From 98872cd8f52c7781ce514ef34bcba6b2fd993200 Mon Sep 17 00:00:00 2001
From: coder-mos1 <coder-mos1@fleet.mosaicstack.dev>
Date: Sat, 1 Aug 2026 00:33:41 -0500
Subject: [PATCH] test(rm-03): prove merge queue bypass reaches provider

---
 .../tools/git/test-pr-merge-head-pin.sh       | 25 +++++++++++++++++++
 1 file changed, 25 insertions(+)

diff --git a/packages/mosaic/framework/tools/git/test-pr-merge-head-pin.sh b/packages/mosaic/framework/tools/git/test-pr-merge-head-pin.sh
index 717c8221..824cc1f4 100644
--- a/packages/mosaic/framework/tools/git/test-pr-merge-head-pin.sh
+++ b/packages/mosaic/framework/tools/git/test-pr-merge-head-pin.sh
@@ -93,6 +93,31 @@ if [[ "$stale_rc" -eq 0 ]] || [[ -e "$WORK_DIR/gitea-payload-stale.json" ]]; the
     exit 1
 fi
 
+# A merge-capable path cannot bypass the mandatory queue guard. The legacy
+# --skip-queue-guard option must be rejected before any provider merge call.
+cat > "$WORK_DIR/gitea/tools/git/ci-queue-wait.sh" <<'SH'
+#!/usr/bin/env bash
+exit 99
+SH
+chmod +x "$WORK_DIR/gitea/tools/git/ci-queue-wait.sh"
+rm -f "$WORK_DIR/gitea-payload-bypass.json"
+set +e
+(
+    cd "$WORK_DIR/gitea/repo"
+    export PATH="$WORK_DIR/gitea:$PATH"
+    export GITEA_TOKEN=stub-token
+    export GITEA_URL=https://git.example.test
+    export MOSAIC_CREDENTIALS_FILE="$WORK_DIR/no-credentials.json"
+    export MOSAIC_MERGE_PAYLOAD_LOG="$WORK_DIR/gitea-payload-bypass.json"
+    env -u MOSAIC_GIT_IDENTITY "$WORK_DIR/gitea/tools/git/pr-merge.sh" -n 123 --skip-queue-guard
+) >"$WORK_DIR/gitea-bypass.out" 2>&1
+bypass_rc=$?
+set -e
+if [[ "$bypass_rc" -eq 0 ]] || [[ -e "$WORK_DIR/gitea-payload-bypass.json" ]]; then
+    echo "FAIL merge-bypass: --skip-queue-guard reached the provider merge path" >&2
+    exit 1
+fi
+
 cat > "$WORK_DIR/github/gh" <<'SH'
 #!/usr/bin/env bash
 set -euo pipefail