@opengsd/gsd-path 1.4.0 → 1.5.0

package/scripts/loop_run.py

@@ -514,16 +514,28 @@ def run_shell(command: str, timeout: float) -> tuple[Optional[int], str]:
     """Run one spec command; a hung command counts as failed (exit None).
 
     POSIX runs /bin/sh as shell=True did; Windows runs Git for Windows bash, not
-    cmd.exe. A timeout kills the whole process group, so a grandchild cannot
-    keep the output pipes open.
+    cmd.exe. A timeout kills the whole process group when possible; if output
+    pipes stay open, drain them with a short grace timeout and then close them.
     """
     argv = _common.bash_argv(command) if os.name == "nt" else ["/bin/sh", "-c", command]
     process = _common.popen_group(argv, stdout=subprocess.PIPE, stderr=subprocess.PIPE)
+    stdout = b""
+    stderr = b""
     try:
         stdout, stderr = process.communicate(timeout=timeout)
-    except subprocess.TimeoutExpired:
+    except subprocess.TimeoutExpired as expired:
         _common.kill_tree(process)
-        stdout, stderr = process.communicate()
+        try:
+            stdout, stderr = process.communicate(timeout=5)
+        except subprocess.TimeoutExpired as drained:
+            stdout = drained.stdout or expired.stdout or b""
+            stderr = drained.stderr or expired.stderr or b""
+            if process.stdout:
+                process.stdout.close()
+            if process.stderr:
+                process.stderr.close()
+            process.kill()
+            process.wait(timeout=5)
         output = stdout.decode("utf-8", errors="replace") + stderr.decode("utf-8", errors="replace")
         return None, f"{output}\ntimed out at the admitted wall-clock deadline"
     return process.returncode, (stdout + stderr).decode("utf-8", errors="replace")

package/scripts/members.py

@@ -255,6 +255,7 @@ def check_member(
     coordinator_name: str,
     checkout: Path,
     recorded_remote: Optional[str] = None,
+    refuse_reserved_refs: bool = True,
 ) -> str:
     """Refuse a checkout that cannot join; return its origin URL."""
     if checkout.is_symlink() or not checkout.is_dir():
@@ -294,13 +295,14 @@ def check_member(
             raise MembersError(f"member STATE.md is unreadable: {error}") from error
         if state.milestone is not None and (state.phase, state.status) != ("shipped", "done"):
             raise MembersError(f"member has an active milestone: {state.milestone}")
-    prefixes = member_ref_prefixes(coordinator_name) + tuple(
-        "refs/remotes/origin/" + branch.format(coordinator_name) for branch in MEMBER_BRANCH_FORMATS
-    )
-    refs = _git(checkout, "for-each-ref", "--format=%(refname)").splitlines()
-    colliding = [ref for ref in refs if ref.startswith(prefixes)]
-    if colliding:
-        raise MembersError("member refs collide with coordinator names: " + ", ".join(colliding))
+    if refuse_reserved_refs:
+        prefixes = member_ref_prefixes(coordinator_name) + tuple(
+            "refs/remotes/origin/" + branch.format(coordinator_name) for branch in MEMBER_BRANCH_FORMATS
+        )
+        refs = _git(checkout, "for-each-ref", "--format=%(refname)").splitlines()
+        colliding = [ref for ref in refs if ref.startswith(prefixes)]
+        if colliding:
+            raise MembersError("member refs collide with coordinator names: " + ", ".join(colliding))
     return remote
 
 
@@ -620,7 +622,7 @@ def validate_members(repo: Path) -> list[dict[str, str]]:
     members = read_members(root)
     for member in members:
         checkout = Path(member["checkout"])
-        check_member(root, state.project, checkout, member["remote"])
+        check_member(root, state.project, checkout, member["remote"], refuse_reserved_refs=False)
         try:
             role = member_role(checkout)
         except MembersError as error:
@@ -639,7 +641,7 @@ def repair_members(repo: Path) -> list[dict[str, str]]:
     members = read_members(root)
     for member in members:
         checkout = Path(member["checkout"])
-        check_member(root, state.project, checkout, member["remote"])
+        check_member(root, state.project, checkout, member["remote"], refuse_reserved_refs=False)
         _refuse_foreign_marker(checkout.resolve(), root, state.project, member["name"])
     for member in members:
         checkout = Path(member["checkout"]).resolve()

package/scripts/path_config.py

@@ -13,7 +13,7 @@ sys.dont_write_bytecode = True
 ROLES = ('coder', 'reviewer', 'review_panel', 'skeptic', 'inspect_codebase',
          'inspect_docs', 'docs_audit', 'research', 'decide', 'roadmap', 'plan', 'plan_patch')
 HOSTS = ('codex', 'claude', 'grok', 'opencode', 'copilot', 'qwen', 'antigravity',
-         'cursor', 'zed', 'kiro', 'kimi')
+         'cursor', 'zed', 'kiro', 'kimi', 'muse')
 
