .engageRow .mineJoinNote:not([hidden])", 0]], "text": [["#engageList .engageRow:nth-child(1) .mineRow__name", "Forge Crew is applying to Tidepool — apply with them?"], ["#engageList .engageRow:nth-child(1) .mineRow__host", "tidepool.cloudbongos.com"], ["#engageList .engageRow:nth-child(2) .mineRow__name", "Lantern Works invited Forge Crew"], ["#engageList .engageRow:nth-child(1) .mineRow__hint", "You apply as yourself — add a note for the owner if you like."], ["#engageList .engageRow:nth-child(1) .btn", "Apply"]] } },
     "in-mine-engagement-note": { "auth": true, "url": "/projects?view=mine", "actions": [["wait",900],["click","#engageList .engageRow:first-child .linklike"],["fill","#engageList .engageRow:first-child .mineJoinNote","I like the boring parts too: migrations and the deploy path."],["wait",150]], "expect": { "visible": ["#engageList .engageRow:first-child .mineJoinNote"], "hidden": ["#engageList .engageRow:first-child .linklike"], "value": [["#engageList .engageRow:first-child .mineJoinNote", "I like the boring parts too: migrations and the deploy path."]] } },
     "in-mine-engagement-applied": { "auth": true, "url": "/projects?view=mine", "actions": [["wait",900],["click","#engageList .engageRow:first-child .linklike"],["fill","#engageList .engageRow:first-child .mineJoinNote","I like the boring parts too: migrations and the deploy path."],["click","#engageList .engageRow:first-child .btn"],["wait",400]], "expect": { "hidden": ["#engageList .engageRow:first-child .mineJoinNote", "#engageList .engageRow:first-child .linklike"], "hasClass": [["#engageList .engageRow:first-child .projMsg", "ok"], ["#engageList .engageRow:first-child .btn", "ghost"]], "text": [["#engageList .engageRow:first-child .btn", "Applied"], ["#engageList .engageRow:first-child .projMsg", "Requested access. The project’s owner admits new builders; once approved, sign in to enter."], ["#engageList .engageRow:nth-child(2) .btn", "Apply"]] } },
+    "in-mine-guild-cards": {"auth": true, "url": "/projects?view=mine", "actions": [["wait", 900], ["focus", "#guildInviteList .guildRow:first-child .btn"], ["wait", 200]], "expect": {"visible": ["#mineInvites", "#guildInviteList", "#guildRequestList", "#guildInviteList .guildRow:first-child .guildCount"], "count": [["#guildInviteList .guildRow", 2], ["#guildRequestList .guildRow", 2], ["#guildInviteList .guildRow .guildCount", 2], ["#guildRequestList .guildRow .guildCount", 0]], "text": [["#guildInviteList .guildRow:nth-child(1) .mineRow__name", "You’re invited to join Open Hands"], ["#guildInviteList .guildRow:nth-child(2) .mineRow__name", "You’re invited to join Quiet Room"], ["#guildInviteList .guildRow:nth-child(1) .guildCount__what", "Your numbers count toward this guild’s rounded totals — even while your record is hidden or your account is private. They are never shown on their own: only inside totals rounded down to a band (10+, 20+, 50+ …) and counted once a week. Leave them out of any guild you’d rather not share them with."], ["#guildRequestList .guildRow:nth-child(1) .mineRow__name", "Tomás Ek asked to join Night Shift"], ["#guildRequestList .guildRow:nth-child(2) .mineRow__name", "@kai-lowe asked to join Night Shift"]], "checked": "#guildInviteList .guildRow:first-child input[value=\"on\"]"}},
+    "in-mine-guild-count-off": {"auth": true, "url": "/projects?view=mine", "actions": [["wait", 900], ["click", "#guildInviteList .guildRow:first-child .guildCount__opt:nth-child(2)"], ["wait", 150]], "expect": {"checked": "#guildInviteList .guildRow:first-child input[value=\"off\"]", "text": [["#guildInviteList .guildRow:first-child .guildCount__what", "Your numbers are left out of this guild’s totals, from its next weekly count."], ["#guildInviteList .guildRow:first-child .btn", "Accept"]]}},
+    "in-mine-guild-joined": {"auth": true, "url": "/projects?view=mine", "actions": [["wait", 900], ["click", "#guildInviteList .guildRow:first-child .guildCount__opt:nth-child(2)"], ["click", "#guildInviteList .guildRow:first-child .btn"], ["wait", 400]], "expect": {"hidden": ["#guildInviteList .guildRow:first-child .btn.ghost + .btn"], "hasClass": [["#guildInviteList .guildRow:first-child .projMsg", "ok"], ["#guildInviteList .guildRow:first-child .btn", "ghost"]], "text": [["#guildInviteList .guildRow:first-child .btn", "Joined"], ["#guildInviteList .guildRow:first-child .projMsg", "You’ve joined Open Hands, and your numbers are left out of its totals."]]}},
     "in-manage-app-live": { "auth": true, "url": "/projects?view=manage&id=101", "actions": [["wait",900],["focus","#mApp a"]], "expect": {"visible":["#mAppCard","#mApp .appStat","#mApp .appVars"],"hidden":[]} },
     "in-manage-app-building": { "auth": true, "url": "/projects?view=manage&id=102", "actions": [["wait",900],["focus","#mApp a"]], "expect": {"visible":["#mAppCard","#mApp .appStages"],"hidden":[]} },
     "in-manage-app-failed": { "auth": true, "url": "/projects?view=manage&id=105", "actions": [["wait",900],["focus","#mApp .appRetryBtn"]], "expect": {"visible":["#mAppCard","#mApp p.err","#mApp .appRetryBtn"],"hidden":["#mApp .appRetry"]} },

