@hunter-harness/workflow-harness 0.2.59 → 0.2.61

package/harness/bundles/java/cursor/scripts/harness_archive.py

@@ -3,8 +3,8 @@
 
 Subcommands:
   status   — pre-archive gate checks (read-only)
-  finalize — single-process archive: manifest → move → collect → render →
-             validate → after-manifest → publish → ZIP upload/service
+  finalize — single-process archive: manifest → move → collect → validate →
+             after-manifest → publish → ZIP upload/service
   replay   — read-only re-collect + validate for historical archives
 
 Python 3.10+, stdlib only. UTF-8 without BOM. Windows path safe.
@@ -27,6 +27,7 @@ import subprocess
 import sys
 import tarfile
 import tempfile
+import time
 import uuid
 import zipfile
 from collections.abc import Mapping
@@ -43,7 +44,6 @@ if hasattr(sys.stderr, "reconfigure"):
 
 SCRIPTS_DIR = Path(__file__).resolve().parent
 SKILLS_ROOT = SCRIPTS_DIR.parent
-RENDER_SCRIPT = SKILLS_ROOT / "harness-archive" / "templates" / "render-summary.mjs"
 SUMMARY_TEMPLATE = (
     SKILLS_ROOT / "harness-archive" / "templates" / "summary-data-template.json"
 )
@@ -1908,8 +1908,13 @@ def find_test_reports(change_dir: Path) -> list[Path]:
         "reports/test/*.md",
     ]
     found: list[Path] = []
+    seen: set[Path] = set()
     for pattern in patterns:
-        found.extend(sorted(change_dir.glob(pattern)))
+        for path in sorted(change_dir.glob(pattern)):
+            if path in seen:
+                continue
+            seen.add(path)
+            found.append(path)
     return found
 
 
@@ -2185,6 +2190,21 @@ def check_status(
     checks["project_root"] = str(project)
     state_root = resolve_archive_state_root(change_dir)
     checks["state_root"] = str(state_root)
+    range_adoption = validate_existing_range_adoption(change_dir)
+    checks["range_adoption"] = range_adoption
+    if not range_adoption.get("ok"):
+        blockers.append(
+            {
+                "code": str(
+                    range_adoption.get("reasonCode")
+                    or "EXISTING_RANGE_RECEIPT_INVALID"
+                ),
+                "message": str(
+                    range_adoption.get("message")
+                    or "既有提交范围认领收据无效。"
+                ),
+            }
+        )
 
     exact_byte = check_archive_exact_byte_policy(project)
     checks["archive_exact_byte"] = exact_byte
@@ -2203,14 +2223,33 @@ def check_status(
     )
     checks["sensitive_evidence_publication"] = sensitive_gate
     if not sensitive_gate.get("ok"):
-        blockers.append({
-            "code": str(sensitive_gate.get("reasonCode") or "SECRET_SCAN_GATE_BLOCKED"),
-            "message": str(
-                sensitive_gate.get("nextAction")
-                or sensitive_gate.get("error")
-                or "sensitive evidence publication gate failed"
-            ),
-        })
+        sensitive_issue_codes = {
+            str(item.get("code") or "")
+            for item in sensitive_gate.get("issues") or []
+            if isinstance(item, dict)
+        }
+        digest_only_drift = sensitive_issue_codes == {
+            "SECRET_SCAN_TREE_DIGEST_MISMATCH"
+        }
+        if digest_only_drift and not sensitive_gate.get("unresolvedFailures"):
+            warnings.append(
+                {
+                    "code": "SECRET_SCAN_RECEIPT_REFRESH_REQUIRED",
+                    "message": (
+                        "归档事件或锁文件变化使敏感信息扫描收据过期；"
+                        "正式归档会重新扫描并绑定当前字节。"
+                    ),
+                }
+            )
+        else:
+            blockers.append({
+                "code": str(sensitive_gate.get("reasonCode") or "SECRET_SCAN_GATE_BLOCKED"),
+                "message": str(
+                    sensitive_gate.get("nextAction")
+                    or sensitive_gate.get("error")
+                    or "sensitive evidence publication gate failed"
+                ),
+            })
 
     # --- H-4 formal-layer minimum set ---
     plans_dir = change_dir / "plans"
@@ -2239,6 +2278,28 @@ def check_status(
 
     ledger = load_ledger(change_dir)
     checks["verification_ledger"] = ledger is not None
+    immutable_base = _immutable_change_base_from_snapshot(change_dir)
+    ledger_base = (
+        str(ledger.get("baseCommit") or "").strip()
+        if isinstance(ledger, dict)
+        else ""
+    )
+    checks["change_base"] = immutable_base or None
+    if (
+        immutable_base
+        and ledger_base
+        and immutable_base != ledger_base
+        and not range_adoption.get("present")
+    ):
+        blockers.append(
+            {
+                "code": "CHANGE_BASE_IDENTITY_MISMATCH",
+                "message": (
+                    "计划阶段保存的变更基线与验证账本不一致；"
+                    "请先恢复正确身份，不得在归档阶段自动改写。"
+                ),
+            }
+        )
     if ledger is None:
         target = warnings if closure_disposition != "completed" else blockers
         target.append(
@@ -2297,7 +2358,10 @@ def check_status(
     hash_source: str | None = None
     if ledger is None:
         ledger = load_ledger(change_dir)
-    if worktree_requested(change_dir) and ledger:
+    if range_adoption.get("ok") and range_adoption.get("present"):
+        expected_hash = str(range_adoption.get("tipCommit") or "").strip() or None
+        hash_source = "meta/archive-range-adoption.json"
+    if expected_hash is None and worktree_requested(change_dir) and ledger:
         merge_hash = ledger.get("mergeFinalHash") or (
             ledger.get("merge") or {}
         ).get("finalHash")
@@ -2493,7 +2557,6 @@ def check_status(
                 ),
             })
 
-    archivable = len(blockers) == 0
     candidate_codes = {
         "PRODUCT_CI_NOT_GREEN",
         "PRODUCT_CANDIDATE_NOT_VERIFIED",
@@ -2501,6 +2564,71 @@ def check_status(
         "PROJECT_RELEASE_POLICY_BLOCKED",
         "REMOTE_CI_DOWNGRADE_REFUSED",
     }
+    report_adequacy: dict[str, Any]
+    release_summary: dict[str, Any] | None = None
+    try:
+        release_summary = collect_summary_data(
+            change_dir, write=False, for_replay=False
+        )
+        release_summary["archiveIntent"] = archive_intent
+        release_summary["closureDisposition"] = closure_disposition
+        release_summary["closureReason"] = closure_reason
+        report_adequacy = validate_report_adequacy(release_summary)
+    except Exception as exc:  # noqa: BLE001 — status must remain read-only
+        report_adequacy = {
+            "ok": False,
+            "code": "REPORT_ADEQUACY_UNAVAILABLE",
+            "message": str(exc),
+            "issues": [
+                {
+                    "code": "REPORT_ADEQUACY_UNAVAILABLE",
+                    "severity": "error",
+                    "message": str(exc),
+                }
+            ],
+        }
+
+    adequacy_messages_zh = {
+        "ARCHIVE_BASE_EQUALS_FEATURE_TIP": (
+            "变更基线与产品提交相同，本次没有可归档的产品增量。"
+            "如需封存已有提交，请先使用受控的既有范围认领；"
+            "如变更未完成，请选择废弃或被替代并填写中文原因。"
+        ),
+        "IDENTITY_BASE_MISSING": "缺少不可变的变更基线，无法证明归档范围。",
+        "DIFF_ZERO_WITH_NONEMPTY_COMMIT": "提交范围非空，但报告中的文件变更数为 0。",
+        "ARCHIVE_DIFF_SHRUNK_VS_OWNERSHIP": "归档差异小于声明的产品范围。",
+        "ARCHIVE_NOFF_MERGE_DELTA_ONLY": "归档只覆盖了合并提交差异，未覆盖完整变更。",
+        "REPORT_ADEQUACY_UNAVAILABLE": "无法生成归档充分性报告。",
+    }
+    for issue in report_adequacy.get("issues") or []:
+        if not isinstance(issue, dict) or issue.get("severity") != "error":
+            continue
+        code = str(issue.get("code") or "REPORT_ADEQUACY_FAILED")
+        if any(item.get("code") == code for item in blockers):
+            continue
+        blockers.append(
+            {
+                "code": code,
+                "message": adequacy_messages_zh.get(
+                    code,
+                    str(issue.get("message") or "归档报告不完整"),
+                ),
+            }
+        )
+    for issue in report_adequacy.get("issues") or []:
+        if not isinstance(issue, dict) or issue.get("severity") != "warning":
+            continue
+        code = str(issue.get("code") or "REPORT_ADEQUACY_WARNING")
+        if any(item.get("code") == code for item in warnings):
+            continue
+        warnings.append(
+            {
+                "code": code,
+                "message": str(issue.get("message") or "归档报告需要注意"),
+            }
+        )
+
+    archivable = len(blockers) == 0
     archive_integrity_ok = not any(
         item.get("code") not in candidate_codes for item in blockers
     )
@@ -2512,34 +2640,23 @@ def check_status(
             else "ARCHIVE_INTEGRITY_FAILED"
         ),
         "message": (
-            "archive preconditions are complete"
+            "归档前置条件完整"
             if archive_integrity_ok
-            else "archive preconditions contain non-candidate blockers"
+            else "归档前置条件存在阻断项"
         ),
     }
-    try:
-        release_summary = collect_summary_data(
-            change_dir, write=False, for_replay=False
-        )
-        release_summary["archiveIntent"] = archive_intent
-        release_summary["closureDisposition"] = closure_disposition
-        release_summary["closureReason"] = closure_reason
-        report_adequacy = validate_report_adequacy(release_summary)
+    if release_summary is not None:
         release_decision = evaluate_release_eligibility(
             change_dir,
             release_summary,
             archive_integrity=archive_integrity,
             report_adequacy=report_adequacy,
         )
-    except Exception as exc:  # noqa: BLE001 — status must remain read-only
+    else:
         release_decision = compose_release_decision(
             {
                 "archiveIntegrity": archive_integrity,
-                "reportAdequacy": {
-                    "ok": False,
-                    "code": "REPORT_ADEQUACY_UNAVAILABLE",
-                    "message": str(exc),
-                },
+                "reportAdequacy": report_adequacy,
                 "candidateVerification": ci_gate,
             }
         )
@@ -2573,21 +2690,37 @@ def archive_auto_gate(
     *,
     allow_missing_review: bool = False,
     archive_intent: str = "release-candidate",
+    closure_disposition: str = "completed",
+    closure_reason: str = "",
 ) -> dict[str, Any]:
     """Read-only proof that a post-submit/merge archive may run unattended."""
     status = check_status(
         change_dir,
         allow_missing_review=allow_missing_review,
         archive_intent=archive_intent,
+        closure_disposition=closure_disposition,
+        closure_reason=closure_reason,
     )
     if not status.get("archivable"):
+        report_adequacy = (
+            (status.get("releaseDecision") or {}).get("checks") or {}
+        ).get("reportAdequacy") or {}
+        adequacy_failed = report_adequacy.get("ok") is False
         return {
             "ok": False,
             "action": "auto-gate",
             "autoArchiveAllowed": False,
-            "reasonCode": "ARCHIVE_PRECONDITIONS_UNSATISFIED",
+            "reasonCode": (
+                "ARCHIVE_REPORT_ADEQUACY_FAILED"
+                if adequacy_failed
+                else "ARCHIVE_PRECONDITIONS_UNSATISFIED"
+            ),
             "status": status,
-            "nextAction": "Resolve archive status blockers, then run `harness_archive.py auto-gate` again.",
+            "nextAction": (
+                "归档报告不完整，请按 blockers 中的中文建议处理后重试。"
+                if adequacy_failed
+                else "请先处理归档阻断项，再重新执行归档。"
+            ),
         }
 
     state_root = resolve_archive_state_root(change_dir)
@@ -2609,7 +2742,7 @@ def archive_auto_gate(
         }
 
     git_state = snapshot.get("git")
-    snapshot_base = (
+    snapshot_base = snapshot.get("changeBase") or (
         (git_state.get("base") or git_state.get("baseCommit"))
         if isinstance(git_state, dict)
         else snapshot.get("base") or snapshot.get("baseCommit")
@@ -2685,10 +2818,131 @@ def archive_auto_gate(
         "status": status,
         "snapshotPath": str(snapshot_path),
         "snapshotBase": snapshot_base,
-        "nextAction": "Run `harness_archive.py finalize` with the same change directory and intent; no AskQuestion confirmation is required.",
+        "nextAction": "运行 `harness_archive.py execute`；它会复用本次状态结果，不再重复扫描。",
     }
 
