@opengsd/gsd-path 1.3.1 → 1.5.0

package/skills/gsd-path-undo/scripts/discussion_records.py

@@ -16,14 +16,20 @@ from pathlib import Path
 from typing import Iterator, Optional, Sequence
 
 def _load_pipeline_modules():
-    try:
-        import archive_milestone
-        import pipeline_state
-        import _common
+    if __package__:
+        from . import archive_milestone
+        from . import pipeline_state
+        from . import _common
         return _common, archive_milestone, pipeline_state
-    except ModuleNotFoundError as error:
-        if error.name not in {"archive_milestone", "pipeline_state", "_common"}:
-            raise
+    else:
+        try:
+            import archive_milestone
+            import pipeline_state
+            import _common
+            return _common, archive_milestone, pipeline_state
+        except ModuleNotFoundError as error:
+            if error.name not in {"archive_milestone", "pipeline_state", "_common"}:
+                raise
     try:
         from scripts import archive_milestone, pipeline_state, _common
         return _common, archive_milestone, pipeline_state
@@ -111,7 +117,7 @@ def record_count(directory: Path) -> int:
 def validate_or_empty(directory: Path) -> None:
     if directory.is_symlink() or not directory.is_dir():
         raise DiscussionError("discussion records must be a real directory")
-    if sorted(path.name for path in directory.iterdir()) != sorted(FILES):
+    if sorted(path.name for path in directory.iterdir() if not _common.is_ignored_junk(path)) != sorted(FILES):
         raise DiscussionError("discussion directory must contain exactly DIALOGUE.md and ANSWERS.md")
     if record_count(directory) == 0:
         if "### D" in (directory / "DIALOGUE.md").read_text(encoding="utf-8"):
@@ -170,7 +176,7 @@ def validate_contents(project: Path, files: dict) -> None:
     staging.mkdir()
     try:
         for name in FILES:
-            (staging / name).write_text(files[name], encoding="utf-8")
+            (staging / name).write_bytes(files[name].encode("utf-8"))
         validate_or_empty(staging)
     finally:
         shutil.rmtree(staging)
@@ -187,11 +193,11 @@ def initialize_records(discussion: Path, dialogue_template: Path, answers_templa
         shutil.rmtree(staging)
     staging.mkdir()
     try:
-        (staging / "DIALOGUE.md").write_text(
-            template_header(dialogue_template, "### D001"), encoding="utf-8"
+        (staging / "DIALOGUE.md").write_bytes(
+            template_header(dialogue_template, "### D001").encode("utf-8")
         )
-        (staging / "ANSWERS.md").write_text(
-            template_header(answers_template, "## Answer A001"), encoding="utf-8"
+        (staging / "ANSWERS.md").write_bytes(
+            template_header(answers_template, "## Answer A001").encode("utf-8")
         )
         os.replace(staging, discussion)
     finally:

package/skills/gsd-path-undo/scripts/loop_run.py

@@ -32,10 +32,10 @@ from datetime import datetime, timedelta, timezone
 from pathlib import Path
 from typing import Iterator, Optional, Sequence
 
-if sys.platform == "win32":
-    import msvcrt
-else:
-    import fcntl
+try:
+    from . import _common
+except ImportError:
+    import _common
 
 
 class LoopError(RuntimeError):
@@ -119,25 +119,8 @@ def log_path(fields: dict) -> Path:
 def log_lock(fields: dict) -> Iterator[None]:
     path = log_path(fields)
     path.parent.mkdir(parents=True, exist_ok=True)
-    lock_path = path.with_name(f".{path.name}.lock")
-    with lock_path.open("a+b") as handle:
-        if sys.platform == "win32":
-            handle.seek(0, os.SEEK_END)
-            if handle.tell() == 0:
-                handle.write(b"\0")
-                handle.flush()
-            handle.seek(0)
-            msvcrt.locking(handle.fileno(), msvcrt.LK_LOCK, 1)
-        else:
-            fcntl.flock(handle.fileno(), fcntl.LOCK_EX)
-        try:
-            yield
-        finally:
-            if sys.platform == "win32":
-                handle.seek(0)
-                msvcrt.locking(handle.fileno(), msvcrt.LK_UNLCK, 1)
-            else:
-                fcntl.flock(handle.fileno(), fcntl.LOCK_UN)
+    with _common.exclusive_lock(path.with_name(f".{path.name}.lock")):
+        yield
 
