Fix broken legacy script handling

tests/integration.sh

@@ -98,3 +98,50 @@ printf 'a\n' | "$tmp/launcher" migrate legacy >/dev/null
 printf '#!/bin/sh\necho legacy-v2\n' > "$home/bin/legacy"
 [ "$("$tmp/launcher" run legacy)" = 'legacy-v1' ]
 printf 'Integration tests passed.\n'
+# A broken legacy symlink must not stop migration of subsequent entries.
+ln -s "$home/bin/missing-us" "$root/bin/us"
+printf 'Missing script\n' > "$root/descriptions/us"
+cat > "$home/bin/zzgood" <<'EOF_INNER'
+#!/bin/sh
+echo zzgood-v1
+EOF_INNER
+chmod 0755 "$home/bin/zzgood"
+chown "$uid:$gid" "$home/bin/zzgood"
+ln -s "$home/bin/zzgood" "$root/bin/zzgood"
+printf 'Good legacy script\n' > "$root/descriptions/zzgood"
+if printf 'a\n' | "$tmp/launcher" migrate > "$tmp/migrate.out" 2> "$tmp/migrate.err"; then
+    echo 'Expected batch migration to report a broken legacy link' >&2
+    exit 1
+fi
+grep -q 'broken legacy symlink: us' "$tmp/migrate.err"
+grep -q 'migration finished with 1 unreadable or broken link' "$tmp/migrate.err"
+[ -L "$root/bin/us" ] && [ ! -e "$root/bin/us" ]
+[ "$("$tmp/launcher" run zzgood)" = zzgood-v1 ]
+"$tmp/launcher" status us | grep -q 'broken or inaccessible'
+# Root-owned legacy submission directories may be reviewed read-only.
+# Broken submitted symlinks must give actionable diagnostics, not abort the queue.
+chown root:root "$root/pending-submissions/$user"
+chmod 0755 "$root/pending-submissions/$user"
+mkdir -m 0755 "$root/pending-submissions/$user/us"
+ln -s "$home/bin/missing-us" "$root/pending-submissions/$user/us/us"
+printf 'Broken old submission\n' > "$root/pending-submissions/$user/us/description.txt"
+cat > "$home/bin/legacypending" <<'EOF_INNER'
+#!/bin/sh
+echo reviewed-legacy-pending
+EOF_INNER
+chmod 0755 "$home/bin/legacypending"
+chown "$uid:$gid" "$home/bin/legacypending"
+mkdir -m 0755 "$root/pending-submissions/$user/legacypending"
+ln -s "$home/bin/legacypending" "$root/pending-submissions/$user/legacypending/legacypending"
+printf 'An older pending submission\n' > "$root/pending-submissions/$user/legacypending/description.txt"
+printf 'a\n' | "$tmp/launcher" approve > "$tmp/approve.out" 2> "$tmp/approve.err"
+grep -q "broken submitted-script symlink: $user/us" "$tmp/approve.err"
+[ "$("$tmp/launcher" run legacypending)" = reviewed-legacy-pending ]
+[ -L "$root/bin/us" ] && [ ! -e "$root/bin/us" ]
+# A broken legacy link can be revoked with confirmation, even without its owner.
+printf 'n\n' | "$tmp/launcher" revoke us >/dev/null
+[ -L "$root/bin/us" ]
+printf 'y\nBroken and no longer available\n' | "$tmp/launcher" revoke us >/dev/null 2> "$tmp/revoke.err"
+[ ! -L "$root/bin/us" ] && [ ! -e "$root/bin/us" ]
+[ ! -e "$root/descriptions/us" ]
+grep -q 'author unknown; no notification sent' "$tmp/revoke.err"

tests/smoke.sh

@@ -2,7 +2,7 @@
 set -eu
 cd "$(dirname "$0")/.."
 sh -n tilde
-[ "$(./tilde --version)" = 0.2.0 ]
+[ "$(./tilde --version)" = 0.2.1 ]
 ./tilde --help | grep -q 'migrate'
 if ./tilde run '../etc/passwd' >/dev/null 2>&1; then
     printf 'Path traversal was accepted\n' >&2