@opengsd/gsd-path 1.3.0 → 1.4.0

package/scripts/pipeline_state.py

@@ -27,25 +27,35 @@ from datetime import date
 from pathlib import Path, PurePosixPath
 from typing import Iterator, Mapping, Optional, Sequence
 
-try:
-    from isolation import (
+if __package__:
+    from .isolation import (
         IsolationError,
         authorized_task_worktree,
         checkpoint as isolation_checkpoint,
         collect_artifact_recoveries,
     )
-    import _common
-    import roadmap
-except ModuleNotFoundError as error:  # pragma: no cover - package imports used by tests
-    if error.name not in {"isolation", "_common", "roadmap"}:
-        raise
-    from scripts.isolation import (
-        IsolationError,
-        authorized_task_worktree,
-        checkpoint as isolation_checkpoint,
-        collect_artifact_recoveries,
-    )
-    from scripts import _common, roadmap
+    from . import _common
+    from . import roadmap
+else:
+    try:
+        from isolation import (
+            IsolationError,
+            authorized_task_worktree,
+            checkpoint as isolation_checkpoint,
+            collect_artifact_recoveries,
+        )
+        import _common
+        import roadmap
+    except ModuleNotFoundError as error:  # pragma: no cover - package imports used by tests
+        if error.name not in {"isolation", "_common", "roadmap"}:
+            raise
+        from scripts.isolation import (
+            IsolationError,
+            authorized_task_worktree,
+            checkpoint as isolation_checkpoint,
+            collect_artifact_recoveries,
+        )
+        from scripts import _common, roadmap
 
 try:  # pragma: no cover - exercised only on Windows
     import fcntl
@@ -66,6 +76,8 @@ PHASES = (
     "shipped",
 )
 STATUSES = ("active", "done", "blocked")
+PRE_APPROVAL_KINDS = ("intent", "plan")
+PRE_APPROVAL_MARKER = "pre-approval: "
 STATE_FIELDS = (
     "pipeline",
     "project",
@@ -184,7 +196,7 @@ def _run_git(
     result = subprocess.run(
         ["git", "-C", str(repo), *arguments],
         capture_output=True,
-        text=True,
+        encoding="utf-8", errors="replace",
     )
     if check and result.returncode != 0:
         detail = result.stderr.strip() or result.stdout.strip()
@@ -410,14 +422,17 @@ def undo_transaction(repo: Path) -> Optional[dict[str, object]]:
         "archive_fingerprint",
         "discussion",
     }
+    if value.get("kind") == "member-task":
+        # A member landing undo also names the member reset it performs first.
+        expected |= {"member", "landing", "member_parent"}
     if set(value) != expected or value.get("schema") != UNDO_TRANSACTION_SCHEMA:
         raise PipelineStateError("undo transaction has invalid fields")
     if value.get("repo") != str(resolved):
         raise PipelineStateError("undo transaction belongs to another worktree")
     kind = value.get("kind")
-    if kind not in {"checkpoint", "uncommitted-archive"}:
+    if kind not in {"checkpoint", "uncommitted-archive", "member-task"}:
         raise PipelineStateError("undo transaction has invalid kind")
-    for field in ("expected_head", "parent"):
+    for field in ("expected_head", "parent") + (("landing", "member_parent") if kind == "member-task" else ()):
         field_value = value.get(field)
         if not isinstance(field_value, str) or not re.fullmatch(
             r"[0-9a-f]{40,64}", field_value
@@ -433,10 +448,12 @@ def undo_transaction(repo: Path) -> Optional[dict[str, object]]:
         raise PipelineStateError("undo transaction has invalid worktree fingerprint")
     archive = value.get("archive")
     archive_fingerprint = value.get("archive_fingerprint")
-    if kind == "checkpoint" and (
+    if kind in {"checkpoint", "member-task"} and (
         archive is not None or archive_fingerprint is not None
     ):
-        raise PipelineStateError("checkpoint undo transaction cannot name an archive")
+        raise PipelineStateError(f"{kind} undo transaction cannot name an archive")
+    if kind == "member-task" and not isinstance(value.get("member"), str):
+        raise PipelineStateError("member-task undo transaction has invalid member")
     if kind == "uncommitted-archive" and (
         not isinstance(archive, str) or ARCHIVE_RE.fullmatch(archive) is None
     ):
@@ -563,12 +580,15 @@ def _pending_answers(repo: Path) -> tuple[list[dict[str, str]], Optional[str]]:
     if not answers.exists() and not answers.is_symlink():
         return [], None
     try:
-        try:
-            from discussion_records import DiscussionError, pending_records
-        except ModuleNotFoundError as error:  # pragma: no cover - package imports used by tests
-            if error.name != "discussion_records":
-                raise
-            from scripts.discussion_records import DiscussionError, pending_records
+        if __package__:
+            from .discussion_records import DiscussionError, pending_records
+        else:
+            try:
+                from discussion_records import DiscussionError, pending_records
+            except ModuleNotFoundError as error:  # pragma: no cover - package imports used by tests
+                if error.name != "discussion_records":
+                    raise
+                from scripts.discussion_records import DiscussionError, pending_records
     except ModuleNotFoundError as error:
         if error.name not in {"scripts", "scripts.discussion_records"}:
             raise
@@ -624,6 +644,29 @@ def _completion_status(repo: Path, state: Mapping[str, object], project_dir: str
     return {"status": "verified", "proof": proof}
 
