diff -r 0c1e7ff75e51 -r 8a166e02c975 src/core/package.reef
--- a/src/core/package.reef	Sun Jul 05 17:04:23 2026 -0500
+++ b/src/core/package.reef	Sun Jul 05 17:04:35 2026 -0500
@@ -68,6 +68,7 @@
     fn new_script_ctx(root: string, do_chroot: bool): ScriptCtx
     fn script_wants_chroot(root: string, chroot_scripts: bool): bool
     fn build_script_cmd(ctx: ScriptCtx, script_path: string, script_name: string, args: string, is_sh: bool): string
+    fn resolve_script_ctx(root: string, chroot_scripts: bool, caller_is_root: bool): ScriptCtx
 
     // Install scripts support (version passed as $VERSION to scripts)
     fn has_scripts(pkg_dir: string): bool
@@ -531,6 +532,18 @@
     return chroot_scripts
 end script_wants_chroot
 
+// Resolve the script execution context for a command flow.
+// want_chroot requires both a non-"/" root with chroot enabled AND a root caller;
+// the caller is responsible for aborting first when chroot is wanted but caller_is_root
+// is false (see resolve in the command flows).
+fn resolve_script_ctx(root: string, chroot_scripts: bool, caller_is_root: bool): ScriptCtx
+    mut want_chroot = script_wants_chroot(root, chroot_scripts)
+    if not caller_is_root
+        want_chroot = false
+    end if
+    return new_script_ctx(root, want_chroot)
+end resolve_script_ctx
+
 // The single place a maintainer-script shell command is assembled.
 // is_sh true  -> run under zsh; false -> execute the file directly.
 // Phase 1: only the non-chroot (host) branch exists.