 
+def execute_archive(
+    change_dir: Path,
+    archive_root: Path,
+    *,
+    durable_root: Path | None = None,
+    retention_policy: str = "unspecified",
+    skip_ingest: bool = False,
+    allow_missing_review: bool = False,
+    archive_intent: str = "release-candidate",
+    closure_disposition: str = "completed",
+    closure_reason: str = "",
+) -> tuple[int, dict[str, Any]]:
+    """Run one status collection, boundary gate, and finalize operation."""
+    change_dir = change_dir.resolve()
+    started = time.perf_counter()
+    try:
+        state_root = resolve_archive_state_root(change_dir)
+    except (OSError, ValueError):
+        state_root = change_dir
+    if state_root.is_dir():
+        try:
+            append_event(
+                state_root,
+                phase="archive",
+                type_="phase.prepare.start",
+                note="开始一次性检查归档条件",
+            )
+        except OSError:
+            pass
+    candidate_certification: dict[str, Any] | None = None
+    if load_product_candidate_ci(change_dir) is None:
+        try:
+            receipt = certify_local_candidate(
+                change_dir,
+                project=find_project_root(change_dir),
+            )
+            subject = (
+                receipt.get("subject")
+                if isinstance(receipt.get("subject"), dict)
+                else {}
+            )
+            candidate_certification = {
+                "ok": True,
+                "code": "LOCAL_CANDIDATE_CERTIFIED",
+                "assurance": receipt.get("assurance"),
+                "subject": subject,
+                "reusedValidations": (
+                    receipt.get("verification", {}).get("reusedValidations", [])
+                    if isinstance(receipt.get("verification"), dict)
+                    else []
+                ),
+            }
+        except (OSError, ValueError, json.JSONDecodeError) as exc:
+            candidate_certification = {
+                "ok": False,
+                "code": "LOCAL_CANDIDATE_CERTIFICATION_UNAVAILABLE",
+                "message": str(exc),
+            }
+    gate = archive_auto_gate(
+        change_dir,
+        allow_missing_review=allow_missing_review,
+        archive_intent=archive_intent,
+        closure_disposition=closure_disposition,
+        closure_reason=closure_reason,
+    )
+    elapsed_ms = max(0, int(round((time.perf_counter() - started) * 1000)))
+    if state_root.is_dir():
+        try:
+            append_event(
+                state_root,
+                phase="archive",
+                type_="phase.prepare.end",
+                status="OK" if gate.get("ok") else "BLOCKED",
+                code=str(gate.get("reasonCode") or "ARCHIVE_PREPARE_FINISHED"),
+                message=(
+                    "归档条件检查通过"
+                    if gate.get("ok")
+                    else str(gate.get("nextAction") or "归档条件未满足")
+                ),
+                duration_ms=elapsed_ms,
+                note="一次性归档预检完成",
+            )
+        except OSError:
+            pass
+    if not gate.get("ok"):
+        status = gate.get("status") if isinstance(gate.get("status"), dict) else {}
+        blocked_payload = {
+            "ok": False,
+            "action": "execute",
+            "reasonCode": gate.get("reasonCode"),
+            "error": gate.get("nextAction"),
+            "issues": list(status.get("blockers") or []),
+            "preflight": gate,
+            "change_dir": str(change_dir),
+            "archive_dir": str(archive_root.resolve() / f"{today_date()}-{change_dir.name}"),
+            "original_preserved": change_dir.is_dir(),
+            "finalStatus": "BLOCKED",
+            "preparationDurationMs": elapsed_ms,
+        }
+        if candidate_certification is not None:
+            blocked_payload["candidateCertification"] = candidate_certification
+        return 1, blocked_payload
+    code, payload = cmd_finalize(
+        change_dir,
+        archive_root,
+        durable_root=durable_root,
+        retention_policy=retention_policy,
+        skip_ingest=skip_ingest,
+        allow_missing_review=allow_missing_review,
+        archive_intent=archive_intent,
+        closure_disposition=closure_disposition,
+        closure_reason=closure_reason,
+        preflight_status=gate["status"],
+    )
+    payload["preflight"] = gate
+    payload["preparationDurationMs"] = elapsed_ms
+    if candidate_certification is not None:
+        payload["candidateCertification"] = candidate_certification
+    return code, payload
+
+
 # ---------------------------------------------------------------------------
 # collect
 # ---------------------------------------------------------------------------
@@ -3198,7 +3452,11 @@ def build_verification_projection(
         "apiTests": _ledger_api_tests(effective_ledger, change_dir=change_dir),
     }
     db_compatibility = _ledger_db_compat(effective_ledger)
-    if db_compatibility["status"] == "NOT_RUN" and change_dir is not None:
+    if db_compatibility["status"] in {
+        "NOT_RUN",
+        "UNKNOWN",
+        "EVIDENCE_MISSING",
+    } and change_dir is not None:
         gate_policy_path = change_dir / "meta" / "gate-policy.json"
         try:
             gate_policy = read_json(gate_policy_path) if gate_policy_path.is_file() else None
@@ -3206,15 +3464,22 @@ def build_verification_projection(
             gate_policy = None
         if isinstance(gate_policy, dict):
             capabilities = gate_policy.get("capabilities")
-            required = gate_policy.get("requiredValidations")
-            if (
-                isinstance(capabilities, list)
-                and "database" not in capabilities
-                and (not isinstance(required, list) or "dbCompatibility" not in required)
-            ):
+            required_names: set[str] = set()
+            for field in ("requiredValidations", "requiredValidationsByPhase"):
+                required = gate_policy.get(field)
+                if isinstance(required, list):
+                    required_names.update(str(item) for item in required)
+                elif isinstance(required, dict):
+                    for phase_items in required.values():
+                        if isinstance(phase_items, list):
+                            required_names.update(str(item) for item in phase_items)
+            has_database_capability = (
+                isinstance(capabilities, list) and "database" in capabilities
+            )
+            if not has_database_capability and "dbCompatibility" not in required_names:
                 db_compatibility = {
                     "status": "NOT_APPLICABLE",
-                    "reason": "项目能力画像未声明数据库能力",
+                    "reason": "门禁策略未声明数据库能力或数据库兼容性验证要求",
                     "source": "capability-profile",
                 }
     projection["dbCompatibility"] = db_compatibility["status"]
@@ -3893,6 +4158,303 @@ def _review_summary(
     return base
 
 
+def _archive_range_adoption_path(change_dir: Path) -> Path:
+    return change_dir.resolve() / "meta" / "archive-range-adoption.json"
+
+
+def _archive_range_receipt_id(payload: dict[str, Any]) -> str:
+    canonical = {
+        key: value for key, value in payload.items() if key != "receiptId"
+    }
+    raw = json.dumps(
+        canonical,
+        ensure_ascii=False,
+        sort_keys=True,
+        separators=(",", ":"),
+    ).encode("utf-8")
+    return "sha256:" + hashlib.sha256(raw).hexdigest()
+
+
+def _evaluate_existing_range(
+    change_dir: Path,
+    *,
+    base: str,
+    tip: str,
+) -> dict[str, Any]:
+    project = find_project_root(change_dir)
+    base_code, resolved_base, base_error = git_run(
+        project, "rev-parse", "--verify", f"{base}^{{commit}}"
+    )
+    tip_code, resolved_tip, tip_error = git_run(
+        project, "rev-parse", "--verify", f"{tip}^{{commit}}"
+    )
+    if base_code != 0 or not resolved_base:
+        return {
+            "ok": False,
+            "reasonCode": "EXISTING_RANGE_BASE_INVALID",
+            "message": f"无法解析既有范围基线：{base_error or base}",
+        }
+    if tip_code != 0 or not resolved_tip:
+        return {
+            "ok": False,
+            "reasonCode": "EXISTING_RANGE_TIP_INVALID",
+            "message": f"无法解析既有范围终点：{tip_error or tip}",
+        }
+    if resolved_base == resolved_tip:
+        return {
+            "ok": False,
+            "reasonCode": "EXISTING_RANGE_EMPTY",
+            "message": "既有提交范围为空，不能认领为已完成产品变更。",
+        }
+    ancestor_code, _, ancestor_error = git_run(
+        project, "merge-base", "--is-ancestor", resolved_base, resolved_tip
+    )
+    if ancestor_code != 0:
+        return {
+            "ok": False,
+            "reasonCode": "EXISTING_RANGE_NOT_ANCESTOR",
+            "message": f"范围基线不是终点的祖先：{ancestor_error or resolved_base}",
+        }
+    identity = resolve_product_archive_identity(change_dir, project=project)
+    expected_tip = str(
+        identity.get("featureTip") or identity.get("productCommit") or ""
+    ).strip()
+    if expected_tip:
+        expected_code, resolved_expected, _ = git_run(
+            project, "rev-parse", "--verify", f"{expected_tip}^{{commit}}"
+        )
+        if expected_code == 0 and resolved_expected != resolved_tip:
+            return {
+                "ok": False,
+                "reasonCode": "EXISTING_RANGE_TIP_MISMATCH",
+                "message": (
+                    "既有范围终点与当前产品提交不一致："
+                    f"expected={resolved_expected} actual={resolved_tip}"
+                ),
+            }
+    try:
+        ownership = hl.compute_ownership_diff(
+            project,
+            base=resolved_base,
+            head=resolved_tip,
+            change_dir=change_dir,
+        )
+    except (OSError, ValueError, RuntimeError) as exc:
+        return {
+            "ok": False,
+            "reasonCode": "EXISTING_RANGE_OWNERSHIP_UNAVAILABLE",
+            "message": f"无法验证既有范围归属：{exc}",
+        }
+    foreign = list(ownership.get("foreignPaths") or [])
+    owned = list(ownership.get("files") or [])
+    if foreign:
+        return {
+            "ok": False,
+            "reasonCode": "EXISTING_RANGE_FOREIGN_PATHS",
+            "message": "既有范围包含不属于本变更的文件。",
+            "foreignPaths": foreign,
+        }
+    if not owned:
+        return {
+            "ok": False,
+            "reasonCode": "EXISTING_RANGE_NO_PRODUCT_FILES",
+            "message": "既有范围未包含本变更声明的产品文件。",
+        }
+    return {
+        "ok": True,
+        "reasonCode": "EXISTING_RANGE_VALID",
+        "project": project,
+        "baseCommit": resolved_base,
+        "tipCommit": resolved_tip,
+        "ownership": ownership,
+    }
+
+
+def validate_existing_range_adoption(change_dir: Path) -> dict[str, Any]:
+    path = _archive_range_adoption_path(change_dir)
+    if not path.is_file():
+        return {
+            "ok": True,
+            "present": False,
+            "reasonCode": "EXISTING_RANGE_NOT_ADOPTED",
+            "receiptPath": str(path),
+        }
+    try:
+        receipt = read_json(path)
+    except (OSError, json.JSONDecodeError, TypeError) as exc:
+        return {
+            "ok": False,
+            "present": True,
+            "reasonCode": "EXISTING_RANGE_RECEIPT_INVALID",
+            "message": str(exc),
+            "receiptPath": str(path),
+        }
+    if not isinstance(receipt, dict):
+        return {
+            "ok": False,
+            "present": True,
+            "reasonCode": "EXISTING_RANGE_RECEIPT_INVALID",
+            "message": "既有范围认领收据必须是 JSON 对象。",
+            "receiptPath": str(path),
+        }
+    issues: list[str] = []
+    if receipt.get("schemaVersion") != 1:
+        issues.append("schemaVersion")
+    if receipt.get("action") != "adopt-existing-range":
+        issues.append("action")
+    if receipt.get("changeName") != change_dir.name:
+        issues.append("changeName")
+    if receipt.get("confirmedByUser") is not True:
+        issues.append("confirmedByUser")
+    reason = str(receipt.get("reason") or "").strip()
+    if not reason or re.search(r"[\u4e00-\u9fff]", reason) is None:
+        issues.append("reason")
+    if receipt.get("receiptId") != _archive_range_receipt_id(receipt):
+        issues.append("receiptId")
+    if issues:
+        return {
+            "ok": False,
+            "present": True,
+            "reasonCode": "EXISTING_RANGE_RECEIPT_INVALID",
+            "message": "既有范围认领收据字段无效：" + ", ".join(issues),
+            "receiptPath": str(path),
+        }
+    evaluated = _evaluate_existing_range(
+        change_dir,
+        base=str(receipt.get("baseCommit") or ""),
+        tip=str(receipt.get("tipCommit") or ""),
+    )
+    if not evaluated.get("ok"):
+        return {
+            **evaluated,
+            "present": True,
+            "receiptPath": str(path),
+        }
+    project = evaluated["project"]
+    repository_id = hp.repository_identity(project)
+    ownership = evaluated["ownership"]
+    if receipt.get("repositoryId") != repository_id:
+        issues.append("repositoryId")
+    if receipt.get("diffHash") != ownership.get("diffHash"):
+        issues.append("diffHash")
+    if receipt.get("ownershipHash") != ownership.get("ownershipHash"):
+        issues.append("ownershipHash")
+    if list(receipt.get("files") or []) != list(ownership.get("files") or []):
+        issues.append("files")
+    if issues:
+        return {
+            "ok": False,
+            "present": True,
+            "reasonCode": "EXISTING_RANGE_RECEIPT_STALE",
+            "message": "既有范围认领收据与当前仓库不一致：" + ", ".join(issues),
+            "receiptPath": str(path),
+        }
+    return {
+        "ok": True,
+        "present": True,
+        "reasonCode": "EXISTING_RANGE_ADOPTED",
+        "receiptPath": str(path),
+        "receipt": receipt,
+        "baseCommit": evaluated["baseCommit"],
+        "tipCommit": evaluated["tipCommit"],
+        "files": list(ownership.get("files") or []),
+    }
+
+
+def adopt_existing_range(
+    change_dir: Path,
+    *,
+    base: str,
+    tip: str,
+    reason: str,
+    confirmed: bool,
+) -> dict[str, Any]:
+    change_dir = change_dir.resolve()
+    path = _archive_range_adoption_path(change_dir)
+    if not confirmed:
+        return {
+            "ok": False,
+            "action": "adopt-existing-range",
+            "reasonCode": "EXISTING_RANGE_CONFIRMATION_REQUIRED",
+            "message": "认领既有提交范围必须先获得用户明确确认。",
+            "receiptPath": str(path),
+        }
+    reason = reason.strip()
+    if not reason or re.search(r"[\u4e00-\u9fff]", reason) is None:
+        return {
+            "ok": False,
+            "action": "adopt-existing-range",
+            "reasonCode": "EXISTING_RANGE_REASON_REQUIRED",
+            "message": "请提供可读的中文认领原因。",
+            "receiptPath": str(path),
+        }
+    evaluated = _evaluate_existing_range(
+        change_dir,
+        base=base,
+        tip=tip,
+    )
+    if not evaluated.get("ok"):
+        return {
+            **evaluated,
+            "action": "adopt-existing-range",
+            "receiptPath": str(path),
+        }
+    project = evaluated["project"]
+    ownership = evaluated["ownership"]
+    if path.is_file():
+        existing = validate_existing_range_adoption(change_dir)
+        existing_receipt = (
+            existing.get("receipt")
+            if isinstance(existing.get("receipt"), dict)
+            else {}
+        )
+        if (
+            existing.get("ok")
+            and existing_receipt.get("baseCommit") == evaluated["baseCommit"]
+            and existing_receipt.get("tipCommit") == evaluated["tipCommit"]
+            and existing_receipt.get("reason") == reason
+        ):
+            return {
+                "ok": True,
+                "action": "adopt-existing-range",
+                "reasonCode": "EXISTING_RANGE_ADOPTED",
+                "idempotent": True,
+                "receiptPath": str(path),
+                "receipt": existing_receipt,
+            }
+        return {
+            "ok": False,
+            "action": "adopt-existing-range",
+            "reasonCode": "EXISTING_RANGE_RECEIPT_CONFLICT",
+            "message": "已有不同的既有范围认领收据，拒绝覆盖。",
+            "receiptPath": str(path),
+        }
+    receipt = {
+        "schemaVersion": 1,
+        "action": "adopt-existing-range",
+        "changeName": change_dir.name,
+        "repositoryId": hp.repository_identity(project),
+        "baseCommit": evaluated["baseCommit"],
+        "tipCommit": evaluated["tipCommit"],
+        "diffHash": ownership["diffHash"],
+        "ownershipHash": ownership["ownershipHash"],
+        "files": list(ownership.get("files") or []),
+        "reason": reason,
+        "confirmedByUser": True,
+        "recordedAt": now_iso(),
+    }
+    receipt["receiptId"] = _archive_range_receipt_id(receipt)
+    write_json(path, receipt)
+    return {
+        "ok": True,
+        "action": "adopt-existing-range",
+        "reasonCode": "EXISTING_RANGE_ADOPTED",
+        "idempotent": False,
+        "receiptPath": str(path),
+        "receipt": receipt,
+    }
+
+
 def _base_from_state_snapshot(change_dir: Path) -> str:
     """Read archive-boundary base from meta/state-snapshot.json when present."""
     for relative in (
@@ -3908,6 +4470,9 @@ def _base_from_state_snapshot(change_dir: Path) -> str:
             continue
         if not isinstance(payload, dict):
             continue
+        change_base = str(payload.get("changeBase") or "").strip()
+        if change_base and change_base != NOT_AVAILABLE:
+            return change_base
         git_info = payload.get("git")
         if isinstance(git_info, dict):
             base = str(git_info.get("base") or git_info.get("baseCommit") or "").strip()
@@ -3919,6 +4484,27 @@ def _base_from_state_snapshot(change_dir: Path) -> str:
     return ""
 