 
+def _member_status(repo: Path, state: Mapping[str, object]) -> Optional[list]:
+    """Locked members and their ship close, when this milestone has a member lock."""
+    if __package__:
+        from scripts import members
+    else:
+        import members
+    archive = state.get("archive")
+    locks = [repo / ".project" / "build" / "members.json"]
+    if isinstance(archive, str) and archive not in {"", "null"}:
+        locks.insert(0, repo / archive.rstrip("/") / "build" / "members.json")
+    lock = next((path for path in locks if path.is_file()), None)
+    if lock is None:
+        return None
+    closed = {}
+    match = re.fullmatch(r"gsd-path/M(\d{3,})", str(state.get("branch") or ""))
+    if match is not None:
+        common = Path(_run_git(repo, "rev-parse", "--path-format=absolute", "--git-common-dir").stdout.strip())
+        closed = {row["name"]: row.get("status") for row in members.milestone_member_close(common, int(match.group(1)))}
+    entries = json.loads(lock.read_text(encoding="utf-8"))["members"]
+    return [{"name": entry["name"], "branch": entry["branch"], "close": closed.get(entry["name"])}
+            for entry in entries]
+
+
 def status_state(repo: Path, project_dir: str = ".project") -> dict[str, object]:
     """Report owned state, route, and git facts without advancing a phase."""
     resolved = _repo_root(repo)
@@ -658,7 +701,8 @@ def status_state(repo: Path, project_dir: str = ".project") -> dict[str, object]
         "collect_artifact": None,
     }
     completion = _completion_status(resolved, state, project_dir)
-    return {
+    member_rows = _member_status(resolved, state) if has_git and project_dir == ".project" else None
+    result = {
         "schema": STATUS_SCHEMA,
         "advance": False,
         "completion": completion,
@@ -688,6 +732,9 @@ def status_state(repo: Path, project_dir: str = ".project") -> dict[str, object]
         "next_skill": _next_skill(route if isinstance(route, dict) else {}),
         "handoff": phase_handoff(state, route, _track_root(resolved, project_dir) / "STATE.md", completion),
     }
+    if member_rows is not None:
+        result["members"] = member_rows
+    return result
 
 
 def phase_handoff(state: Mapping[str, object], route: Mapping[str, object], path: Path,
@@ -759,7 +806,7 @@ def _valid_patch_findings(repo: Path) -> bool:
             str(repo),
         ],
         capture_output=True,
-        text=True,
+        encoding="utf-8", errors="replace",
     )
     return result.returncode == 0
 
