@gajae-code/coding-agent 0.10.1 → 0.11.0

package/src/gjc-runtime/team-runtime.ts

@@ -2,7 +2,7 @@ import { createHash, randomUUID } from "node:crypto";
 import * as fs from "node:fs/promises";
 import * as path from "node:path";
 import { getWorktreesDir } from "@gajae-code/utils/dirs";
-import { SPAWN_PROVENANCE_ENV } from "../notifications/config";
+import { SPAWN_PROVENANCE_ENV } from "../sdk/bus/config";
 import type { WorkflowHudSummary } from "../skill-state/active-state";
 import { buildTeamHudSummary as buildWorkflowTeamHudSummary } from "../skill-state/workflow-hud";
 import { WORKFLOW_STATE_VERSION } from "../skill-state/workflow-state-contract";
@@ -208,7 +208,7 @@ export type GjcTeamNotificationDeliveryState =
 	| "acknowledged";
 
 export type GjcTeamPaneAttemptResult = "sent" | "queued" | "deferred" | "failed";
-export type GjcTeamMailboxDeliveryTransportKind = "notifications_sdk" | "pane";
+export type GjcTeamMailboxDeliveryTransportKind = "sdk" | "pane";
 
 export interface GjcTeamNotification {
 	id: string;
@@ -235,7 +235,7 @@ export interface GjcTeamMailboxDeliveryInput {
 	env: NodeJS.ProcessEnv;
 }
 export type GjcTeamMailboxDeliveryResult =
-	| { transport: "notifications_sdk"; state: GjcTeamNotificationDeliveryState; reason?: string }
+	| { transport: "sdk"; state: GjcTeamNotificationDeliveryState; reason?: string }
 	| { transport: "pane"; state: GjcTeamPaneAttemptResult; reason?: string };
 export interface GjcTeamMailboxDeliveryTransport {
 	deliverMailboxMessage(input: GjcTeamMailboxDeliveryInput): Promise<GjcTeamMailboxDeliveryResult | null>;
@@ -1995,25 +1995,32 @@ function readCurrentTmuxLeaderContext(tmuxCommand: string, env: NodeJS.ProcessEn
 	}
 	return { sessionName, windowIndex, leaderPaneId, target: `${sessionName}:${windowIndex}` };
 }
-type CommandPathResolver = (command: string) => string | null;
-
 function isBunVirtualPath(candidate: string | undefined): boolean {
-	const normalized = candidate?.trim().replace(/\\/g, "/");
-	return normalized === "/$bunfs" || normalized?.startsWith("/$bunfs/") === true;
+	const normalized = candidate?.trim().replace(/\\/g, "/").toLowerCase();
+	return (
+		normalized === "/$bunfs" ||
+		normalized?.startsWith("/$bunfs/") === true ||
+		normalized === "b:/~bun" ||
+		normalized?.startsWith("b:/~bun/") === true
+	);
 }
 
-function resolveFallbackGjcWorkerCommand(
-	platform: NodeJS.Platform,
-	execPath: string,
-	which: CommandPathResolver,
-): string {
-	const pathModule = platform === "win32" ? path.win32 : path;
-	const quote = platform === "win32" ? powershellQuote : shellQuote;
-	const executable = execPath.trim();
-	if (executable && !isBunVirtualPath(executable) && pathModule.isAbsolute(executable)) return quote(executable);
-	const gjcPath = which("gjc")?.trim();
-	if (gjcPath && !isBunVirtualPath(gjcPath)) return quote(gjcPath);
-	return "gjc";
+function isAbsoluteRealPath(candidate: string | undefined, pathModule: typeof path): candidate is string {
+	const normalized = candidate?.trim();
+	return Boolean(normalized && !isBunVirtualPath(normalized) && pathModule.isAbsolute(normalized));
+}
+function isGjcExecutablePath(candidate: string | undefined, pathModule: typeof path): candidate is string {
+	return isAbsoluteRealPath(candidate, pathModule) && /^gjc(?:[._-]|$)/i.test(pathModule.basename(candidate.trim()));
+}
+
+function formatWorkerExecutable(platform: NodeJS.Platform, executable: string): string {
+	return (platform === "win32" ? powershellQuote : shellQuote)(executable);
+}
+
+function unresolvedWorkerAuthorityError(): Error {
+	return new Error(
+		"Unable to determine the GJC worker executable from this invocation. Set GJC_TEAM_WORKER_COMMAND to the exact GJC command, or launch GJC from a real executable path instead of a Bun virtual path.",
+	);
 }
 