 
+def _immutable_change_base_from_snapshot(change_dir: Path) -> str:
+    for root in archive_read_roots(change_dir):
+        for relative in (
+            Path("meta") / "state-snapshot.json",
+            Path("state-snapshot.json"),
+        ):
+            path = root / relative
+            if not path.is_file():
+                continue
+            try:
+                payload = read_json(path)
+            except (OSError, json.JSONDecodeError, TypeError):
+                continue
+            if not isinstance(payload, dict):
+                continue
+            value = str(payload.get("changeBase") or "").strip()
+            if value and value != NOT_AVAILABLE:
+                return value
+    return ""
+
+
 def _resolve_base_commit(
     ledger: dict[str, Any] | None,
     change_dir: Path,
@@ -3936,8 +4522,22 @@ def _resolve_base_commit(
 
     Latest merge phase context must not override the full change boundary.
     """
+    def stable_base(value: Any) -> str:
+        candidate = str(value or "").strip()
+        if candidate.upper() in {"HEAD", "FETCH_HEAD", "ORIG_HEAD"}:
+            return ""
+        if candidate.startswith(("refs/", "@{")):
+            return ""
+        return candidate
+
+    adoption = validate_existing_range_adoption(change_dir)
+    if adoption.get("ok") and adoption.get("present"):
+        adopted_base = stable_base(adoption.get("baseCommit"))
+        if adopted_base:
+            return adopted_base
+
     if ledger:
-        base = str(ledger.get("baseCommit") or "").strip()
+        base = stable_base(ledger.get("baseCommit"))
         if base and base != NOT_AVAILABLE:
             return base
 
@@ -3959,7 +4559,7 @@ def _resolve_base_commit(
                 continue
             if not isinstance(payload, dict):
                 continue
-            base = str(payload.get("baseCommit") or "").strip()
+            base = stable_base(payload.get("baseCommit"))
             if base and base != NOT_AVAILABLE:
                 return base
 
@@ -3996,9 +4596,18 @@ def _final_commit_from_sources(
         if str(event.get("phase") or "").lower() not in {"submit", "merge", "archive"}:
             continue
         text = " ".join(str(event.get(key) or "") for key in ("note", "message", "command"))
-        match = commit_pattern.search(text)
-        if match:
-            return match.group(0)
+        for match in commit_pattern.finditer(text):
+            candidate = match.group(0)
+            code, resolved, _ = git_run(
+                project,
+                "rev-parse",
+                "--verify",
+                f"{candidate}^{{commit}}",
+            )
+            resolved_lines = str(resolved or "").splitlines()
+            resolved_hash = resolved_lines[0].strip() if resolved_lines else ""
+            if code == 0 and re.fullmatch(r"[0-9a-f]{40}", resolved_hash, re.IGNORECASE):
+                return resolved_hash
     if existing and existing.get("finalCommit"):
         return str(existing["finalCommit"])
     code, head, _ = git_run(project, "rev-parse", "HEAD")
@@ -4669,618 +5278,6 @@ def collect_summary_data(
 
