From 13dd20635b44f1f28b1e58ba729b1ad1d718f0d4 Mon Sep 17 00:00:00 2001
From: Alexander Mills <alex@oresoftware.com>
Date: Tue, 28 Jul 2026 08:28:37 -0500
Subject: [PATCH 1/7] test: define Node app metadata and syntax check

---
 package.json | 7 ++++++-
 1 file changed, 6 insertions(+), 1 deletion(-)

diff --git a/package.json b/package.json
index 85bf0d9..db5ed35 100644
--- a/package.json
+++ b/package.json
@@ -2,6 +2,11 @@
   "name": "node-app",
   "version": "0.1.0",
   "private": true,
-  "description": "npm still owns these; zed provides @zed-pkg-test/node-lib",
+  "description": "npm still owns ordinary dependencies; zed provides @zed-pkg-test/node-lib.",
+  "scripts": {
+    "check": "node --check src/main.js",
+    "start": "node src/main.js"
+  },
+  "license": "MIT",
   "devDependencies": {}
 }

From 4fabfc4089f0a9cf456674bb371d160c8fe7f88b Mon Sep 17 00:00:00 2001
From: Alexander Mills <alex@oresoftware.com>
Date: Tue, 28 Jul 2026 08:29:37 -0500
Subject: [PATCH 2/7] ci: pin and harden Node Zed interoperability tests

---
 .github/workflows/zed-e2e.yml | 118 ++++++++++++++++++++++++++++------
 1 file changed, 97 insertions(+), 21 deletions(-)

diff --git a/.github/workflows/zed-e2e.yml b/.github/workflows/zed-e2e.yml
index 02f29e4..d972eba 100644
--- a/.github/workflows/zed-e2e.yml
+++ b/.github/workflows/zed-e2e.yml
@@ -1,52 +1,128 @@
 name: zed e2e (node + docker)
+
 on:
+  pull_request:
   push:
+    branches: [main]
   workflow_dispatch:
 
+permissions:
+  contents: read
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+env:
+  ZED_INTERFACES_REF: 61f654d5e4ca718abc4a280a641472466689c278
+  ZED_CLI_REF: 359ea72e21027ed54a29fad95b05f38a1ea142c3
+  NODE_LIB_REF: 7ec5a99da1e5a73209499b750147c5b0b825cb42
+
 jobs:
   test:
     runs-on: ubuntu-latest
+    timeout-minutes: 45
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+        with:
+          persist-credentials: false
+
+      - name: Validate workflow
+        uses: docker://rhysd/actionlint@sha256:b1934ee5f1c509618f2508e6eb47ee0d3520686341fec936f3b79331f9315667
+        with:
+          args: .github/workflows/zed-e2e.yml
 
-      - name: Prepare the Docker build context
+      - name: Verify app and Zed metadata
+        shell: bash
         run: |
-          mkdir -p "$RUNNER_TEMP/zed-docker-context"
-          git clone --depth 1 \
-            https://github.com/zed-pkg/zed-interfaces \
-            "$RUNNER_TEMP/zed-docker-context/zed-interfaces"
-          git clone --depth 1 \
-            https://github.com/zed-pkg/zed-cli \
-            "$RUNNER_TEMP/zed-docker-context/zed-cli"
+          set -euo pipefail
+          docker run --rm \
+            --volume "$GITHUB_WORKSPACE:/work:ro" \
+            --workdir /work \
+            node:22-bookworm-slim \
+            npm run check
+          python3 - <<'PY'
+          import json
+          import tomllib
+          from pathlib import Path
+
+          native = json.loads(Path("package.json").read_text())
+          with Path(".zpkg.toml").open("rb") as handle:
+              zed = tomllib.load(handle)
+          package = zed["package"]
+          assert native["name"] == package["name"]
+          assert native["version"] == package["version"]
+          assert native["license"] == package["license"]
+          assert package["org"] == "zed-pkg-test"
+          assert zed["dependencies"] == {"zed-pkg-test/node-lib": "^1.0.0"}
+          PY
+
+      - name: Prepare immutable Docker build context
+        shell: bash
+        run: |
+          set -euo pipefail
+          context="$RUNNER_TEMP/zed-docker-context"
+          mkdir -p "$context"
+          clone_at() {
+            repo="$1"
+            ref="$2"
+            destination="$3"
+            git init -q "$destination"
+            git -C "$destination" remote add origin "$repo"
+            git -C "$destination" fetch --depth 1 origin "$ref"
+            git -C "$destination" checkout -q --detach FETCH_HEAD
+            test "$(git -C "$destination" rev-parse HEAD)" = "$ref"
+          }
+          clone_at https://github.com/zed-pkg/zed-interfaces.git \
+            "$ZED_INTERFACES_REF" "$context/zed-interfaces"
+          clone_at https://github.com/zed-pkg/zed-cli.git \
+            "$ZED_CLI_REF" "$context/zed-cli"
 