package/modules/ui-design/kit/fixtures/guilds.json

@@ -51,6 +51,13 @@
         { "handle": "sol-reyes", "display_name": "Sol Reyes", "avatar_url": null, "membership_kind": "member" }
       ],
       "count": 3
+    },
+    "requests": {
+      "incoming": [
+        { "id": "601", "created_at": "2026-10-04T19:20:00.000Z", "seen_at": null, "handle": "tomas-ek", "display_name": "Tomás Ek", "avatar_url": null },
+        { "id": "602", "created_at": "2026-10-02T11:05:00.000Z", "seen_at": null, "handle": "kai-lowe", "display_name": null, "avatar_url": null }
+      ],
+      "outgoing": []
     }
   },
   "open-hands": {

package/modules/ui-design/kit/fixtures/me__guild-requests.json

@@ -0,0 +1,9 @@
+{
+  "incoming": [
+    { "id": "501", "created_at": "2026-10-04T15:10:00.000Z", "seen_at": null, "slug": "open-hands", "name": "Open Hands", "description": "A newer guild for first-time builders. Ask anything.", "visibility": "public" },
+    { "id": "502", "created_at": "2026-10-03T08:45:00.000Z", "seen_at": "2026-10-03T09:00:00.000Z", "slug": "quiet-room", "name": "Quiet Room", "description": "", "visibility": "unlisted" }
+  ],
+  "outgoing": [],
+  "incoming_count": 2,
+  "outgoing_count": 0
+}