 
 # ---------------------------------------------------------------------------
-# render
-# ---------------------------------------------------------------------------
-
-
-def resolve_node_path(project_root: Path) -> str | None:
-    profile = project_root / ".harness" / "config" / "build-profile.json"
-    if profile.is_file():
-        try:
-            data = read_json(profile)
-            node = (data.get("toolPaths") or {}).get("node")
-            if node and Path(str(node)).exists():
-                return str(node)
-        except (OSError, json.JSONDecodeError, TypeError):
-            pass
-    return shutil.which("node")
-
-
-def _render_legacy_fallback_html(summary: dict[str, Any]) -> str:
-    """Render escaped, deterministic HTML with every validate-required fact.
-
-    Used when the Node renderer is unavailable or fails. No timestamps / random
-    data; all dynamic values are HTML-escaped via _html_escape.
-    """
-    def esc(v: Any) -> str:
-        return _html_escape("" if v is None else str(v))
-
-    parts: list[str] = [
-        "<!DOCTYPE html>",
-        '<html lang="zh-CN"><head><meta charset="utf-8">',
-        "<title>harness final-summary (python fallback)</title>",
-        "</head><body>",
-        "<h1>变更最终报告（Python fallback 渲染）</h1>",
-        f'<h2 id="changeName">{esc(summary.get("changeName"))}</h2>',
-        f'<p><strong>finalStatus</strong>: '
-        f'<span id="finalStatus">{esc(summary.get("finalStatus"))}</span></p>',
-        f'<div id="finalStatusReasons"><strong>finalStatusReasons</strong><ul>',
-    ]
-    for reason in summary.get("finalStatusReasons") or []:
-        parts.append(f"<li>{esc(reason)}</li>")
-    parts.append("</ul></div>")
-    if summary.get("riskTier"):
-        parts.append(f"<p><strong>riskTier</strong>: {esc(summary.get('riskTier'))}</p>")
-    parts.append("<h3>Current Outcome</h3>")
-    parts.append(
-        f"<p>finalStatus={esc(summary.get('finalStatus'))}</p>"
-    )
-
-    candidate = (
-        summary.get("candidateVerification")
-        if isinstance(summary.get("candidateVerification"), dict)
-        else {}
-    )
-    parts.append("<h3>Candidate Claim / Attestation</h3>")
-    parts.append(
-        f"<p>assurance={esc(candidate.get('assurance'))} "
-        f"code={esc(candidate.get('code'))} "
-        f"provider={esc(candidate.get('provider'))}</p>"
-    )
-
-    integrity = (
-        summary.get("archiveIntegrity")
-        if isinstance(summary.get("archiveIntegrity"), dict)
-        else {}
-    )
-    parts.append("<h3>Archive Integrity</h3>")
-    parts.append(
-        f"<p>ok={esc(integrity.get('ok'))} "
-        f"code={esc(integrity.get('code'))} "
-        f"checksumStatus={esc(integrity.get('checksumStatus'))}</p>"
-    )
-
-    decision = (
-        summary.get("releaseDecision")
-        if isinstance(summary.get("releaseDecision"), dict)
-        else {}
-    )
-    parts.append("<h3>Release Eligibility</h3>")
-    parts.append(
-        f"<p>releaseEligible={esc(decision.get('releaseEligible'))} "
-        f"code={esc(decision.get('code'))}</p><ul>"
-    )
-    checks = decision.get("checks")
-    checks = checks if isinstance(checks, dict) else {}
-    for name, check in checks.items():
-        check = check if isinstance(check, dict) else {}
-        parts.append(
-            f"<li>{esc(name)}: ok={esc(check.get('ok'))} "
-            f"code={esc(check.get('code'))}</li>"
-        )
-    parts.append("</ul>")
-
-    timing = summary.get("timing") if isinstance(summary.get("timing"), dict) else {}
-    if timing:
-        parts.append("<h3>Timing</h3>")
-        parts.append(
-            "<p id=\"timingColumns\">"
-            f"stageActiveExecution={esc(timing.get('stageActiveExecutionMs'))} · "
-            f"stageWallClockSpan={esc(timing.get('stageWallClockSpanMs'))} · "
-            f"workflowWallClock={esc(timing.get('workflowWallClockMs'))}"
-            "</p>"
-        )
-        parts.append(
-            "<p id=\"timingConservation\">"
-            f"attributedStageUnionMs={esc(timing.get('attributedStageUnionMs'))} · "
-            f"externalWaitMs={esc(timing.get('externalWaitMs'))} · "
-            f"pausedMs={esc(timing.get('pausedMs'))} · "
-            "agentOrToolUnattributedMs="
-            f"{esc(timing.get('agentOrToolUnattributedMs'))} · "
-            f"conservationDeltaMs={esc(timing.get('conservationDeltaMs'))}"
-            "</p>"
-        )
-        parts.append(
-            f"<p><strong>reportCutoffAt</strong>: "
-            f"<span id=\"reportCutoffAt\">{esc(timing.get('reportCutoffAt'))}</span></p>"
-        )
-        parts.append(
-            "<p><small>durations.totalMinutes is active-only; "
-            "do not treat it as workflow wall clock.</small></p>"
-        )
-    parts.append("<h3>History Quality</h3><ul>")
-    attempts = timing.get("attempts")
-    attempts = attempts if isinstance(attempts, list) else []
-    for attempt in attempts:
-        attempt = attempt if isinstance(attempt, dict) else {}
-        parts.append(
-            f"<li>{esc(attempt.get('phase'))}: "
-            f"{esc(attempt.get('terminalStatus') or attempt.get('status'))} "
-            f"durationMs={esc(attempt.get('durationMs'))}</li>"
-        )
-    if not attempts:
-        parts.append("<li>no typed attempts recorded</li>")
-    parts.append("</ul>")
-
-    remote_cost = (
-        summary.get("remoteCost")
-        if isinstance(summary.get("remoteCost"), dict)
-        else {}
-    )
-    remote_totals = remote_cost.get("totals")
-    remote_totals = remote_totals if isinstance(remote_totals, dict) else {}
-    parts.append("<h3>Remote Cost</h3>")
-    parts.append(
-        f"<p>runnerMinutes={esc(remote_totals.get('runnerMinutes'))} "
-        f"queueWaitMs={esc(remote_totals.get('queueWaitMs'))} "
-        f"artifactBytes={esc(remote_totals.get('artifactBytes'))} "
-        f"duplicateRunCount={esc(remote_totals.get('duplicateRunCount'))}</p>"
-    )
-
-    storage = (
-        summary.get("artifactStorage")
-        if isinstance(summary.get("artifactStorage"), dict)
-        else {}
-    )
-    parts.append("<h3>Artifact Storage</h3>")
-    parts.append(
-        f"<p>artifactCount={esc(storage.get('artifactCount'))} "
-        f"bytesAdded={esc(storage.get('bytesAdded'))} "
-        f"bytesReused={esc(storage.get('bytesReused'))} "
-        f"bytesPruned={esc(storage.get('bytesPruned'))}</p>"
-    )
-
-    projection = (
-        summary.get("projection")
-        if isinstance(summary.get("projection"), dict)
-        else {}
-    )
-    parts.append("<h3>Projection / Fallback</h3>")
-    parts.append(
-        f"<p>mode={esc(projection.get('mode'))} "
-        f"code={esc(projection.get('code'))} "
-        f"remediation={esc(projection.get('remediation'))}</p>"
-    )
-
-    if summary.get("productCommit") or summary.get("productTreeHash"):
-        parts.append("<h3>Identity</h3>")
-        parts.append(
-            f"<p>productCommit={esc(summary.get('productCommit'))} "
-            f"productTreeHash={esc(summary.get('productTreeHash'))} "
-            f"archiveCommit={esc(summary.get('archiveCommit'))}</p>"
-        )
-
-    pipeline = summary.get("reportPipeline") or {}
-    cmds = pipeline.get("commands") or []
-    parts.append("<h3>Commands</h3><ul>")
-    for c in cmds:
-        parts.append(
-            f"<li><code>{esc(c.get('command'))}</code> "
-            f"exitCode={esc(c.get('exit_code'))}</li>"
-        )
-    parts.append("</ul>")
-
-    ver = summary.get("verification") or {}
-    unit = ver.get("unitTests") or {}
-    api = ver.get("apiTests") or {}
-    browser = ver.get("browserE2E") or {}
-    parts.append("<h3>Verification</h3>")
-    parts.append(
-        "<p>unitTests: run={run} failures={failures} errors={errors} "
-        "skipped={skipped} passRate={passRate} status={status}</p>".format(
-            run=esc(unit.get("run")),
-            failures=esc(unit.get("failures")),
-            errors=esc(unit.get("errors")),
-            skipped=esc(unit.get("skipped")),
-            passRate=esc(unit.get("passRate")),
-            status=esc(unit.get("status")),
-        )
-    )
-    parts.append(
-        "<p>apiTests: status={status} total={total} passed={passed} "
-        "failed={failed} blocked={blocked}</p>".format(
-            status=esc(api.get("status")),
-            total=esc(api.get("total")),
-            passed=esc(api.get("passed")),
-            failed=esc(api.get("failed")),
-            blocked=esc(api.get("blocked")),
-        )
-    )
-    parts.append(
-        "<p>browserE2E: status={status} total={total} passed={passed} "
-        "failed={failed} skipped={skipped} retries={retries}</p>".format(
-            status=esc(browser.get("status")),
-            total=esc(browser.get("total")),
-            passed=esc(browser.get("passed")),
-            failed=esc(browser.get("failed")),
-            skipped=esc(browser.get("skipped")),
-            retries=esc(browser.get("retries")),
-        )
-    )
-    parts.append(f"<p>dbCompatibility: {esc(ver.get('dbCompatibility'))}</p>")
-
-    parts.append("<h3>Changed Files</h3><ul>")
-    for f in summary.get("changedFiles") or []:
-        parts.append(
-            f"<li>{esc(f.get('path'))} +{esc(f.get('insertions'))} "
-            f"-{esc(f.get('deletions'))}</li>"
-        )
-    parts.append("</ul>")
-
-    am = summary.get("archiveManifest") or {}
-    parts.append("<h3>Archive Manifest</h3>")
-    parts.append(
-        "<p>movedFiles={moved} generatedFiles={gen} totalArchiveFiles={total} "
-        "checksumStatus={cs}</p>".format(
-            moved=esc(am.get("movedFiles")),
-            gen=esc(am.get("generatedFiles")),
-            total=esc(am.get("totalArchiveFiles")),
-            cs=esc(am.get("checksumStatus")),
-        )
-    )
-
-    def _list_section(title: str, items: Any) -> None:
-        parts.append(f"<h3>{esc(title)}</h3><ul>")
-        for it in items or []:
-            parts.append(f"<li>{esc(it)}</li>")
-        parts.append("</ul>")
-
-    _list_section("Known Risks", summary.get("knownRisks"))
-    _list_section("Manual Actions", summary.get("manualActions"))
-    _list_section("Maintenance Notes", summary.get("maintenanceNotes"))
-
-    parts.append("</body></html>")
-    return "\n".join(parts) + "\n"
-
-
-def render_fallback_html(summary: dict[str, Any]) -> str:
-    """Render the same executive information architecture without Node."""
-
-    def esc(value: Any) -> str:
-        return _html_escape("" if value is None else str(value))
-
-    def rec(value: Any) -> dict[str, Any]:
-        return value if isinstance(value, dict) else {}
-
-    def seq(value: Any) -> list[Any]:
-        return value if isinstance(value, list) else []
-
-    normalized = rec(summary.get("normalizedReport"))
-    outcomes = rec(normalized.get("outcomes"))
-    current = rec(outcomes.get("current")) or {
-        "status": summary.get("finalStatus"),
-        "reasons": seq(summary.get("finalStatusReasons")),
-        "stages": rec(summary.get("stageStatus")),
-        "knownRisks": seq(summary.get("knownRisks")),
-    }
-    release = rec(outcomes.get("release")) or {
-        "intent": summary.get("archiveIntent"),
-        "decision": "NOT_REQUESTED"
-        if summary.get("archiveIntent") == "record-only"
-        else rec(summary.get("releaseDecision")).get("code"),
-        "eligible": rec(summary.get("releaseDecision")).get("releaseEligible"),
-    }
-    identity = rec(normalized.get("identity")) or rec(summary.get("changeIdentity"))
-    verification = rec(normalized.get("verification")) or rec(
-        summary.get("verification")
-    )
-    timing = rec(normalized.get("timing")) or rec(summary.get("timing"))
-    measurements = rec(normalized.get("measurements"))
-    record_only = (
-        release.get("intent") == "record-only"
-        or summary.get("archiveIntent") == "record-only"
-    )
-    product_commit = (
-        identity.get("productCommit")
-        or summary.get("productCommit")
-        or summary.get("finalCommit")
-        or "N/A"
-    )
-    labels = [
-        ("后端", ("unitTests", "dbCompatibility")),
-        ("Geo", ("geo",)),
-        ("前端", ("frontend",)),
-        ("浏览器", ("browserE2E",)),
-        ("API", ("apiTests",)),
-    ]
-    status_labels = {
-        "OK": "通过",
-        "PASS": "通过",
-        "PASSED": "通过",
-        "CONDITIONAL_OK": "有条件通过",
-        "WARN": "警告",
-        "ADVISORY": "建议",
-        "FAIL": "失败",
-        "FAILED": "失败",
-        "ERROR": "错误",
-        "BLOCKED": "阻塞",
-        "NOT_RUN": "未运行",
-        "SKIPPED": "已跳过",
-        "NOT_APPLICABLE": "不适用",
-        "UNKNOWN": "未知",
-    }
-
-    def status_label(value: Any) -> str:
-        status = str(value or "UNKNOWN").upper()
-        return status_labels.get(status, status)
-
-    def verification_status(value: Any) -> str:
-        if isinstance(value, str):
-            return value
-        item = rec(value)
-        if item.get("status"):
-            return str(item["status"])
-        if int(item.get("failures") or 0) + int(item.get("errors") or 0):
-            return "FAIL"
-        if int(item.get("run") or item.get("total") or 0):
-            return "OK"
-        return "NOT_RUN"
-
-    def describe(value: Any) -> str:
-        if isinstance(value, str):
-            return value
-        item = rec(value)
-        return str(
-            item.get("title")
-            or item.get("message")
-            or item.get("summary")
-            or item.get("action")
-            or item.get("remediation")
-            or item
-        )
-
-    def measurement_label(value: Any) -> str:
-        item = rec(value)
-        if item.get("state") in {"unknown", "not_applicable"}:
-            return "N/A"
-        if item.get("state") == "zero":
-            return "0"
-        if item.get("state") == "known":
-            return str(item.get("value"))
-        return "N/A" if value is None or value == "" else str(value)
-
-    risks = (
-        seq(current.get("findings"))
-        or seq(current.get("knownRisks"))
-        or seq(summary.get("knownRisks"))
-    )
-    actions = seq(summary.get("manualActions"))
-    groups: list[str] = []
-    passed = 0
-    for label, keys in labels:
-        statuses = [
-            verification_status(verification[key])
-            for key in keys
-            if key in verification
-        ]
-        status = (
-            "FAIL"
-            if any(value in {"FAIL", "ERROR", "BLOCKED"} for value in statuses)
-            else "WARN"
-            if any("WARN" in value or "CONDITIONAL" in value for value in statuses)
-            else "NOT_APPLICABLE"
-            if statuses and all(value == "NOT_APPLICABLE" for value in statuses)
-            else "OK"
-            if statuses
-            and all(
-                value in {"OK", "PASS", "PASSED", "NOT_APPLICABLE"}
-                for value in statuses
-            )
-            else "NOT_RUN"
-        )
-        if status == "OK":
-            passed += 1
-        details = " · ".join(
-            str(rec(verification.get(key)).get("passRate") or status)
-            for key in keys
-            if key in verification
-        ) or "未配置该组验证"
-        raw_details = " · ".join(
-            f"{key} · status={verification_status(verification[key])}"
-            + (
-                f" · failed={rec(verification[key]).get('failed')}"
-                if rec(verification[key]).get("failed") is not None
-                else ""
-            )
-            for key in keys
-            if key in verification
-        )
-        groups.append(
-            f'<article class="verify" title="{esc(raw_details)}"><strong>{esc(label)}</strong>'
-            f'<span title="{esc(status)}">{esc(status_label(status))}</span><small>{esc(details)}</small></article>'
-        )
-
-    commands = seq(rec(summary.get("reportPipeline")).get("commands"))
-    command_rows = "".join(
-        f"<tr><td>{esc(item.get('phase') or '-')}</td>"
-        f"<td><code>{esc(item.get('command'))}</code></td>"
-        f"<td>{esc('OK' if int(item.get('exit_code', item.get('exitCode', 1))) == 0 else 'FAIL')}</td></tr>"
-        for item in commands
-        if isinstance(item, dict)
-    ) or '<tr><td colspan="3">没有命令证据</td></tr>'
-    files = seq(summary.get("changedFiles"))
-    file_rows = "".join(
-        f"<tr><td><code>{esc(item.get('path') or item.get('file'))}</code></td>"
-        f"<td>+{esc(item.get('insertions') or 0)}</td>"
-        f"<td>-{esc(item.get('deletions') or 0)}</td></tr>"
-        for item in files
-        if isinstance(item, dict)
-    ) or '<tr><td colspan="3">没有变更文件证据</td></tr>'
-    risk_rows = "".join(f"<li>{esc(describe(item))}</li>" for item in risks) or "<li>当前没有未处置风险</li>"
-    action_rows = "".join(f"<li>{esc(describe(item))}</li>" for item in actions) or "<li>无需人工后续动作</li>"
-    release_card = (
-        ""
-        if record_only
-        else "<article class=\"card\"><h2>发布与候选</h2>"
-        f"<p>候选证明 / 发布资格：{esc(release.get('decision') or 'NOT_EVALUATED')}</p></article>"
-    )
-    remote = rec(measurements.get("remoteCost"))
-    storage = rec(measurements.get("artifactStorage"))
-    remote_totals = rec(remote.get("totals"))
-    projection = rec(summary.get("projection"))
-    archive_integrity = rec(summary.get("archiveIntegrity"))
-    durability = rec(summary.get("archiveDurability"))
-    durability_status = str(
-        durability.get("status") or "ARCHIVED_LOCAL_ONLY"
-    )
-    scenario_coverage = rec(summary.get("scenarioCoverage"))
-    unexecuted_scenarios = [
-        str(item) for item in seq(scenario_coverage.get("unexecuted"))
-    ]
-    scenario_status = str(
-        scenario_coverage.get("code")
-        or ("SCENARIO_COVERAGE_OK" if scenario_coverage.get("ok") else "NOT_RUN")
-    )
-    total_files = rec(summary.get("archiveManifest")).get("totalArchiveFiles")
-    total_files_text = "" if total_files is None else str(total_files)
-
-    return f"""<!doctype html>
-<html lang="zh-CN"><head><meta charset="utf-8"><meta name="viewport" content="width=device-width,initial-scale=1">
-<title>Harness 最终报告 · {esc(summary.get("changeName"))}</title>
-<style>
-:root{{--bg:#f4f6f8;--card:#fff;--text:#172033;--muted:#667085;--line:#dfe5ec}}
-@media(prefers-color-scheme:dark){{:root{{--bg:#0b1119;--card:#121a26;--text:#eef3f9;--muted:#9aa8ba;--line:#2a384a}}}}
-*{{box-sizing:border-box}}html,body{{max-width:100%;overflow-x:hidden}}body{{margin:0;background:var(--bg);color:var(--text);font:14px/1.55 "Segoe UI","Microsoft YaHei",sans-serif}}main{{width:min(1120px,calc(100% - 32px));margin:24px auto}}.hero,.card,.metric,.verify,details{{background:var(--card);border:1px solid var(--line);border-radius:14px;padding:16px}}.hero h1{{margin:4px 0}}.metrics,.groups{{display:grid;grid-template-columns:repeat(5,1fr);gap:9px;margin:10px 0}}.metric strong,.verify strong{{display:block;font-size:17px}}.verify small{{display:block;color:var(--muted)}}.risk{{display:grid;grid-template-columns:1fr 1fr;gap:10px}}.card{{margin:10px 0}}details{{margin:9px 0}}summary{{cursor:pointer;font-weight:700}}details>div{{overflow:auto}}table{{width:100%;border-collapse:collapse}}td,th{{padding:8px;border-bottom:1px solid var(--line);text-align:left}}code{{overflow-wrap:anywhere}}@media(max-width:600px){{main{{width:calc(100% - 18px);margin:9px auto}}.metrics,.groups,.risk{{grid-template-columns:1fr}}}}
-</style></head><body><main>
-<section class="hero"><small>HARNESS · 管理结论</small><h1>{esc(summary.get("changeName"))}</h1>
-<p>{esc(summary.get("businessGoal") or "未记录业务目标")}</p>
-<strong title="{esc(current.get("status"))}">{esc(status_label(current.get("status")))}</strong>
-<p id="finalStatusReasons">{esc(" · ".join(str(item) for item in seq(current.get("reasons"))))}</p>
-{"<p>归档意图：仅记录 · 未请求发布</p>" if record_only else ""}</section>
-<section class="metrics"><article class="metric"><small>产品提交</small><strong><code>{esc(str(product_commit)[:10])}</code></strong></article>
-<article class="metric"><small>验证概览</small><strong>{passed}/5 组通过</strong></article>
-<article class="metric"><small>风险与动作</small><strong>{len(risks)} / {len(actions)}</strong></article>
-<article class="metric"><small>全流程耗时</small><strong>{esc(timing.get("workflowWallClockMs") or "N/A")}</strong></article>
-<article class="metric"><small>归档文件</small><strong>{esc(total_files_text or "N/A")}</strong></article></section>
-<article class="card"><h2>验证概览</h2><div class="groups">{"".join(groups)}</div></article>
-<article class="card"><h2>场景执行闭环</h2>
-<p>结构化运行回执：{esc(scenario_status)}</p>
-<p>未执行 / 未通过：{esc(", ".join(unexecuted_scenarios) or "无")}</p></article>
-<article class="card"><h2>风险与动作</h2><div class="risk"><section><h3>当前风险</h3><ul>{risk_rows}</ul></section><section><h3>人工动作</h3><ul>{action_rows}</ul></section></div></article>
-{release_card}
-<details><summary>技术证据 · 时间守恒</summary><div><p>conservationDeltaMs={esc(timing.get("conservationDeltaMs") if "conservationDeltaMs" in timing else "N/A")}</p>
-<p>workflowWallClock={esc(timing.get("workflowWallClockMs") if "workflowWallClockMs" in timing else "N/A")}</p>
-<p>stageActiveExecution={esc(timing.get("stageActiveExecutionMs") if "stageActiveExecutionMs" in timing else "N/A")}</p>
-<p>stageWallClockSpan={esc(timing.get("stageWallClockSpanMs") if "stageWallClockSpanMs" in timing else "N/A")}</p>
-<p>reportCutoffAt={esc(timing.get("reportCutoffAt") or "N/A")}</p>
-<p>远端 runner 成本：{esc(measurement_label(remote_totals.get("runnerMinutes") or remote.get("runnerMinutes")))}</p>
-<p>新增制品字节：{esc(measurement_label(storage.get("bytesAdded")))}</p></div></details>
-<details><summary>技术证据 · 发布与归档治理</summary><div>
-    <p>归档完整性：{esc(archive_integrity.get("code") or rec(summary.get("archiveManifest")).get("checksumStatus") or "N/A")}</p>
-    <p>归档持久性：{esc(durability_status)} · {esc(durability.get("risk") or "已通过持久介质回读校验")}</p>
-    <p>保留策略：{esc(durability.get("retentionPolicy") or "N/A")}</p>
-    <p>历史质量：未闭合尝试 {esc(timing.get("unclosedAttemptCount") if "unclosedAttemptCount" in timing else "N/A")}</p>
-<p>投影状态：{esc(projection.get("code") or projection.get("mode") or "N/A")}</p></div></details>
-<details><summary>技术证据 · 变更文件</summary><div><table><tbody>{file_rows}</tbody></table></div></details>
-<details><summary>技术证据 · 命令</summary><div><table><tbody>{command_rows}</tbody></table></div></details>
-<details><summary>技术元数据</summary><div><p>productCommit=<code>{esc(product_commit)}</code></p>
-<p>schemaVersion={esc(summary.get("schemaVersion"))}</p></div></details>
-</main></body></html>
-"""
-
-
-
-# P1 slim-files: final-summary.html is a regenerable presentation layer over
-# summary-data.json. `finalize --no-html` skips local HTML rendering entirely
-# (a remote platform can render from summary-data.json); render failures are
-# downgraded to warnings instead of rolling back the archive.
-RENDER_HTML_ENABLED = True
-
-
-def render_final_summary(
-    change_dir: Path,
-    summary_path: Path,
-) -> dict[str, Any]:
-    """Render final-summary.html via Node; fall back to a Python renderer.
-
-    Returns ``{ok, renderer, fallbackReason, out_path}``:
-    - Node success -> renderer="node".
-    - Node unavailable/timeout/non-zero/no-file -> Python fallback; success ->
-      renderer="python-fallback" (fallbackReason carries the node failure cause).
-    - Both fail or produce no file -> ok=False (caller downgrades to warning).
-    - Rendering disabled (--no-html) -> ok=True with renderer="skipped".
-    """
-    out_path = change_dir / "reports" / "final" / "final-summary.html"
-    if not RENDER_HTML_ENABLED:
-        return {
-            "ok": True,
-            "renderer": "skipped",
-            "fallbackReason": "",
-            "out_path": str(out_path),
-            "skipped": True,
-        }
-    project = find_project_root(change_dir)
-    node = resolve_node_path(project)
-    fallback_reason = ""
-
-    if node and RENDER_SCRIPT.is_file():
-        out_path.parent.mkdir(parents=True, exist_ok=True)
-        try:
-            proc = subprocess.run(
-                [
-                    node,
-                    str(RENDER_SCRIPT),
-                    "--summary",
-                    str(summary_path),
-                    "--out",
-                    str(out_path),
-                ],
-                capture_output=True,
-                text=True,
-                encoding="utf-8",
-                errors="replace",
-                timeout=60,
-                check=False,
-            )
-            if proc.returncode == 0 and out_path.is_file():
-                return {
-                    "ok": True,
-                    "renderer": "node",
-                    "fallbackReason": "",
-                    "out_path": str(out_path),
-                }
-            fallback_reason = (
-                f"node render exit {proc.returncode}: "
-                f"{(proc.stderr or proc.stdout or '')[:200]}"
-            )
-        except (OSError, subprocess.TimeoutExpired) as exc:
-            fallback_reason = f"node render failed: {exc}"
-    else:
-        fallback_reason = (
-            "node unavailable" if not node else f"renderer missing: {RENDER_SCRIPT}"
-        )
-
-    # Python fallback
-    try:
-        summary = read_json(summary_path)
-        html = render_fallback_html(summary)
-        out_path.parent.mkdir(parents=True, exist_ok=True)
-        out_path.write_text(html, encoding="utf-8", newline="\n")
-    except (OSError, json.JSONDecodeError, ValueError) as exc:
-        return {
-            "ok": False,
-            "renderer": "none",
-            "fallbackReason": f"{fallback_reason}; fallback failed: {exc}",
-            "out_path": str(out_path),
-        }
-    if out_path.is_file():
-        return {
-            "ok": True,
-            "renderer": "python-fallback",
-            "fallbackReason": fallback_reason,
-            "out_path": str(out_path),
-        }
-    return {
-        "ok": False,
-        "renderer": "none",
-        "fallbackReason": f"{fallback_reason}; fallback produced no file",
-        "out_path": str(out_path),
-    }
-
-
-# ---------------------------------------------------------------------------
-# validate
-# ---------------------------------------------------------------------------
 