@@ -791,6 +838,8 @@ def _selected_initial_branch(project: Path, state: PipelineState) -> str:
         if archive.is_symlink() or not archive.is_dir():
             raise PipelineStateError(f"archive root must be a real directory: {archive}")
         for child in archive.iterdir():
+            if _common.is_ignored_junk(child):
+                continue
             match = re.fullmatch(r"(\d{3,})-[a-z0-9][a-z0-9-]*", child.name)
             if (
                 child.is_symlink()
@@ -1381,8 +1430,11 @@ def _append_event(
 
 @contextlib.contextmanager
 def _state_lock(project: Path) -> Iterator[None]:
-    if fcntl is None:  # pragma: no cover - Windows CI is not used
-        raise PipelineStateError("state locking is unavailable on this platform")
+    if fcntl is None:
+        # Windows cannot flock a directory.
+        with _common.directory_mutex(project):
+            yield
+        return
     descriptor = os.open(project, os.O_RDONLY)
     try:
         fcntl.flock(descriptor, fcntl.LOCK_EX)
@@ -1408,27 +1460,21 @@ def _atomic_write(path: Path, content: str) -> None:
             and os.path.samestat(path_status, temporary_status)
         ):
             temporary.unlink()
-            directory = os.open(path.parent, os.O_RDONLY)
-            try:
-                os.fsync(directory)
-            finally:
-                os.close(directory)
+            _common.fsync_directory(path.parent)
     if temporary.exists() or temporary.is_symlink():
         raise PipelineStateError(f"atomic-write temporary path already exists: {temporary}")
     descriptor: Optional[int] = None
     try:
-        descriptor = os.open(temporary, os.O_WRONLY | os.O_CREAT | os.O_EXCL, 0o666)
-        with os.fdopen(descriptor, "w", encoding="utf-8") as handle:
+        descriptor = os.open(
+            temporary, os.O_WRONLY | os.O_CREAT | os.O_EXCL | _common.O_BINARY, 0o666
+        )
+        with os.fdopen(descriptor, "wb") as handle:
             descriptor = None
-            handle.write(content)
+            handle.write(content.encode("utf-8"))
             handle.flush()
             os.fsync(handle.fileno())
-        os.replace(temporary, path)
-        directory = os.open(path.parent, os.O_RDONLY)
-        try:
-            os.fsync(directory)
-        finally:
-            os.close(directory)
+        _common.replace(temporary, path)
+        _common.fsync_directory(path.parent)
     finally:
         if descriptor is not None:
             os.close(descriptor)
@@ -1668,12 +1714,6 @@ def transition_state(
         if recovery_context and recovery_context["active"]:
             if (state.milestone, state.branch, state.archive) != (after.milestone, after.branch, after.archive):
                 raise PipelineStateError("build recovery must preserve milestone identity")
-        if state.phase == "build" and after.phase in {"define", "plan"}:
-            recovery = _build_recovery().begin(resolved, state, after, event)
-            rendered = _append_event(
-                rendered, after.phase,
-                _build_recovery().MARKER + json.dumps(recovery, sort_keys=True),
-            )
         if after.status != "blocked":
             reason = _pending_discussion_block(
                 resolved, after.phase if after.status == "active" else None
@@ -1683,10 +1723,13 @@ def transition_state(
         if state.phase in {"research", "decide"} and (
             after.phase != state.phase or after.status == "done"
         ):
-            try:
-                import check_handoffs
-            except ImportError:  # pragma: no cover - package imports used by tests
-                from scripts import check_handoffs
+            if __package__:
+                from . import check_handoffs
+            else:
+                try:
+                    import check_handoffs
+                except ImportError:  # pragma: no cover - package imports used by tests
+                    from scripts import check_handoffs
             validator = {
                 "research": check_handoffs.validate_research_artifacts,
                 "decide": check_handoffs.validate_decide_artifacts,
@@ -1695,6 +1738,15 @@ def transition_state(
                 validator(resolved, project_dir)
             except check_handoffs.HandoffError as error:
                 raise PipelineStateError(f"{state.phase} handoff failed: {error}") from error
+        if (project_dir == ".project" and (state.phase, state.status) == ("plan", "done")
+                and (after.phase, after.status) == ("build", "active")):
+            _lock_build_members(resolved)
+        if state.phase == "build" and after.phase in {"define", "plan"}:
+            recovery = _build_recovery().begin(resolved, state, after, event)
+            rendered = _append_event(
+                rendered, after.phase,
+                _build_recovery().MARKER + json.dumps(recovery, sort_keys=True),
+            )
         _atomic_write(path, rendered)
     return {
         "schema": STATE_SCHEMA,
@@ -1705,6 +1757,17 @@ def transition_state(
     }
 