 
 def sibling(name):
@@ -73,8 +73,8 @@ def validate_value(key, value):
     if not isinstance(value, str) or not value or value != value.strip():
         raise ValueError(f'{key} requires a nonempty string')
     if key == 'integration':
-        if value not in ('direct', 'pull-request'):
-            raise ValueError('integration must be direct or pull-request')
+        if value not in ('direct', 'pull-request', 'external-landing'):
+            raise ValueError('integration must be direct, pull-request, or external-landing')
     elif key == 'review_panel':
         if any(char.isspace() for char in value):
             raise ValueError('use off, detected, or comma-separated families without spaces')

package/scripts/pipeline_git.py

@@ -146,6 +146,29 @@ def ship_commit_body(archive_path: str, reviewed_head: str, members: Sequence[di
     )
 
 
+_TRAILER_LINE = re.compile(r"^[A-Za-z-]+:\s")
+
+
+def ship_body_matches(body: str, expected_body: str) -> bool:
+    """True when body equals the contract or adds only optional git trailers after it."""
+    normalized = body.rstrip("\n")
+    expected = expected_body.rstrip("\n")
+    if normalized == expected:
+        return True
+    prefix = expected + "\n"
+    if not normalized.startswith(prefix):
+        return False
+    remainder = normalized[len(prefix):]
+    if not remainder:
+        return True
+    for line in remainder.splitlines():
+        if not line.strip():
+            return False
+        if not _TRAILER_LINE.match(line):
+            return False
+    return True
+
+
 def integrate_commit_body(
     archive_path: str,
     ship_commit: str,
@@ -270,22 +293,50 @@ def _symbolic_branch(repo: Path) -> str:
     return result.stdout.strip()
 
 
-def _branch_worktrees(repo: Path) -> dict[str, Path]:
-    """Return every checked-out local branch from Git's worktree registry."""
-    output = _run_git(repo, "worktree", "list", "--porcelain", "-z").stdout
+def worktree_list_porcelain(repo: Path) -> tuple[str, bool]:
+    """Return worktree list output and whether it is NUL-separated."""
+    result = _run_git(repo, "worktree", "list", "--porcelain", "-z", check=False)
+    if result.returncode == 0:
+        return result.stdout, True
+    result = _run_git(repo, "worktree", "list", "--porcelain", check=False)
+    if result.returncode != 0:
+        message = (result.stderr or result.stdout).strip() or "could not list worktrees"
+        raise PipelineGitError(message)
+    return result.stdout, False
+
+
+def branch_worktrees_from_porcelain(output: str, *, nul_separated: bool) -> dict[str, Path]:
     worktrees: dict[str, Path] = {}
-    current_path: Optional[Path] = None
-    for field in output.split("\0"):
-        if field.startswith("worktree "):
-            current_path = Path(field.removeprefix("worktree ")).resolve()
-        elif field.startswith("branch ") and current_path is not None:
-            ref = field.removeprefix("branch ")
-            prefix = "refs/heads/"
-            if ref.startswith(prefix):
-                worktrees[ref.removeprefix(prefix)] = current_path
+    if nul_separated:
+        current_path: Optional[Path] = None
+        for field in output.split("\0"):
+            if not field:
+                continue
+            if field.startswith("worktree "):
+                current_path = Path(field.removeprefix("worktree ")).resolve()
+            elif field.startswith("branch ") and current_path is not None:
+                ref = field.removeprefix("branch ")
+                prefix = "refs/heads/"
+                if ref.startswith(prefix):
+                    worktrees[ref.removeprefix(prefix)] = current_path
+        return worktrees
+    for block in output.strip().split("\n\n"):
+        fields = block.splitlines()
+        if not fields or not fields[0].startswith("worktree "):
+            continue
+        current_path = Path(fields[0].removeprefix("worktree ")).resolve()
+        for line in fields[1:]:
+            if line.startswith("branch refs/heads/"):
+                worktrees[line.removeprefix("branch refs/heads/")] = current_path
     return worktrees
 