package/modules/ui-design/kit/serve.js

@@ -512,6 +512,44 @@ function guildInvitePost(res, body) {
   const invites = (g.public.members || []).map((m) => ({ handle: m.handle, display_name: m.display_name || null, invite_url: 'https://mercury.example.test/builders/watch?invite=' + encodeURIComponent(m.handle) }));
   return json(res, 200, { invited: false, guild: { slug: g.public.guild.slug, name: g.public.guild.name }, invites, count: invites.length });
 }
+// The guild cards in the mine view's invitations (task 1004583): GET /me/guild-requests is
+// the invites to the builder (me__guild-requests.json, each card with the guild's CURRENT
+// visibility) plus `owner_incoming`, the join requests to every held guild they own (its
+// `requests` in guilds.json), each naming its guild — one read, as the route answers it. The
+// stub mirrors the routes' refusals: an invitee's accept must echo the card's visibility (400
+// without one, 409 with the guild's current one when it differs), only `visibility` and
+// `counted_in_totals` are taken, a row the caller may not answer is one 404, and a decline is
+// a SILENT 204. Nothing is written: a reload draws the same cards, as the join relay's
+// 'requested' does.
+function ownedRequests() {
+  return Object.values(guildsHeld()).filter((g) => g.members && g.members.you.membership_kind === 'owner')
+    .flatMap((g) => ((g.requests && g.requests.incoming) || []).map((r) => ({ ...r, guild: { slug: g.members.guild.slug, name: g.members.guild.name } })));
+}
+function myGuildRequests(res) {
+  const q = heldFixture('me__guild-requests');
+  const owner = ownedRequests();
+  return json(res, 200, { ...q, owner_incoming: owner, owner_incoming_count: owner.length });
+}
+function guildRequestAnswer(res, id, verb, body) {
+  const notFound = () => refuse(res, 404, 'guild_request_not_found', 'guild_request_not_found');
+  if (!/^\d{1,19}$/.test(id)) return notFound();
+  const bad = Object.keys(body).find((k) => !['visibility', 'counted_in_totals'].includes(k));
+  if (bad) return refuse(res, 400, 'validation_failed', `unknown field: ${bad}`);
+  if (body.visibility !== undefined && !['public', 'unlisted'].includes(body.visibility)) return refuse(res, 400, 'validation_failed', 'visibility must be public or unlisted');
+  if (body.counted_in_totals !== undefined && typeof body.counted_in_totals !== 'boolean') return refuse(res, 400, 'validation_failed', 'counted_in_totals must be a boolean');
+  const invite = (heldFixture('me__guild-requests').incoming || []).find((r) => r.id === id);
+  const request = Object.values(guildsHeld()).some((g) => g.members && g.members.you.membership_kind === 'owner'
+    && ((g.requests && g.requests.incoming) || []).some((r) => r.id === id));
+  if (!invite && !request) return notFound();
+  if (verb === 'decline') { res.writeHead(204, { 'cache-control': 'no-store' }); return res.end(); }
+  if (invite) {
+    if (!body.visibility) return refuse(res, 400, 'guild_card_visibility_required', 'send the visibility your invite card showed');
+    const held = guildsHeld()[invite.slug];
+    const now = (held && held.members && held.members.guild.visibility) || invite.visibility;
+    if (body.visibility !== now) return json(res, 409, { error: { code: 'guild_visibility_changed', message: 'guild_visibility_changed', details: { visibility: now } } });
+  }
+  return json(res, 200, { status: 'accepted' });
+}
 function guildEngagementLive(slug, origin) {
   const g = typeof slug === 'string' && guildsHeld()[slug.toLowerCase()];
   if (!g || !g.members) return false;
@@ -540,6 +578,9 @@ const server = http.createServer((req, res) => {
     if (guild && guild[2] === '/members' && req.method === 'GET') return AUTH ? guildRead(res, guild[1], 'members', origin) : json(res, 401, UNAUTH);
     if (guild && guild[2] === '/membership' && req.method === 'PATCH') return AUTH ? readBody(req, (body) => guildMembershipPatch(res, guild[1], body)) : json(res, 401, UNAUTH);
     if (guild && guild[2] === '/engagements' && req.method === 'POST') return AUTH ? readBody(req, (body) => guildEngagementPost(res, guild[1], body)) : json(res, 401, UNAUTH);
+    if (rest === '/me/guild-requests' && req.method === 'GET') return AUTH ? myGuildRequests(res) : json(res, 401, UNAUTH);
+    const answer = rest.match(/^\/guild-requests\/([^/]+)\/(accept|decline)$/);
+    if (answer && req.method === 'POST') return AUTH ? readBody(req, (body) => guildRequestAnswer(res, answer[1], answer[2], body)) : json(res, 401, UNAUTH);
     if (rest === '/provisioning/instances' && req.method === 'GET') return AUTH ? instances(res, null, false) : json(res, 401, UNAUTH);
     // the planet-physics questions' pre-create check (task 1004418): nothing stops here —
     // the kit carries no screen. Of the soft-limit table it mirrors only the three hide

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.21.61",
+  "version": "1.21.63",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.21.61",
+      "version": "1.21.63",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.21.61",
+  "version": "1.21.63",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/release-notes.json