 
 def load_log(fields: dict) -> list[dict]:
@@ -528,15 +511,34 @@ def command_claim(fields: dict) -> dict:
 
 
 def run_shell(command: str, timeout: float) -> tuple[Optional[int], str]:
-    """Run one spec command; a hung command counts as failed (exit None)."""
+    """Run one spec command; a hung command counts as failed (exit None).
+
+    POSIX runs /bin/sh as shell=True did; Windows runs Git for Windows bash, not
+    cmd.exe. A timeout kills the whole process group when possible; if output
+    pipes stay open, drain them with a short grace timeout and then close them.
+    """
+    argv = _common.bash_argv(command) if os.name == "nt" else ["/bin/sh", "-c", command]
+    process = _common.popen_group(argv, stdout=subprocess.PIPE, stderr=subprocess.PIPE)
+    stdout = b""
+    stderr = b""
     try:
-        completed = subprocess.run(
-            command, shell=True, capture_output=True, text=True, check=False, timeout=timeout
-        )
+        stdout, stderr = process.communicate(timeout=timeout)
     except subprocess.TimeoutExpired as expired:
-        output = (expired.stdout or b"").decode(errors="replace") + (expired.stderr or b"").decode(errors="replace")
+        _common.kill_tree(process)
+        try:
+            stdout, stderr = process.communicate(timeout=5)
+        except subprocess.TimeoutExpired as drained:
+            stdout = drained.stdout or expired.stdout or b""
+            stderr = drained.stderr or expired.stderr or b""
+            if process.stdout:
+                process.stdout.close()
+            if process.stderr:
+                process.stderr.close()
+            process.kill()
+            process.wait(timeout=5)
+        output = stdout.decode("utf-8", errors="replace") + stderr.decode("utf-8", errors="replace")
         return None, f"{output}\ntimed out at the admitted wall-clock deadline"
-    return completed.returncode, completed.stdout + completed.stderr
+    return process.returncode, (stdout + stderr).decode("utf-8", errors="replace")
 
 
 def command_verify(fields: dict, claim_identifier: Optional[str]) -> dict:

package/skills/gsd-path-undo/scripts/path_config.py

@@ -13,7 +13,7 @@ sys.dont_write_bytecode = True
 ROLES = ('coder', 'reviewer', 'review_panel', 'skeptic', 'inspect_codebase',
          'inspect_docs', 'docs_audit', 'research', 'decide', 'roadmap', 'plan', 'plan_patch')
 HOSTS = ('codex', 'claude', 'grok', 'opencode', 'copilot', 'qwen', 'antigravity',
-         'cursor', 'zed', 'kiro', 'kimi')
+         'cursor', 'zed', 'kiro', 'kimi', 'muse')
 
 
 def sibling(name):
@@ -73,8 +73,8 @@ def validate_value(key, value):
     if not isinstance(value, str) or not value or value != value.strip():
         raise ValueError(f'{key} requires a nonempty string')
     if key == 'integration':
-        if value not in ('direct', 'pull-request'):
-            raise ValueError('integration must be direct or pull-request')
+        if value not in ('direct', 'pull-request', 'external-landing'):
+            raise ValueError('integration must be direct, pull-request, or external-landing')
     elif key == 'review_panel':
         if any(char.isspace() for char in value):
             raise ValueError('use off, detected, or comma-separated families without spaces')
@@ -174,13 +174,13 @@ def set_value(repo, scope, key, value, reset=False):
     if scope == 'project':
         state, _, _ = sibling('pipeline_state').load_state(repo)
         branch = subprocess.run(['git', '-C', str(repo), 'branch', '--show-current'],
-                                capture_output=True, text=True)
+                                capture_output=True, encoding="utf-8", errors="replace")
         if branch.returncode or not state.branch or branch.stdout.strip() != state.branch:
             raise ValueError('Run the router to bind the project branch before editing settings.')
         head = subprocess.run(['git', '-C', str(repo), 'rev-parse', '--verify', 'HEAD'], capture_output=True)
         if head.returncode == 0:
             closed = subprocess.run([sys.executable, '-B', str(Path(__file__).with_name('git_guard.py')),
-                                     'closed-milestone'], cwd=repo, capture_output=True, text=True)
+                                     'closed-milestone'], cwd=repo, capture_output=True, encoding="utf-8", errors="replace")
             if closed.returncode:
                 raise ValueError(closed.stderr.strip() or 'Cannot verify the milestone branch is open.')
     if scope == 'project' and key == 'integration':

package/skills/gsd-path-undo/scripts/pipeline_undo.py

@@ -17,6 +17,7 @@ import os
 import re
 import shutil
 import sys
+from datetime import date
 