 export function resolveGjcWorkerCommand(
@@ -2022,24 +2029,36 @@ export function resolveGjcWorkerCommand(
 	platform: NodeJS.Platform = process.platform,
 	argv: string[] = process.argv,
 	execPath = process.execPath,
-	which: CommandPathResolver = Bun.which,
 ): string {
 	const explicit = env.GJC_TEAM_WORKER_COMMAND?.trim();
-	if (explicit) return explicit;
-	const entrypoint = argv[1];
-	if (isBunVirtualPath(entrypoint)) return resolveFallbackGjcWorkerCommand(platform, execPath, which);
-	if (!entrypoint) return "gjc";
-	const pathModule = platform === "win32" ? path.win32 : path;
-	const resolvedEntrypoint = pathModule.isAbsolute(entrypoint) ? entrypoint : pathModule.resolve(cwd, entrypoint);
-	if (platform === "win32") {
-		if (entrypoint.endsWith(".ts") || entrypoint.endsWith(".js") || entrypoint.endsWith(".mjs"))
-			return `${powershellQuote(execPath)} ${powershellQuote(resolvedEntrypoint)}`;
-		if (pathModule.basename(entrypoint).startsWith("gjc")) return powershellQuote(resolvedEntrypoint);
-		return "gjc";
+	if (explicit) {
+		if (isBunVirtualPath(explicit)) throw unresolvedWorkerAuthorityError();
+		return explicit;
+	}
+
+	const pathModule = platform === "win32" ? path.win32 : path.posix;
+	const runtime = argv[0]?.trim();
+	const entrypoint = argv[1]?.trim();
+	const sourceEntrypoint = entrypoint && !isBunVirtualPath(entrypoint) && /\.(?:[cm]?[jt]s)$/i.test(entrypoint);
+
+	if (sourceEntrypoint) {
+		const sourceRuntime = isAbsoluteRealPath(runtime, pathModule)
+			? runtime
+			: isAbsoluteRealPath(execPath, pathModule)
+				? execPath.trim()
+				: undefined;
+		if (!sourceRuntime) throw unresolvedWorkerAuthorityError();
+		const absoluteEntrypoint = pathModule.isAbsolute(entrypoint) ? entrypoint : pathModule.resolve(cwd, entrypoint);
+		if (!isAbsoluteRealPath(absoluteEntrypoint, pathModule)) throw unresolvedWorkerAuthorityError();
+		return `${formatWorkerExecutable(platform, sourceRuntime)} ${formatWorkerExecutable(platform, absoluteEntrypoint)}`;
 	}
-	if (entrypoint.endsWith(".ts")) return `${shellQuote(execPath)} ${shellQuote(resolvedEntrypoint)}`;
-	if (path.basename(entrypoint).startsWith("gjc")) return shellQuote(path.resolve(cwd, entrypoint));
-	return "gjc";
+
+	const executable =
+		(isGjcExecutablePath(entrypoint, pathModule) ? entrypoint : undefined) ??
+		(isGjcExecutablePath(execPath, pathModule) ? execPath.trim() : undefined) ??
+		(isGjcExecutablePath(runtime, pathModule) ? runtime : undefined);
+	if (!executable) throw unresolvedWorkerAuthorityError();
+	return formatWorkerExecutable(platform, executable);
 }
 /** @internal Exported for unit tests. */
 export function buildWorkerCommand(
@@ -4010,7 +4029,7 @@ async function attemptConfiguredMailboxTransport(
 			env,
 		});
 		if (!result) return null;
-		if (result.transport === "notifications_sdk" && result.state === "failed") return null;
+		if (result.transport === "sdk" && result.state === "failed") return null;
 		return writeNotificationRecord(dir, {
 			...notification,
 			delivery_state: result.state,

package/src/gjc-runtime/tmux-owner-isolation-cli.ts

@@ -53,27 +53,63 @@ function isKnownNoServerDiagnostic(stderr: string): boolean {
 	);
 }
 