@@ -9138,5 +9138,21 @@
       "id": "1004570",
       "text": "A project owner now sees a Danger zone in their project's settings, with links straight to the place where they can take the project offline or delete it. Nobody else sees it, and self-hosted projects don't show it."
     }
+  ],
+  "1.21.62": [
+    {
+      "id": "1003461",
+      "text": "Decided how planning works in the hall: simple forms for creating tasks, goals and criteria, while version planning stays a guided Claude session. A goal made in the hall now comes with its own 'spec this goal' task that the r"
+    },
+    {
+      "id": "1004584",
+      "text": "Shipping finished tasks now works for projects that install Bongos as a package, so their work lands instead of getting stuck halfway."
+    }
+  ],
+  "1.21.63": [
+    {
+      "id": "1004583",
+      "text": "Builders can now accept or decline a guild invite from their projects page, choosing first whether their numbers count toward the guild's totals, and guild owners can answer join requests there too."
+    }
   ]
 }

package/scripts/gds/ship-grade.js

@@ -9,6 +9,7 @@
 'use strict';
 
 const crypto = require('node:crypto');
+const path = require('node:path');
 const { spawn } = require('node:child_process');
 const { cliClient } = require('./cli-lib');
 const grader = require('../../modules/grading/grader');
@@ -22,7 +23,10 @@ const grader = require('../../modules/grading/grader');
 const { hasCopyOrVisualWork } = require('../../modules/lifecycle/cascade.js');
 const { resolveBuilderModel } = require('./ship-memory-sync.js');
 const { argvOut, gitArgvOk, gitOk, shellOk } = require('./ship-git.js');
-const { GRADER_DIFF_CHAR_CAP, GRADER_TIMEOUT_MS, REPO_ROOT, noteServerReward } = require('./ship-state.js');
+const { GRADER_DIFF_CHAR_CAP, GRADER_TIMEOUT_MS, CORE_ROOT, REPO_ROOT, noteServerReward } = require('./ship-state.js');
+
+// The core's smoke suite, by absolute path from the package dir (task 1004584).
+const SMOKE_SCRIPT = path.join(CORE_ROOT, 'scripts', 'gds', 'smoke-gds.js');
 
 // ---------- Step 1+2: local verification ----------
 
@@ -380,10 +384,13 @@ async function runNoArtifactGrader({ task, valueSummary, notes, runOpts: extraOp
 }
 
 function runSmoke() {
-  // `cwd: REPO_ROOT` + a relative script path is robust to spaces or other
-  // shell metacharacters that may appear in the absolute repo path on some
-  // machines.
-  const okPms = shellOk(`"${process.execPath}" scripts/gds/smoke-gds.js`, { cwd: REPO_ROOT });
+  // The script is addressed from CORE_ROOT, never cwd-relative: in a vendored
+  // instance it lives under node_modules/@bongos/core, not under the instance
+  // checkout, and the relative form died MODULE_NOT_FOUND after a clean merge —
+  // which then reset main and stranded the task at confirmed (task 1004584).
+  // cwd stays the instance checkout so instance config resolves as before; the
+  // JSON.stringify quoting survives spaces in either path.
+  const okPms = shellOk(`"${process.execPath}" ${JSON.stringify(SMOKE_SCRIPT)}`, { cwd: REPO_ROOT });
   return { ran: true, clean: okPms };
 }
 
@@ -394,7 +401,7 @@ function runSmoke() {
 // post-merge smoke call keeps the sync form (nothing overlaps there).
 function runSmokeAsync() {
   return new Promise((resolve) => {
-    const child = spawn(process.execPath, ['scripts/gds/smoke-gds.js'], {
+    const child = spawn(process.execPath, [SMOKE_SCRIPT], {
       cwd: REPO_ROOT, stdio: 'inherit', windowsHide: true,
     });
     child.on('error', () => resolve({ ran: true, clean: false }));

package/scripts/gds/ship-merge-gate.js

@@ -168,7 +168,32 @@ function removeProbe(repoRoot, dir) {
 // tip as it stood BEFORE the branch was merged in (in ship-merge.js that is
 // origin/main, since the ff-only step immediately above it guarantees the two
 // are the same commit).
+// gateApplies — does this repo carry the fitness gate at all? A VENDORED
+// instance (core under node_modules/@bongos/core) has no scripts/gds/fitness.js
+// of its own — fitness is the core's architecture gate, and the core ran it in
+// its own CI before it was published. Without this the gate read the missing
+// file as 'unmeasurable' on BOTH sides and blocked every vendored land
+// (task 1004584). It only stands down when the pre-merge base lacks the file
+// too, so a branch that DELETES fitness.js from the core is still measured
+// (and blocked as unmeasurable) rather than waved through.
+function gateApplies(repoRoot, baseSha) {
+  if (fs.existsSync(path.join(repoRoot, 'scripts', 'gds', 'fitness.js'))) return true;
+  if (!baseSha) return true;
+  try {
+    execFileSync('git', ['cat-file', '-e', `${baseSha}:scripts/gds/fitness.js`], {
+      cwd: repoRoot, stdio: 'ignore', shell: false,
+    });
+    return true; // the base had it — this merge removed it; measure (and block)
+  } catch (_) {
+    return false; // neither side carries the gate — nothing to run
+  }
+}
+
 function gateMergeResult({ repoRoot, baseSha, log = console.log }) {
+  if (!gateApplies(repoRoot, baseSha)) {
+    log('  fitness: this repo carries no scripts/gds/fitness.js (a vendored instance) — gate not applicable');
+    return { block: false, reason: 'not-applicable' };
+  }
   log('  fitness against post-merge state...');
   const mergeClean = runFitnessAt(repoRoot);
   const baseClean = mergeClean ? true : probeBaseClean(repoRoot, baseSha);
@@ -179,6 +204,7 @@ function gateMergeResult({ repoRoot, baseSha, log = console.log }) {
 
