kenaz 0.0.0-stage → 0.3.2

package/core/.specialist/Ansuz/tools/verify-and-land.test.js

@@ -0,0 +1,1099 @@
+'use strict';
+
+/**
+ * Unit tests for verify-and-land.js (TASK_2059).
+ *
+ * Every external effect (git/node process spawns, fs, time) is injected —
+ * these tests never touch the real repo, never merge, never call
+ * task-api.js complete or mark-landed for real, and never spawn a real
+ * process. Negative control's "always restores" test asserts on writes
+ * captured by a fake fs, not on git HEAD content.
+ *
+ * Run: node --test .specialist/Ansuz/tools/verify-and-land.test.js
+ */
+
+const test = require('node:test');
+const assert = require('node:assert/strict');
+const { spawnSync: realSpawnSync } = require('node:child_process');
+const path = require('node:path');
+
+const {
+  parseArgs,
+  validateConfig,
+  buildPlan,
+  runVerifyAndLand,
+  resolveVerifyTargetDir,
+  latestStartedAtAfter,
+  resolveRepoFromWorktree,
+  coreToolPath,
+  assertRepoOwnsWorktree,
+  resolveRepo,
+  UsageError,
+  DEFAULT_RUST_LOCK_WAIT_S,
+  DEFAULT_RUST_MAX_S,
+  resolveVerifyOfflineCmd,
+  stepVerifyOffline,
+} = require('./verify-and-land.js');
+
+// Same shared list verify-and-land.js reads (TASK_2069) — tests assert
+// against the real list, never a hand-copied one.
+const {
+  WORKTREE_COMMIT_EXCLUDE_PATHSPECS,
+  dispatchLockPath: realDispatchLockPath,
+  tryAcquireDispatchLock: realTryAcquireDispatchLock,
+} = require(
+  path.join(__dirname, '..', '..', '..', '.formation', 'tools', 'utils.js')
+);
+
+// Fake dispatch-lock pair for stepVerifyOffline unit tests (TASK_2176) — a
+// tiny in-memory Map standing in for the real lock FILE, so these tests
+// never write into this repo's real .formation/ dir. Mirrors the real
+// contract's shape: tryAcquireDispatchLock returns {acquired, holder}.
+function makeFakeLock(initialHolder = null) {
+  let holder = initialHolder; // non-null = already held
+  return {
+    dispatchLockPath: projectPath => `/fake-lock/${projectPath}`,
+    tryAcquireDispatchLock: (lockFile, meta) => {
+      if (holder) return { acquired: false, holder };
+      holder = Object.assign({ startedAt: '2026-01-01T00:00:00.000Z' }, meta);
+      return { acquired: true, holder: null };
+    },
+    release: () => { holder = null; },
+    isHeld: () => !!holder,
+  };
+}
+
+// ── fakes ────────────────────────────────────────────────────────────────
+
+// Windows path.join() returns backslash paths even when inputs used forward
+// slashes; the real fs doesn't care about slash direction, but a naive
+// string-keyed fake does — normalize keys so the fake behaves like a real
+// filesystem regardless of platform (GEN-009).
+function normPath(p) {
+  return String(p).replace(/\\/g, '/');
+}
+
+function makeFakeFs(initialFiles = {}) {
+  const store = new Map(Object.entries(initialFiles).map(([k, v]) => [normPath(k), Buffer.isBuffer(v) ? v : Buffer.from(v)]));
+  const writes = [];
+  return {
+    store,
+    writes,
+    existsSync: p => store.has(normPath(p)),
+    mkdirSync: () => {},
+    writeFileSync: (p, data) => {
+      const key = normPath(p);
+      const buf = Buffer.isBuffer(data) ? data : Buffer.from(data);
+      store.set(key, buf);
+      writes.push({ path: key, data: buf });
+    },
+    readFileSync: p => {
+      const key = normPath(p);
+      if (!store.has(key)) throw new Error('ENOENT ' + key);
+      return store.get(key);
+    },
+    copyFileSync: (src, dst) => store.set(normPath(dst), store.get(normPath(src)) || Buffer.from('')),
+    statSync: () => ({ isDirectory: () => false }),
+    readdirSync: () => [],
+    unlinkSync: p => { store.delete(normPath(p)); },
+  };
+}
+
+function baseConfig(overrides) {
+  return Object.assign(
+    {
+      task: 'TASK_TEST',
+      worktree: '/wt',
+      repo: '/repo',
+      rustFilters: [],
+      nodeTests: [],
+      negFile: null,
+      negTest: null,
+      messageFile: null,
+      noMerge: false,
+      waitBackend: false,
+      waitBackendTimeoutMs: 1000,
+      waitBackendPollMs: 10,
+      live: null,
+      logDir: '/logs/test',
+      dryRun: false,
+      rustLockWaitS: DEFAULT_RUST_LOCK_WAIT_S,
+      rustMaxS: DEFAULT_RUST_MAX_S,
+      rustInWorktree: false,
+    },
+    overrides
+  );
+}
+
+function ok(stdout) {
+  return { status: 0, stdout, stderr: '' };
+}
+function bad(status, stdout, stderr) {
+  return { status, stdout: stdout || '', stderr: stderr || '' };
+}
+
+// `git -C <repo> worktree list --porcelain` fixture — every non-dry-run
+// pipeline test now hits this via resolveRepo()'s assertRepoOwnsWorktree
+// check (config.repo is set explicitly by baseConfig, so it always takes
+// the "validate the given --repo" path, never the git-common-dir path).
+function worktreeListOutput(repo, wt, branch) {
+  return `worktree ${repo}\nbranch refs/heads/main\n\nworktree ${wt}\nbranch refs/heads/${branch}\n`;
+}
+
+// ── pure-function tests ──────────────────────────────────────────────────
+
+test('parseArgs: repeated --rust/--node-test collect into arrays; positional is task', () => {
+  const config = parseArgs([
+    'TASK_9',
+    '--worktree', '/wt',
+    '--rust', 'delta_graph',
+    '--rust', 'heat',
+    '--node-test', 'a.test.js',
+    '--neg-file', 'src/x.rs',
+    '--neg-test', 'rust:delta_graph',
+    '--no-merge',
+    '--dry-run',
+  ]);
+  assert.equal(config.task, 'TASK_9');
+  assert.equal(config.worktree, '/wt');
+  assert.deepEqual(config.rustFilters, ['delta_graph', 'heat']);
+  assert.deepEqual(config.nodeTests, ['a.test.js']);
+  assert.equal(config.negFile, 'src/x.rs');
+  assert.equal(config.negTest, 'rust:delta_graph');
+  assert.equal(config.noMerge, true);
+  assert.equal(config.dryRun, true);
+});
+
+test('parseArgs: --task/--worktree/--rust/--node with comma lists (dogfood repro, TASK_2059 follow-up)', () => {
+  const config = parseArgs([
+    '--task', 'TASK_2059',
+    '--worktree', '/wt',
+    '--rust', 'delta_graph,heat',
+    '--node', 'a.test.js,b.test.js',
+    '--message-file', '/msg.txt',
+    '--dry-run',
+  ]);
+  assert.equal(config.task, 'TASK_2059');
+  assert.equal(config.worktree, '/wt');
+  assert.deepEqual(config.rustFilters, ['delta_graph', 'heat']);
+  assert.deepEqual(config.nodeTests, ['a.test.js', 'b.test.js']);
+  assert.equal(config.messageFile, '/msg.txt');
+  assert.equal(config.dryRun, true);
+});
+
+test('parseArgs: --rust/--node also repeatable (not just comma lists)', () => {
+  const config = parseArgs(['--task', 'T', '--worktree', '/wt', '--rust', 'a', '--rust', 'b', '--node', 'x.js', '--node', 'y.js']);
+  assert.deepEqual(config.rustFilters, ['a', 'b']);
+  assert.deepEqual(config.nodeTests, ['x.js', 'y.js']);
+});
+
+test('parseArgs: --rust-lock-wait-s/--rust-max-s default to 900/1800, overridable; --rust-in-worktree flag (TASK_2084)', () => {
+  const defaults = parseArgs(['--task', 'T', '--worktree', '/wt']);
+  assert.equal(defaults.rustLockWaitS, DEFAULT_RUST_LOCK_WAIT_S);