       - name: Build Node + zed test image
         run: |
           docker build \
             --file .github/docker/Dockerfile \
-            --tag zed-pkg-test/node-e2e \
+            --tag zed-pkg-test/node-e2e:${GITHUB_SHA} \
             "$RUNNER_TEMP/zed-docker-context"
 
+      - name: Fetch and verify the exact node-lib fixture
+        shell: bash
+        run: |
+          set -euo pipefail
+          destination="$RUNNER_TEMP/node-lib"
+          git init -q "$destination"
+          git -C "$destination" remote add origin https://github.com/zed-pkg-test/node-lib.git
+          git -C "$destination" fetch --depth 1 origin "$NODE_LIB_REF"
+          git -C "$destination" checkout -q --detach FETCH_HEAD
+          test "$(git -C "$destination" rev-parse HEAD)" = "$NODE_LIB_REF"
+          docker run --rm \
+            --volume "$destination:/package:ro" \
+            --workdir /package \
+            node:22-bookworm-slim \
+            node -e 'const {greet}=require("./src"); if(greet("fixture")!=="hello fixture from @zed-pkg-test/node-lib") process.exit(1)'
+
       - name: Publish node-lib inside Docker
+        shell: bash
         run: |
-          git clone --depth 1 \
-            https://github.com/zed-pkg-test/node-lib \
-            "$RUNNER_TEMP/node-lib"
+          set -euo pipefail
           mkdir -p "$RUNNER_TEMP/zed-registry" "$RUNNER_TEMP/zed-home"
           docker run --rm \
-            --volume "$RUNNER_TEMP/node-lib:/package" \
+            --volume "$RUNNER_TEMP/node-lib:/package:ro" \
             --volume "$RUNNER_TEMP/zed-registry:/registry" \
             --workdir /package \
-            zed-pkg-test/node-e2e \
+            zed-pkg-test/node-e2e:${GITHUB_SHA} \
             zed publish --registry file:///registry --skip-vcs-checks
+          test -n "$(find "$RUNNER_TEMP/zed-registry" -type f -print -quit)"
 
       - name: Symlink install works with its store mounted
         run: |
+          rm -rf .vendor/.zed node_modules .zed
           docker run --rm \
             --volume "$GITHUB_WORKSPACE:/work" \
             --volume "$RUNNER_TEMP/zed-registry:/registry:ro" \
             --volume "$RUNNER_TEMP/zed-home:/zed-home" \
             --workdir /work \
-            zed-pkg-test/node-e2e \
+            zed-pkg-test/node-e2e:${GITHUB_SHA} \
             sh -euc '
               zed install \
                 --registry file:///registry \
@@ -54,7 +130,7 @@ jobs:
                 --install-mode symlink
               test -L .vendor/.zed/zed-pkg-test/node-lib
               test -L node_modules/@zed-pkg-test/node-lib
-              node src/main.js
+              npm start
             '
 
       - name: Symlink install fails without its store mount
@@ -63,7 +139,7 @@ jobs:
             --volume "$GITHUB_WORKSPACE:/work:ro" \
             --workdir /work \
             node:22-bookworm-slim \
-            node src/main.js
+            npm start
           then
             echo "expected the unmounted store-backed symlinks to fail"
             exit 1
@@ -76,7 +152,7 @@ jobs:
             --volume "$RUNNER_TEMP/zed-registry:/registry:ro" \
             --volume "$RUNNER_TEMP/zed-home:/zed-home" \
             --workdir /work \
-            zed-pkg-test/node-e2e \
+            zed-pkg-test/node-e2e:${GITHUB_SHA} \
             sh -euc '
               zed install \
                 --frozen \
@@ -86,7 +162,7 @@ jobs:
               test ! -L .vendor/.zed/zed-pkg-test/node-lib
               test ! -L node_modules/@zed-pkg-test/node-lib
               test -z "$(find .vendor/.zed node_modules/@zed-pkg-test -type l -print -quit)"
-              node src/main.js
+              npm start
             '
 