-async function tmuxServerProof(socketKey: string, tmuxControlArgv?: string[]): Promise<TmuxServerProof> {
-	void socketKey;
-	if (!tmuxControlArgv?.length) return { state: "unverifiable" };
-	const controlArgv = tmuxControlArgv;
+interface TmuxListSessionsResult {
+	exitCode: number | null;
+	stdout: string;
+	stderr: string;
+}
+
+interface TmuxServerProofOptions {
+	platform?: NodeJS.Platform;
+	runListSessions?: (argv: string[]) => TmuxListSessionsResult;
+}
+
+function runTmuxListSessions(controlArgv: string[]): TmuxListSessionsResult {
 	const subprocess = Bun.spawnSync([...controlArgv, "list-sessions", "-F", "#{pid}\t#{session_name}"], {
 		stdout: "pipe",
 		stderr: "pipe",
 	});
-	const stderr = Buffer.from(subprocess.stderr).toString();
+	return {
+		exitCode: subprocess.exitCode,
+		stdout: Buffer.from(subprocess.stdout).toString(),
+		stderr: Buffer.from(subprocess.stderr).toString(),
+	};
+}
+
+function parseTmuxSessionRows(stdout: string): { pid: number; sessionNames: string[] } | null {
+	const lines = stdout.split("\n");
+	if (lines[lines.length - 1] === "") lines.pop();
+	let pid: number | undefined;
+	const sessionNames: string[] = [];
+	for (const rawLine of lines) {
+		const line = rawLine.endsWith("\r") ? rawLine.slice(0, -1) : rawLine;
+		const columns = line.split("\t");
+		if (columns.length !== 2 || !/^[1-9]\d*$/.test(columns[0]) || !columns[1].trim()) return null;
+		const rowPid = Number(columns[0]);
+		if (!Number.isSafeInteger(rowPid) || (pid !== undefined && pid !== rowPid)) return null;
+		pid = rowPid;
+		sessionNames.push(columns[1]);
+	}
+	return pid === undefined ? null : { pid, sessionNames };
+}
+
+/** Probes a tmux server using an injectable list-sessions runner for platform-bounded callers. */
+export async function tmuxServerProof(
+	socketKey: string,
+	tmuxControlArgv?: string[],
+	options: TmuxServerProofOptions = {},
+): Promise<TmuxServerProof> {
+	void socketKey;
+	if (!tmuxControlArgv?.length) return { state: "unverifiable" };
+	const platform = options.platform ?? process.platform;
+	const subprocess = options.runListSessions?.(tmuxControlArgv) ?? runTmuxListSessions(tmuxControlArgv);
 	if (subprocess.exitCode !== 0)
-		return isKnownNoServerDiagnostic(stderr) ? { state: "absent" } : { state: "unverifiable" };
-	const lines = Buffer.from(subprocess.stdout)
-		.toString()
-		.split("\n")
-		.map(line => line.trim())
-		.filter(Boolean);
-	const [pidText] = lines[0]?.split("\t") ?? [];
-	const pid = Number(pidText);
-	const sessionNames = lines.map(line => line.split("\t")[1]).filter((name): name is string => Boolean(name));
-	if (!Number.isSafeInteger(pid) || pid <= 0) return { state: "unverifiable" };
-	if (process.platform !== "linux") {
+		return isKnownNoServerDiagnostic(subprocess.stderr) ? { state: "absent" } : { state: "unverifiable" };
+	if (!subprocess.stdout.trim()) return { state: "absent" };
+	const rows = parseTmuxSessionRows(subprocess.stdout);
+	if (!rows) return { state: "unverifiable" };
+	const { pid, sessionNames } = rows;
+	if (platform !== "linux") {
 		return {
 			state: "safe",
 			pid,
@@ -82,7 +118,7 @@ async function tmuxServerProof(socketKey: string, tmuxControlArgv?: string[]): P
 			sessionNames,
 		};
 	}
-	const cgroup = classifyCgroup({ platform: process.platform, cgroupText: await readCgroup(String(pid)) });
+	const cgroup = classifyCgroup({ platform, cgroupText: await readCgroup(String(pid)) });
 	const startTime = await readProcessStartTime(pid);
 	if (!startTime) return { state: "unverifiable", pid, cgroup, sessionNames };
 	return {