+  assert.equal(defaults.rustMaxS, DEFAULT_RUST_MAX_S);
+  assert.equal(defaults.rustInWorktree, false);
+
+  const overridden = parseArgs([
+    '--task', 'T', '--worktree', '/wt',
+    '--rust-lock-wait-s', '60', '--rust-max-s', '120', '--rust-in-worktree',
+  ]);
+  assert.equal(overridden.rustLockWaitS, 60);
+  assert.equal(overridden.rustMaxS, 120);
+  assert.equal(overridden.rustInWorktree, true);
+});
+
+test('parseArgs: unknown flag throws UsageError (never silently dropped)', () => {
+  assert.throws(
+    () => parseArgs(['--task', 'T', '--worktree', '/wt', '--nod', 'typo.js']),
+    err => err instanceof UsageError && /unknown flag: --nod\b/.test(err.message)
+  );
+});
+
+test('parseArgs: missing value for a flag throws UsageError', () => {
+  assert.throws(() => parseArgs(['--task']), err => err instanceof UsageError && /missing value for --task/.test(err.message));
+  assert.throws(
+    () => parseArgs(['--task', '--worktree', '/wt']),
+    err => err instanceof UsageError && /missing value for --task/.test(err.message),
+    'a value that looks like the next flag counts as missing'
+  );
+});
+
+test('validateConfig: merge planned with zero verification requested -> refused', () => {
+  const config = baseConfig({ rustFilters: [], nodeTests: [], negFile: null, noMerge: false, mergeWithoutTests: false, dryRun: true });
+  assert.throws(() => validateConfig(config), err => err instanceof UsageError && /zero verification/.test(err.message));
+});
+
+test('validateConfig: --merge-without-tests explicitly allows a zero-verification merge', () => {
+  const config = baseConfig({ rustFilters: [], nodeTests: [], negFile: null, noMerge: false, mergeWithoutTests: true });
+  assert.doesNotThrow(() => validateConfig(config));
+});
+
+test('validateConfig: missing --task/--worktree refused', () => {
+  assert.throws(() => validateConfig(baseConfig({ task: null })), UsageError);
+  assert.throws(() => validateConfig(baseConfig({ worktree: null })), UsageError);
+});
+
+test('runVerifyAndLand: refuses a zero-verification merge before touching any dep (dry-run included)', async () => {
+  const config = baseConfig({ rustFilters: [], nodeTests: [], negFile: null, noMerge: false, mergeWithoutTests: false, dryRun: true });
+  const deps = {
+    spawnSync: () => { throw new Error('must not be called'); },
+    fs: new Proxy({}, { get() { return () => { throw new Error('must not be touched'); }; } }),
+  };
+  await assert.rejects(() => runVerifyAndLand(config, deps), UsageError);
+});
+
+test('CLI: an unknown flag exits 2 with a usage message, before touching git (real subprocess, no fixtures)', () => {
+  const scriptPath = path.join(__dirname, 'verify-and-land.js');
+  const res = realSpawnSync(process.execPath, [scriptPath, '--task', 'TASK_X', '--worktree', '/nonexistent', '--bogus'], {
+    encoding: 'utf8',
+  });
+  assert.equal(res.status, 2);
+  assert.match(res.stderr, /unknown flag: --bogus/);
+});
+
+test('CLI: a zero-verification merge request exits 2 before doing anything (real subprocess)', () => {
+  const scriptPath = path.join(__dirname, 'verify-and-land.js');
+  const res = realSpawnSync(process.execPath, [scriptPath, '--task', 'TASK_X', '--worktree', '/nonexistent'], { encoding: 'utf8' });
+  assert.equal(res.status, 2);
+  assert.match(res.stderr, /zero verification/);
+});
+
+test('buildPlan: fixed step order for a full config (default warm route — no copy-rust-resources)', () => {
+  const config = baseConfig({
+    rustFilters: ['foo'],
+    nodeTests: ['t.js'],
+    negFile: 'x.rs',
+    negTest: 'rust:foo',
+    waitBackend: true,
+    live: 'echo hi',
+  });
+  const names = buildPlan(config).map(s => s.name);
+  assert.deepEqual(names, [
+    'preflight',
+    'rust:foo',
+    'node:t.js',
+    'negative-control',
+    'merge',
+    'task-complete',
+    'mark-landed',
+    'wait-backend',
+    'live',
+  ]);
+});
+
+test('buildPlan: --rust-in-worktree escape hatch keeps copy-rust-resources (TASK_2084 R3)', () => {
+  const config = baseConfig({ rustFilters: ['foo'], rustInWorktree: true, noMerge: true });
+  const names = buildPlan(config).map(s => s.name);
+  assert.deepEqual(names, ['preflight', 'copy-rust-resources', 'rust:foo']);
+});
+
+test('buildPlan: --no-merge drops merge/task-complete/mark-landed', () => {
+  const config = baseConfig({ noMerge: true });
+  const names = buildPlan(config).map(s => s.name);
+  assert.deepEqual(names, ['preflight']);
+});
+
+test('resolveVerifyTargetDir: env var wins on any platform', () => {
+  assert.equal(resolveVerifyTargetDir({ KENAZ_VERIFY_TARGET_DIR: '/x/y' }, 'linux'), '/x/y');
+  assert.equal(resolveVerifyTargetDir({ KENAZ_VERIFY_TARGET_DIR: '/x/y' }, 'win32'), '/x/y');
+});
+
+test('resolveVerifyTargetDir: win32 falls back to canonical dir without env var', () => {
+  assert.equal(resolveVerifyTargetDir({}, 'win32'), 'C:/t/kenaz-verify');
+});
+
+test('resolveVerifyTargetDir: non-win32 without env var throws (no silent fallback)', () => {
+  assert.throws(() => resolveVerifyTargetDir({}, 'linux'), /KENAZ_VERIFY_TARGET_DIR/);
+});
+
+test('latestStartedAtAfter: finds quoted started_at at/after sinceMs', () => {
+  // The raw "started_at=" value carries no timezone (chrono::Local::now()'s
+  // format string has none) — both the Rust backend and this script run on
+  // the same machine, so Date's local-time parsing is the correct
+  // interpretation in production. Build the fixture in local time too, so
+  // the test doesn't depend on the runner's timezone.
+  const pad = n => String(n).padStart(2, '0');
+  const since = new Date(2026, 8, 27, 12, 0, 0, 0);
+  const later = new Date(since.getTime() + 5000);
+  const raw = `${later.getFullYear()}-${pad(later.getMonth() + 1)}-${pad(later.getDate())} ` +
+    `${pad(later.getHours())}:${pad(later.getMinutes())}:${pad(later.getSeconds())}.000`;
+  const tail = `blah\nINFO started_at="${raw}" backend logging initialized pid=1\n`;
+  const result = latestStartedAtAfter(tail, since.getTime());
+  assert.ok(result, 'expected a match');
+  assert.equal(new Date(result).getTime(), later.getTime());
+});
+
+test('latestStartedAtAfter: timestamp before sinceMs -> null', () => {
+  const tail = 'started_at="2020-01-01 00:00:00.000" backend logging initialized\n';
+  const sinceMs = Date.now();
+  assert.equal(latestStartedAtAfter(tail, sinceMs), null);
+});
+
+test('latestStartedAtAfter: no matching line -> null', () => {
+  assert.equal(latestStartedAtAfter('nothing here\n', Date.now()), null);
+});
+
+// ── pipeline tests (the six required scenarios) ─────────────────────────
+
+test('success path: runs steps in order (rust via the warm rust-verify-worktree.js route), verifies the merge landed, and merges exactly once', async () => {
+  const calls = [];
+  const rustVerifyCalls = [];
+  let mergeCount = 0;
+  let headRevParseCount = 0; // stepMerge calls `rev-parse HEAD` twice: before and after.