       - name: Copy install runs in a fresh Node container
@@ -95,4 +171,4 @@ jobs:
             --volume "$GITHUB_WORKSPACE:/work:ro" \
             --workdir /work \
             node:22-bookworm-slim \
-            node src/main.js
+            npm start

From de95541d1cd264ae35106599f8e7df7395ff8df1 Mon Sep 17 00:00:00 2001
From: Alexander Mills <alex@oresoftware.com>
Date: Tue, 28 Jul 2026 08:43:05 -0500
Subject: [PATCH 3/7] test: extract deterministic Node Zed e2e script

---
 scripts/zed-e2e.sh | 135 +++++++++++++++++++++++++++++++++++++++++++++
 1 file changed, 135 insertions(+)
 create mode 100644 scripts/zed-e2e.sh

diff --git a/scripts/zed-e2e.sh b/scripts/zed-e2e.sh
new file mode 100644
index 0000000..f605f97
--- /dev/null
+++ b/scripts/zed-e2e.sh
@@ -0,0 +1,135 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+: "${ZED_INTERFACES_REF:?ZED_INTERFACES_REF is required}"
+: "${ZED_CLI_REF:?ZED_CLI_REF is required}"
+: "${NODE_LIB_REF:?NODE_LIB_REF is required}"
+
+WORKSPACE="${GITHUB_WORKSPACE:-$(pwd)}"
+TEMP_ROOT="${RUNNER_TEMP:-${TMPDIR:-/tmp}/zed-pkg-test-node}"
+RUN_ID="${GITHUB_SHA:-local}"
+CONTEXT="$TEMP_ROOT/zed-docker-context"
+REGISTRY="$TEMP_ROOT/zed-registry"
+HOME_DIR="$TEMP_ROOT/zed-home"
+NODE_LIB="$TEMP_ROOT/node-lib"
+IMAGE="zed-pkg-test/node-e2e:$RUN_ID"
+
+rm -rf "$CONTEXT" "$REGISTRY" "$HOME_DIR" "$NODE_LIB"
+mkdir -p "$CONTEXT" "$REGISTRY" "$HOME_DIR"
+
+clone_at() {
+  local repo="$1"
+  local ref="$2"
+  local destination="$3"
+  git init -q "$destination"
+  git -C "$destination" remote add origin "$repo"
+  git -C "$destination" fetch --depth 1 origin "$ref"
+  git -C "$destination" checkout -q --detach FETCH_HEAD
+  test "$(git -C "$destination" rev-parse HEAD)" = "$ref"
+}
+
+cd "$WORKSPACE"
+
+docker run --rm \
+  --volume "$WORKSPACE:/work:ro" \
+  --workdir /work \
+  node:22-bookworm-slim \
+  npm run check
+
+python3 - <<'PY'
+import json
+import tomllib
+from pathlib import Path
+
+native = json.loads(Path("package.json").read_text())
+with Path(".zpkg.toml").open("rb") as handle:
+    zed = tomllib.load(handle)
+package = zed["package"]
+assert native["name"] == package["name"]
+assert native["version"] == package["version"]
+assert native["license"] == package["license"]
+assert package["org"] == "zed-pkg-test"
+assert zed["dependencies"] == {"zed-pkg-test/node-lib": "^1.0.0"}
+PY
+
+clone_at https://github.com/zed-pkg/zed-interfaces.git \
+  "$ZED_INTERFACES_REF" "$CONTEXT/zed-interfaces"
+clone_at https://github.com/zed-pkg/zed-cli.git \
+  "$ZED_CLI_REF" "$CONTEXT/zed-cli"
+
+docker build \
+  --file "$WORKSPACE/.github/docker/Dockerfile" \
+  --tag "$IMAGE" \
+  "$CONTEXT"
+
+clone_at https://github.com/zed-pkg-test/node-lib.git \
+  "$NODE_LIB_REF" "$NODE_LIB"
+
+docker run --rm \
+  --volume "$NODE_LIB:/package:ro" \
+  --workdir /package \
+  node:22-bookworm-slim \
+  node -e 'const {greet}=require("./src"); if(greet("fixture")!=="hello fixture from @zed-pkg-test/node-lib") process.exit(1)'
+
+docker run --rm \
+  --volume "$NODE_LIB:/package:ro" \
+  --volume "$REGISTRY:/registry" \
+  --workdir /package \
+  "$IMAGE" \
+  zed publish --registry file:///registry --skip-vcs-checks
+if ! find "$REGISTRY" -type f -print -quit | grep -q .; then
+  echo "zed publish produced no registry artifact" >&2
+  exit 1
+fi
+
+rm -rf .vendor/.zed node_modules .zed
+
+docker run --rm \
+  --volume "$WORKSPACE:/work" \
+  --volume "$REGISTRY:/registry:ro" \
+  --volume "$HOME_DIR:/zed-home" \
+  --workdir /work \
+  "$IMAGE" \
+  sh -euc '
+    zed install \
+      --registry file:///registry \
+      --home /zed-home \
+      --install-mode symlink
+    test -L .vendor/.zed/zed-pkg-test/node-lib
+    test -L node_modules/@zed-pkg-test/node-lib
+    npm start
+  '
+
+if docker run --rm \
+  --volume "$WORKSPACE:/work:ro" \
+  --workdir /work \
+  node:22-bookworm-slim \
+  npm start
+then
+  echo "expected the unmounted store-backed symlinks to fail" >&2
+  exit 1
+fi
+
+docker run --rm \
+  --volume "$WORKSPACE:/work" \
+  --volume "$REGISTRY:/registry:ro" \
+  --volume "$HOME_DIR:/zed-home" \
+  --workdir /work \
+  "$IMAGE" \
+  sh -euc '
+    zed install \
+      --frozen \
+      --registry file:///registry \
+      --home /zed-home \
+      --install-mode copy
+    test ! -L .vendor/.zed/zed-pkg-test/node-lib
+    test ! -L node_modules/@zed-pkg-test/node-lib
+    test -z "$(find .vendor/.zed node_modules/@zed-pkg-test -type l -print -quit)"
+    npm start
+  '
+
+docker run --rm \
+  --volume "$WORKSPACE:/work:ro" \
+  --workdir /work \
+  node:22-bookworm-slim \
+  npm start