 
 def _manifest_self_stats(
@@ -5312,22 +5309,24 @@ def _append_finalize_failure_terminal(
     *,
     operation_id: str,
 ) -> None:
-    """Persist one failed finalize attempt on the authoritative change source."""
+    """Record a blocked preparation without manufacturing an archive attempt."""
     if not authoritative_change_dir.is_dir():
         return
     try:
         append_event(
             authoritative_change_dir,
             phase="archive",
-            type_="phase.start",
-            note=f"finalize operation {operation_id} failed before publish",
+            type_="phase.prepare.start",
+            note="开始检查归档条件",
         )
         append_event(
             authoritative_change_dir,
             phase="archive",
-            type_="phase.end",
-            status="FAIL",
-            note=f"finalize operation {operation_id} discarded: {message}",
+            type_="phase.prepare.end",
+            status="BLOCKED",
+            code="ARCHIVE_PREPARE_BLOCKED",
+            message=f"归档条件未满足：{message}",
+            note=f"归档操作 {operation_id} 未进入正式执行",
         )
     except OSError:
         pass
@@ -5501,302 +5500,62 @@ def validate_source_consistency(
                     "message": f"summary {field} does not match frozen source projection",
                 }
             )
-
-    # 4. Manifest structure/checksums and summary semantics.
-    before_path = change_dir / "evidence" / "archive-manifest-before.json"
-    if before_path.is_file():
-        try:
-            manifest = read_json(before_path)
-            entries = manifest.get("files") if isinstance(manifest, dict) else None
-            valid = isinstance(entries, list) and manifest.get("fileCount") == len(entries)
-            seen: set[str] = set()
-            if valid:
-                for entry in entries:
-                    rel = str(entry.get("path") or "") if isinstance(entry, dict) else ""
-                    digest = str(entry.get("sha256") or "") if isinstance(entry, dict) else ""
-                    if (
-                        not rel
-                        or rel in seen
-                        or re.fullmatch(r"[0-9a-f]{64}", digest) is None
-                    ):
-                        valid = False
-                        break
-                    seen.add(rel)
-                    target = (change_dir / rel).resolve()
-                    if not target.is_relative_to(change_dir.resolve()) or not target.is_file():
-                        valid = False
-                        break
-                    if not _manifest_path_excluded(rel) and sha256_file(target) != digest:
-                        valid = False
-                        break
-            if not valid:
-                issues.append(
-                    {
-                        "code": "manifest-invalid",
-                        "severity": "error",
-                        "message": "archive-manifest-before structure or checksum is invalid",
-                    }
-                )
-        except (OSError, json.JSONDecodeError):
-            issues.append(
-                {
-                    "code": "manifest-invalid",
-                    "severity": "error",
-                    "message": "archive-manifest-before is unreadable",
-                }
-            )
-
-    # 5. Artifact paths must resolve to immutable files inside the archive.
-    root = change_dir.resolve()
-    for artifact in summary.get("artifacts") or []:
-        raw = str(artifact.get("path") or "") if isinstance(artifact, dict) else ""
-        candidate = (root / raw).resolve() if raw else root
-        if not raw or not candidate.is_relative_to(root) or not candidate.is_file():
-            issues.append(
-                {
-                    "code": "artifact-missing",
-                    "severity": "error",
-                    "message": f"artifact path is missing or outside archive: {raw}",
-                }
-            )
-
-    errors = [i for i in issues if i.get("severity") == "error"]
-    warnings = [i for i in issues if i.get("severity") != "error"]
-    return {
-        "ok": len(errors) == 0,
-        "issues": issues,
-        "error_count": len(errors),
-        "warning_count": len(warnings),
-    }
-
-
-def validate_summary(
-    summary: dict[str, Any],
-    html_path: Path | None,
-    *,
-    render_skipped: bool = False,
-) -> dict[str, Any]:
-    """Validate final-summary covers summary-data key facts (in-process)."""
-    issues: list[dict[str, str]] = []
-
-    change_id = str(summary.get("changeName") or "")
-    html = ""
-    if html_path and html_path.is_file():
-        try:
-            html = html_path.read_text(encoding="utf-8-sig")
-        except OSError as exc:
-            issues.append(
-                {
-                    "code": "missing-final-report",
-                    "severity": "error",
-                    "message": f"cannot read final-summary: {exc}",
-                }
-            )
-    else:
-        # P1 slim-files: final-summary.html 是 summary-data.json 的可再生展示
-        # 投影，不再是硬产物（summary-data + manifest + adequacy 仍 fail-closed）。
-        # 缺 HTML 恒为 warning，不阻断归档收尾；平台端可按 summary-data 渲染。
-        _ = render_skipped  # kept for call-site compatibility
-        issues.append(
-            {
-                "code": "missing-final-report",
-                "severity": "warning",
-                "message": "reports/final/final-summary.html not found",
-            }
-        )
-
-    def has_text(needle: str) -> bool:
-        if not needle or needle == NOT_AVAILABLE:
-            return True
-        return needle in html
-
-    # change id
-    if html and change_id and not has_text(change_id):
-        issues.append(
-            {
-                "code": "missing-change-id",
-                "severity": "error",
-                "message": f"final-summary missing change id '{change_id}'",
-            }
-        )
-
-    # key commands — stock render-summary.mjs does not embed reportPipeline.commands.
-    # Require commands to be present in summary-data; HTML absence is warning only.
-    commands = (summary.get("reportPipeline") or {}).get("commands") or []
-    if html:
-        for cmd in commands[:8]:
-            c = str(cmd.get("command") or "").strip()
-            if not c:
-                continue
-            fragment = c if len(c) <= 60 else c[:60]
-            token = c.split()[-1] if c.split() else c
-            in_html = (
-                fragment in html
-                or _html_escape(fragment) in html
-                or (len(token) >= 4 and (token in html or _html_escape(token) in html))
-            )
-            if not in_html:
-                issues.append(
-                    {
-                        "code": "missing-command",
-                        "severity": "warning",
-                        "message": (
-                            f"final-summary HTML omits command (renderer may not "
-                            f"embed commands): {c}"
-                        ),
-                    }
-                )
-
-        # verification
-        ver = summary.get("verification") or {}
-        unit = ver.get("unitTests") or {}
-        api = ver.get("apiTests") or {}
-        browser = ver.get("browserE2E") or {}
-        pass_rate = unit.get("passRate")
-        if pass_rate and pass_rate != NOT_AVAILABLE and str(pass_rate) not in html:
-            issues.append(
-                {
-                    "code": "missing-verification",
-                    "severity": "warning",
-                    "message": f"unitTests.passRate '{pass_rate}' not in final-summary",
-                }
-            )
-        api_status = str(api.get("status") or "")
-        if api_status and api_status not in {"", NOT_AVAILABLE} and api_status not in html:
-            # Renderer shows api status; soft warning
-            if api_status in {"USER_SKIPPED", "BLOCKED_BY_DBA", "NOT_RUN", "PARTIAL"}:
-                issues.append(
-                    {
-                        "code": "missing-verification",
-                        "severity": "warning",
-                        "message": f"apiTests.status '{api_status}' not visible in final-summary",
-                    }
-                )
-        browser_status = str(browser.get("status") or "")
-        if (
-            browser_status
-            and browser_status not in {"", NOT_AVAILABLE}
-            and browser_status not in html
-        ):
-            issues.append(
-                {
-                    "code": "missing-verification",
-                    "severity": "warning",
-                    "message": (
-                        f"browserE2E.status '{browser_status}' not visible "
-                        "in final-summary"
-                    ),
-                }
-            )
-
-        # artifacts / summary-data path hints
-        am = summary.get("archiveManifest") or {}
-        total = am.get("totalArchiveFiles")
-        if total is not None and str(total) not in html:
-            issues.append(
-                {
-                    "code": "missing-artifact",
-                    "severity": "warning",
-                    "message": "archiveManifest.totalArchiveFiles not reflected in final-summary",
-                }
-            )
-
-        # risks / manual actions — empty arrays are OK (placeholder)
-        for risk in summary.get("knownRisks") or []:
-            # UT-016/RET-28: canonical projection — structured risk objects
-            # project to their message; str(dict) never matches rendered HTML.
-            if isinstance(risk, dict):
-                text = str(risk.get("message") or risk.get("summary") or "").strip()
-            else:
-                text = str(risk)
-            if text and text not in html and _html_escape(text) not in html:
+
+    # 4. Manifest structure/checksums and summary semantics.
+    before_path = change_dir / "evidence" / "archive-manifest-before.json"
+    if before_path.is_file():
+        try:
+            manifest = read_json(before_path)
+            entries = manifest.get("files") if isinstance(manifest, dict) else None
+            valid = isinstance(entries, list) and manifest.get("fileCount") == len(entries)
+            seen: set[str] = set()
+            if valid:
+                for entry in entries:
+                    rel = str(entry.get("path") or "") if isinstance(entry, dict) else ""
+                    digest = str(entry.get("sha256") or "") if isinstance(entry, dict) else ""
+                    if (
+                        not rel
+                        or rel in seen
+                        or re.fullmatch(r"[0-9a-f]{64}", digest) is None
+                    ):
+                        valid = False
+                        break
+                    seen.add(rel)
+                    target = (change_dir / rel).resolve()
+                    if not target.is_relative_to(change_dir.resolve()) or not target.is_file():
+                        valid = False
+                        break
+                    if not _manifest_path_excluded(rel) and sha256_file(target) != digest:
+                        valid = False
+                        break
+            if not valid:
                 issues.append(
                     {
-                        "code": "missing-risk",
-                        "severity": "warning",
-                        "message": f"knownRisk not in final-summary: {text[:80]}",
+                        "code": "manifest-invalid",
+                        "severity": "error",
+                        "message": "archive-manifest-before structure or checksum is invalid",
                     }
                 )
-
-        # status contradiction
-        final_status = str(summary.get("finalStatus") or "")
-        browser_conditional = {
-            "USER_SKIPPED",
-            "BLOCKED",
-            "BLOCKED_BY_ENV",
-            "NOT_RUN",
-            "PARTIAL",
-        }
-        has_skip = api_status == "USER_SKIPPED" or browser_status in browser_conditional or str(
-            ver.get("dbCompatibility") or ""
-        ) == "BLOCKED_BY_DBA"
-        has_fail_ver = int(unit.get("failures") or 0) > 0 or int(unit.get("errors") or 0) > 0
-        has_fail_ver = has_fail_ver or int(api.get("failed") or 0) > 0
-        has_fail_ver = (
-            has_fail_ver
-            or int(browser.get("failed") or 0) > 0
-            or browser_status == "FAIL"
-        )
-        stage = summary.get("stageStatus") or {}
-        has_fail_stage = any(str(v).upper() == "FAIL" for v in stage.values())
-
-        if (has_skip or has_fail_ver or has_fail_stage) and final_status == "OK":
+        except (OSError, json.JSONDecodeError):
             issues.append(
                 {
-                    "code": "status-contradiction",
+                    "code": "manifest-invalid",
                     "severity": "error",
-                    "message": (
-                        "finalStatus is pure OK but USER_SKIPPED/BLOCKED_BY_DBA/"
-                        "failed verification present"
-                    ),
+                    "message": "archive-manifest-before is unreadable",
                 }
             )
-        if has_skip and html:
-            if re.search(r">\s*OK\s*<", html) and "CONDITIONAL" not in html.upper():
-                if final_status != "CONDITIONAL_OK":
-                    issues.append(
-                        {
-                            "code": "status-contradiction",
-                            "severity": "error",
-                            "message": "final-summary shows pure OK despite USER_SKIPPED/BLOCKED",
-                        }
-                    )
-    else:
-        # No HTML (and not render_skipped handled above): still check data-level status rules
-        ver = summary.get("verification") or {}
-        unit = ver.get("unitTests") or {}
-        api = ver.get("apiTests") or {}
-        browser = ver.get("browserE2E") or {}
-        api_status = str(api.get("status") or "")
-        browser_status = str(browser.get("status") or "")
-        final_status = str(summary.get("finalStatus") or "")
-        has_skip = api_status == "USER_SKIPPED" or browser_status in {
-            "USER_SKIPPED",
-            "BLOCKED",
-            "BLOCKED_BY_ENV",
-            "NOT_RUN",
-            "PARTIAL",
-        } or str(
-            ver.get("dbCompatibility") or ""
-        ) == "BLOCKED_BY_DBA"
-        has_fail_ver = int(unit.get("failures") or 0) > 0 or int(unit.get("errors") or 0) > 0
-        has_fail_ver = has_fail_ver or int(api.get("failed") or 0) > 0
-        has_fail_ver = (
-            has_fail_ver
-            or int(browser.get("failed") or 0) > 0
-            or browser_status == "FAIL"
-        )
-        stage = summary.get("stageStatus") or {}
-        has_fail_stage = any(str(v).upper() == "FAIL" for v in stage.values())
-        if (has_skip or has_fail_ver or has_fail_stage) and final_status == "OK":
+
+    # 5. Artifact paths must resolve to immutable files inside the archive.
+    root = change_dir.resolve()
+    for artifact in summary.get("artifacts") or []:
+        raw = str(artifact.get("path") or "") if isinstance(artifact, dict) else ""
+        candidate = (root / raw).resolve() if raw else root
+        if not raw or not candidate.is_relative_to(root) or not candidate.is_file():
             issues.append(
                 {
-                    "code": "status-contradiction",
+                    "code": "artifact-missing",
                     "severity": "error",
-                    "message": (
-                        "finalStatus is pure OK but USER_SKIPPED/BLOCKED_BY_DBA/"
-                        "failed verification present"
-                    ),
+                    "message": f"artifact path is missing or outside archive: {raw}",
                 }
             )
 