 # Runtime helpers must not modify their immutable installation.
 sys.dont_write_bytecode = True
@@ -25,22 +26,30 @@ from pathlib import Path, PurePosixPath
 from typing import Optional, Sequence
 
 def _load_pipeline_modules():
-    try:
-        import archive_milestone
-        import isolation
-        import pipeline_git
-        import pipeline_state
-        import state_checkpoint
+    if __package__:
+        from . import archive_milestone
+        from . import isolation
+        from . import pipeline_git
+        from . import pipeline_state
+        from . import state_checkpoint
         return archive_milestone, isolation, pipeline_git, pipeline_state, state_checkpoint
-    except ModuleNotFoundError as error:
-        if error.name not in {
-            "archive_milestone",
-            "isolation",
-            "pipeline_git",
-            "pipeline_state",
-            "state_checkpoint",
-        }:
-            raise
+    else:
+        try:
+            import archive_milestone
+            import isolation
+            import pipeline_git
+            import pipeline_state
+            import state_checkpoint
+            return archive_milestone, isolation, pipeline_git, pipeline_state, state_checkpoint
+        except ModuleNotFoundError as error:
+            if error.name not in {
+                "archive_milestone",
+                "isolation",
+                "pipeline_git",
+                "pipeline_state",
+                "state_checkpoint",
+            }:
+                raise
     try:
         from scripts import archive_milestone, isolation, pipeline_git, pipeline_state, state_checkpoint
         return archive_milestone, isolation, pipeline_git, pipeline_state, state_checkpoint
@@ -94,10 +103,20 @@ UNDO_TRANSACTION_SCHEMA = pipeline_state.UNDO_TRANSACTION_SCHEMA
 UNDO_TRANSACTION_NAME = pipeline_state.UNDO_TRANSACTION_NAME
 ROADMAP_APPROVAL_SUBJECT = "roadmap: program roadmap approved"
 TASK_SUBJECT_RE = re.compile(r"^(T\d{3,}): .+")
-KINDS = ("checkpoint", "task", "uncommitted-archive", "lookahead")
+KINDS = ("checkpoint", "task", "member-task", "uncommitted-archive", "lookahead")
 PROMOTION_PREFIX = "router: promote lookahead milestone "
 ABANDON_PREFIX = "build: abandon milestone "
 INTEGRATE_PREFIX = "integrate: "
+SHIP_LOG_ONLY_LINE = re.compile(
+    r"- (?P<date>\d{4}-\d{2}-\d{2}) — ship — (?P<event>[^\r\n]+)\n\Z"
+)
+SHIPMENT_RECORD_LINE = re.compile(
+    r"- (?P<date>\d{4}-\d{2}-\d{2}) — shipped — (?P<event>[^\r\n]+)\n\Z"
+)
+SHIPMENT_EVENTS = {
+    "archive preflight passed; shipment recorded",
+    "archive preflight passed; shipment recorded; program complete",
+}
 
 
 class UndoError(RuntimeError):
@@ -367,6 +386,80 @@ def pending_transaction(repo: Path) -> Optional[dict[str, object]]:
         raise UndoError(str(error)) from error
 