 module.exports = {
   fitnessOutcome,
+  gateApplies,
   gateMergeResult,
   gateMessage,
   mergeGateVerdict,

package/scripts/gds/ship-merge.js

@@ -31,7 +31,7 @@ const { runSmoke } = require('./ship-grade.js');
 const { gateMergeResult } = require('./ship-merge-gate.js');
 const { dbOnlyIgnoredNotice } = require('./ship-honesty.js');
 const { currentBranch, mainWorktreeBusy, regenerateApiClient, regenerateApiDocs, regenerateCopyInventory, regenerateDiagrams, regenerateFileMap, regenerateRepoMap, regenerateSessionIndex } = require('./ship-regen.js');
-const { REPO_ROOT } = require('./ship-state.js');
+const { MAIN_CHECKED_OUT, REPO_ROOT } = require('./ship-state.js');
 const { envPrefix } = require('../../src/instance-config');
 
 // zeroCommitVerdict — dbOnly is deliberately consulted ONLY at zero commits
@@ -265,9 +265,14 @@ async function mergeLocally(taskId, valueSummary, { dbOnly = false } = {}) {
       // — the branch lands fine via a PR. Tagged PR-recoverable so autoMerge falls
       // back instead of parking the task at 'confirmed' unpaid. The reason +
       // nextStep are kept for the case where the fallback itself bails.
+      // task 1004584: when NO worktree holds main at all, say exactly that and
+      // how to fix it — REPO_ROOT is then the primary checkout by fallback, and
+      // "work in your own worktree" is advice the builder already followed.
       return landBailed(
-        `the main checkout is on ${onMain}, not main — work a task in its own worktree so the main checkout stays on main`,
-        '/merge-mode',
+        MAIN_CHECKED_OUT
+          ? `the main checkout is on ${onMain}, not main — work a task in its own worktree so the main checkout stays on main`
+          : `no worktree of this repo has main checked out (the main checkout ${REPO_ROOT} is on ${onMain}) — run \`git checkout main\` there, then re-ship`,
+        MAIN_CHECKED_OUT ? '/merge-mode' : `git -C "${REPO_ROOT}" checkout main && node scripts/gds/ship.js ${taskId}`,
         LAND_BAIL_MAIN_CHECKOUT_ON_BRANCH,
       );
     }
@@ -448,6 +453,10 @@ async function mergeLocally(taskId, valueSummary, { dbOnly = false } = {}) {
 
 module.exports = {
   autoMerge,
+  // task 1004584: the local merge leg on its own, so the vendored-instance
+  // regression test can read a bail's reason without the PR fallback (which
+  // needs an authed gh) swallowing it.
+  mergeLocally,
   // task 1004322: the held page tweak's publish-only path.
   publishHeld,
   // task 1002572 (PART 2): the pure recovery command for a ship run from main —

package/scripts/gds/ship-state.js

@@ -18,7 +18,7 @@
 'use strict';
 
 const path = require('node:path');
-const { findMainWorktree } = require('../../modules/lifecycle/ship-preflight');
+const { findMainWorktree, findPrimaryWorktree } = require('../../modules/lifecycle/ship-preflight');
 
 // The instance's reward policy, as reported by the server on GET /me (ADR 0146 /
 // task 1002469). Cached module-level because the credits print + the completion
@@ -43,10 +43,43 @@ function getServerReward() {
 const GRADER_DIFF_CHAR_CAP = 250_000;
 const GRADER_TIMEOUT_MS = 240_000; // 4 min — Opus on a big diff with Read tool calls
 