From cbd671aeb3bb4d00193b0505166fbf7ca3ce8790 Mon Sep 17 00:00:00 2001
From: Alexander Mills <alex@oresoftware.com>
Date: Tue, 28 Jul 2026 08:43:39 -0500
Subject: [PATCH 4/7] ci: run reusable Node Zed e2e script

---
 .github/workflows/zed-e2e.yml | 143 +---------------------------------
 1 file changed, 4 insertions(+), 139 deletions(-)

diff --git a/.github/workflows/zed-e2e.yml b/.github/workflows/zed-e2e.yml
index d972eba..f5e2a43 100644
--- a/.github/workflows/zed-e2e.yml
+++ b/.github/workflows/zed-e2e.yml
@@ -32,143 +32,8 @@ jobs:
         with:
           args: .github/workflows/zed-e2e.yml
 
-      - name: Verify app and Zed metadata
-        shell: bash
-        run: |
-          set -euo pipefail
-          docker run --rm \
-            --volume "$GITHUB_WORKSPACE:/work:ro" \
-            --workdir /work \
-            node:22-bookworm-slim \
-            npm run check
-          python3 - <<'PY'
-          import json
-          import tomllib
-          from pathlib import Path
+      - name: Validate executable test script
+        run: bash -n scripts/zed-e2e.sh
 