+  const config = baseConfig({
+    rustFilters: ['foo'],
+    nodeTests: ['test/a.test.js'],
+    messageFile: '/msg.txt',
+  });
+  const deps = {
+    env: { KENAZ_VERIFY_TARGET_DIR: 'C:/t/fake' },
+    platform: 'win32',
+    fs: makeFakeFs(),
+    now: () => 0,
+    sleep: async () => {},
+    spawnSync: (cmd, args, opts) => {
+      calls.push([cmd, ...args].join(' '));
+      if (cmd === 'git' && args[2] === 'worktree' && args[3] === 'list') return ok(worktreeListOutput('/repo', '/wt', 'ansuz-wt-test'));
+      if (cmd === 'git' && args[2] === 'rev-parse' && args[3] === '--abbrev-ref') return ok('ansuz-wt-test\n');
+      if (cmd === 'git' && args[2] === 'status') return ok('');
+      if (cmd === 'git' && args[2] === 'rev-list') return ok('3\n');
+      if (cmd === 'node' && args[0].includes('rust-verify-worktree.js') && args[1] === 'run') {
+        rustVerifyCalls.push({ args, cwd: opts && opts.cwd });
+        return ok('test result: ok. 5 passed; 0 failed\n');
+      }
+      if (cmd === 'node' && args[0] === '--test') return ok('ℹ pass 2\nℹ fail 0\n');
+      if (cmd === 'git' && args[2] === 'merge' && args.includes('--no-ff')) {
+        mergeCount++;
+        return ok('Merge made by the recursive strategy.\n');
+      }
+      if (cmd === 'git' && args[2] === 'rev-parse' && args[3] === 'HEAD') {
+        headRevParseCount++;
+        // before the merge: deadbeef; after: cafebabe (HEAD actually moved).
+        return ok((headRevParseCount === 1 ? 'deadbeef' : 'cafebabe') + '\n');
+      }
+      if (cmd === 'git' && args[2] === 'rev-parse' && args[3] === 'ansuz-wt-test') return ok('branchtip1\n');
+      if (cmd === 'git' && args[2] === 'merge-base' && args[3] === '--is-ancestor') return ok('');
+      if (cmd === 'node' && args[0].includes('task-api.js')) return ok('completed\n');
+      if (cmd === 'node' && args[0].includes('worktree-create.js')) return ok('landed\n');
+      throw new Error('unexpected spawnSync: ' + [cmd, ...args].join(' '));
+    },
+  };
+  const result = await runVerifyAndLand(config, deps);
+  assert.equal(result.ok, true);
+  assert.equal(result.failed_step, null);
+  assert.equal(result.branch, 'ansuz-wt-test');
+  // No copy-rust-resources step on the default (warm) route — rust-verify-worktree.js
+  // copies its own resources into the fixed verify worktree.
+  assert.deepEqual(
+    result.steps.map(s => s.name),
+    ['preflight', 'rust:foo', 'node:test/a.test.js', 'merge', 'task-complete', 'mark-landed']
+  );
+  assert.ok(result.steps.every(s => s.ok === true));
+  assert.equal(mergeCount, 1, 'merge must run exactly once');
+
+  // A1: the rust step spawns rust-verify-worktree.js with the branch, filter,
+  // and default timeouts, cwd = config.repo (never config.worktree).
+  assert.equal(rustVerifyCalls.length, 1);
+  assert.deepEqual(rustVerifyCalls[0].args.slice(1), [
+    'run', 'ansuz-wt-test', 'foo', '--lock-wait-s', String(DEFAULT_RUST_LOCK_WAIT_S), '--max-s', String(DEFAULT_RUST_MAX_S),
+  ]);
+  assert.equal(rustVerifyCalls[0].cwd, '/repo');
+});
+
+test('TASK_2142 R2: task-complete bakes landed commit sha + verification summary into the card via `update --technical-notes --append`, BEFORE `complete` runs', async () => {
+  const taskApiCalls = [];
+  let headCount = 0;
+  const config = baseConfig({ rustFilters: ['foo'] });
+  const deps = {
+    env: { KENAZ_VERIFY_TARGET_DIR: 'C:/t/fake' },
+    platform: 'win32',
+    fs: makeFakeFs(),
+    now: () => 0,
+    sleep: async () => {},
+    spawnSync: (cmd, args) => {
+      if (cmd === 'git' && args[2] === 'worktree' && args[3] === 'list') return ok(worktreeListOutput('/repo', '/wt', 'ansuz-wt-test'));
+      if (cmd === 'git' && args[2] === 'rev-parse' && args[3] === '--abbrev-ref') return ok('ansuz-wt-test\n');
+      if (cmd === 'git' && args[2] === 'status') return ok('');
+      if (cmd === 'git' && args[2] === 'rev-list') return ok('1\n');
+      if (cmd === 'node' && args[0].includes('rust-verify-worktree.js') && args[1] === 'run') return ok('test result: ok. 3 passed; 0 failed\n');
+      if (cmd === 'git' && args[2] === 'merge' && args.includes('--no-ff')) return ok('Merge made by the recursive strategy.\n');
+      if (cmd === 'git' && args[2] === 'rev-parse' && args[3] === 'HEAD') {
+        headCount++;
+        return ok((headCount === 1 ? 'deadbeef00' : 'cafebabe11') + '\n');
+      }
+      if (cmd === 'git' && args[2] === 'rev-parse' && args[3] === 'ansuz-wt-test') return ok('branchtip1\n');
+      if (cmd === 'git' && args[2] === 'merge-base' && args[3] === '--is-ancestor') return ok('');
+      if (cmd === 'node' && args[0].includes('task-api.js')) {
+        taskApiCalls.push(args);
+        return ok('ok\n');
+      }
+      if (cmd === 'node' && args[0].includes('worktree-create.js')) return ok('landed\n');
+      throw new Error('unexpected spawnSync: ' + [cmd, ...args].join(' '));
+    },
+  };
+  const result = await runVerifyAndLand(config, deps);
+  assert.equal(result.ok, true);
+
+  // Exactly two task-api.js invocations: update (landing info), then complete.
+  assert.equal(taskApiCalls.length, 2);
+  const [updateArgs, completeArgs] = taskApiCalls;
+  assert.equal(updateArgs[3], 'update');
+  assert.ok(updateArgs.includes('--technical-notes'));
+  assert.ok(updateArgs.includes('--append'));
+  assert.ok(updateArgs.some(a => typeof a === 'string' && a.startsWith('Landed commit: ')));
+  assert.ok(updateArgs.some(a => typeof a === 'string' && a.startsWith('Verification: ')));
+  assert.ok(completeArgs.includes('complete'));
+});
+
+test('TASK_2142 R2: --no-merge skips writeLandingInfo entirely (no update call, only complete via mark-landed path is also skipped)', async () => {
+  // --no-merge drops merge/task-complete/mark-landed from the plan altogether
+  // (see buildPlan) -- this just re-confirms writeLandingInfo has nothing to
+  // do when task-complete never runs (ctx.postMergeHead never gets set).