package/src/gjc-runtime/tmux-owner-isolation.ts

@@ -86,7 +86,10 @@ export function classifyCgroup(input: { platform: NodeJS.Platform; cgroupText?:
 			diagnostic: "service_cgroup_inheritance",
 		};
 	const scope = paths.find(value => /(?:^|\/)(?:user|session|app|init|gjc)[^/]*\.scope(?:\/|$)/.test(value));
-	if (scope) return { classification: "safe", scope };
+	const vteScope = paths.find(value =>
+		/^\/user\.slice\/user-(\d+)\.slice\/user@\1\.service(?:\/[^/]+)*\/vte-spawn-[A-Za-z0-9_.-]+\.scope$/.test(value),
+	);
+	if (scope || vteScope) return { classification: "safe", scope: scope ?? vteScope };
 	if (paths.every(value => value === "/")) return { classification: "safe", scope: "/" };
 	return {
 		classification: "unverifiable",
@@ -1521,7 +1524,7 @@ export function isValidOwnerIntent(intent: unknown, request?: ObserveTerminalReq
 		intent.generation === request.owner_generation &&
 		intent.session_id === request.session_id &&
 		intent.server_key === request.socket_key &&
-		intent.dispatch_id === request.operator_dispatch_id &&
+		(request.operator_dispatch_id === undefined || intent.dispatch_id === request.operator_dispatch_id) &&
 		request.signal === "SIGTERM"
 	);
 }

package/src/gjc-runtime/tmux-sessions.ts

@@ -49,6 +49,7 @@ import {
 	type TmuxOwnerIsolationExecutionResult,
 	type TmuxServerProof,
 } from "./tmux-owner-isolation";
+import { buildWindowsPowerShellInnerCommand } from "./windows-powershell-command";
 
 export interface GjcTmuxSessionStatus {
 	name: string;
@@ -128,6 +129,10 @@ export interface ForceCloseOwnerDependencies {
 const FORCE_CLOSE_VERDICT_TIMEOUT_MS = 5_000;
 const FORCE_CLOSE_VERDICT_POLL_MS = 50;
 
+export interface CreateGjcTmuxSessionOptions {
+	platform?: NodeJS.Platform;
+}
+
 export type CreateOwnerIsolationTestDependencies = {
 	probe?: Partial<OwnerIsolationProbeSync>;
 	execute?: (plan: PlanResponse, deps: TmuxOwnerIsolationExecutionDependencies) => TmuxOwnerIsolationExecutionResult;
@@ -354,15 +359,19 @@ export function statusGjcTmuxSession(sessionName: string, env: NodeJS.ProcessEnv
 	throw new Error(`gjc_tmux_session_not_found:${sessionName}`);
 }
 
-export function createGjcTmuxSession(env: NodeJS.ProcessEnv = process.env): GjcTmuxSessionStatus {
-	const tmuxCommand = resolveGjcTmuxCommand(env);
+export function createGjcTmuxSession(
+	env: NodeJS.ProcessEnv = process.env,
+	options: CreateGjcTmuxSessionOptions = {},
+): GjcTmuxSessionStatus {
+	const platform = options.platform ?? process.platform;
+	const tmuxCommand = resolveGjcTmuxCommand(env, platform);
 	const sessionName = buildGjcTmuxSessionName(env);
 	const cwd = process.cwd();
 	const sessionId = env[GJC_COORDINATOR_SESSION_ID_ENV]?.trim() || sessionName;
 	const stateFile =
 		env[GJC_COORDINATOR_SESSION_STATE_FILE_ENV]?.trim() ||
 		tmuxRuntimeSessionPath(cwd, env.GJC_SESSION_ID?.trim() || sessionId, buildGjcTmuxSessionSlug(sessionName));
-	const stateDir = path.dirname(stateFile);
+	const stateDir = (platform === "win32" ? path.win32 : path).dirname(stateFile);
 	const generation = crypto.randomUUID();
 	const childEnvironment: Record<string, string> = {
 		GJC_TMUX_LAUNCHED: "1",
@@ -373,12 +382,9 @@ export function createGjcTmuxSession(env: NodeJS.ProcessEnv = process.env): GjcT
 		[GJC_COORDINATOR_SESSION_STATE_FILE_ENV]: stateFile,
 	};
 	const shellQuote = (value: string): string => `'${value.replace(/'/g, `'\\''`)}'`;
-	const powershellQuote = (value: string): string => `'${value.replace(/'/g, "''")}'`;
 	const command =
-		process.platform === "win32"
-			? `${Object.entries(childEnvironment)
-					.map(([name, value]) => `$env:${name} = ${powershellQuote(value)}`)
-					.join("; ")}; gjc`
+		platform === "win32"
+			? buildWindowsPowerShellInnerCommand({ command: ["gjc"], environment: childEnvironment })
 			: `exec env ${Object.entries(childEnvironment)
 					.map(([name, value]) => `${name}=${shellQuote(value)}`)
 					.join(" ")} gjc`;
@@ -388,11 +394,11 @@ export function createGjcTmuxSession(env: NodeJS.ProcessEnv = process.env): GjcT
 		"-d",
 		"-s",
 		sessionName,
-		...(process.platform === "win32" ? [] : ["-P", "-F", "#{session_id}"]),
+		...(platform === "win32" ? [] : ["-P", "-F", "#{session_id}"]),
 		command,
 	];
 	function probeTmuxServer(tmuxCommand: string, env: NodeJS.ProcessEnv): TmuxServerProof {
-		if (process.platform !== "linux") {
+		if (platform !== "linux") {
 			return {
 				state: "safe",
 				pid: 1,
@@ -421,7 +427,7 @@ export function createGjcTmuxSession(env: NodeJS.ProcessEnv = process.env): GjcT
 				.split(/\s+/)[19];
 			if (!startTime) return { state: "unverifiable" };
 			const cgroup = classifyCgroup({
-				platform: process.platform,
+				platform,
 				cgroupText: fsSync.readFileSync(`/proc/${pid}/cgroup`, "utf8"),
 			});
 			return {
@@ -484,7 +490,7 @@ export function createGjcTmuxSession(env: NodeJS.ProcessEnv = process.env): GjcT
 				}
 			}),
 	};
-	if (resolveGjcTmuxBinary({ env }).isPsmux)
+	if (resolveGjcTmuxBinary({ env, platform }).isPsmux)
 		throw new Error("gjc_tmux_owner_isolation_native_session_identity_unavailable");
 