 
+def _lock_build_members(repo: Path) -> None:
+    if __package__:
+        from scripts import members
+    else:
+        import members
+    try:
+        members.lock_build_members(repo)
+    except members.MembersError as error:
+        raise PipelineStateError(f"build start: {error}") from error
+
+
 def _build_recovery():
     if __package__:
         from scripts import build_recovery
@@ -1776,6 +1839,55 @@ def configure_integration(
     }
 
 
+def _log_events(text: str) -> list[str]:
+    return [line.split(" — ", 2)[-1] for line in text.splitlines()
+            if line.startswith("- ") and " — " in line]
+
+
+def pre_approve(repo: Path, grant: Optional[str], use: Optional[str]) -> dict[str, object]:
+    """Record an owner's pre-approval grant, or record one granted gate's use."""
+    resolved = _repo_root(repo)
+    project = _track_root(resolved, ".project")
+    with _state_lock(project):
+        state, text, path = load_state(resolved)
+        if grant is not None:
+            kinds = grant.split(",")
+            if not kinds or len(set(kinds)) != len(kinds) or not set(kinds) <= set(PRE_APPROVAL_KINDS):
+                raise PipelineStateError(
+                    f"pre-approval kinds must be distinct values from: {', '.join(PRE_APPROVAL_KINDS)}"
+                )
+            if state.milestone is not None:
+                raise PipelineStateError("pre-approval is granted only before milestone intent approval")
+            event = PRE_APPROVAL_MARKER + json.dumps({"kinds": kinds}, sort_keys=True)
+        else:
+            events = _log_events(text)
+            starts = [index for index, event in enumerate(events) if event.startswith(PRE_APPROVAL_MARKER)]
+            if not starts:
+                raise PipelineStateError("no pre-approval grant is recorded")
+            try:
+                recorded = json.loads(events[starts[-1]][len(PRE_APPROVAL_MARKER):])
+                kinds = recorded["kinds"]
+            except (ValueError, TypeError, KeyError) as error:
+                raise PipelineStateError("invalid pre-approval record") from error
+            if not isinstance(kinds, list):
+                raise PipelineStateError("invalid pre-approval record")
+            if (_build_recovery().context(resolved, text) or {}).get("active") or (project / "review/PATCH-FINDINGS.md").exists():
+                raise PipelineStateError("pre-approval never covers build recovery or patch planning")
+            if use not in kinds:
+                raise PipelineStateError(f"pre-approval does not grant {use}")
+            # The canonical approval event, not this record, consumes the grant.
+            approvals = events[starts[-1] + 1:].count("milestone intent approved")
+            expected = {"intent": ("define", "active", 0), "plan": ("plan", "active", 1)}[use]
+            if (state.phase, state.status, approvals) != expected or (
+                (state.milestone is None) != (use == "intent")
+            ):
+                raise PipelineStateError(f"pre-approval for {use} is used or out of scope")
+            event = f"pre-authorized approval: {use}"
+        rendered = _append_event(text, state.phase, event)
+        _atomic_write(path, rendered)
+    return {"schema": STATE_SCHEMA, "status": "recorded", "event": event, "state": state.json()}
+
+
 def _shipment_roadmap(text: str, state: PipelineState, archive: str) -> str:
     if state.milestone is None or state.branch is None:
         raise PipelineStateError("shipment state must name milestone and branch")
@@ -2016,7 +2128,8 @@ def _commit_message(subject: str, body_fields: Mapping[str, str]) -> str:
 def _validate_next_layout(next_root: Path, state: PipelineState) -> None:
     phase_index = LOOKAHEAD_PHASES.index(state.phase)
     for path in next_root.rglob("*"):
-        relative = path.relative_to(next_root)
+        # POSIX form: a WindowsPath never equals the PurePosixPath layout below.
+        relative = PurePosixPath(path.relative_to(next_root).as_posix())
         if path.is_symlink():
             raise PipelineStateError(f"lookahead artifacts must not be symlinks: {path}")
         if path.is_dir():
@@ -2028,6 +2141,8 @@ def _validate_next_layout(next_root: Path, state: PipelineState) -> None:
             continue
         if not path.is_file():
             raise PipelineStateError(f"lookahead has unsafe artifact: {path}")
+        if _common.is_ignored_junk(path):
+            continue
         artifact = relative.as_posix()
         required_phase = LOOKAHEAD_FIXED_ARTIFACTS.get(artifact)
         if required_phase is None and LOOKAHEAD_EVIDENCE_RE.fullmatch(artifact):
@@ -2112,6 +2227,11 @@ def parse_args(argv: Optional[Sequence[str]] = None) -> argparse.Namespace:
     configure.add_argument("--project-dir", default=".project")
     configure.add_argument("--scope", required=True, choices=("default", "milestone"))
     configure.add_argument("--mode", required=True, choices=INTEGRATION_MODES)
+    pre = subparsers.add_parser("pre-approve")
+    pre.add_argument("--repo", required=True, type=Path)
+    pre_mode = pre.add_mutually_exclusive_group(required=True)
+    pre_mode.add_argument("--grant")
+    pre_mode.add_argument("--use", choices=PRE_APPROVAL_KINDS)
     shipment = subparsers.add_parser("record-shipment")
     shipment.add_argument("--repo", required=True, type=Path)
     shipment.add_argument("--archive", required=True)
@@ -2200,6 +2320,8 @@ def main(argv: Optional[Sequence[str]] = None) -> int:
                 base,
                 landing,
             )
+        elif args.command == "pre-approve":
+            result = pre_approve(args.repo, args.grant, args.use)
         elif args.command == "record-shipment":
             result = record_shipment(args.repo, args.archive, args.event)
         elif args.command == "configure-integration":