@@ -5810,14 +5569,55 @@ def validate_summary(
     }
 
 
-def _html_escape(text: str) -> str:
-    return (
-        text.replace("&", "&amp;")
-        .replace("<", "&lt;")
-        .replace(">", "&gt;")
-        .replace('"', "&quot;")
-        .replace("'", "&#39;")
+def validate_summary_data(summary: dict[str, Any]) -> dict[str, Any]:
+    """Validate canonical summary data without creating an HTML projection."""
+    issues: list[dict[str, str]] = []
+    verification = summary.get("verification") or {}
+    verification = verification if isinstance(verification, dict) else {}
+    unit = verification.get("unitTests") or {}
+    api = verification.get("apiTests") or {}
+    browser = verification.get("browserE2E") or {}
+    unit = unit if isinstance(unit, dict) else {}
+    api = api if isinstance(api, dict) else {}
+    browser = browser if isinstance(browser, dict) else {}
+    api_status = str(api.get("status") or "")
+    browser_status = str(browser.get("status") or "")
+    final_status = str(summary.get("finalStatus") or "")
+    has_skip = api_status == "USER_SKIPPED" or browser_status in {
+        "USER_SKIPPED",
+        "BLOCKED",
+        "BLOCKED_BY_ENV",
+        "NOT_RUN",
+        "PARTIAL",
+    } or str(verification.get("dbCompatibility") or "") == "BLOCKED_BY_DBA"
+    has_failed_verification = (
+        int(unit.get("failures") or 0) > 0
+        or int(unit.get("errors") or 0) > 0
+        or int(api.get("failed") or 0) > 0
+        or int(browser.get("failed") or 0) > 0
+        or browser_status == "FAIL"
     )
+    stage = summary.get("stageStatus") or {}
+    stage = stage if isinstance(stage, dict) else {}
+    has_failed_stage = any(str(value).upper() == "FAIL" for value in stage.values())
+    if (has_skip or has_failed_verification or has_failed_stage) and final_status == "OK":
+        issues.append(
+            {
+                "code": "status-contradiction",
+                "severity": "error",
+                "message": (
+                    "finalStatus is pure OK but skipped, blocked, or failed "
+                    "verification is present"
+                ),
+            }
+        )
+    errors = [item for item in issues if item.get("severity") == "error"]
+    return {
+        "ok": not errors,
+        "issues": issues,
+        "error_count": len(errors),
+        "warning_count": len(issues) - len(errors),
+    }
 
 
 # ---------------------------------------------------------------------------
@@ -5834,6 +5634,10 @@ def validate_report_adequacy(summary: dict[str, Any]) -> dict[str, Any]:
     a lossy projection of itself.
     """
     issues: list[dict[str, str]] = []
+    closure_disposition = str(
+        summary.get("closureDisposition") or "completed"
+    ).strip()
+    unfinished_closure = closure_disposition in {"abandoned", "superseded"}
 
     # H-12: prefer top-level baseCommit + diffStat; gitFacts is a mirror.
     base = str(summary.get("baseCommit") or "").strip()
@@ -5858,7 +5662,7 @@ def validate_report_adequacy(summary: dict[str, Any]) -> dict[str, Any]:
     final_present = bool(
         (final and final != NOT_AVAILABLE) or (merge_final and merge_final != NOT_AVAILABLE)
     )
-    if final_present and base_missing:
+    if final_present and base_missing and not unfinished_closure:
         issues.append({
             "code": "IDENTITY_BASE_MISSING",
             "severity": "error",
@@ -5875,6 +5679,7 @@ def validate_report_adequacy(summary: dict[str, Any]) -> dict[str, Any]:
         and final != NOT_AVAILABLE
         and base != final
         and files_changed == 0
+        and not unfinished_closure
     ):
         issues.append({
             "code": "DIFF_ZERO_WITH_NONEMPTY_COMMIT",
@@ -5902,13 +5707,14 @@ def validate_report_adequacy(summary: dict[str, Any]) -> dict[str, Any]:
     if not feature_tip:
         feature_tip = str(identity_doc_early.get("productCommit") or "").strip()
 
-    if (
+    collapsed_boundary = (
         base
         and base != NOT_AVAILABLE
         and feature_tip
         and feature_tip != NOT_AVAILABLE
         and base == feature_tip
-    ):
+    )
+    if collapsed_boundary and not unfinished_closure:
         issues.append({
             "code": "ARCHIVE_BASE_EQUALS_FEATURE_TIP",
             "severity": "error",
@@ -5917,6 +5723,15 @@ def validate_report_adequacy(summary: dict[str, Any]) -> dict[str, Any]:
                 "archive boundary collapsed to an empty/merge-only delta"
             ),
         })
+    elif unfinished_closure and files_changed == 0:
+        issues.append({
+            "code": "NO_PRODUCT_DELTA",
+            "severity": "warning",
+            "message": (
+                "未完成变更没有产生产品增量；仅封存过程、原因与已有证据，"
+                "不得作为发布候选。"
+            ),
+        })
 
     ownership = summary.get("ownershipDiff") or summary.get("ownership")
     ownership = ownership if isinstance(ownership, dict) else {}
@@ -5929,7 +5744,7 @@ def validate_report_adequacy(summary: dict[str, Any]) -> dict[str, Any]:
     changed_files = summary.get("changedFiles")
     changed_count = len(changed_files) if isinstance(changed_files, list) else files_changed
 