 	const baseline = captureOwnerGenerationBaselineSync(stateDir, sessionId);
@@ -492,7 +498,7 @@ export function createGjcTmuxSession(env: NodeJS.ProcessEnv = process.env): GjcT
 		{
 			schema_version: 1,
 			op: "plan",
-			platform: process.platform,
+			platform,
 			session_id: sessionId,
 			owner_generation: generation,
 			baseline,

package/src/gjc-runtime/ultragoal-guard.ts

@@ -174,6 +174,39 @@ function findReceiptGoal(
 	return storyGoal ? { goal: storyGoal, receiptKind: "per-goal" } : null;
 }
 
+/**
+ * A review-blocker replacement can stand in for a superseded validation-batch
+ * final only while validating the run's final aggregate receipt. Ordinary
+ * per-goal validation continues to require the original batch-close receipt.
+ */
+function hasFreshReviewedBatchFinalReplacement(input: {
+	plan: UltragoalPlan;
+	ledger: readonly UltragoalLedgerEvent[];
+	deferredGoal: UltragoalGoal;
+}): boolean {
+	const finalGoalId = input.deferredGoal.completionVerification?.validationBatch?.finalGoalId;
+	const finalGoal = finalGoalId ? input.plan.goals.find(goal => goal.id === finalGoalId) : undefined;
+	if (finalGoal?.status !== "superseded") return false;
+	const replacements = input.plan.goals.filter(
+		goal =>
+			goal.status === "complete" &&
+			goal.steering?.kind === "review_blocker" &&
+			goal.steering.blockedGoalId === finalGoal.id,
+	);
+	if (replacements.length !== 1) return false;
+	const replacement = replacements[0]!;
+	const receipt = replacement.completionVerification;
+	if (receipt?.receiptKind !== "per-goal") return false;
+	return (
+		validateCompletionReceipt({
+			plan: input.plan,
+			ledger: input.ledger,
+			goal: replacement,
+			receiptKind: "per-goal",
+		}).state === "active_verified_complete"
+	);
+}
+
 export function validateCompletionReceipt(input: {
 	plan: UltragoalPlan;
 	ledger: readonly UltragoalLedgerEvent[];
@@ -267,12 +300,26 @@ export function validateCompletionReceipt(input: {
 					goalId: input.goal.id,
 				};
 			}
-			const priorDiagnostic = validateCompletionReceipt({
-				plan: input.plan,
-				ledger: input.ledger,
-				goal: priorGoal,
-				receiptKind: "per-goal",
-			});
+			const priorDiagnostic =
+				priorGoal.completionVerification.validationBatch?.role === "deferred-member"
+					? validateDeferredMemberReceiptFresh({
+							plan: input.plan,
+							ledger: input.ledger,
+							goal: priorGoal,
+							receipt: priorGoal.completionVerification,
+							receiptKind: "per-goal",
+							requireClose: !hasFreshReviewedBatchFinalReplacement({
+								plan: input.plan,
+								ledger: input.ledger,
+								deferredGoal: priorGoal,
+							}),
+						})
+					: validateCompletionReceipt({
+							plan: input.plan,
+							ledger: input.ledger,
+							goal: priorGoal,
+							receiptKind: "per-goal",
+						});
 			if (priorDiagnostic.state !== "active_verified_complete") {
 				return {
 					state: priorDiagnostic.state,