 
+def _valid_state_event_line(line: str, phase: str) -> bool:
+    pattern = SHIP_LOG_ONLY_LINE if phase == "ship" else SHIPMENT_RECORD_LINE
+    match = pattern.fullmatch(line)
+    if match is None:
+        return False
+    try:
+        event_date = date.fromisoformat(match.group("date"))
+    except ValueError:
+        return False
+    event = match.group("event")
+    return event_date.isoformat() == match.group("date") and event == " ".join(event.split())
+
+
+def _owned_ship_log_events(
+    prepared_state: str,
+    current_state: str,
+    phase: object,
+    status: object,
+) -> Optional[str]:
+    """Return only ship log lines appended around a helper-owned archive event.
+
+    The prepared text must remain byte-for-byte unchanged. For shipped/done,
+    record-shipment changes only phase and status before appending its one
+    generated shipment event, so validate that exact prefix and event shape.
+    """
+    if (phase, status) == ("ship", "active"):
+        if current_state == prepared_state:
+            return ""
+        if not current_state.startswith(prepared_state):
+            return None
+        suffix = current_state[len(prepared_state):]
+        separator = "" if prepared_state.endswith("\n") else "\n"
+        if separator:
+            if not suffix.startswith(separator):
+                return None
+            suffix = suffix[len(separator):]
+        lines = suffix.splitlines(keepends=True)
+        if not lines or "".join(lines) != suffix:
+            return None
+        if not all(_valid_state_event_line(line, "ship") for line in lines):
+            return None
+        return separator + suffix
+
+    if (phase, status) != ("shipped", "done"):
+        return None
+    try:
+        shipped_prefix = pipeline_state._set_frontmatter(
+            prepared_state,
+            {"phase": "shipped", "status": "done"},
+        )
+    except PipelineStateError:
+        return None
+    if not current_state.startswith(shipped_prefix):
+        return None
+    suffix = current_state[len(shipped_prefix):]
+    separator = "" if shipped_prefix.endswith("\n") else "\n"
+    if separator:
+        if not suffix.startswith(separator):
+            return None
+        suffix = suffix[len(separator):]
+    lines = suffix.splitlines(keepends=True)
+    if not lines or "".join(lines) != suffix:
+        return None
+    shipment_event = lines[-1]
+    if not _valid_state_event_line(shipment_event, "shipped"):
+        return None
+    if SHIPMENT_RECORD_LINE.fullmatch(shipment_event).group("event") not in SHIPMENT_EVENTS:
+        return None
+    ship_events = lines[:-1]
+    if not all(_valid_state_event_line(line, "ship") for line in ship_events):
+        return None
+    return separator + "".join(ship_events) if ship_events else ""
+
+
 def _archive_metadata_error(
     repo: Path,
     state_fields: dict[str, object],
@@ -412,8 +505,13 @@ def _archive_metadata_error(
         if final_review.exists() or gap_reviews:
             reviewed_head, _ = archive_milestone.parse_final_review(archive_path)
             archive_milestone.validate_gap_reviews(archive_path, reviewed_head)
-            if reviewed_head != _optional_rev(repo, "HEAD"):
-                return "archive undo final review does not match current HEAD"
+            if not archive_milestone.reviewed_head_covers(
+                repo, reviewed_head, _optional_rev(repo, "HEAD")
+            ):
+                return (
+                    "archive undo final review does not match current HEAD; "
+                    f"{archive_milestone._common.RUNTIME_PIN_ALLOWANCE}"
+                )
             expected_inventory.add("review/FINAL.md")
             expected_inventory.update(
                 path.relative_to(archive_path).as_posix() for path in gap_reviews
@@ -468,10 +566,14 @@ def _archive_metadata_error(
         "archive",
         configured,
     )
-    current_state = (repo / ".project" / "STATE.md").read_text(encoding="utf-8")
+    current_state = (repo / ".project" / "STATE.md").read_bytes().decode("utf-8")
     phase = state_fields.get("phase")
     status = state_fields.get("status")
+    ship_events = _owned_ship_log_events(prepared_state, current_state, phase, status)
     if (phase, status) == ("ship", "active"):
+        if ship_events is None:
+            return "archive undo found unowned STATE.md changes"
+        prepared_state += ship_events
         if current_state != prepared_state:
             return "archive undo found unowned STATE.md changes"
         if ".project/ROADMAP.md" in dirty:
@@ -479,14 +581,13 @@ def _archive_metadata_error(
         return None
     if (phase, status) != ("shipped", "done"):
         return "archive undo requires ship/active or shipped/done"
+    if ship_events is None:
+        return "archive undo found unowned shipment STATE.md changes"
+    prepared_state += ship_events
 