-          native = json.loads(Path("package.json").read_text())
-          with Path(".zpkg.toml").open("rb") as handle:
-              zed = tomllib.load(handle)
-          package = zed["package"]
-          assert native["name"] == package["name"]
-          assert native["version"] == package["version"]
-          assert native["license"] == package["license"]
-          assert package["org"] == "zed-pkg-test"
-          assert zed["dependencies"] == {"zed-pkg-test/node-lib": "^1.0.0"}
-          PY
-
-      - name: Prepare immutable Docker build context
-        shell: bash
-        run: |
-          set -euo pipefail
-          context="$RUNNER_TEMP/zed-docker-context"
-          mkdir -p "$context"
-          clone_at() {
-            repo="$1"
-            ref="$2"
-            destination="$3"
-            git init -q "$destination"
-            git -C "$destination" remote add origin "$repo"
-            git -C "$destination" fetch --depth 1 origin "$ref"
-            git -C "$destination" checkout -q --detach FETCH_HEAD
-            test "$(git -C "$destination" rev-parse HEAD)" = "$ref"
-          }
-          clone_at https://github.com/zed-pkg/zed-interfaces.git \
-            "$ZED_INTERFACES_REF" "$context/zed-interfaces"
-          clone_at https://github.com/zed-pkg/zed-cli.git \
-            "$ZED_CLI_REF" "$context/zed-cli"
-
-      - name: Build Node + zed test image
-        run: |
-          docker build \
-            --file .github/docker/Dockerfile \
-            --tag zed-pkg-test/node-e2e:${GITHUB_SHA} \
-            "$RUNNER_TEMP/zed-docker-context"
-
-      - name: Fetch and verify the exact node-lib fixture
-        shell: bash
-        run: |
-          set -euo pipefail
-          destination="$RUNNER_TEMP/node-lib"
-          git init -q "$destination"
-          git -C "$destination" remote add origin https://github.com/zed-pkg-test/node-lib.git
-          git -C "$destination" fetch --depth 1 origin "$NODE_LIB_REF"
-          git -C "$destination" checkout -q --detach FETCH_HEAD
-          test "$(git -C "$destination" rev-parse HEAD)" = "$NODE_LIB_REF"
-          docker run --rm \
-            --volume "$destination:/package:ro" \
-            --workdir /package \
-            node:22-bookworm-slim \
-            node -e 'const {greet}=require("./src"); if(greet("fixture")!=="hello fixture from @zed-pkg-test/node-lib") process.exit(1)'
-
-      - name: Publish node-lib inside Docker
-        shell: bash
-        run: |
-          set -euo pipefail
-          mkdir -p "$RUNNER_TEMP/zed-registry" "$RUNNER_TEMP/zed-home"
-          docker run --rm \
-            --volume "$RUNNER_TEMP/node-lib:/package:ro" \
-            --volume "$RUNNER_TEMP/zed-registry:/registry" \
-            --workdir /package \
-            zed-pkg-test/node-e2e:${GITHUB_SHA} \
-            zed publish --registry file:///registry --skip-vcs-checks
-          test -n "$(find "$RUNNER_TEMP/zed-registry" -type f -print -quit)"
-
-      - name: Symlink install works with its store mounted
-        run: |
-          rm -rf .vendor/.zed node_modules .zed
-          docker run --rm \
-            --volume "$GITHUB_WORKSPACE:/work" \
-            --volume "$RUNNER_TEMP/zed-registry:/registry:ro" \
-            --volume "$RUNNER_TEMP/zed-home:/zed-home" \
-            --workdir /work \
-            zed-pkg-test/node-e2e:${GITHUB_SHA} \
-            sh -euc '
-              zed install \
-                --registry file:///registry \
-                --home /zed-home \
-                --install-mode symlink
-              test -L .vendor/.zed/zed-pkg-test/node-lib
-              test -L node_modules/@zed-pkg-test/node-lib
-              npm start
-            '
-
-      - name: Symlink install fails without its store mount
-        run: |
-          if docker run --rm \
-            --volume "$GITHUB_WORKSPACE:/work:ro" \
-            --workdir /work \
-            node:22-bookworm-slim \
-            npm start
-          then
-            echo "expected the unmounted store-backed symlinks to fail"
-            exit 1
-          fi
-
-      - name: Frozen copy install contains no store symlinks
-        run: |
-          docker run --rm \
-            --volume "$GITHUB_WORKSPACE:/work" \
-            --volume "$RUNNER_TEMP/zed-registry:/registry:ro" \
-            --volume "$RUNNER_TEMP/zed-home:/zed-home" \
-            --workdir /work \
-            zed-pkg-test/node-e2e:${GITHUB_SHA} \
-            sh -euc '
-              zed install \
-                --frozen \
-                --registry file:///registry \
-                --home /zed-home \
-                --install-mode copy
-              test ! -L .vendor/.zed/zed-pkg-test/node-lib
-              test ! -L node_modules/@zed-pkg-test/node-lib
-              test -z "$(find .vendor/.zed node_modules/@zed-pkg-test -type l -print -quit)"
-              npm start
-            '
-
-      - name: Copy install runs in a fresh Node container
-        run: |
-          docker run --rm \
-            --volume "$GITHUB_WORKSPACE:/work:ro" \
-            --workdir /work \
-            node:22-bookworm-slim \
-            npm start
+      - name: Run pinned cross-container interoperability suite
+        run: bash scripts/zed-e2e.sh