package/src/gjc-runtime/ultragoal-runtime.ts

@@ -9,6 +9,7 @@ import { DEFAULT_ULTRAGOAL_OBJECTIVE } from "./goal-mode-request";
 import {
 	computeUltragoalPlanGeneration,
 	findFreshBatchCloseReceipt,
+	findLedgerReceiptEvent,
 	requiredUltragoalGoals,
 	validateDeferredMemberReceiptFresh,
 	validateReceiptFreshBase,
@@ -3451,7 +3452,12 @@ function canonicalChangeSetRows(value: unknown, fieldName: string): UltragoalCha
 		if ("goalId" in record) throw new Error(`${fieldName}[${index}] must not contain goalId attribution`);
 		const status = nonEmptyString(record.status);
 		if (!status) throw new Error(`${fieldName}[${index}].status is required`);
-		return { path: normalizeRepoPath(pathValue), status: status as UltragoalChangeStatus };
+		const oldPath = nonEmptyString(record.oldPath);
+		return {
+			path: normalizeRepoPath(pathValue),
+			status: status as UltragoalChangeStatus,
+			...(oldPath ? { oldPath: normalizeRepoPath(oldPath) } : {}),
+		};
 	});
 }
 
@@ -3711,6 +3717,140 @@ function validateBatchCloseQualityGate(
 		throw new Error("validationBatchClose.unionChangeSet.unionHash does not match declared union");
 	requireNonEmptyString(close.coverageEvidence, "validationBatchClose.coverageEvidence");
 }
+
+function hydrateReviewedBatchReplacementClose(input: {
+	gate: JsonObject;
+	plan: UltragoalPlan;
+	goal: UltragoalGoal;
+	metadata: UltragoalValidationBatchMetadata;
+	ledger: readonly UltragoalLedgerEvent[];
+	changeSet?: UltragoalChangeSet;
+}): JsonObject {
+	const requested = qualityGateObject(input.gate.validationBatchClose);
+	if (requested?.kind !== "review-blocker-replacement-close") return input.gate;
+	const expectedKeys = new Set(["schemaVersion", "kind", "replacementGoalId", "coverageEvidence"]);
+	if (Object.keys(requested).some(key => !expectedKeys.has(key)))
+		throw new Error("review-blocker replacement close contains unsupported fields");
+	const replacementGoalId = nonEmptyString(requested.replacementGoalId);
+	const coverageEvidence = nonEmptyString(requested.coverageEvidence);
+	if (requested.schemaVersion !== 1 || !replacementGoalId || !coverageEvidence)
+		throw new Error("review-blocker replacement close is malformed");
+	if (input.goal.status !== "active" || input.metadata.finalGoalId !== input.goal.id)
+		throw new Error("review-blocker replacement close requires the active durable validation-batch final goal");
+	if (!input.changeSet) throw new Error("review-blocker replacement close requires a current cumulative change set");
+
+	const replacements = input.plan.goals.filter(
+		goal => goal.steering?.kind === "review_blocker" && goal.steering.blockedGoalId === input.goal.id,
+	);
+	if (replacements.length !== 1 || replacements[0]?.id !== replacementGoalId)
+		throw new Error("review-blocker replacement close requires exactly the declared replacement");
+	const replacement = replacements[0]!;
+	const replacementReceipt = replacement.completionVerification;
+	if (replacement.status !== "complete" || replacementReceipt?.receiptKind !== "per-goal")
+		throw new Error("review-blocker replacement close requires a completed per-goal replacement receipt");
+	const replacementDiagnostic = validateReceiptFreshBase({
+		plan: input.plan,
+		ledger: input.ledger,
+		goal: replacement,
+		receipt: replacementReceipt,
+		receiptKind: "per-goal",
+	});
+	if (replacementDiagnostic) throw new Error(`review-blocker replacement close ${replacementDiagnostic.message}`);
+	const replacementCheckpointIndex = input.ledger.findIndex(
+		event => event.eventId === replacementReceipt.checkpointLedgerEventId,
+	);
+	const reviewRecordedIndex = input.ledger.findIndex(
+		event =>
+			event.event === "review_blockers_recorded" &&
+			event.goalId === input.goal.id &&
+			event.blockerGoalId === replacement.id,
+	);
+	const reactivatedIndex = input.ledger.findIndex(
+		(event, index) =>
+			index > replacementCheckpointIndex &&
+			event.event === "goal_checkpointed" &&
+			event.goalId === input.goal.id &&
+			event.status === "active",
+	);