-// Where auto-merge runs — the worktree that has `main` checked out, not the
-// feature worktree this script lives in. Falls back to two-levels-up if we
-// can't ask git (e.g. fresh clone with no `main` worktree set up yet).
-const REPO_ROOT = findMainWorktree(__dirname) || path.resolve(__dirname, '..', '..');
+// TWO ROOTS, not one (task 1004584). In the core's own repo they are the same
+// folder, which is how a single REPO_ROOT served both jobs for so long. In a
+// VENDORED instance — the core installed as node_modules/@bongos/core — they are
+// not, and conflating them broke every land (mercury, core 1.21.20):
+//   CORE_ROOT     — where the core's own scripts live (the package dir). Every
+//                   core script ship spawns (smoke-gds.js, …) is addressed from
+//                   here, never by a cwd-relative path.
+//   INSTANCE_ROOT — the instance repo's checkout that auto-merge runs in: the
+//                   worktree with `main` checked out (primary OR linked). With no
+//                   `main` anywhere it is the primary checkout, so the merge leg
+//                   bails with "on X, not main" — never the package dir, which is
+//                   not a repo and turned the bail into an ENOENT on the lock.
+// Git is asked from __dirname first (unchanged for the core repo), then from the
+// process cwd (the feature worktree ship is run from) as a backstop.
+const CORE_ROOT = path.resolve(__dirname, '..', '..');
+
+// resolveRoots — the pure resolution, with git injected so the vendored layouts
+// are unit-testable. `mainCheckedOut` is false when no worktree holds `main`;
+// ship-merge names that case in its bail instead of a generic "on X".
+function resolveRoots({
+  dirname = __dirname,
+  cwd = process.cwd(),
+  findMain = findMainWorktree,
+  findPrimary = findPrimaryWorktree,
+} = {}) {
+  const core = path.resolve(dirname, '..', '..');
+  const main = findMain(dirname) || findMain(cwd);
+  if (main) return { coreRoot: core, instanceRoot: main, mainCheckedOut: true };
+  const primary = findPrimary(dirname) || findPrimary(cwd);
+  return { coreRoot: core, instanceRoot: primary || core, mainCheckedOut: false };
+}
+
+const { instanceRoot: INSTANCE_ROOT, mainCheckedOut: MAIN_CHECKED_OUT } = resolveRoots();
+// The historical name every ship phase imports. It always meant "the checkout
+// auto-merge runs in", i.e. the instance root — kept as an alias so the phases
+// that only ever wanted that do not churn.
+const REPO_ROOT = INSTANCE_ROOT;
 
 // Sound playback is COSMETIC — the ship pipeline must NEVER depend on it. Guard
 // the require so a missing/broken player (e.g. .claude/sounds/ absent on a fresh
@@ -68,6 +101,10 @@ module.exports = {
   GRADER_DIFF_CHAR_CAP,
   GRADER_TIMEOUT_MS,
   REPO_ROOT,
+  CORE_ROOT,
+  INSTANCE_ROOT,
+  MAIN_CHECKED_OUT,
+  resolveRoots,
   playSound,
   BEHIND_MAIN_LIMIT,
 };

package/src/module-api.js

@@ -75,7 +75,7 @@ const { responsibilityFor, ROLE_RESPONSIBILITIES } = require('./role-responsibil
 // MAJOR (see allowBoxScope below): passes the request through untouched.
 function deprecatedNoopMiddleware(_req, _res, next) { next(); }
 
-const CORE_VERSION = '1.21.61'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
+const CORE_VERSION = '1.21.63'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('discord'); log.info('mounted');

package/tests/guilds_api.mjs

@@ -578,6 +578,37 @@ test('the owner\'s invite list names only invitees THIS owner could address (a t
     'public, or connected to the viewing owner — the addressableAccount rule, reusing the one symmetric-edge fragment');
 });
 