-    if ownership_count > 0 and changed_count == 0:
+    if ownership_count > 0 and changed_count == 0 and not unfinished_closure:
         issues.append({
             "code": "ARCHIVE_DIFF_SHRUNK_VS_OWNERSHIP",
             "severity": "error",
@@ -5939,7 +5754,12 @@ def validate_report_adequacy(summary: dict[str, Any]) -> dict[str, Any]:
                 "but does not represent the full change"
             ),
         })
-    elif ownership_count > 0 and changed_count > 0 and changed_count * 3 < ownership_count:
+    elif (
+        ownership_count > 0
+        and changed_count > 0
+        and changed_count * 3 < ownership_count
+        and not unfinished_closure
+    ):
         issues.append({
             "code": "ARCHIVE_DIFF_SHRUNK_VS_OWNERSHIP",
             "severity": "error",
@@ -5950,7 +5770,11 @@ def validate_report_adequacy(summary: dict[str, Any]) -> dict[str, Any]:
         })
 
     merge_parents = summary.get("mergeParents") or summary.get("mergeParentHashes")
-    if isinstance(merge_parents, list) and len(merge_parents) >= 2:
+    if (
+        isinstance(merge_parents, list)
+        and len(merge_parents) >= 2
+        and not unfinished_closure
+    ):
         first_parent = str(merge_parents[0] or "").strip()
         if (
             base
@@ -6173,7 +5997,15 @@ def validate_report_adequacy(summary: dict[str, Any]) -> dict[str, Any]:
             }
         )
 
-    return {"ok": not issues, "issues": issues}
+    error_count = sum(
+        1 for issue in issues if str(issue.get("severity") or "error") == "error"
+    )
+    return {
+        "ok": error_count == 0,
+        "issues": issues,
+        "error_count": error_count,
+        "warning_count": len(issues) - error_count,
+    }
 
 
 RELEASE_CHECKS = (
@@ -7466,6 +7298,7 @@ def cmd_finalize(
     archive_intent: str = "release-candidate",
     closure_disposition: str = "completed",
     closure_reason: str = "",
+    preflight_status: dict[str, Any] | None = None,
 ) -> tuple[int, dict[str, Any]]:
     """Execute the 9-step finalize pipeline. Returns (exit_code, payload)."""
     if archive_intent not in {"release-candidate", "record-only"}:
@@ -7536,6 +7369,11 @@ def cmd_finalize(
         if resolved_state_dir.resolve() != original_change_dir.resolve()
         else None
     )
+    authoritative_event_dir = (
+        split_state_dir
+        if split_state_dir is not None and split_state_dir.is_dir()
+        else original_change_dir
+    )
     operation_id = f"a-{uuid.uuid4().hex[:12]}"
     operation_root = project_root / ".harness" / "archive-operations"
     operation_temp_dir = operation_root / "staging" / operation_id / change_dir.name
@@ -7545,13 +7383,22 @@ def cmd_finalize(
         shutil.rmtree(operation_temp_dir.parent, ignore_errors=True)
         payload["original_preserved"] = original_change_dir.is_dir()
         payload["finalStatus"] = "FAIL"
-        _append_finalize_failure_terminal(
-            split_state_dir
-            if split_state_dir is not None and split_state_dir.is_dir()
-            else original_change_dir,
-            str(payload.get("error") or "archive finalize failed"),
-            operation_id=operation_id,
-        )
+        if authoritative_event_dir.is_dir():
+            try:
+                append_event(
+                    authoritative_event_dir,
+                    phase="archive",
+                    type_="phase.end",
+                    status="FAIL",
+                    code=str(
+                        payload.get("reasonCode")
+                        or "ARCHIVE_FINALIZE_FAILED"
+                    ),
+                    message=str(payload.get("error") or "归档执行失败"),
+                    note=f"归档操作 {operation_id} 失败，原变更目录已保留",
+                )
+            except OSError:
+                pass
         try:
             write_json(
                 operation_record,
@@ -7595,6 +7442,65 @@ def cmd_finalize(
         payload["error"] = f"archive target already exists: {archive_dir}"
         return 1, payload
 
+    status = preflight_status or check_status(
+        original_change_dir,
+        allow_missing_review=allow_missing_review,
+        archive_intent=archive_intent,
+        closure_disposition=closure_disposition,
+        closure_reason=closure_reason,
+    )
+    payload["steps"]["preflight"] = status
+    if not status.get("archivable"):
+        report_adequacy = (
+            (status.get("releaseDecision") or {}).get("checks") or {}
+        ).get("reportAdequacy") or {}
+        adequacy_failed = report_adequacy.get("ok") is False
+        payload["reasonCode"] = (
+            "ARCHIVE_REPORT_ADEQUACY_FAILED"
+            if adequacy_failed
+            else "ARCHIVE_PRECONDITIONS_UNSATISFIED"
+        )
+        payload["error"] = (
+            "归档报告不完整，未进入暂存与发布阶段。"
+            if adequacy_failed
+            else "归档前置条件未满足，未进入暂存与发布阶段。"
+        )
+        payload["issues"] = [
+            {
+                "code": str(
+                    item.get("code") or "ARCHIVE_PRECONDITION_FAILED"
+                ).replace("-", "_").upper(),
+                "severity": "error",
+                "message": str(item.get("message") or payload["error"]),
+            }
+            for item in status.get("blockers") or []
+            if isinstance(item, dict)
+        ]
+        payload["original_preserved"] = original_change_dir.is_dir()
+        payload["finalStatus"] = "BLOCKED"
+        _append_finalize_failure_terminal(
+            split_state_dir
+            if split_state_dir is not None and split_state_dir.is_dir()
+            else original_change_dir,
+            payload["error"],
+            operation_id=operation_id,
+        )
+        return 1, payload
+
+    # The formal archive attempt starts after the one-shot preflight succeeds,
+    # before scans and staging begin.  Keeping this start in authoritative state
+    # makes the monitor show the real duration and exactly one attempt.
+    if authoritative_event_dir.is_dir():
+        try:
+            append_event(
+                authoritative_event_dir,
+                phase="archive",
+                type_="phase.start",
+                note="归档条件已通过，开始扫描、暂存与发布",
+            )
+        except OSError as exc:
+            warnings.append(f"archive phase start append failed: {exc}")
+
     source_sensitive_refresh = hruntime.refresh_sensitive_evidence_scan_receipt(
         original_change_dir,
         persist=False,
@@ -7615,8 +7521,7 @@ def cmd_finalize(
                 "message": payload["error"],
             }
         ]
-        payload["original_preserved"] = original_change_dir.is_dir()
-        payload["finalStatus"] = "FAIL"
+        _restore_finalize_failure()
         return 1, payload
 
     source_sensitive_gate = validate_sensitive_evidence_publication_gate(
@@ -7642,8 +7547,7 @@ def cmd_finalize(
                 "message": payload["error"],
             }
         ]
-        payload["original_preserved"] = original_change_dir.is_dir()
-        payload["finalStatus"] = "FAIL"
+        _restore_finalize_failure()
         return 1, payload
 
     exact_byte = check_archive_exact_byte_policy(project_root)
@@ -7674,15 +7578,7 @@ def cmd_finalize(
                 ),
             }
         ]
-        payload["original_preserved"] = original_change_dir.is_dir()
-        payload["finalStatus"] = "FAIL"
-        _append_finalize_failure_terminal(
-            split_state_dir
-            if split_state_dir is not None and split_state_dir.is_dir()
-            else original_change_dir,
-            payload["error"],
-            operation_id=operation_id,
-        )
+        _restore_finalize_failure()
         return 1, payload
 
     payload["steps"]["service_stop_before_staging"] = run_service_stop(
@@ -7801,9 +7697,6 @@ def cmd_finalize(
         except OSError as exc:
             warnings.append(f"event append failed: {exc}")
 
-    # Step 9 starts here: phase.start
-    _safe_append(phase="archive", type_="phase.start", note="finalize start")
-
     # --- 0. cleanup transients (before before-manifest) ---
     try:
         cleanup_result = _cleanup_transients(work_dir)
@@ -8125,32 +8018,12 @@ def cmd_finalize(
         payload["ok"] = False
         return 1, payload
 
-    # --- 6. render (Node, else Python fallback) ---
-    render_result = render_final_summary(work_dir, summary_path)
-    payload["steps"]["render"] = render_result
-    if not render_result.get("ok"):
-        # final-summary.html 是 summary-data.json 的可再生展示层：渲染失败
-        # 降级为 warning，归档继续（平台端可按 summary-data 重新渲染）。
-        msg = str(render_result.get("fallbackReason") or "render failed")
-        warnings.append(f"final-summary render failed (archive continues): {msg}")
-    renderer = render_result.get("renderer")
-    if renderer == "python-fallback" and render_result.get("fallbackReason"):
-        warnings.append(
-            f"node render unavailable; used python-fallback: "
-            f"{render_result.get('fallbackReason')}"
-        )
-
-    html_path = work_dir / "reports" / "final" / "final-summary.html"
-
-    # --- 7. renderer consistency (layer 2) ---
+    # --- 6. canonical summary validation ---
     try:
         summary = read_json(summary_path)
     except (OSError, json.JSONDecodeError):
         pass
-    validate_result = validate_summary(
-        summary,
-        html_path if html_path.is_file() else None,
-    )
+    validate_result = validate_summary_data(summary)
     payload["steps"]["validate"] = validate_result
     summary.setdefault("reportPipeline", {})["validationIssues"] = validate_result.get(
         "issues"
@@ -8169,10 +8042,10 @@ def cmd_finalize(
         warnings.append(f"archive-meta write failed: {exc}")
         payload["steps"]["archive_meta"] = {"ok": False, "error": str(exc)}
 
-    # --- 9/10. final summary stats + render, then LAST manifest (IA-7) ---
-    # Post-manifest rewrites of covered bytes are forbidden. We update summary /
-    # HTML first, regenerate after-manifest last, then verify on-disk hashes.
-    # If summary/html must still change after that, they are excluded with reasons.
+    # --- 9/10. final summary stats, then LAST manifest (IA-7) ---
+    # Post-manifest rewrites of covered bytes are forbidden. We update the
+    # summary first, regenerate after-manifest last, then verify on-disk hashes.
+    # If summary must still change after that, it is excluded with a reason.
     summary = read_json(summary_path)
     summary["archiveManifest"] = {
         "movedFiles": 0,
@@ -8181,14 +8054,8 @@ def cmd_finalize(
         "checksumStatus": "PENDING",
     }
     write_json(summary_path, summary)
-    render_result = render_final_summary(work_dir, summary_path)
-    if not render_result.get("ok"):
-        warnings.append(
-            "final summary re-render failed (archive continues): "
-            f"{render_result.get('fallbackReason') or render_result.get('error')}"
-        )
     summary = read_json(summary_path)
-    validate_result = validate_summary(summary, html_path if html_path.is_file() else None)
+    validate_result = validate_summary_data(summary)
     payload["steps"]["validate"] = validate_result
     summary.setdefault("reportPipeline", {})["validationIssues"] = validate_result.get(
         "issues"
@@ -8214,25 +8081,15 @@ def cmd_finalize(
                 "reports/final/summary-data.json": (
                     "archiveManifest stats written after coverage snapshot"
                 ),
-                "reports/final/final-summary.html": (
-                    "re-rendered after coverage snapshot to display manifest stats"
-                ),
             },
             **_manifest_self_stats(work_dir, after_manifest, after_path),
         }
         write_json(summary_path, summary)
-        render_result = render_final_summary(work_dir, summary_path)
-        if not render_result.get("ok"):
-            warnings.append(
-                "post-manifest summary render failed (archive continues): "
-                f"{render_result.get('fallbackReason') or render_result.get('error')}"
-            )
         coverage = verify_manifest_byte_coverage(
             work_dir,
             after_manifest,
             exclude_paths=[
                 "reports/final/summary-data.json",
-                "reports/final/final-summary.html",
             ],
             exclusion_reasons=summary["archiveManifest"]["exclusionReasons"],
         )
@@ -8288,12 +8145,8 @@ def cmd_finalize(
         ]
         payload["releaseEligible"] = summary["releaseEligible"]
         write_json(summary_path, summary)
-        # Re-render once more for checksumStatus display; remain excluded.
-        render_final_summary(work_dir, summary_path)
         summary = read_json(summary_path)
-        validate_result = validate_summary(
-            summary, html_path if html_path.is_file() else None
-        )
+        validate_result = validate_summary_data(summary)
         payload["steps"]["validate"] = validate_result
         summary.setdefault("reportPipeline", {})["validationIssues"] = (
             validate_result.get("issues") or []
@@ -8407,7 +8260,6 @@ def cmd_finalize(
         shutil.rmtree(operation_temp_dir.parent, ignore_errors=True)
         work_dir = archive_dir
         summary_path = work_dir / "reports" / "final" / "summary-data.json"
-        html_path = work_dir / "reports" / "final" / "final-summary.html"
         payload["steps"]["move"] = {"ok": True, "to": str(archive_dir)}
     except OSError as exc:
         payload["error"] = f"publish failed: {exc}"
@@ -8508,7 +8360,6 @@ def cmd_finalize(
     payload["finalStatus"] = "OK"
     payload["warnings"] = warnings
     payload["summary_data"] = str(summary_path)
-    payload["final_summary"] = str(html_path) if html_path.is_file() else None
     return 0, payload
 
 
@@ -8845,6 +8696,59 @@ def _deterministic_zip_info(path: str) -> zipfile.ZipInfo:
     return info
 
