test-build: implement installed_in_base from image package db

Replace the stub with a lazy load of the active image's /var/log/packages:
strip each entry's -<ver>-<arch>-<build> tail to the bare package name and
match REQUIRES tokens against that set, so a dep the full-install image
already provides resolves as met instead of UNMET. Loaded once per run via
docker run --rm; TB_BASE_PKGS/TB_BASE_LOADED are test-seedable to bypass
docker. Add logic-check coverage.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

2 files changed, 41 insertions, 7 deletions

diff --git a/.extras/test-build b/.extras/test-build
index d830d69..8057683 100755
--- a/.extras/test-build
+++ b/.extras/test-build
@@ -183,13 +183,33 @@ declare -A _vstate=()
 declare -A FETCH_DEPS=()   # prog -> 1: resolve via sbopkg in-container
 
 # Is a prog already present in the container base? Kept as a callback so the
-# pure topo logic stays testable. Default: not in base.
-# ponytail: stub returns false, so a dep that the full-install image already
-#   provides currently reads as UNMET and needs a `drop:` override. Real fix
-#   belongs with the image-builder work: query the image's package db (e.g.
-#   `docker run --rm $ACTIVE_IMAGE ls /var/log/packages | grep`) once per run
-#   and consult it here. Deferred until the image exists (Task 10 / image-builder).
-installed_in_base() { return 1; }
+# pure topo logic stays testable.
+#
+# Populated lazily from the active image's package db on first call: each entry
+# in /var/log/packages is named <name>-<ver>-<arch>-<build>, so strip the last
+# three dash-fields to get the bare package name and match the SBo token
+# against that. TB_BASE_PKGS can be pre-seeded by tests to bypass docker.
+declare -A TB_BASE_PKGS=()
+TB_BASE_LOADED="${TB_BASE_LOADED:-0}"
+
+load_base_pkgs() {
+  [[ "$TB_BASE_LOADED" == "1" ]] && return 0
+  TB_BASE_LOADED=1
+  [[ -n "$ACTIVE_IMAGE" ]] || return 0
+  local entry name
+  while IFS= read -r entry; do
+    [[ -n "$entry" ]] || continue
+    # strip trailing -<ver>-<arch>-<build>
+    name="${entry%-*-*-*}"
+    TB_BASE_PKGS["$name"]=1
+  done < <(docker run --rm "$ACTIVE_IMAGE" \
+             /bin/sh -c 'ls /var/log/packages' 2>/dev/null)
+}
+
+installed_in_base() {
+  load_base_pkgs
+  [[ -n "${TB_BASE_PKGS[$1]:-}" ]]
+}
 
 _resolve_visit() {
   local dir="$1" parent="$2"
diff --git a/.extras/test-logic.sh b/.extras/test-logic.sh
index a05e990..6d54334 100644
--- a/.extras/test-logic.sh
+++ b/.extras/test-logic.sh
@@ -70,6 +70,20 @@ resolve_target "$T/cat/d"
 resolve_target "$T/cat/e"
 [[ ${#CYCLES[@]} -ge 1 ]] && ok "cycle caught" || bad "cycle missed"
 
+# --- installed_in_base ------------------------------------------------------
+# Pre-seed the base pkg set (TB_BASE_LOADED=1 bypasses docker). Names are the
+# bare package name; installed_in_base must match a REQUIRES token against it.
+TB_BASE_LOADED=1
+TB_BASE_PKGS=([python3]=1 [libfoo]=1)
+installed_in_base python3 && ok "base pkg matched" || bad "base pkg not matched"
+installed_in_base notthere && bad "absent pkg wrongly matched" || ok "absent pkg not matched"
+
+# a dep present in the base resolves as met, not UNMET
+mk h "python3"
+resolve_target "$T/cat/h"
+[[ ${#UNMET[@]} -eq 0 ]] && ok "base-provided dep not unmet" || bad "base dep flagged unmet"
+TB_BASE_LOADED=0; TB_BASE_PKGS=()
+
 # --- overrides --------------------------------------------------------------
 VERSION_ID="current"   # reset: left at 15.0 by the version-selection checks above
 OV=$(mktemp)