+  const config = baseConfig({ noMerge: true, rustFilters: [] });
+  const deps = {
+    env: { KENAZ_VERIFY_TARGET_DIR: 'C:/t/fake' },
+    platform: 'win32',
+    fs: makeFakeFs(),
+    now: () => 0,
+    sleep: async () => {},
+    spawnSync: (cmd, args) => {
+      if (cmd === 'git' && args[2] === 'worktree' && args[3] === 'list') return ok(worktreeListOutput('/repo', '/wt', 'ansuz-wt-test'));
+      if (cmd === 'git' && args[2] === 'rev-parse' && args[3] === '--abbrev-ref') return ok('ansuz-wt-test\n');
+      if (cmd === 'git' && args[2] === 'status') return ok('');
+      if (cmd === 'git' && args[2] === 'rev-list') return ok('1\n');
+      throw new Error('unexpected spawnSync: ' + [cmd, ...args].join(' '));
+    },
+  };
+  const result = await runVerifyAndLand(config, deps);
+  assert.equal(result.ok, true);
+  assert.deepEqual(result.steps.map(s => s.name), ['preflight']);
+});
+
+test('failing rust suite: stops before merge, failed_step set, merge never invoked', async () => {
+  const config = baseConfig({ rustFilters: ['broken'] });
+  let mergeCalled = false;
+  const deps = {
+    env: { KENAZ_VERIFY_TARGET_DIR: 'C:/t/fake' },
+    platform: 'win32',
+    fs: makeFakeFs(),
+    now: () => 0,
+    sleep: async () => {},
+    spawnSync: (cmd, args) => {
+      if (cmd === 'git' && args[2] === 'worktree' && args[3] === 'list') return ok(worktreeListOutput('/repo', '/wt', 'ansuz-wt-test'));
+      if (cmd === 'git' && args[2] === 'rev-parse' && args[3] === '--abbrev-ref') return ok('ansuz-wt-test\n');
+      if (cmd === 'git' && args[2] === 'status') return ok('');
+      if (cmd === 'git' && args[2] === 'rev-list') return ok('1\n');
+      if (cmd === 'node' && args[0].includes('rust-verify-worktree.js') && args[1] === 'run') {
+        return bad(101, 'test result: FAILED. 2 passed; 1 failed\n');
+      }
+      if (cmd === 'git' && args[2] === 'merge') { mergeCalled = true; return ok(''); }
+      throw new Error('unexpected spawnSync: ' + [cmd, ...args].join(' '));
+    },
+  };
+  const result = await runVerifyAndLand(config, deps);
+  assert.equal(result.ok, false);
+  assert.equal(result.failed_step, 'rust:broken');
+  assert.equal(mergeCalled, false);
+  assert.deepEqual(result.steps.map(s => s.name), ['preflight', 'rust:broken']);
+});
+
+test('rust step (warm route): exit 75 from rust-verify-worktree.js maps to "verify worktree busy"', async () => {
+  const config = baseConfig({ rustFilters: ['foo'] });
+  const deps = {
+    env: {}, platform: 'win32', fs: makeFakeFs(), now: () => 0, sleep: async () => {},
+    spawnSync: (cmd, args) => {
+      if (cmd === 'git' && args[2] === 'worktree' && args[3] === 'list') return ok(worktreeListOutput('/repo', '/wt', 'ansuz-wt-test'));
+      if (cmd === 'git' && args[2] === 'rev-parse' && args[3] === '--abbrev-ref') return ok('ansuz-wt-test\n');
+      if (cmd === 'git' && args[2] === 'status') return ok('');
+      if (cmd === 'git' && args[2] === 'rev-list') return ok('1\n');
+      if (cmd === 'node' && args[0].includes('rust-verify-worktree.js') && args[1] === 'run') {
+        return bad(75, '', 'verify worktree busy — report unverified\n');
+      }
+      throw new Error('unexpected spawnSync: ' + [cmd, ...args].join(' '));
+    },
+  };
+  const result = await runVerifyAndLand(config, deps);
+  assert.equal(result.ok, false);
+  assert.equal(result.failed_step, 'rust:foo');
+  assert.equal(result.steps[result.steps.length - 1].summary, 'verify worktree busy');
+});
+
+test('rust step (warm route): exit 124 from rust-verify-worktree.js maps to "rust verify timed out"', async () => {
+  const config = baseConfig({ rustFilters: ['foo'] });
+  const deps = {
+    env: {}, platform: 'win32', fs: makeFakeFs(), now: () => 0, sleep: async () => {},
+    spawnSync: (cmd, args) => {
+      if (cmd === 'git' && args[2] === 'worktree' && args[3] === 'list') return ok(worktreeListOutput('/repo', '/wt', 'ansuz-wt-test'));
+      if (cmd === 'git' && args[2] === 'rev-parse' && args[3] === '--abbrev-ref') return ok('ansuz-wt-test\n');
+      if (cmd === 'git' && args[2] === 'status') return ok('');
+      if (cmd === 'git' && args[2] === 'rev-list') return ok('1\n');
+      if (cmd === 'node' && args[0].includes('rust-verify-worktree.js') && args[1] === 'run') {
+        return bad(124, '', 'test run exceeded --max-s — report unverified\n');
+      }
+      throw new Error('unexpected spawnSync: ' + [cmd, ...args].join(' '));
+    },
+  };
+  const result = await runVerifyAndLand(config, deps);
+  assert.equal(result.ok, false);
+  assert.equal(result.failed_step, 'rust:foo');
+  assert.equal(result.steps[result.steps.length - 1].summary, 'rust verify timed out');
+});
+
+test('--rust-in-worktree escape hatch: reproduces the old in-worktree spawn exactly (cwd=worktree, CARGO_TARGET_DIR set)', async () => {
+  const config = baseConfig({ rustFilters: ['foo'], rustInWorktree: true, noMerge: true });
+  const rustCalls = [];
+  const deps = {
+    env: { KENAZ_VERIFY_TARGET_DIR: 'C:/t/fake', OTHER: '1' },
+    platform: 'win32',
+    fs: makeFakeFs(),
+    now: () => 0,
+    sleep: async () => {},
+    spawnSync: (cmd, args, opts) => {
+      if (cmd === 'git' && args[2] === 'worktree' && args[3] === 'list') return ok(worktreeListOutput('/repo', '/wt', 'ansuz-wt-test'));
+      if (cmd === 'git' && args[2] === 'rev-parse' && args[3] === '--abbrev-ref') return ok('ansuz-wt-test\n');
+      if (cmd === 'git' && args[2] === 'status') return ok('');
+      if (cmd === 'git' && args[2] === 'rev-list') return ok('1\n');
+      if (cmd === 'node' && args[0] === 'dev/scripts/run-rust-tests.js') {
+        rustCalls.push({ args, opts });
+        return ok('test result: ok. 1 passed; 0 failed\n');
+      }
+      throw new Error('unexpected spawnSync: ' + [cmd, ...args].join(' '));
+    },
+  };
+  const result = await runVerifyAndLand(config, deps);
+  assert.equal(result.failed_step, null);
+  assert.deepEqual(result.steps.map(s => s.name), ['preflight', 'copy-rust-resources', 'rust:foo']);
+  assert.equal(rustCalls.length, 1);
+  // Exactly the pre-TASK_2084 spawn: same command, args, cwd and env shape.
+  assert.deepEqual(rustCalls[0].args, ['dev/scripts/run-rust-tests.js', 'foo']);
+  assert.equal(rustCalls[0].opts.cwd, config.worktree);
+  assert.equal(rustCalls[0].opts.env.CARGO_TARGET_DIR, 'C:/t/fake');
+  assert.equal(rustCalls[0].opts.env.SKIP_SIDECAR_STAGING, '1');
+  assert.equal(rustCalls[0].opts.env.OTHER, '1');
+});
+
+test('negative control passes on main: stops before merge, failed_step = negative-control', async () => {
+  const config = baseConfig({ negFile: 'src/thing.rs', negTest: 'test/thing.test.js' });
+  const fakeFs = makeFakeFs({ '/wt/src/thing.rs': 'CURRENT VERSION' });
+  let mergeCalled = false;
+  const deps = {
+    env: {}, platform: 'win32', fs: fakeFs, now: () => 0, sleep: async () => {},
+    spawnSync: (cmd, args) => {
+      if (cmd === 'git' && args[2] === 'worktree' && args[3] === 'list') return ok(worktreeListOutput('/repo', '/wt', 'ansuz-wt-test'));
+      if (cmd === 'git' && args[2] === 'rev-parse' && args[3] === '--abbrev-ref') return ok('ansuz-wt-test\n');
+      if (cmd === 'git' && args[2] === 'status') return ok('');
+      if (cmd === 'git' && args[2] === 'rev-list') return ok('1\n');
+      if (cmd === 'git' && args[2] === 'show') return { status: 0, stdout: Buffer.from('MAIN VERSION (old, buggy)'), stderr: '' };
+      // The whole point of the negative control: on main's version, the test still passes (bad).
+      if (cmd === 'node' && args[0] === '--test') return ok('ℹ pass 3\nℹ fail 0\n');
+      if (cmd === 'git' && args[2] === 'merge') { mergeCalled = true; return ok(''); }
+      throw new Error('unexpected spawnSync: ' + [cmd, ...args].join(' '));
+    },
+  };
+  const result = await runVerifyAndLand(config, deps);
+  assert.equal(result.ok, false);
+  assert.equal(result.failed_step, 'negative-control');
+  assert.equal(mergeCalled, false);
+  // File must have been restored to its original worktree content.