 
+def _branch_worktrees(repo: Path) -> dict[str, Path]:
+    """Return every checked-out local branch from Git's worktree registry."""
+    output, nul_separated = worktree_list_porcelain(repo)
+    return branch_worktrees_from_porcelain(output, nul_separated=nul_separated)
+
+
 def _remote_ref_sha(repo: Path, ref: str) -> Optional[str]:
     if not _origin_remote_exists(repo):
         raise PipelineGitError("origin remote is not configured")

package/scripts/pipeline_state.py

@@ -91,7 +91,7 @@ STATE_FIELDS = (
     "integration_source",
 )
 LEGACY_STATE_FIELDS = STATE_FIELDS[:7]
-INTEGRATION_MODES = ("direct", "pull-request")
+INTEGRATION_MODES = ("direct", "pull-request", "external-landing")
 INTEGRATION_SOURCES = ("default", "milestone")
 NULL = "null"
 SLUG_RE = re.compile(r"^[a-z0-9][a-z0-9-]*$")
@@ -141,6 +141,8 @@ CROSS_PHASE_TRANSITIONS = {
     ("decide", "done", "plan", "active"),
     ("roadmap", "done", "define", "active"),
     ("plan", "done", "build", "active"),
+    ("plan", "active", "define", "active"),
+    ("plan", "blocked", "define", "active"),
     ("build", "blocked", "define", "active"),
     ("build", "blocked", "plan", "active"),
     ("build", "active", "ship", "active"),
@@ -193,11 +195,24 @@ def _run_git(
     *arguments: str,
     check: bool = True,
 ) -> subprocess.CompletedProcess[str]:
+    command = _common.git_command(repo, *arguments)
     result = subprocess.run(
-        ["git", "-C", str(repo), *arguments],
+        command,
         capture_output=True,
         encoding="utf-8", errors="replace",
     )
+    if (
+        check
+        and result.returncode != 0
+        and arguments
+        and arguments[0] == "commit"
+        and _common.git_index_lock_retryable(result.stderr)
+    ):
+        result = subprocess.run(
+            command,
+            capture_output=True,
+            encoding="utf-8", errors="replace",
+        )
     if check and result.returncode != 0:
         detail = result.stderr.strip() or result.stdout.strip()
         raise PipelineStateError(f"git {' '.join(arguments)} failed: {detail}")
@@ -911,36 +926,13 @@ def _legacy_bind_next_landing(repo: Path, state: PipelineState) -> str:
     return landing
 
 
-def _bind_next_recovery(
+def _bind_next_journal_recovery(
     repo: Path,
     state: PipelineState,
+    path: Path,
+    transaction: dict[str, object],
+    current: Optional[str],
 ) -> Optional[dict[str, object]]:
-    journal_root = _git_path(repo, BIND_NEXT_JOURNAL_DIR)
-    if not journal_root.exists() and not journal_root.is_symlink():
-        return None
-    if journal_root.is_symlink() or not journal_root.is_dir():
-        raise PipelineStateError(f"bind-next journal root must be a real directory: {journal_root}")
-
-    matches: list[tuple[Path, dict[str, object]]] = []
-    for path in sorted(journal_root.glob("*.json")):
-        transaction = _read_json(path)
-        if transaction.get("schema") not in {
-            LEGACY_BIND_NEXT_JOURNAL_SCHEMA,
-            BIND_NEXT_JOURNAL_SCHEMA,
-        }:
-            raise PipelineStateError(f"bind-next journal has invalid schema: {path}")
-        if transaction.get("repo") != str(repo):
-            raise PipelineStateError(f"bind-next journal belongs to another worktree: {path}")
-        if transaction.get("previous_branch") == state.branch:
-            matches.append((path, transaction))
-    if not matches:
-        return None
-    if len(matches) != 1:
-        raise PipelineStateError("multiple bind-next journals claim the current STATE branch")
-    if state.phase != "shipped" or state.status != "done":
-        raise PipelineStateError("bind-next journal requires STATE shipped/done")
-
-    path, transaction = matches[0]
     required = (
         "branch",
         "previous_branch",
@@ -1022,7 +1014,32 @@ def _bind_next_recovery(
     if stage not in {"prepared", "switched", "retired"}:
         raise PipelineStateError("bind-next journal has invalid stage")
 
-    current = _current_branch(repo)
+    stale_retired = False
+    if stage == "retired":
+        target_ref = _run_git(
+            repo,
+            "show-ref",
+            "--verify",
+            "--quiet",
+            f"refs/heads/{branch}",
+            check=False,
+        )
+        if target_ref.returncode not in {0, 1}:
+            detail = (target_ref.stderr or target_ref.stdout).strip()
+            raise PipelineStateError(
+                f"could not check bind-next target branch {branch}: {detail}"
+            )
+        target_exists = target_ref.returncode == 0
+        stale_retired = current not in {previous, branch} or not target_exists
+    if stale_retired:
+        # If the completed target is gone while the previous branch is checked
+        # out, still prove that branch has not moved away from the recorded ship.
+        if current == previous:
+            head = _run_git(repo, "rev-parse", "HEAD").stdout.strip()
+            if head != ship:
+                raise PipelineStateError("bind-next previous branch is not at journal ship")
+        return None
+
     if current not in {previous, branch}:
         raise PipelineStateError("bind-next journal does not own the current branch")
     if current == previous and stage != "prepared":
@@ -1057,6 +1074,52 @@ def _bind_next_recovery(
     return result
 