 
+_WINDOWS_LOCAL_PATH_RE = re.compile(
+    r"\b[A-Za-z]:\\(?:[^\s<>:\"|?*]+\\)*[^\s<>:\"|?*]*"
+)
+
+
+def _archive_remote_json_value(value: Any) -> Any:
+    """Remove machine-local absolute paths from the remote JSON projection."""
+    if isinstance(value, dict):
+        return {
+            key: _archive_remote_json_value(item)
+            for key, item in value.items()
+        }
+    if isinstance(value, list):
+        return [_archive_remote_json_value(item) for item in value]
+    if not isinstance(value, str):
+        return value
+    if re.match(r"^[A-Za-z]:[\\/]", value) or value.startswith("\\\\"):
+        return "<local-path>"
+    return _WINDOWS_LOCAL_PATH_RE.sub("<local-path>", value)
+
+
+def _archive_remote_json_bytes(raw: bytes) -> bytes:
+    value = json.loads(raw)
+    projected = _archive_remote_json_value(value)
+    return (
+        json.dumps(
+            projected,
+            ensure_ascii=False,
+            sort_keys=True,
+            separators=(",", ":"),
+        )
+        + "\n"
+    ).encode("utf-8")
+
+
+def resolve_npx_launcher() -> list[str]:
+    """Resolve npx without asking CreateProcess to execute a Windows .CMD shim."""
+    npx = shutil.which("npx")
+    if not npx:
+        raise FileNotFoundError("npx is not installed or not available on PATH")
+    if os.name != "nt":
+        return [npx]
+
+    node = shutil.which("node")
+    if not node:
+        raise FileNotFoundError("node is required to launch npx on Windows")
+    npx_path = Path(npx)
+    npx_cli = npx_path.parent / "node_modules" / "npm" / "bin" / "npx-cli.js"
+    if not npx_cli.is_file():
+        raise FileNotFoundError(f"npx-cli.js not found beside Node.js: {npx_cli}")
+    return [node, str(npx_cli)]
+
+
 def build_archive_package(
     project_root: Path,
     archive_dir: Path,
@@ -8875,7 +8779,7 @@ def build_archive_package(
         # All semantic archive inputs are text and must round-trip as UTF-8.
         raw.decode("utf-8")
         if media_type == "application/json":
-            json.loads(raw)
+            raw = _archive_remote_json_bytes(raw)
         content_by_path[package_path] = raw
         entries.append(
             {
@@ -9104,8 +9008,21 @@ def auto_push_archive_core(
 
     # The published CLI owns credentials, project binding, durable receipt checks,
     # and retries. Generic `push` is intentionally not used for archive bytes.
+    try:
+        launcher = resolve_npx_launcher()
+    except OSError as exc:
+        reason_code = "ARCHIVE_UPLOAD_DEFERRED"
+        try:
+            persist_receipt(upload_status="pending", reason_code=reason_code)
+        except OSError:
+            pass
+        return {
+            **base_result,
+            "reasonCode": reason_code,
+            "warning": f"归档自动上传已延后：{exc}",
+        }
     command = [
-        "npx",
+        *launcher,
         "--yes",
         "hunter-harness",
         "archive",
@@ -9359,13 +9276,7 @@ def cmd_replay(
     # Collect without writing into the archive
     summary = collect_summary_data(archive_dir, write=False, for_replay=True)
 
-    html_path = archive_dir / "reports" / "final" / "final-summary.html"
-    render_skipped = not html_path.is_file()
-    validate_result = validate_summary(
-        summary,
-        html_path if html_path.is_file() else None,
-        render_skipped=render_skipped,
-    )
+    validate_result = validate_summary_data(summary)
     summary.setdefault("reportPipeline", {})["validationIssues"] = (
         validate_result.get("issues") or []
     )
@@ -9423,6 +9334,20 @@ def cmd_auto_gate_cli(args: argparse.Namespace) -> int:
         resolve_path(args.change_dir),
         allow_missing_review=bool(getattr(args, "allow_missing_review", False)),
         archive_intent=str(getattr(args, "intent", "release-candidate")),
+        closure_disposition=str(getattr(args, "closure", "completed")),
+        closure_reason=str(getattr(args, "closure_reason", "")),
+    )
+    emit_json(result)
+    return 0 if result.get("ok") else 1
+
+
+def cmd_adopt_existing_range_cli(args: argparse.Namespace) -> int:
+    result = adopt_existing_range(
+        resolve_path(args.change_dir),
+        base=str(args.base),
+        tip=str(args.tip),
+        reason=str(args.reason),
+        confirmed=bool(getattr(args, "confirm_existing_range", False)),
     )
     emit_json(result)
     return 0 if result.get("ok") else 1
@@ -9462,9 +9387,6 @@ def cmd_certify_local_cli(args: argparse.Namespace) -> int:
 
 
 def cmd_finalize_cli(args: argparse.Namespace) -> int:
-    global RENDER_HTML_ENABLED
-    if getattr(args, "no_html", False):
-        RENDER_HTML_ENABLED = False
     change_dir = resolve_path(args.change_dir)
     archive_root = resolve_path(args.archive_root)
     durable_root = (
@@ -9489,6 +9411,29 @@ def cmd_finalize_cli(args: argparse.Namespace) -> int:
     return code
 
 
+def cmd_execute_cli(args: argparse.Namespace) -> int:
+    durable_root = (
+        resolve_path(args.durable_root)
+        if getattr(args, "durable_root", None)
+        else None
+    )
+    code, payload = execute_archive(
+        resolve_path(args.change_dir),
+        resolve_path(args.archive_root),
+        durable_root=durable_root,
+        retention_policy=str(
+            getattr(args, "retention_policy", "unspecified")
+        ),
+        skip_ingest=bool(args.skip_ingest),
+        allow_missing_review=bool(getattr(args, "allow_missing_review", False)),
+        archive_intent=str(getattr(args, "intent", "release-candidate")),
+        closure_disposition=str(getattr(args, "closure", "completed")),
+        closure_reason=str(getattr(args, "closure_reason", "")),
+    )
+    emit_json(payload)
+    return code
+
+
 def cmd_restore_durable_cli(args: argparse.Namespace) -> int:
     receipt_path = resolve_path(args.receipt)
     target_root = resolve_path(args.target_root)
@@ -9516,50 +9461,12 @@ def cmd_replay_cli(args: argparse.Namespace) -> int:
     return code
 
 
-def _render_html_to(
-    change_dir: Path,
-    summary_path: Path,
-    out_path: Path,
-) -> dict[str, Any]:
-    """Render summary HTML to an arbitrary path (node first, python fallback).
-
-    Unlike ``render_final_summary`` this never touches the canonical
-    ``reports/final/final-summary.html`` — repair renders into staging.
-    """
-    project = find_project_root(change_dir)
-    node = resolve_node_path(project)
-    out_path.parent.mkdir(parents=True, exist_ok=True)
-    if node and RENDER_SCRIPT.is_file():
-        try:
-            proc = subprocess.run(
-                [node, str(RENDER_SCRIPT), "--summary", str(summary_path), "--out", str(out_path)],
-                capture_output=True,
-                text=True,
-                encoding="utf-8",
-                errors="replace",
-                timeout=60,
-                check=False,
-            )
-            if proc.returncode == 0 and out_path.is_file():
-                return {"ok": True, "renderer": "node", "out_path": str(out_path)}
-        except (OSError, subprocess.TimeoutExpired):
-            pass
-    try:
-        summary = read_json(summary_path)
-        html = render_fallback_html(summary)
-        out_path.write_text(html, encoding="utf-8", newline="\n")
-    except (OSError, json.JSONDecodeError, ValueError) as exc:
-        return {"ok": False, "renderer": "none", "error": str(exc)}
-    return {"ok": True, "renderer": "python-fallback", "out_path": str(out_path)}
-
-
 def cmd_repair(archive_dir: Path) -> tuple[int, dict[str, Any]]:
     """Versioned repair (task 11 / RET-40).
 
-    Re-collect a candidate from the frozen sources, run both validators, and
-    only then write an immutable ``derived/v<N>/`` plus a repair record. The
-    original summary/HTML/manifest is never overwritten; the authoritative
-    pointer moves only when both validators pass.
+    Re-collect a candidate from the frozen sources, validate its source and
+    canonical data, then write an immutable ``derived/v<N>/`` plus a repair
+    record. The original summary and manifest are never overwritten.
     """
     payload: dict[str, Any] = {
         "ok": False,
@@ -9596,25 +9503,18 @@ def cmd_repair(archive_dir: Path) -> tuple[int, dict[str, Any]]:
         payload["error"] = f"repair collect failed: {exc}"
         return 1, payload
 
-    # 2. stage outside the archive; run both validators on the candidate.
+    # 2. stage outside the archive; validate canonical data only.
     staging = Path(tempfile.mkdtemp(prefix="harness-repair-"))
     try:
         staged_summary = staging / "summary-data.json"
         write_json(staged_summary, candidate)
         source_result = validate_source_consistency(archive_dir, candidate)
-        render_result = _render_html_to(
-            archive_dir, staged_summary, staging / "final-summary.html"
-        )
-        staged_html = staging / "final-summary.html"
-        renderer_result = validate_summary(
-            candidate,
-            staged_html if staged_html.is_file() else None,
-        )
+        summary_result = validate_summary_data(candidate)
         payload["validators"] = {
             "source": source_result,
-            "renderer": renderer_result,
+            "summary": summary_result,
         }
-        if not (source_result.get("ok") and renderer_result.get("ok")):
+        if not (source_result.get("ok") and summary_result.get("ok")):
             payload["error"] = "repair validators failed; derived version not written"
             return 1, payload
 
@@ -9637,8 +9537,6 @@ def cmd_repair(archive_dir: Path) -> tuple[int, dict[str, Any]]:
             target_manifest = staged_version_dir / manifest_name
             shutil.copy2(source_manifest, target_manifest)
             frozen_manifest_hashes[manifest_name] = "sha256:" + sha256_file(target_manifest)
-        if staged_html.is_file():
-            shutil.copy2(staged_html, staged_version_dir / "final-summary.html")
         record = {
             "version": version,
             "createdAt": now_iso(),
@@ -9647,7 +9545,7 @@ def cmd_repair(archive_dir: Path) -> tuple[int, dict[str, Any]]:
             "frozenManifestHashes": frozen_manifest_hashes,
             "validators": {
                 "source": {"ok": bool(source_result.get("ok")), "issues": source_result.get("issues") or []},
-                "renderer": {"ok": bool(renderer_result.get("ok")), "issues": renderer_result.get("issues") or []},
+                "summary": {"ok": bool(summary_result.get("ok")), "issues": summary_result.get("issues") or []},
             },
         }
         write_json(staged_version_dir / "repair-record.json", record)
@@ -9723,8 +9621,26 @@ def build_parser() -> argparse.ArgumentParser:
         choices=("release-candidate", "record-only"),
         default="release-candidate",
     )
+    p_auto_gate.add_argument(
+        "--closure",
+        choices=("completed", "abandoned", "superseded"),
+        default="completed",
+    )
+    p_auto_gate.add_argument("--closure-reason", default="")
     p_auto_gate.set_defaults(func=cmd_auto_gate_cli)
 
+    p_adopt = sub.add_parser(
+        "adopt-existing-range",
+        help="explicitly bind an already committed product range to this change",
+    )
+    p_adopt.add_argument("--change-dir", required=True)
+    p_adopt.add_argument("--base", required=True)
+    p_adopt.add_argument("--tip", required=True)
+    p_adopt.add_argument("--reason", required=True)
+    p_adopt.add_argument("--confirm-existing-range", action="store_true")
+    p_adopt.add_argument("--json", action="store_true", default=True)
+    p_adopt.set_defaults(func=cmd_adopt_existing_range_cli)
+
     p_cert = sub.add_parser(
         "certify-local",
         help="create candidate receipt from existing full ledger evidence without rerunning tests",
@@ -9769,14 +9685,33 @@ def build_parser() -> argparse.ArgumentParser:
         default="release-candidate",
         help="release-candidate enforces candidate evidence; record-only archives facts without release eligibility",
     )
-    p_fin.add_argument(
-        "--no-html",
-        action="store_true",
-        help="skip local final-summary.html rendering (summary-data.json stays canonical)",
-    )
     p_fin.add_argument("--json", action="store_true", default=True)
     p_fin.set_defaults(func=cmd_finalize_cli)
 
+    p_execute = sub.add_parser(
+        "execute",
+        help="run one archive preflight, boundary gate, finalize, ZIP, and upload flow",
+    )
+    p_execute.add_argument("--change-dir", required=True)
+    p_execute.add_argument("--archive-root", required=True)
+    p_execute.add_argument("--durable-root", default=None)
+    p_execute.add_argument(
+        "--closure",
+        choices=("completed", "abandoned", "superseded"),
+        default="completed",
+    )
+    p_execute.add_argument("--closure-reason", default="")
+    p_execute.add_argument("--retention-policy", default="unspecified")
+    p_execute.add_argument("--skip-ingest", action="store_true")
+    p_execute.add_argument("--allow-missing-review", action="store_true")
+    p_execute.add_argument(
+        "--intent",
+        choices=("release-candidate", "record-only"),
+        default="release-candidate",
+    )
+    p_execute.add_argument("--json", action="store_true", default=True)
+    p_execute.set_defaults(func=cmd_execute_cli)
+
     p_restore = sub.add_parser(
         "restore-durable",
         help="verify a durable receipt and restore its archive without overwriting",