+test('GET /me/guild-requests carries the requests to EVERY guild I own in one statement keyed on the session, each naming its guild (task 1004583)', async () => {
+  const OWNED = (t) => /WHERE r\.kind = 'request' AND r\.status = 'pending'/.test(t);
+  on(base((t) => (OWNED(t) && /^\s*SELECT/.test(t)
+    ? result([{ id: '601', created_at: 'c', seen_at: null, slug: 'night-shift', name: 'Night Shift', handle: 'tomas-ek', display_name: 'Tomás Ek', avatar_url: null },
+      { id: '602', created_at: 'c', seen_at: 's', slug: 'lamp-room', name: 'Lamp Room', handle: 'kai-lowe', display_name: null, avatar_url: null }])
+    : null)));
+  const res = await call('GET', '/api/bongos/me/guild-requests');
+  assert.equal(res.status, 200);
+  assert.equal(res.headers['cache-control'], 'no-store');
+  assert.deepEqual(res.json.owner_incoming[0], { id: '601', created_at: 'c', seen_at: null, handle: 'tomas-ek', display_name: 'Tomás Ek', avatar_url: null, guild: { slug: 'night-shift', name: 'Night Shift' } });
+  assert.equal(res.json.owner_incoming_count, res.json.owner_incoming.length);
+  assert.equal(res.json.incoming_count, res.json.incoming.length, 'the invite half is unchanged');
+
+  const reads = calls.filter((c) => OWNED(c.text) && /^\s*SELECT/.test(c.text));
+  assert.equal(reads.length, 1, 'one statement for every guild I own — never one per guild');
+  const [read] = reads;
+  assert.equal(read.params[0], ME, 'keyed on the SESSION’s github_id');
+  assert.equal(read.params[2], guilds.LIST_MAX, 'capped as every queue is');
+  assert.ok(read.text.includes(require('../modules/platform-identity/account-visibility.js').accountActiveSql('pa')),
+    'a requester floors on an active account, as the per-guild queue does');
+  assert.match(read.text, /o\.guild_id = r\.guild_id AND o\.github_id = \$1::bigint\s+AND o\.membership_kind = 'owner'/, 'the owner test, per row, in the statement');
+  assert.match(read.text, /JOIN platform_identity_accounts pa ON pa\.github_id = r\.github_id/);
+  assert.doesNotMatch(read.text, /github_login|pa\.github_id AS|r\.github_id AS/, 'no GitHub identity leaves the module');
+  assert.match(read.text, /pa\.handle, pa\.display_name, pa\.avatar_url/, 'the person columns a guild list carries, no more');
+
+  const stamp = calls.find((c) => /^\s*UPDATE platform_identity_guild_requests r SET seen_at = now\(\)/.test(c.text));
+  assert.ok(stamp, 'the unseen request is stamped, as the per-guild read stamps it');
+  assert.deepEqual(stamp.params, [['601'], ME], 'only the unseen row, by the same owner');
+  assert.match(stamp.text, /r\.kind = 'request'[\s\S]*o\.github_id = \$2::bigint\s+AND o\.membership_kind = 'owner'/, 'the stamp re-asserts the owner test');
+});
+
 // ===========================================================================
 // 7. Nothing here is authority; counts are lengths
 // ===========================================================================

package/tests/guilds_db.mjs

@@ -160,6 +160,13 @@ try {
     'the requester\'s own counted_in_totals choice rides the request — the owner cannot override it');
 
   ok((await guilds.requestToJoin({ slug: 'r24-pub', githubId: BOB }, { pool })).outcome === 'created', 'Bob asks');
+  const ownerQ = await guilds.listOwnedRequests({ githubId: OWNER }, { pool });
+  const bobAsk = ownerQ.find((r) => r.handle === 'r24bob');
+  ok(bobAsk && bobAsk.guild.slug === 'r24-pub' && !('github_id' in bobAsk) && !('kind' in bobAsk),
+    'the owner\'s ONE read across every guild they own carries Bob\'s request, naming its guild, by handle never github_id (task 1004583)');
+  ok((await guilds.listOwnedRequests({ githubId: ALICE }, { pool })).every((r) => r.guild.slug !== 'r24-pub'),
+    'a member who is not the owner reads none of its requests (the owner gate is in the statement)');
+  ok((await openRows('r24-pub', BOB))[0].seen_at !== null, 'reading it stamps seen_at on the request, as the per-guild queue does');
   ok(await guilds.declineRequest({ id: await pendingId('r24-pub', BOB), githubId: OWNER }, { pool }), 'the owner declines');
   const before = (await openRows('r24-pub', BOB)).length;
   ok((await guilds.requestToJoin({ slug: 'r24-pub', githubId: BOB }, { pool })).outcome === 'swallowed',

package/tests/hub_engagement_cards.mjs

@@ -37,11 +37,13 @@ const LANDING = path.join(ROOT, 'modules', 'public-landing', 'public');
 const HUB = fs.readFileSync(path.join(LANDING, 'projects.html'), 'utf8').replace(/\r\n/g, '\n');
 const SCRIPT = (HUB.match(/<script>([\s\S]*?)<\/script>\s*<\/body>/) || [, ''])[1];
 