From 4c9fe8dfe3f8d547a232ca57e62fde9c89eda63d Mon Sep 17 00:00:00 2001
From: Alexander Mills <alex@oresoftware.com>
Date: Tue, 28 Jul 2026 08:51:27 -0500
Subject: [PATCH 5/7] test: split Node Zed e2e into named phases

---
 scripts/zed-e2e.sh | 208 ++++++++++++++++++++++++++-------------------
 1 file changed, 120 insertions(+), 88 deletions(-)

diff --git a/scripts/zed-e2e.sh b/scripts/zed-e2e.sh
index f605f97..b3d1142 100644
--- a/scripts/zed-e2e.sh
+++ b/scripts/zed-e2e.sh
@@ -14,9 +14,6 @@ HOME_DIR="$TEMP_ROOT/zed-home"
 NODE_LIB="$TEMP_ROOT/node-lib"
 IMAGE="zed-pkg-test/node-e2e:$RUN_ID"
 
-rm -rf "$CONTEXT" "$REGISTRY" "$HOME_DIR" "$NODE_LIB"
-mkdir -p "$CONTEXT" "$REGISTRY" "$HOME_DIR"
-
 clone_at() {
   local repo="$1"
   local ref="$2"
@@ -28,15 +25,18 @@ clone_at() {
   test "$(git -C "$destination" rev-parse HEAD)" = "$ref"
 }
 
-cd "$WORKSPACE"
+prepare() {
+  rm -rf "$CONTEXT" "$REGISTRY" "$HOME_DIR" "$NODE_LIB"
+  mkdir -p "$CONTEXT" "$REGISTRY" "$HOME_DIR"
+  cd "$WORKSPACE"
 
-docker run --rm \
-  --volume "$WORKSPACE:/work:ro" \
-  --workdir /work \
-  node:22-bookworm-slim \
-  npm run check
+  docker run --rm \
+    --volume "$WORKSPACE:/work:ro" \
+    --workdir /work \
+    node:22-bookworm-slim \
+    npm run check
 
-python3 - <<'PY'
+  python3 - <<'PY'
 import json
 import tomllib
 from pathlib import Path
@@ -52,84 +52,116 @@ assert package["org"] == "zed-pkg-test"
 assert zed["dependencies"] == {"zed-pkg-test/node-lib": "^1.0.0"}
 PY
 