     prepared = _state_from_text(prepared_state, "prepared archive STATE.md")
-    events = (
-        "archive preflight passed; shipment recorded",
-        "archive preflight passed; shipment recorded; program complete",
-    )
     rendered_states = []
-    for event in events:
+    for event in SHIPMENT_EVENTS:
         try:
             _, _, rendered = _render_transition(
                 prepared,
@@ -528,6 +629,7 @@ def _prepare_transaction(
     branch: str,
     archive: Optional[str],
     discussion: Optional[dict[str, bytes]],
+    member_fields: Optional[dict[str, str]] = None,
 ) -> dict[str, object]:
     transaction = {
         "schema": UNDO_TRANSACTION_SCHEMA,
@@ -545,6 +647,8 @@ def _prepare_transaction(
         ),
         "discussion": _encode_discussion(discussion),
     }
+    if member_fields is not None:
+        transaction.update(member_fields)
     _write_json(_git_path(repo, UNDO_TRANSACTION_NAME), transaction)
     return transaction
 
@@ -641,7 +745,7 @@ def _transaction_recovery_stage(
     expected_head = str(transaction["expected_head"])
     parent = str(transaction["parent"])
     current = _optional_rev(repo, "HEAD")
-    if transaction["kind"] == "checkpoint":
+    if transaction["kind"] in {"checkpoint", "member-task"}:
         allowed = {expected_head, parent}
     else:
         allowed = {expected_head}
@@ -662,8 +766,60 @@ def _transaction_recovery_stage(
     return "reset"
 
 
+def _member_undo_parent(repo: Path, member: str, landing: str) -> str:
+    """The member landing's parent, while that landing is the unpublished bound tip."""
+    checkout, _, entry = isolation._member_context(repo, member)
+    bound = entry["branch"]
+    if _run_git(checkout, "rev-parse", f"refs/heads/{bound}").stdout.strip() != landing:
+        raise UndoError(f"member {member} {bound} moved past this landing")
+    _require_member_unpublished(checkout, member, landing, bound)
+    return _run_git(checkout, "rev-parse", f"{landing}^").stdout.strip()
+
+
+def _require_member_unpublished(checkout: Path, member: str, landing: str, bound: str) -> None:
+    for ref, where in (("refs/remotes/origin/main", "origin/main"), (f"refs/remotes/origin/{bound}", f"origin/{bound}")):
+        if _run_git(checkout, "merge-base", "--is-ancestor", landing, ref, check=False).returncode == 0:
+            raise UndoError(f"member {member} landing is already on {where}")
+
+
+def _require_no_member_landing_journal(repo: Path) -> None:
+    directory = isolation.common_git_dir(repo).joinpath(*isolation.MEMBER_LANDING_DIR)
+    if any(directory.glob("*.json")):
+        raise UndoError("member landing journal is pending; recover member landing first")
+
+
+def _undo_member_landing(repo: Path, transaction: dict[str, object]) -> None:
+    """Reset the member bound branch first; a resumed undo finds it already reset."""
+    member = str(transaction["member"])
+    checkout, _, entry = isolation._member_context(repo, member)
+    tip = _run_git(checkout, "rev-parse", f"refs/heads/{entry['branch']}").stdout.strip()
+    if tip == transaction["member_parent"]:
+        _require_member_unpublished(checkout, member, str(transaction["landing"]), entry["branch"])
+        return
+    if tip != transaction["landing"]:
+        raise UndoError(f"member {member} bound branch moved during undo")
+    if _member_undo_parent(repo, member, str(transaction["landing"])) != transaction["member_parent"]:
+        raise UndoError(f"member {member} landing parent changed during undo")
+    bound = Path(isolation.member_bound_checkout(repo, member)["checkout"])
+    if _run_git(bound, "status", "--porcelain", "--untracked-files=all").stdout:
+        raise UndoError(f"member {member} bound checkout is dirty")
+    _run_git(bound, "reset", "--hard", str(transaction["member_parent"]))
+
+
 def _finish_transaction(repo: Path, transaction: dict[str, object]) -> None:
+    if transaction["kind"] == "member-task":
+        with isolation._member_landing_lock(repo):
+            _finish_transaction_locked(repo, transaction)
+        return
+    _finish_transaction_locked(repo, transaction)
+
+
+def _finish_transaction_locked(repo: Path, transaction: dict[str, object]) -> None:
+    if transaction["kind"] == "member-task":
+        _require_no_member_landing_journal(repo)
     stage = _transaction_recovery_stage(repo, transaction)
+    if transaction["kind"] == "member-task":
+        _undo_member_landing(repo, transaction)
     if stage == "prepared":
         _require_unpublished_reset(repo, str(transaction["branch"]))
         _reset_to(repo, str(transaction["parent"]))
@@ -675,11 +831,7 @@ def _finish_transaction(repo: Path, transaction: dict[str, object]) -> None:
         _remove_untracked_tree(repo, archive)
     path = _git_path(repo, UNDO_TRANSACTION_NAME)
     path.unlink()
-    descriptor = os.open(path.parent, os.O_RDONLY)
-    try:
-        os.fsync(descriptor)
-    finally:
-        os.close(descriptor)
+    pipeline_state._common.fsync_directory(path.parent)
 