+  assert.equal(fakeFs.store.get('/wt/src/thing.rs').toString(), 'CURRENT VERSION');
+});
+
+test('negative control with a rust: test (warm route): passes --overlay-from main:<negFile>, never touches the task worktree file', async () => {
+  const config = baseConfig({ negFile: 'src/thing.rs', negTest: 'rust:thing_filter' });
+  const fakeFs = makeFakeFs({ '/wt/src/thing.rs': 'CURRENT VERSION' });
+  const rustVerifyCalls = [];
+  let mergeCalled = false;
+  const deps = {
+    env: {}, platform: 'win32', fs: fakeFs, now: () => 0, sleep: async () => {},
+    spawnSync: (cmd, args, opts) => {
+      if (cmd === 'git' && args[2] === 'worktree' && args[3] === 'list') return ok(worktreeListOutput('/repo', '/wt', 'ansuz-wt-test'));
+      if (cmd === 'git' && args[2] === 'rev-parse' && args[3] === '--abbrev-ref') return ok('ansuz-wt-test\n');
+      if (cmd === 'git' && args[2] === 'status') return ok('');
+      if (cmd === 'git' && args[2] === 'rev-list') return ok('1\n');
+      if (cmd === 'node' && args[0].includes('rust-verify-worktree.js') && args[1] === 'run') {
+        rustVerifyCalls.push({ args, cwd: opts && opts.cwd });
+        // On main's (pre-fix) version of the file, the test still passes — bad.
+        return ok('test result: ok. 3 passed; 0 failed\n');
+      }
+      if (cmd === 'git' && args[2] === 'merge') { mergeCalled = true; return ok(''); }
+      throw new Error('unexpected spawnSync: ' + [cmd, ...args].join(' '));
+    },
+  };
+  const result = await runVerifyAndLand(config, deps);
+  assert.equal(result.ok, false);
+  assert.equal(result.failed_step, 'negative-control');
+  assert.equal(mergeCalled, false);
+  // Never touched the task worktree's copy of the file — no rewrite/restore.
+  assert.equal(fakeFs.store.get('/wt/src/thing.rs').toString(), 'CURRENT VERSION');
+  assert.equal(fakeFs.writes.filter(w => w.path === '/wt/src/thing.rs').length, 0);
+  assert.equal(rustVerifyCalls.length, 1);
+  assert.ok(rustVerifyCalls[0].args.includes('--overlay-from'));
+  assert.ok(rustVerifyCalls[0].args.includes('main:src/thing.rs'));
+  assert.deepEqual(rustVerifyCalls[0].args.slice(1), [
+    'run', 'ansuz-wt-test', 'thing_filter', '--overlay-from', 'main:src/thing.rs',
+    '--lock-wait-s', String(DEFAULT_RUST_LOCK_WAIT_S), '--max-s', String(DEFAULT_RUST_MAX_S),
+  ]);
+  assert.equal(rustVerifyCalls[0].cwd, '/repo');
+});
+
+test('dirty worktree: refused before anything else runs', async () => {
+  const config = baseConfig({ rustFilters: ['foo'], nodeTests: ['t.js'] });
+  const calls = [];
+  const deps = {
+    env: {}, platform: 'win32', fs: makeFakeFs(), now: () => 0, sleep: async () => {},
+    spawnSync: (cmd, args) => {
+      calls.push([cmd, ...args].join(' '));
+      if (cmd === 'git' && args[2] === 'worktree' && args[3] === 'list') return ok(worktreeListOutput('/repo', '/wt', 'ansuz-wt-test'));
+      if (cmd === 'git' && args[2] === 'rev-parse' && args[3] === '--abbrev-ref') return ok('ansuz-wt-test\n');
+      if (cmd === 'git' && args[2] === 'status') return ok(' M dashboard/src-tauri/src/lib.rs\n');
+      throw new Error('unexpected spawnSync beyond preflight: ' + [cmd, ...args].join(' '));
+    },
+  };
+  const result = await runVerifyAndLand(config, deps);
+  assert.equal(result.ok, false);
+  assert.equal(result.failed_step, 'preflight');
+  assert.deepEqual(result.steps.map(s => s.name), ['preflight']);
+  // resolveRepo's `git worktree list` (repo validation) runs before the step
+  // loop even starts, then only the two preflight calls (branch resolve +
+  // dirty check) — no rev-list, no rust/node suites, no merge.
+  assert.equal(calls.length, 3);
+});
+
+// ── preflight: dispatch-telemetry exclusion (TASK_2069) ──────────────────
+//
+// Every subagent worktree's dispatch prompt writes an untracked
+// .kenaz/specialist/progress_note_TASK_<id>.json, deliberately excluded
+// from its own commit — preflight used to refuse on it ("worktree has
+// tracked changes, refusing" even though the file was untracked). Fixed by
+// passing the same WORKTREE_COMMIT_EXCLUDE_PATHSPECS the dispatch commit
+// step already excludes to `git status --short`, and trusting git to
+// filter. rune rune_db21a2fc.
+
+test('preflight: an untracked dispatch-telemetry file alone (.kenaz/specialist/progress_note) passes; git status is called with the shared exclude pathspecs', async () => {
+  const config = baseConfig({ noMerge: true });
+  const statusCalls = [];
+  const deps = {
+    env: {}, platform: 'win32', fs: makeFakeFs(), now: () => 0, sleep: async () => {},
+    spawnSync: (cmd, args) => {
+      if (cmd === 'git' && args[2] === 'worktree' && args[3] === 'list') return ok(worktreeListOutput('/repo', '/wt', 'ansuz-wt-test'));
+      if (cmd === 'git' && args[2] === 'rev-parse' && args[3] === '--abbrev-ref') return ok('ansuz-wt-test\n');
+      if (cmd === 'git' && args[2] === 'rev-list') return ok('1\n');
+      if (cmd === 'git' && args[2] === 'status') {
+        statusCalls.push(args);
+        // Simulate real git honoring the exclude pathspecs this call must
+        // pass: a progress note under .kenaz/specialist is untracked but
+        // excluded, so real git's filtered `--short` output is empty. If
+        // the pathspecs were NOT passed (old, unfixed behavior — the
+        // negative control from the task spec), real git would instead
+        // report "?? .kenaz/specialist/progress_note_TASK_x.json" and
+        // preflight would refuse.