-// the rows region: mineEl/mineRow, the two lists, the section, and the guild cards
+// the rows region: mineEl/mineRow, the lists, the section, and the guild cards —
+// through the guild invite and request cards (task 1004583), which loadInvites
+// also reads; tests/hub_guild_cards.mjs drives those
 const START = SCRIPT.indexOf('  function mineEl(tag, cls)');
-const END = SCRIPT.indexOf('\n  }\n', SCRIPT.indexOf('  function loadEngagements() {')) + 5;
+const END = SCRIPT.indexOf('\n  }\n', SCRIPT.indexOf('  function loadGuildQueue() {')) + 5;
 assert.ok(START > 0, 'the region starts at mineEl');
-assert.ok(END > START, 'and ends with loadEngagements');
+assert.ok(END > START, 'and ends with loadGuildQueue');
 const REGION = SCRIPT.slice(START, END);
 for (const fn of ['function mineRow(', 'function renderInvitesList(', 'function paintInvitesSection(', 'function loadInvites(',
   'function engageLine(', 'function engageRow(', 'function renderEngagements(', 'function loadEngagements(']) {
@@ -81,7 +83,7 @@ const REQUESTED = { ok: true, status: 200, body: { ok: true, status: 'requested'
 
 function boot({ answers = [] } = {}) {
   const ids = new Map();
-  for (const id of ['mineInvites', 'invitesList', 'engageList', 'buildingList', 'buildingEmpty']) ids.set(id, el(id === 'mineInvites' ? 'section' : 'ul'));
+  for (const id of ['mineInvites', 'invitesList', 'guildInviteList', 'engageList', 'guildRequestList', 'buildingList', 'buildingEmpty']) ids.set(id, el(id === 'mineInvites' ? 'section' : 'ul'));
   ids.get('mineInvites').hidden = true;
   const requests = [];
   const queued = answers.slice();
@@ -173,7 +175,8 @@ test('loadInvites reads both lists, and a guild read that fails is silent', asyn
   ] });
   await ui.sandbox.loadInvites();
   await ui.settle();
-  assert.deepEqual(ui.requests.map((r) => `${r.method} ${r.url}`).sort(), ['GET /api/bongos/me/guild-engagements', 'GET /api/bongos/my-projects/invites']);
+  assert.deepEqual(ui.requests.map((r) => `${r.method} ${r.url}`).sort(),
+    ['GET /api/bongos/me/guild-engagements', 'GET /api/bongos/me/guild-requests', 'GET /api/bongos/my-projects/invites']);
   for (const r of ui.requests) assert.equal(r.credentials, 'same-origin', 'own-scope reads, on the cookie session');
   assert.equal(ui.cards().length, 0);
   assert.equal(ui.section().hidden, true);
@@ -291,7 +294,7 @@ test('the cards are a real list inside the Invitations section, built with creat
   assert.doesNotMatch(CARDS, /innerHTML|insertAdjacentHTML|outerHTML/, 'no markup built from strings');
   assert.match(SCRIPT, /if \(v === 'mine' && me\) \{ refreshList\(\); loadMemberships\(\); loadInvites\(\); \}/, 'the mine view re-reads both lists on entry, through loadInvites');
   const COSMOS = fs.readFileSync(path.join(LANDING, 'assets', 'cosmos.css'), 'utf8');
-  assert.match(COSMOS, /\.mineRows:not\(:empty\)\+\.mineRows \.mineRow:first-child\{border-top:1px solid var\(--rule-soft\);\}/, 'one hairline between the two lists when both have rows');
+  assert.match(COSMOS, /\.mineRows:not\(:empty\)~\.mineRows \.mineRow:first-child\{border-top:1px solid var\(--rule-soft\);\}/, 'one hairline between any two lists that have rows');
   assert.doesNotMatch(HUB.slice(0, HUB.indexOf('</head>')), /engageRow/, 'styled in cosmos.css, not in the page head');
 });