 
 def classify_undo(repo: Path) -> dict[str, object]:
@@ -821,6 +973,28 @@ def classify_undo(repo: Path) -> dict[str, object]:
         proof_error = _task_proof_error(resolved, head)
         if proof_error:
             return _blocked([f"task landing ownership is unproven: {proof_error}"])
+        record = isolation.MEMBER_RECORD_RE.search(body)
+        if record is not None:
+            try:
+                _require_no_member_landing_journal(resolved)
+                member_parent = _member_undo_parent(resolved, record["member"], record["landing"])
+            except (IsolationError, UndoError, PipelineStateError) as error:
+                return _blocked([f"member landing undo is unsafe: {error}"])
+            return {
+                "kind": "member-task",
+                "branch": recorded_branch,
+                "head": head,
+                "parent": parent,
+                "subject": subject,
+                "member": record["member"],
+                "landing": record["landing"],
+                "member_parent": member_parent,
+                "effects": [
+                    f"reset member {record['member']} bound branch to {member_parent}",
+                    f"reset {recorded_branch} to {parent}",
+                ],
+                "blocked": [],
+            }
         return {
             "kind": "task",
             "branch": recorded_branch,
@@ -978,6 +1152,20 @@ def apply_undo(repo: Path, kind: str, expected_head: str) -> dict[str, object]:
             discussion,
         )
         _finish_transaction(resolved, transaction)
+    elif kind == "member-task":
+        with isolation._member_landing_lock(resolved):
+            _require_no_member_landing_journal(resolved)
+            if preview(resolved)["target"] != target:
+                raise UndoError("member task undo target changed after preview")
+            if _worktree_changes(resolved):
+                raise UndoError("worktree changed after member task undo preview")
+            _require_unpublished_reset(resolved, str(target["branch"]))
+            transaction = _prepare_transaction(
+                resolved, kind, expected_head, str(target["parent"]), str(target["branch"]), None, None,
+                {"member": str(target["member"]), "landing": str(target["landing"]),
+                 "member_parent": str(target["member_parent"])},
+            )
+            _finish_transaction_locked(resolved, transaction)
     elif kind == "task":
         parent = target["parent"]
         if not parent:

package/skills/gsd-path-undo/scripts/review_panel.py

@@ -470,7 +470,7 @@ def merge_artifacts(
         lines.append(artifact["text"].rstrip())
         lines.append("")
     output.parent.mkdir(parents=True, exist_ok=True)
-    output.write_text("\n".join(lines).rstrip() + "\n", encoding="utf-8")
+    output.write_bytes(("\n".join(lines).rstrip() + "\n").encode("utf-8"))
     return {
         "output": str(output.resolve()),
         "families": families,

package/skills/gsd-path-undo/scripts/worktree_paths.py

@@ -13,10 +13,34 @@ import os
 import tempfile
 from pathlib import Path
 
-try:
-    import _common
-except ImportError:
-    from scripts import _common
+if __package__:
+    from . import _common
+else:
+    try:
+        import _common
+    except ImportError:
+        from scripts import _common
+
+
+def _worktree_list_porcelain(primary: Path) -> tuple[str, bool]:
+    try:
+        if __package__:
+            from . import pipeline_git as pg
+        else:
+            from scripts import pipeline_git as pg
+    except ImportError:
+        try:
+            import pipeline_git as pg
+        except ImportError:
+            pg = None
+    if pg is not None:
+        return pg.worktree_list_porcelain(primary)
+    try:
+        output = _git(primary, "worktree", "list", "--porcelain", "-z")
+        return output, True
+    except ValueError:
+        output = _git(primary, "worktree", "list", "--porcelain")
+        return output, False
 