package/scripts/pipeline_undo.py

@@ -25,22 +25,30 @@ from pathlib import Path, PurePosixPath
 from typing import Optional, Sequence
 
 def _load_pipeline_modules():
-    try:
-        import archive_milestone
-        import isolation
-        import pipeline_git
-        import pipeline_state
-        import state_checkpoint
+    if __package__:
+        from . import archive_milestone
+        from . import isolation
+        from . import pipeline_git
+        from . import pipeline_state
+        from . import state_checkpoint
         return archive_milestone, isolation, pipeline_git, pipeline_state, state_checkpoint
-    except ModuleNotFoundError as error:
-        if error.name not in {
-            "archive_milestone",
-            "isolation",
-            "pipeline_git",
-            "pipeline_state",
-            "state_checkpoint",
-        }:
-            raise
+    else:
+        try:
+            import archive_milestone
+            import isolation
+            import pipeline_git
+            import pipeline_state
+            import state_checkpoint
+            return archive_milestone, isolation, pipeline_git, pipeline_state, state_checkpoint
+        except ModuleNotFoundError as error:
+            if error.name not in {
+                "archive_milestone",
+                "isolation",
+                "pipeline_git",
+                "pipeline_state",
+                "state_checkpoint",
+            }:
+                raise
     try:
         from scripts import archive_milestone, isolation, pipeline_git, pipeline_state, state_checkpoint
         return archive_milestone, isolation, pipeline_git, pipeline_state, state_checkpoint
@@ -94,7 +102,7 @@ UNDO_TRANSACTION_SCHEMA = pipeline_state.UNDO_TRANSACTION_SCHEMA
 UNDO_TRANSACTION_NAME = pipeline_state.UNDO_TRANSACTION_NAME
 ROADMAP_APPROVAL_SUBJECT = "roadmap: program roadmap approved"
 TASK_SUBJECT_RE = re.compile(r"^(T\d{3,}): .+")
-KINDS = ("checkpoint", "task", "uncommitted-archive", "lookahead")
+KINDS = ("checkpoint", "task", "member-task", "uncommitted-archive", "lookahead")
 PROMOTION_PREFIX = "router: promote lookahead milestone "
 ABANDON_PREFIX = "build: abandon milestone "
 INTEGRATE_PREFIX = "integrate: "
@@ -528,6 +536,7 @@ def _prepare_transaction(
     branch: str,
     archive: Optional[str],
     discussion: Optional[dict[str, bytes]],
+    member_fields: Optional[dict[str, str]] = None,
 ) -> dict[str, object]:
     transaction = {
         "schema": UNDO_TRANSACTION_SCHEMA,
@@ -545,6 +554,8 @@ def _prepare_transaction(
         ),
         "discussion": _encode_discussion(discussion),
     }
+    if member_fields is not None:
+        transaction.update(member_fields)
     _write_json(_git_path(repo, UNDO_TRANSACTION_NAME), transaction)
     return transaction
 