+	if (reviewRecordedIndex < 0 || reviewRecordedIndex >= replacementCheckpointIndex || reactivatedIndex < 0)
+		throw new Error("review-blocker replacement close lacks durable supersession and reopening evidence");
+
+	const historicalRequiredGoalIds = input.plan.goals
+		.filter(goal => goal.id !== input.goal.id && goal.status !== "superseded")
+		.map(goal => goal.id);
+	const aggregateGoals = input.plan.goals.filter(goal => {
+		const receipt = goal.completionVerification;
+		return goal.status === "complete" && receipt?.receiptKind === "final-aggregate";
+	});
+	const aggregateGoal = aggregateGoals.find(goal => {
+		const receipt = goal.completionVerification!;
+		const event = findLedgerReceiptEvent(input.ledger, receipt);
+		return (
+			event !== null &&
+			hashStructuredValue(event.qualityGateJson) === receipt.qualityGateHash &&
+			goal.updatedAt === receipt.verifiedAt &&
+			receipt.basis.relevantGoalIdsBeforeCheckpoint.length === historicalRequiredGoalIds.length &&
+			receipt.basis.relevantGoalIdsBeforeCheckpoint.every(
+				(goalId, index) => goalId === historicalRequiredGoalIds[index],
+			)
+		);
+	});
+	if (!aggregateGoal)
+		throw new Error(
+			"review-blocker replacement close requires a fresh final-aggregate receipt covering required goals",
+		);
+
+	const memberMetadataHashes: Record<string, string> = {};
+	const memberChangeSetHashes: Record<string, string> = {};
+	const memberReceipts: JsonObject[] = [];
+	for (const memberId of input.metadata.memberIds) {
+		const member = input.plan.goals.find(goal => goal.id === memberId);
+		if (!member?.validationBatch)
+			throw new Error(`review-blocker replacement close references missing batch member ${memberId}`);
+		memberMetadataHashes[memberId] = member.validationBatch.metadataHash;
+		if (memberId === input.goal.id) continue;
+		const receipt = requireDeferredMemberReceiptFresh(
+			input.plan,
+			input.ledger,
+			member,
+			"review-blocker replacement close",
+		);
+		memberChangeSetHashes[memberId] = receipt.validationBatch.changeSetHash;
+		memberReceipts.push({
+			goalId: memberId,
+			receiptId: receipt.receiptId,
+			checkpointLedgerEventId: receipt.checkpointLedgerEventId,
+			qualityGateHash: receipt.qualityGateHash,
+			changeSetHash: receipt.validationBatch.changeSetHash,
+			role: "deferred-member",
+		});
+	}
+	const paths = input.changeSet.paths.map(row => ({ ...row }));
+	memberChangeSetHashes[input.goal.id] = changeSetHashForPaths(paths);
+	const unionHash = hashStructuredValue({
+		memberChangeSetHashes,
+		paths: paths.map(row => ({ path: row.path, status: row.status, oldPath: row.oldPath })),
+	});
+	return {
+		...input.gate,
+		validationBatchClose: {
+			schemaVersion: 1,
+			kind: "validation-batch-close",
+			batchId: input.metadata.batchId,
+			finalGoalId: input.metadata.finalGoalId,
+			memberIds: [...input.metadata.memberIds],
+			memberMetadataHashes,
+			memberReceipts,
+			unionChangeSet: {
+				source: "validation-batch",
+				memberChangeSetHashes,
+				paths,
+				unionHash,
+			},
+			coverageEvidence,
+		},
+	};
+}
 async function readRequiredCompletionQualityGate(
 	cwd: string,
 	value: string | undefined,
@@ -3729,13 +3869,25 @@ async function readRequiredCompletionQualityGate(
 	const gate = await readStructuredValue(cwd, value);
 	const gateObject = qualityGateObject(gate);
 	if (!gateObject) throw new Error("qualityGate must be a JSON object");
-	await validateCompletionQualityGate(cwd, gateObject, {
+	const validationBatch = options.goal ? requireFreshValidationBatchMetadata(options.goal) : undefined;
+	const hydratedGate =
+		validationBatch && options.plan && options.goal && options.ledger
+			? hydrateReviewedBatchReplacementClose({
+					gate: gateObject,
+					plan: options.plan,
+					goal: options.goal,
+					metadata: validationBatch,
+					ledger: options.ledger,
+					changeSet: options.changeSet,
+				})
+			: gateObject;
+	await validateCompletionQualityGate(cwd, hydratedGate, {
 		changeSet: options.changeSet,
 		plan: options.plan,
 		goal: options.goal,
 		ledger: options.ledger,
 	});
-	return gate;
+	return hydratedGate;
 }
 