 
 def _git(primary: Path, *args: str) -> str:
@@ -27,7 +51,10 @@ def _git(primary: Path, *args: str) -> str:
 
 
 def _identity(path: Path) -> str:
-    return hashlib.sha256(os.fsencode(path)).hexdigest()
+    digest = hashlib.sha256(os.fsencode(path)).hexdigest()
+    # Two identities nest in every managed path; full digests would use about
+    # 130 of Windows' 260-character MAX_PATH before any repository content.
+    return digest[:16] if os.name == "nt" else digest
 
 
 def _workspace(primary: Path, pin: bool) -> Path:
@@ -65,7 +92,7 @@ def _workspace(primary: Path, pin: bool) -> Path:
         receipt.parent.mkdir(parents=True, exist_ok=True)
         fd, temporary = tempfile.mkstemp(dir=receipt.parent)
         try:
-            with os.fdopen(fd, "w", encoding="utf-8") as handle:
+            with os.fdopen(fd, "w", encoding="utf-8", newline="\n") as handle:
                 json.dump({"primary": str(primary), "root": str(workspace)}, handle)
             try:
                 os.link(temporary, receipt)
@@ -76,17 +103,52 @@ def _workspace(primary: Path, pin: bool) -> Path:
     return workspace
 
 
+def release_workspace(primary: Path) -> bool:
+    """Forget the pinned placement receipt once no linked worktrees remain.
+
+    Lets GSD_PATH_WORKTREE_ROOT (or a new default) apply again at the next
+    milestone's first allocation. Returns True when a receipt was removed;
+    any remaining linked worktree (including one only still registered) keeps
+    the pin.
+    """
+    primary = primary.resolve()
+    common = Path(_git(primary, "rev-parse", "--git-common-dir"))
+    common = (primary / common).resolve()
+    receipt = common / "gsd-path" / "workspaces" / f"{_identity(primary)}.json"
+    if not receipt.is_file():
+        return False
+    output, nul_separated = _worktree_list_porcelain(primary)
+    records = output.split("\0\0") if nul_separated else [
+        block for block in output.strip().split("\n\n") if block.strip()
+    ]
+    for record in records:
+        fields = record.split("\0") if nul_separated else record.splitlines()
+        for field in fields:
+            if field.startswith("worktree ") and Path(field[len("worktree "):]).resolve() != primary:
+                return False
+    receipt.unlink()
+    return True
+
+
 def worktree_path(primary: Path, kind: str, name: str, *, pin: bool = False) -> Path:
     primary = primary.resolve()
-    if kind not in {"task", "verify", "integrate"} or not name or Path(name).name != name or name in {".", ".."}:
+    if kind not in {"task", "verify", "integrate", "bound"} or not name or Path(name).name != name or name in {".", ".."}:
         raise ValueError("invalid managed worktree kind or name")
+    if kind == "bound":
+        return _workspace(primary, pin) / kind / name
     legacy = (primary.parent / f".{primary.name}-gsd-path-integrate-{name}"
               if kind == "integrate" else primary.parent / f"{primary.name}.gsd-path" / kind / name)
     branch = f"refs/heads/gsd-path-{kind}/{name}"
-    records = _git(primary, "worktree", "list", "--porcelain", "-z").split("\0\0")
+    output, nul_separated = _worktree_list_porcelain(primary)
+    if nul_separated:
+        records = output.split("\0\0")
+    else:
+        records = [block for block in output.strip().split("\n\n") if block.strip()]
     for record in records:
-        fields = record.split("\0")
-        if f"worktree {legacy}" in fields and f"branch {branch}" in fields:
+        fields = record.split("\0") if nul_separated else record.splitlines()
+        # Compare as paths: git prints forward slashes on Windows.
+        worktrees = [Path(field[len("worktree "):]) for field in fields if field.startswith("worktree ")]
+        if legacy in worktrees and f"branch {branch}" in fields:
             return legacy
     # Keep collision checks and missing-directory recovery at the old location.
     if os.path.lexists(legacy):