@@ -641,7 +652,7 @@ def _transaction_recovery_stage(
     expected_head = str(transaction["expected_head"])
     parent = str(transaction["parent"])
     current = _optional_rev(repo, "HEAD")
-    if transaction["kind"] == "checkpoint":
+    if transaction["kind"] in {"checkpoint", "member-task"}:
         allowed = {expected_head, parent}
     else:
         allowed = {expected_head}
@@ -662,8 +673,60 @@ def _transaction_recovery_stage(
     return "reset"
 
 
+def _member_undo_parent(repo: Path, member: str, landing: str) -> str:
+    """The member landing's parent, while that landing is the unpublished bound tip."""
+    checkout, _, entry = isolation._member_context(repo, member)
+    bound = entry["branch"]
+    if _run_git(checkout, "rev-parse", f"refs/heads/{bound}").stdout.strip() != landing:
+        raise UndoError(f"member {member} {bound} moved past this landing")
+    _require_member_unpublished(checkout, member, landing, bound)
+    return _run_git(checkout, "rev-parse", f"{landing}^").stdout.strip()
+
+
+def _require_member_unpublished(checkout: Path, member: str, landing: str, bound: str) -> None:
+    for ref, where in (("refs/remotes/origin/main", "origin/main"), (f"refs/remotes/origin/{bound}", f"origin/{bound}")):
+        if _run_git(checkout, "merge-base", "--is-ancestor", landing, ref, check=False).returncode == 0:
+            raise UndoError(f"member {member} landing is already on {where}")
+
+
+def _require_no_member_landing_journal(repo: Path) -> None:
+    directory = isolation.common_git_dir(repo).joinpath(*isolation.MEMBER_LANDING_DIR)
+    if any(directory.glob("*.json")):
+        raise UndoError("member landing journal is pending; recover member landing first")
+
+
+def _undo_member_landing(repo: Path, transaction: dict[str, object]) -> None:
+    """Reset the member bound branch first; a resumed undo finds it already reset."""
+    member = str(transaction["member"])
+    checkout, _, entry = isolation._member_context(repo, member)
+    tip = _run_git(checkout, "rev-parse", f"refs/heads/{entry['branch']}").stdout.strip()
+    if tip == transaction["member_parent"]:
+        _require_member_unpublished(checkout, member, str(transaction["landing"]), entry["branch"])
+        return
+    if tip != transaction["landing"]:
+        raise UndoError(f"member {member} bound branch moved during undo")
+    if _member_undo_parent(repo, member, str(transaction["landing"])) != transaction["member_parent"]:
+        raise UndoError(f"member {member} landing parent changed during undo")
+    bound = Path(isolation.member_bound_checkout(repo, member)["checkout"])
+    if _run_git(bound, "status", "--porcelain", "--untracked-files=all").stdout:
+        raise UndoError(f"member {member} bound checkout is dirty")
+    _run_git(bound, "reset", "--hard", str(transaction["member_parent"]))
+
+
 def _finish_transaction(repo: Path, transaction: dict[str, object]) -> None:
+    if transaction["kind"] == "member-task":
+        with isolation._member_landing_lock(repo):
+            _finish_transaction_locked(repo, transaction)
+        return
+    _finish_transaction_locked(repo, transaction)
+
+
+def _finish_transaction_locked(repo: Path, transaction: dict[str, object]) -> None:
+    if transaction["kind"] == "member-task":
+        _require_no_member_landing_journal(repo)
     stage = _transaction_recovery_stage(repo, transaction)
+    if transaction["kind"] == "member-task":
+        _undo_member_landing(repo, transaction)
     if stage == "prepared":
         _require_unpublished_reset(repo, str(transaction["branch"]))
         _reset_to(repo, str(transaction["parent"]))
@@ -675,11 +738,7 @@ def _finish_transaction(repo: Path, transaction: dict[str, object]) -> None:
         _remove_untracked_tree(repo, archive)
     path = _git_path(repo, UNDO_TRANSACTION_NAME)
     path.unlink()
-    descriptor = os.open(path.parent, os.O_RDONLY)
-    try:
-        os.fsync(descriptor)
-    finally:
-        os.close(descriptor)
+    pipeline_state._common.fsync_directory(path.parent)
 