-clone_at https://github.com/zed-pkg/zed-interfaces.git \
-  "$ZED_INTERFACES_REF" "$CONTEXT/zed-interfaces"
-clone_at https://github.com/zed-pkg/zed-cli.git \
-  "$ZED_CLI_REF" "$CONTEXT/zed-cli"
-
-docker build \
-  --file "$WORKSPACE/.github/docker/Dockerfile" \
-  --tag "$IMAGE" \
-  "$CONTEXT"
-
-clone_at https://github.com/zed-pkg-test/node-lib.git \
-  "$NODE_LIB_REF" "$NODE_LIB"
-
-docker run --rm \
-  --volume "$NODE_LIB:/package:ro" \
-  --workdir /package \
-  node:22-bookworm-slim \
-  node -e 'const {greet}=require("./src"); if(greet("fixture")!=="hello fixture from @zed-pkg-test/node-lib") process.exit(1)'
-
-docker run --rm \
-  --volume "$NODE_LIB:/package:ro" \
-  --volume "$REGISTRY:/registry" \
-  --workdir /package \
-  "$IMAGE" \
-  zed publish --registry file:///registry --skip-vcs-checks
-if ! find "$REGISTRY" -type f -print -quit | grep -q .; then
-  echo "zed publish produced no registry artifact" >&2
-  exit 1
-fi
-
-rm -rf .vendor/.zed node_modules .zed
-
-docker run --rm \
-  --volume "$WORKSPACE:/work" \
-  --volume "$REGISTRY:/registry:ro" \
-  --volume "$HOME_DIR:/zed-home" \
-  --workdir /work \
-  "$IMAGE" \
-  sh -euc '
-    zed install \
-      --registry file:///registry \
-      --home /zed-home \
-      --install-mode symlink
-    test -L .vendor/.zed/zed-pkg-test/node-lib
-    test -L node_modules/@zed-pkg-test/node-lib
+  clone_at https://github.com/zed-pkg/zed-interfaces.git \
+    "$ZED_INTERFACES_REF" "$CONTEXT/zed-interfaces"
+  clone_at https://github.com/zed-pkg/zed-cli.git \
+    "$ZED_CLI_REF" "$CONTEXT/zed-cli"
+
+  docker build \
+    --file "$WORKSPACE/.github/docker/Dockerfile" \
+    --tag "$IMAGE" \
+    "$CONTEXT"
+
+  clone_at https://github.com/zed-pkg-test/node-lib.git \
+    "$NODE_LIB_REF" "$NODE_LIB"
+
+  docker run --rm \
+    --volume "$NODE_LIB:/package:ro" \
+    --workdir /package \
+    node:22-bookworm-slim \
+    node -e 'const {greet}=require("./src"); if(greet("fixture")!=="hello fixture from @zed-pkg-test/node-lib") process.exit(1)'
+
+  docker run --rm \
+    --volume "$NODE_LIB:/package:ro" \
+    --volume "$REGISTRY:/registry" \
+    --workdir /package \
+    "$IMAGE" \
+    zed publish --registry file:///registry --skip-vcs-checks
+  if ! find "$REGISTRY" -type f -print -quit | grep -q .; then
+    echo "zed publish produced no registry artifact" >&2
+    exit 1
+  fi
+}
+
+symlink_install() {
+  cd "$WORKSPACE"
+  rm -rf .vendor/.zed node_modules .zed
+  docker run --rm \
+    --volume "$WORKSPACE:/work" \
+    --volume "$REGISTRY:/registry:ro" \
+    --volume "$HOME_DIR:/zed-home" \
+    --workdir /work \
+    "$IMAGE" \
+    sh -euc '
+      zed install \
+        --registry file:///registry \
+        --home /zed-home \
+        --install-mode symlink
+      test -L .vendor/.zed/zed-pkg-test/node-lib
+      test -L node_modules/@zed-pkg-test/node-lib
+      npm start
+    '
+}
+
+missing_store() {
+  cd "$WORKSPACE"
+  if docker run --rm \
+    --volume "$WORKSPACE:/work:ro" \
+    --workdir /work \
+    node:22-bookworm-slim \
     npm start
-  '
-
-if docker run --rm \
-  --volume "$WORKSPACE:/work:ro" \
-  --workdir /work \
-  node:22-bookworm-slim \
-  npm start
-then
-  echo "expected the unmounted store-backed symlinks to fail" >&2
-  exit 1
-fi
-
-docker run --rm \
-  --volume "$WORKSPACE:/work" \
-  --volume "$REGISTRY:/registry:ro" \
-  --volume "$HOME_DIR:/zed-home" \
-  --workdir /work \
-  "$IMAGE" \
-  sh -euc '
-    zed install \
-      --frozen \
-      --registry file:///registry \
-      --home /zed-home \
-      --install-mode copy
-    test ! -L .vendor/.zed/zed-pkg-test/node-lib
-    test ! -L node_modules/@zed-pkg-test/node-lib
-    test -z "$(find .vendor/.zed node_modules/@zed-pkg-test -type l -print -quit)"
+  then
+    echo "expected the unmounted store-backed symlinks to fail" >&2
+    exit 1
+  fi
+}
+
+copy_install() {
+  cd "$WORKSPACE"
+  docker run --rm \
+    --volume "$WORKSPACE:/work" \
+    --volume "$REGISTRY:/registry:ro" \
+    --volume "$HOME_DIR:/zed-home" \
+    --workdir /work \
+    "$IMAGE" \
+    sh -euc '
+      zed install \
+        --frozen \
+        --registry file:///registry \
+        --home /zed-home \
+        --install-mode copy
+      test ! -L .vendor/.zed/zed-pkg-test/node-lib
+      test ! -L node_modules/@zed-pkg-test/node-lib
+      test -z "$(find .vendor/.zed node_modules/@zed-pkg-test -type l -print -quit)"
+      npm start
+    '
+}
+
+fresh_copy() {
+  cd "$WORKSPACE"
+  docker run --rm \
+    --volume "$WORKSPACE:/work:ro" \
+    --workdir /work \
+    node:22-bookworm-slim \
     npm start
-  '
+}
 