 function validatePipelineCheckpointSafety(

package/src/gjc-runtime/windows-powershell-command.ts

@@ -0,0 +1,58 @@
+import { Buffer } from "node:buffer";
+import * as path from "node:path";
+
+export const GJC_TMUX_LAUNCHED_ENV = "GJC_TMUX_LAUNCHED";
+
+export interface WindowsPowerShellInnerCommandOptions {
+	command: readonly string[];
+	args?: readonly string[];
+	environment?: Record<string, string>;
+	tmuxExitMarkerPath?: string;
+}
+
+function powershellQuote(value: string): string {
+	return `'${value.replace(/'/g, "''")}'`;
+}
+
+function buildPowerShellTmuxExitMarkerFinally(markerPath: string): string {
+	const markerDir = path.win32.dirname(markerPath);
+	return [
+		"} finally {",
+		"\ttry {",
+		`\t\tNew-Item -ItemType Directory -Force -Path ${powershellQuote(markerDir)} -ErrorAction Stop | Out-Null`,
+		"\t\t$__gjcTmuxExitMarker = @{ schema_version = 1; source = 'tmux_inner_shell'; ended_at = (Get-Date).ToUniversalTime().ToString('o'); exit_code = $__gjcTmuxExitCode } | ConvertTo-Json -Compress",
+		`\t\tSet-Content -LiteralPath ${powershellQuote(markerPath)} -Value $__gjcTmuxExitMarker -Encoding UTF8 -ErrorAction Stop`,
+		"\t} catch {",
+		"\t}",
+		"}",
+	].join("\n");
+}
+
+/** Builds the shared BOM-free UTF-16LE command for native Windows tmux-compatible panes. */
+export function buildWindowsPowerShellInnerCommand({
+	command,
+	args = [],
+	environment,
+	tmuxExitMarkerPath,
+}: WindowsPowerShellInnerCommandOptions): string {
+	const envLines = Object.entries({ [GJC_TMUX_LAUNCHED_ENV]: "1", ...(environment ?? {}) }).map(
+		([key, value]) => `$env:${key} = ${powershellQuote(value)}`,
+	);
+	const resolvedCommand = command.map(powershellQuote).join(" ");
+	const innerArgs = args.map(powershellQuote).join(" ");
+	const invocation = `& ${resolvedCommand} ${innerArgs}`;
+	const exitLine = "if ($null -ne $LASTEXITCODE) { exit $LASTEXITCODE } else { exit 1 }";
+	const script = tmuxExitMarkerPath
+		? [
+				...envLines,
+				"$__gjcTmuxExitCode = 1",
+				"try {",
+				`\t${invocation}`,
+				"\tif ($null -ne $LASTEXITCODE) { $__gjcTmuxExitCode = $LASTEXITCODE } else { $__gjcTmuxExitCode = 1 }",
+				buildPowerShellTmuxExitMarkerFinally(tmuxExitMarkerPath),
+				"exit $__gjcTmuxExitCode",
+			].join("\n")
+		: [...envLines, invocation, exitLine].join("\n");
+	const encodedCommand = Buffer.from(script, "utf16le").toString("base64");
+	return `pwsh -NoLogo -NoProfile -NonInteractive -ExecutionPolicy Bypass -EncodedCommand ${encodedCommand}`;
+}