 
 def classify_undo(repo: Path) -> dict[str, object]:
@@ -821,6 +880,28 @@ def classify_undo(repo: Path) -> dict[str, object]:
         proof_error = _task_proof_error(resolved, head)
         if proof_error:
             return _blocked([f"task landing ownership is unproven: {proof_error}"])
+        record = isolation.MEMBER_RECORD_RE.search(body)
+        if record is not None:
+            try:
+                _require_no_member_landing_journal(resolved)
+                member_parent = _member_undo_parent(resolved, record["member"], record["landing"])
+            except (IsolationError, UndoError, PipelineStateError) as error:
+                return _blocked([f"member landing undo is unsafe: {error}"])
+            return {
+                "kind": "member-task",
+                "branch": recorded_branch,
+                "head": head,
+                "parent": parent,
+                "subject": subject,
+                "member": record["member"],
+                "landing": record["landing"],
+                "member_parent": member_parent,
+                "effects": [
+                    f"reset member {record['member']} bound branch to {member_parent}",
+                    f"reset {recorded_branch} to {parent}",
+                ],
+                "blocked": [],
+            }
         return {
             "kind": "task",
             "branch": recorded_branch,
@@ -978,6 +1059,20 @@ def apply_undo(repo: Path, kind: str, expected_head: str) -> dict[str, object]:
             discussion,
         )
         _finish_transaction(resolved, transaction)
+    elif kind == "member-task":
+        with isolation._member_landing_lock(resolved):
+            _require_no_member_landing_journal(resolved)
+            if preview(resolved)["target"] != target:
+                raise UndoError("member task undo target changed after preview")
+            if _worktree_changes(resolved):
+                raise UndoError("worktree changed after member task undo preview")
+            _require_unpublished_reset(resolved, str(target["branch"]))
+            transaction = _prepare_transaction(
+                resolved, kind, expected_head, str(target["parent"]), str(target["branch"]), None, None,
+                {"member": str(target["member"]), "landing": str(target["landing"]),
+                 "member_parent": str(target["member_parent"])},
+            )
+            _finish_transaction_locked(resolved, transaction)
     elif kind == "task":
         parent = target["parent"]
         if not parent:

package/scripts/promote_lookahead.py

@@ -205,7 +205,7 @@ def select_fetched_base(
     resolved = subprocess.run(
         ["git", "-C", str(root), "rev-parse", "--verify", f"{remote_default}^{{commit}}"],
         capture_output=True,
-        text=True,
+        encoding="utf-8", errors="replace",
         check=False,
     )
     if resolved.returncode != 0 or resolved.stdout.strip() != base:

package/scripts/review_panel.py

@@ -470,7 +470,7 @@ def merge_artifacts(
         lines.append(artifact["text"].rstrip())
         lines.append("")
     output.parent.mkdir(parents=True, exist_ok=True)
-    output.write_text("\n".join(lines).rstrip() + "\n", encoding="utf-8")
+    output.write_bytes(("\n".join(lines).rstrip() + "\n").encode("utf-8"))
     return {
         "output": str(output.resolve()),
         "families": families,