+        const hasAllExcludes = WORKTREE_COMMIT_EXCLUDE_PATHSPECS.every(p => args.includes(p));
+        return ok(hasAllExcludes ? '' : '?? .kenaz/specialist/progress_note_TASK_x.json\n');
+      }
+      throw new Error('unexpected spawnSync beyond preflight: ' + [cmd, ...args].join(' '));
+    },
+  };
+  const result = await runVerifyAndLand(config, deps);
+  assert.equal(result.ok, true);
+  assert.equal(result.failed_step, null);
+  assert.equal(statusCalls.length, 1);
+  for (const p of WORKTREE_COMMIT_EXCLUDE_PATHSPECS) {
+    assert.ok(statusCalls[0].includes(p), `status call must include exclude pathspec ${p}`);
+  }
+});
+
+test('preflight: an untracked file outside the excluded paths still refuses, with an "untracked" message', async () => {
+  const config = baseConfig({ noMerge: true });
+  const deps = {
+    env: {}, platform: 'win32', fs: makeFakeFs(), now: () => 0, sleep: async () => {},
+    spawnSync: (cmd, args) => {
+      if (cmd === 'git' && args[2] === 'worktree' && args[3] === 'list') return ok(worktreeListOutput('/repo', '/wt', 'ansuz-wt-test'));
+      if (cmd === 'git' && args[2] === 'rev-parse' && args[3] === '--abbrev-ref') return ok('ansuz-wt-test\n');
+      if (cmd === 'git' && args[2] === 'status') return ok('?? src/some_new_file.rs\n');
+      throw new Error('unexpected spawnSync beyond preflight: ' + [cmd, ...args].join(' '));
+    },
+  };
+  const result = await runVerifyAndLand(config, deps);
+  assert.equal(result.ok, false);
+  assert.equal(result.failed_step, 'preflight');
+  assert.match(result.steps[0].summary, /untracked/);
+  assert.ok(!/tracked changes/.test(result.steps[0].summary), 'an untracked-only refusal must not say "tracked changes"');
+});
+
+test('preflight: commits-ahead check uses HEAD..<branch> in config.repo, not a hardcoded main..<branch>', async () => {
+  const config = baseConfig({ noMerge: true });
+  let revListArgs = null;
+  const deps = {
+    env: {}, platform: 'win32', fs: makeFakeFs(), now: () => 0, sleep: async () => {},
+    spawnSync: (cmd, args) => {
+      if (cmd === 'git' && args[2] === 'worktree' && args[3] === 'list') return ok(worktreeListOutput('/repo', '/wt', 'ansuz-wt-test'));
+      if (cmd === 'git' && args[2] === 'rev-parse' && args[3] === '--abbrev-ref') return ok('ansuz-wt-test\n');
+      if (cmd === 'git' && args[2] === 'status') return ok('');
+      if (cmd === 'git' && args[2] === 'rev-list') { revListArgs = args; return ok('2\n'); }
+      throw new Error('unexpected spawnSync beyond preflight: ' + [cmd, ...args].join(' '));
+    },
+  };
+  const result = await runVerifyAndLand(config, deps);
+  assert.equal(result.ok, true);
+  assert.ok(revListArgs, 'rev-list must have been called');
+  assert.equal(revListArgs[revListArgs.length - 1], 'HEAD..ansuz-wt-test');
+  assert.ok(!revListArgs.some(a => a === 'main..ansuz-wt-test'), 'must not use a hardcoded main..<branch>');
+});
+
+test('dry-run: resolves/validates --repo via read-only git (same guard as a real run), plans steps, never touches fs', async () => {
+  const config = baseConfig({
+    dryRun: true,
+    rustFilters: ['foo'],
+    nodeTests: ['t.js'],
+    negFile: 'x.rs',
+    negTest: 'rust:foo',
+    waitBackend: true,
+    live: 'echo hi',
+  });
+  const deps = {
+    env: {}, platform: 'win32',
+    // Only the read-only `git worktree list --porcelain` call (repo
+    // resolution/validation) is allowed in dry-run — anything else calling
+    // spawnSync is a bug (rust/node suites, merge, etc must not run).
+    spawnSync: (cmd, args) => {
+      if (cmd === 'git' && args.includes('worktree') && args.includes('list')) {
+        return ok(worktreeListOutput(config.repo, config.worktree, 'branch-x'));
+      }
+      throw new Error(`spawnSync must not be called for ${cmd} ${args.join(' ')} in dry-run`);
+    },
+    fs: new Proxy({}, { get() { return () => { throw new Error('fs must not be touched in dry-run'); }; } }),
+    tmpdir: () => { throw new Error('tmpdir must not be called in dry-run'); },
+    now: () => { throw new Error('now must not be called in dry-run'); },
+    sleep: async () => { throw new Error('sleep must not be called in dry-run'); },
+  };
+  const result = await runVerifyAndLand(config, deps);
+  assert.equal(result.dry_run, true);
+  assert.equal(result.ok, true);
+  assert.equal(result.repo, config.repo, 'dry-run output includes the resolved repo path');
+  assert.deepEqual(
+    result.steps.map(s => s.name),
+    ['preflight', 'rust:foo', 'node:t.js', 'negative-control', 'merge', 'task-complete', 'mark-landed', 'wait-backend', 'live']
+  );
+  assert.ok(result.steps.every(s => s.planned === true));
+});
+
+test('dry-run: --repo equal to --worktree is refused before a plan is printed (same guard as a real run)', async () => {
+  const config = baseConfig({ dryRun: true, repo: '/wt', worktree: '/wt' });
+  const deps = {
+    spawnSync: () => { throw new Error('must not be called — the worktree-equality check is a pure path comparison'); },
+    fs: new Proxy({}, { get() { return () => { throw new Error('fs must not be touched'); }; } }),
+  };
+  await assert.rejects(() => runVerifyAndLand(config, deps), UsageError);
+});
+
+test('CLI: --repo equal to --worktree with --dry-run exits 2, not 0 with a plan (real subprocess)', () => {
+  const scriptPath = path.join(__dirname, 'verify-and-land.js');
+  const res = realSpawnSync(
+    process.execPath,
+    [scriptPath, '--task', 'TASK_X', '--worktree', __dirname, '--repo', __dirname, '--no-merge', '--dry-run'],
+    { encoding: 'utf8' }
+  );
+  assert.equal(res.status, 2);
+  assert.match(res.stderr, /--repo must not be the worktree itself/);
+});
+
+test('negative control always restores the file even when the neg test throws', async () => {
+  const config = baseConfig({ negFile: 'src/thing.rs', negTest: 'test/thing.test.js' });
+  const fakeFs = makeFakeFs({ '/wt/src/thing.rs': 'CURRENT VERSION' });
+  const deps = {
+    env: {}, platform: 'win32', fs: fakeFs, now: () => 0, sleep: async () => {},
+    spawnSync: (cmd, args) => {
+      if (cmd === 'git' && args[2] === 'worktree' && args[3] === 'list') return ok(worktreeListOutput('/repo', '/wt', 'ansuz-wt-test'));
+      if (cmd === 'git' && args[2] === 'rev-parse' && args[3] === '--abbrev-ref') return ok('ansuz-wt-test\n');
+      if (cmd === 'git' && args[2] === 'status') return ok('');
+      if (cmd === 'git' && args[2] === 'rev-list') return ok('1\n');
+      if (cmd === 'git' && args[2] === 'show') return { status: 0, stdout: Buffer.from('MAIN VERSION'), stderr: '' };
+      // Simulate the neg test's own execution blowing up (e.g. spawn failure).
+      if (cmd === 'node' && args[0] === '--test') throw new Error('spawn ENOENT');
+      throw new Error('unexpected spawnSync: ' + [cmd, ...args].join(' '));
+    },
+  };
+  const result = await runVerifyAndLand(config, deps);
+  assert.equal(result.ok, false);
+  assert.equal(result.failed_step, 'negative-control');
+  assert.match(result.steps[result.steps.length - 1].summary, /threw:/);
+  // Despite the throw, the file must be back to its original content — the
+  // LAST write to that path is the restore, not the main-branch version.
+  assert.equal(fakeFs.store.get('/wt/src/thing.rs').toString(), 'CURRENT VERSION');
+  const writesToFile = fakeFs.writes.filter(w => w.path === '/wt/src/thing.rs');
+  assert.ok(writesToFile.length >= 2, 'expected at least [main version write, restore write]');
+  assert.equal(writesToFile[writesToFile.length - 1].data.toString(), 'CURRENT VERSION');
+});
+
+// ── repo resolution & merge verification (coordinator follow-up) ────────
+//
+// Real-run dogfood of an earlier version landed TASK_2059 with cwd = the
+// worktree itself and no --repo: the default was derived from this
+// script's own __dirname, which — when the script runs from inside a
+// worktree checkout (the normal case) — silently resolved to the WORKTREE,
+// not the main repo. `git merge` then merged the branch into its own
+// worktree ("Already up to date", exit 0, no error) and task-api ran
+// against the worktree's own .kenaz/tasks dir ("任務不存在"). No damage was
+// done, but the step was recorded ok=true. Fixed by (1) deriving --repo
+// from the worktree via git plumbing instead of __dirname, and (2)
+// verifying a merge actually landed instead of trusting a zero exit code.