-docker run --rm \
-  --volume "$WORKSPACE:/work:ro" \
-  --workdir /work \
-  node:22-bookworm-slim \
-  npm start
+phase="${1:-all}"
+case "$phase" in
+  prepare) prepare ;;
+  symlink) symlink_install ;;
+  missing-store) missing_store ;;
+  copy) copy_install ;;
+  fresh-copy) fresh_copy ;;
+  all)
+    prepare
+    symlink_install
+    missing_store
+    copy_install
+    fresh_copy
+    ;;
+  *)
+    echo "unknown phase: $phase" >&2
+    exit 2
+    ;;
+esac

From c82801fdb12160d3287436e31ab1f9c66ea6564c Mon Sep 17 00:00:00 2001
From: Alexander Mills <alex@oresoftware.com>
Date: Tue, 28 Jul 2026 09:33:45 -0500
Subject: [PATCH 6/7] test: pin merged node library and retain E2E diagnostics

---
 .github/workflows/zed-e2e.yml | 16 ++++++++++++++--
 1 file changed, 14 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/zed-e2e.yml b/.github/workflows/zed-e2e.yml
index f5e2a43..eebc87c 100644
--- a/.github/workflows/zed-e2e.yml
+++ b/.github/workflows/zed-e2e.yml
@@ -16,7 +16,7 @@ concurrency:
 env:
   ZED_INTERFACES_REF: 61f654d5e4ca718abc4a280a641472466689c278
   ZED_CLI_REF: 359ea72e21027ed54a29fad95b05f38a1ea142c3
-  NODE_LIB_REF: 7ec5a99da1e5a73209499b750147c5b0b825cb42
+  NODE_LIB_REF: 2d41e658a382fdff27ef87a0db24dbaff280a685
 
 jobs:
   test:
@@ -36,4 +36,16 @@ jobs:
         run: bash -n scripts/zed-e2e.sh
 
       - name: Run pinned cross-container interoperability suite
-        run: bash scripts/zed-e2e.sh
+        shell: bash
+        run: |
+          set -o pipefail
+          bash scripts/zed-e2e.sh 2>&1 | tee "$RUNNER_TEMP/zed-node-e2e.log"
+
+      - name: Upload interoperability diagnostics
+        if: ${{ always() }}
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02
+        with:
+          name: zed-node-e2e-log
+          path: ${{ runner.temp }}/zed-node-e2e.log
+          if-no-files-found: warn
+          retention-days: 7

From 3f75374e0f74347c35f4f160aa5127ef16cda031 Mon Sep 17 00:00:00 2001
From: Alexander Mills <alex@oresoftware.com>
Date: Tue, 28 Jul 2026 09:38:11 -0500
Subject: [PATCH 7/7] test: publish from writable staging while preserving
 source immutability

---
 scripts/zed-e2e.sh | 14 +++++++++++---
 1 file changed, 11 insertions(+), 3 deletions(-)

diff --git a/scripts/zed-e2e.sh b/scripts/zed-e2e.sh
index b3d1142..7cc6667 100644
--- a/scripts/zed-e2e.sh
+++ b/scripts/zed-e2e.sh
@@ -71,12 +71,20 @@ PY
     node:22-bookworm-slim \
     node -e 'const {greet}=require("./src"); if(greet("fixture")!=="hello fixture from @zed-pkg-test/node-lib") process.exit(1)'
 
+  test -z "$(git -C "$NODE_LIB" status --porcelain)"
   docker run --rm \
-    --volume "$NODE_LIB:/package:ro" \
+    --volume "$NODE_LIB:/source:ro" \
     --volume "$REGISTRY:/registry" \
-    --workdir /package \
+    --workdir /tmp \
     "$IMAGE" \
-    zed publish --registry file:///registry --skip-vcs-checks
+    sh -euc '
+      cp -a /source /tmp/package
+      chmod -R u+w /tmp/package
+      cd /tmp/package
+      zed publish --registry file:///registry --skip-vcs-checks
+    '
+  test -z "$(git -C "$NODE_LIB" status --porcelain)"
+  test "$(git -C "$NODE_LIB" rev-parse HEAD)" = "$NODE_LIB_REF"
   if ! find "$REGISTRY" -type f -print -quit | grep -q .; then
     echo "zed publish produced no registry artifact" >&2
     exit 1