+
+test('resolveRepoFromWorktree: derives the repo root from git-common-dir (.kenaz-worktrees layout)', () => {
+  const calls = [];
+  const deps = {
+    spawnSync: (cmd, args) => {
+      calls.push([cmd, ...args].join(' '));
+      if (cmd === 'git' && args[2] === 'rev-parse' && args[3] === '--path-format=absolute' && args[4] === '--git-common-dir') {
+        return ok('C:/Users/user/Documents/GitHub/KenazAI/.git\n');
+      }
+      throw new Error('unexpected spawnSync: ' + [cmd, ...args].join(' '));
+    },
+  };
+  const repo = resolveRepoFromWorktree(deps, 'C:/Users/user/Documents/GitHub/.kenaz-worktrees/KenazAI/wt-abc123');
+  assert.equal(repo, 'C:/Users/user/Documents/GitHub/KenazAI');
+  assert.equal(calls.length, 1);
+  assert.match(calls[0], /-C C:\/Users\/user\/Documents\/GitHub\/\.kenaz-worktrees\/KenazAI\/wt-abc123 rev-parse --path-format=absolute --git-common-dir/);
+});
+
+test('resolveRepo: no --repo given -> resolved via resolveRepoFromWorktree, never via __dirname', () => {
+  const config = { worktree: '/kw/wt-abc', repo: null };
+  const deps = {
+    spawnSync: (cmd, args) => {
+      if (cmd === 'git' && args[3] === '--path-format=absolute') return ok('/repo/.git\n');
+      throw new Error('unexpected: ' + [cmd, ...args].join(' '));
+    },
+  };
+  const repo = resolveRepo(config, deps);
+  assert.equal(repo, '/repo');
+  assert.equal(config.repo, '/repo', 'resolveRepo must set config.repo in place');
+});
+
+test('assertRepoOwnsWorktree: --repo equal to the worktree itself -> UsageError', () => {
+  const deps = { spawnSync: () => { throw new Error('must not call git — the equality check is local'); } };
+  assert.throws(
+    () => assertRepoOwnsWorktree(deps, '/wt', '/wt'),
+    err => err instanceof UsageError && /must not be the worktree itself/.test(err.message)
+  );
+});
+
+test('assertRepoOwnsWorktree: given --repo does not list the worktree -> UsageError', () => {
+  const deps = {
+    spawnSync: (cmd, args) => {
+      if (cmd === 'git' && args[2] === 'worktree' && args[3] === 'list') {
+        return ok('worktree /repo\nbranch refs/heads/main\n'); // no /wt entry
+      }
+      throw new Error('unexpected: ' + [cmd, ...args].join(' '));
+    },
+  };
+  assert.throws(
+    () => assertRepoOwnsWorktree(deps, '/repo', '/wt'),
+    err => err instanceof UsageError && /does not list/.test(err.message)
+  );
+});
+
+test('assertRepoOwnsWorktree: given --repo that does list the worktree -> passes', () => {
+  const deps = {
+    spawnSync: (cmd, args) => {
+      if (cmd === 'git' && args[2] === 'worktree' && args[3] === 'list') return ok(worktreeListOutput('/repo', '/wt', 'ansuz-wt-test'));
+      throw new Error('unexpected: ' + [cmd, ...args].join(' '));
+    },
+  };
+  assert.doesNotThrow(() => assertRepoOwnsWorktree(deps, '/repo', '/wt'));
+});
+
+test('runVerifyAndLand: --repo equal to --worktree is refused before any pipeline step runs', async () => {
+  const config = baseConfig({ repo: '/wt', worktree: '/wt', rustFilters: ['foo'] });
+  const deps = {
+    spawnSync: () => { throw new Error('no git/node call should happen once repo===worktree is rejected'); },
+    fs: new Proxy({}, { get() { return () => { throw new Error('fs must not be touched'); }; } }),
+  };
+  await assert.rejects(() => runVerifyAndLand(config, deps), err => err instanceof UsageError && /worktree itself/.test(err.message));
+});
+
+test('merge verification: "Already up to date" (unchanged HEAD) fails the merge step; task-complete/mark-landed never run', async () => {
+  const config = baseConfig({ rustFilters: ['foo'] });
+  const calls = [];
+  let taskCompleteCalled = false;
+  const deps = {
+    env: { KENAZ_VERIFY_TARGET_DIR: 'C:/t/fake' }, platform: 'win32', fs: makeFakeFs(), now: () => 0, sleep: async () => {},
+    spawnSync: (cmd, args) => {
+      calls.push([cmd, ...args].join(' '));
+      if (cmd === 'git' && args[2] === 'worktree' && args[3] === 'list') return ok(worktreeListOutput('/repo', '/wt', 'ansuz-wt-test'));
+      if (cmd === 'git' && args[2] === 'rev-parse' && args[3] === '--abbrev-ref') return ok('ansuz-wt-test\n');
+      if (cmd === 'git' && args[2] === 'status') return ok('');
+      if (cmd === 'git' && args[2] === 'rev-list') return ok('1\n');
+      if (cmd === 'node' && args[0].includes('rust-verify-worktree.js') && args[1] === 'run') return ok('test result: ok. 1 passed; 0 failed\n');
+      if (cmd === 'git' && args[2] === 'merge' && args.includes('--no-ff')) return ok('Already up to date.\n');
+      // HEAD is the SAME before and after — this is the exact bug that shipped.
+      if (cmd === 'git' && args[2] === 'rev-parse' && args[3] === 'HEAD') return ok('deadbeef\n');
+      if (cmd === 'git' && args[2] === 'rev-parse' && args[3] === 'ansuz-wt-test') return ok('branchtip1\n');
+      if (cmd === 'node' && args[0].includes('task-api.js')) { taskCompleteCalled = true; return ok('completed\n'); }
+      throw new Error('unexpected spawnSync: ' + [cmd, ...args].join(' '));
+    },
+  };
+  const result = await runVerifyAndLand(config, deps);
+  assert.equal(result.ok, false);
+  assert.equal(result.failed_step, 'merge');
+  assert.deepEqual(result.steps.map(s => s.name), ['preflight', 'rust:foo', 'merge']);
+  assert.match(result.steps[result.steps.length - 1].summary, /unchanged|did not land/);
+  assert.equal(taskCompleteCalled, false, 'task-api complete must never run after a merge that did not actually land');
+});
+
+// ── TASK_2176: verify_offline (per-project offline verify hook) ────────────
+
+test('resolveVerifyOfflineCmd: reads verify_offline from config.repo/.kenaz/project.yaml', () => {
+  const deps = { fs: makeFakeFs({ '/repo/.kenaz/project.yaml': 'use_worktree: false\nverify_offline: node fake-unity.js --quick\n' }) };
+  assert.equal(resolveVerifyOfflineCmd({ repo: '/repo' }, deps), 'node fake-unity.js --quick');
+});
+
+test('resolveVerifyOfflineCmd: no project.yaml -> null (today\'s behaviour, unaffected project)', () => {
+  const deps = { fs: makeFakeFs({}) };
+  assert.equal(resolveVerifyOfflineCmd({ repo: '/repo' }, deps), null);
+});
+
+test('resolveVerifyOfflineCmd: project.yaml without the key -> null', () => {
+  const deps = { fs: makeFakeFs({ '/repo/.kenaz/project.yaml': 'use_worktree: false\n' }) };
+  assert.equal(resolveVerifyOfflineCmd({ repo: '/repo' }, deps), null);
+});
+
+test('buildPlan: verify-offline step is included only when verifyOfflineCmd is set, placed right before merge', () => {
+  const withCmd = buildPlan(baseConfig({ verifyOfflineCmd: 'node fake-unity.js' }));
+  assert.deepEqual(withCmd.map(s => s.name), ['preflight', 'verify-offline', 'merge', 'task-complete', 'mark-landed']);
+  const withoutCmd = buildPlan(baseConfig({ verifyOfflineCmd: null }));
+  assert.ok(!withoutCmd.some(s => s.kind === 'verify-offline'), 'no key in project.yaml -> no step, unaffected');
+});
+
+test('buildPlan: --no-merge drops verify-offline too (nothing to gate when not landing)', () => {
+  const plan = buildPlan(baseConfig({ verifyOfflineCmd: 'node fake-unity.js', noMerge: true }));
+  assert.ok(!plan.some(s => s.kind === 'verify-offline'));
+});
+
+test('stepVerifyOffline: lock free -> runs the command on config.repo (not the worktree) and releases the lock', () => {
+  const fakeLock = makeFakeLock();
+  const fakeFs = makeFakeFs();
+  const unlinked = [];
+  fakeFs.unlinkSync = p => { unlinked.push(p); fakeLock.release(); };
+  const spawnCalls = [];
+  const deps = Object.assign({ fs: fakeFs }, fakeLock, {
+    spawnSync: (cmd, args, opts) => { spawnCalls.push({ cmd, args, opts }); return { status: 0, stdout: 'ok', stderr: '' }; },
+  });
+  const result = stepVerifyOffline({ repo: '/repo', task: 'TASK_X', verifyOfflineCmd: 'node fake-unity.js --quick' }, deps);
+  assert.equal(result.ok, true);
+  assert.match(result.summary, /exit 0/);
+  assert.equal(spawnCalls.length, 1);
+  assert.equal(spawnCalls[0].cmd, 'node fake-unity.js --quick');
+  assert.equal(spawnCalls[0].opts.cwd, '/repo', 'the heavyweight tool must run on the main tree, never the worktree');
+  assert.equal(unlinked.length, 1, 'lock must be released after a successful run');
+});
+
+test('stepVerifyOffline: real negative control — command fails -> ok:false, lock still released (finally)', () => {
+  const fakeLock = makeFakeLock();
+  const fakeFs = makeFakeFs();
+  fakeFs.unlinkSync = () => { fakeLock.release(); };
+  const deps = Object.assign({ fs: fakeFs }, fakeLock, {
+    spawnSync: () => ({ status: 1, stdout: '', stderr: 'fake-unity: compile error\n' }),
+  });
+  const result = stepVerifyOffline({ repo: '/repo', task: 'TASK_X', verifyOfflineCmd: 'node fake-unity.js --break' }, deps);
+  assert.equal(result.ok, false);
+  assert.match(result.summary, /exit 1/);
+  assert.equal(fakeLock.isHeld(), false, 'a failed heavyweight check must not permanently hold the lock');
+});
+
+test('stepVerifyOffline: lock already held by another landing -> refuses WITHOUT running the heavyweight tool', () => {
+  const fakeLock = makeFakeLock({ taskId: 'TASK_OTHER', startedAt: '2026-01-01T00:00:00.000Z' });
+  let spawnCalled = false;
+  const deps = Object.assign({ fs: makeFakeFs() }, fakeLock, {
+    spawnSync: () => { spawnCalled = true; return { status: 0, stdout: '', stderr: '' }; },
+  });
+  const result = stepVerifyOffline({ repo: '/repo', task: 'TASK_X', verifyOfflineCmd: 'node fake-unity.js' }, deps);
+  assert.equal(result.ok, false);
+  assert.match(result.summary, /lock held/);
+  assert.match(result.summary, /TASK_OTHER/);
+  assert.equal(spawnCalled, false, 'two landings for the same project must never run the heavyweight tool concurrently');
+});
+
+test('runVerifyAndLand: verify_offline failure blocks landing (full pipeline, real negative control) — merge/task-complete/mark-landed never run', async () => {
+  // mergeWithoutTests: true -- this Unity-style project has no rust/node
+  // suite to pass; verify_offline (auto-detected from project.yaml, below)
+  // IS its authoritative verification, exactly the TASK_2176 scenario.
+  const config = baseConfig({ noMerge: false, mergeWithoutTests: true });
+  const fakeLock = makeFakeLock();
+  const fs = makeFakeFs({ '/repo/.kenaz/project.yaml': 'verify_offline: node fake-unity.js --break\n' });
+  fs.unlinkSync = () => { fakeLock.release(); };
+  let mergeCalled = false;
+  const deps = Object.assign({ fs, now: () => 0, sleep: async () => {} }, fakeLock, {
+    spawnSync: (cmd, args) => {
+      if (cmd === 'git' && args[2] === 'worktree' && args[3] === 'list') return ok(worktreeListOutput('/repo', '/wt', 'ansuz-wt-test'));
+      if (cmd === 'git' && args[2] === 'rev-parse' && args[3] === '--abbrev-ref') return ok('ansuz-wt-test\n');
+      if (cmd === 'git' && args[2] === 'status') return ok('');
+      if (cmd === 'git' && args[2] === 'rev-list') return ok('1\n');
+      if (cmd === 'node fake-unity.js --break') return bad(1, '', 'compile error'); // shell:true -- cmd is the whole command string, args is []
+      if (cmd === 'git' && args[2] === 'merge') { mergeCalled = true; return ok('merged\n'); }
+      throw new Error('unexpected spawnSync in verify_offline-blocks-landing test: ' + JSON.stringify({ cmd, args }));
+    },
+  });
+  const result = await runVerifyAndLand(config, deps);
+  assert.equal(result.ok, false);
+  assert.equal(result.failed_step, 'verify-offline');
+  assert.deepEqual(result.steps.map(s => s.name), ['preflight', 'verify-offline']);
+  assert.equal(mergeCalled, false, 'verify_offline failure must block the merge that follows it');
+});
+
+test('stepVerifyOffline: real dispatch lock serializes two landings for the same project (temp project path, no mocked locking)', () => {
+  const os = require('node:os');
+  const fs = require('node:fs');
+  const tmpRoot = fs.mkdtempSync(path.join(os.tmpdir(), 'kenaz-verify-offline-'));
+  const lockFile = realDispatchLockPath(tmpRoot);
+  let heavyToolRuns = 0;
+  const makeDeps = () => ({
+    fs,
+    dispatchLockPath: realDispatchLockPath,
+    tryAcquireDispatchLock: realTryAcquireDispatchLock,
+    spawnSync: () => { heavyToolRuns++; return { status: 0, stdout: 'ok', stderr: '' }; },
+  });
+  try {
+    // Landing #1 (simulated) holds the lock across its own heavyweight run.
+    const held = realTryAcquireDispatchLock(lockFile, { sessionId: 'landing-1', taskId: 'TASK_A', pid: null, holder: 'verify-offline' });
+    assert.equal(held.acquired, true);
+    // Landing #2, same project: must be refused, and the fake heavyweight
+    // tool must NEVER run while #1 holds the lock — the core safety property.
+    const refused = stepVerifyOffline({ repo: tmpRoot, task: 'TASK_B', verifyOfflineCmd: 'fake-unity --quick' }, makeDeps());
+    assert.equal(refused.ok, false);
+    assert.match(refused.summary, /lock held/);
+    assert.equal(heavyToolRuns, 0);
+    // Landing #1 finishes and releases (mirrors stepVerifyOffline's own finally).
+    fs.unlinkSync(lockFile);
+    // Now landing #2 can proceed, and must release the lock itself afterward.
+    const proceeded = stepVerifyOffline({ repo: tmpRoot, task: 'TASK_B', verifyOfflineCmd: 'fake-unity --quick' }, makeDeps());
+    assert.equal(proceeded.ok, true);
+    assert.equal(heavyToolRuns, 1);
+    assert.equal(fs.existsSync(lockFile), false, 'stepVerifyOffline must release the lock in its own finally');
+  } finally {
+    try { fs.unlinkSync(lockFile); } catch { /* already released */ }
+    try { fs.rmSync(tmpRoot, { recursive: true, force: true }); } catch { /* best-effort cleanup */ }
+  }
+});
+
+test('coreToolPath: a sub-project repo (only .kenaz/) resolves core tools via project.yaml core_path (field report TASK_2326)', () => {
+  const fs = require('node:fs');
+  const os = require('node:os');
+  const tmp = fs.mkdtempSync(path.join(os.tmpdir(), 'kenaz-coretool-'));
+  try {
+    const core = path.join(tmp, 'core');
+    const sub = path.join(tmp, 'geo-analyzer');
+    const rel = path.join('.collaboration', 'core', 'task-api.js');
+    fs.mkdirSync(path.join(core, '.collaboration', 'core'), { recursive: true });
+    fs.writeFileSync(path.join(core, rel), '');
+    fs.mkdirSync(path.join(sub, '.kenaz'), { recursive: true });
+    fs.writeFileSync(path.join(sub, '.kenaz', 'project.yaml'), `name: geo\ncore_path: "${core.split(path.sep).join('/')}"\n`);
+    assert.equal(path.resolve(coreToolPath({ repo: sub }, rel)), path.resolve(core, rel));
+    // Control: the core repo itself resolves to its own copy.
+    assert.equal(coreToolPath({ repo: core }, rel), path.join(core, rel));
+    // No project.yaml and no local copy: falls back to the core checkout running this script.
+    const bare = path.join(tmp, 'bare');
+    fs.mkdirSync(bare);
+    assert.ok(fs.existsSync(coreToolPath({ repo: bare }, rel)), 'fallback must be this core checkout');
+  } finally {
+    fs.rmSync(tmp, { recursive: true, force: true });
+  }
+});