 
+def _bind_next_recovery(
+    repo: Path,
+    state: PipelineState,
+) -> Optional[dict[str, object]]:
+    journal_root = _git_path(repo, BIND_NEXT_JOURNAL_DIR)
+    if not journal_root.exists() and not journal_root.is_symlink():
+        return None
+    if journal_root.is_symlink() or not journal_root.is_dir():
+        raise PipelineStateError(f"bind-next journal root must be a real directory: {journal_root}")
+
+    matches: list[tuple[Path, dict[str, object]]] = []
+    for path in sorted(journal_root.glob("*.json")):
+        transaction = _read_json(path)
+        if transaction.get("schema") not in {
+            LEGACY_BIND_NEXT_JOURNAL_SCHEMA,
+            BIND_NEXT_JOURNAL_SCHEMA,
+        }:
+            raise PipelineStateError(f"bind-next journal has invalid schema: {path}")
+        if transaction.get("repo") != str(repo):
+            raise PipelineStateError(f"bind-next journal belongs to another worktree: {path}")
+        if transaction.get("previous_branch") == state.branch:
+            matches.append((path, transaction))
+    if not matches:
+        return None
+    if state.phase != "shipped" or state.status != "done":
+        if len(matches) != 1:
+            raise PipelineStateError("multiple bind-next journals claim the current STATE branch")
+        raise PipelineStateError("bind-next journal requires STATE shipped/done")
+
+    current = _current_branch(repo)
+    recoveries: list[dict[str, object]] = []
+    for path, transaction in matches:
+        recovery = _bind_next_journal_recovery(
+            repo,
+            state,
+            path,
+            transaction,
+            current,
+        )
+        if recovery is not None:
+            recoveries.append(recovery)
+    if len(recoveries) > 1:
+        raise PipelineStateError("multiple bind-next journals claim the current STATE branch")
+    return recoveries[0] if recoveries else None
+
+
 def _pending_discussion_block(repo: Path, phase: Optional[str]) -> Optional[str]:
     pending, error = _pending_answers(repo)
     if error:
@@ -1077,7 +1140,7 @@ def route_state(repo: Path, project_dir: str = ".project") -> dict[str, object]:
             result["recovery"] = recovery
             if route.get("phase") == "define":
                 route["mode"] = "corrections"
-            elif route.get("phase") == "plan":
+            elif route.get("phase") == "plan" and recovery.get("source", "build") == "build":
                 route["mode"] = "build-repair"
     if route["action"] == "run-phase" and result["state"]["archive"] is None:
         reason = _pending_discussion_block(_repo_root(repo), route.get("phase"))
@@ -1668,6 +1731,8 @@ def _validate_transition(
         },
         ("define", "done", "plan", "active"): {"planning started"},
         ("decide", "done", "plan", "active"): {"planning started"},
+        ("plan", "active", "define", "active"): {"plan intent corrections requested"},
+        ("plan", "blocked", "define", "active"): {"plan intent corrections requested"},
         ("ship", "blocked", "plan", "active"): {"patch plan reopened"},
         ("ship", "active", "shipped", "done"): {
             "archive preflight passed; shipment recorded",
@@ -1720,9 +1785,10 @@ def transition_state(
             )
             if reason:
                 raise PipelineStateError(reason)
-        if state.phase in {"research", "decide"} and (
+        leaving_define = (state.phase, after.phase, after.status) == ("define", "define", "done")
+        if leaving_define or (state.phase in {"research", "decide"} and (
             after.phase != state.phase or after.status == "done"
-        ):
+        )):
             if __package__:
                 from . import check_handoffs
             else:
@@ -1731,6 +1797,8 @@ def transition_state(
                 except ImportError:  # pragma: no cover - package imports used by tests
                     from scripts import check_handoffs
             validator = {
+                # Approved intent carries its spec-reach probe tables complete.
+                "define": check_handoffs.validate_intent_probes,
                 "research": check_handoffs.validate_research_artifacts,
                 "decide": check_handoffs.validate_decide_artifacts,
             }[state.phase]
@@ -1747,6 +1815,16 @@ def transition_state(
                 rendered, after.phase,
                 _build_recovery().MARKER + json.dumps(recovery, sort_keys=True),
             )
+        elif (
+            state.phase == "plan"
+            and state.status in {"active", "blocked"}
+            and (after.phase, after.status) == ("define", "active")
+        ):
+            recovery = _build_recovery().begin(resolved, state, after, event)
+            rendered = _append_event(
+                rendered, after.phase,
+                _build_recovery().MARKER + json.dumps(recovery, sort_keys=True),
+            )
         _atomic_write(path, rendered)
     return {
         "schema": STATE_SCHEMA,

package/scripts/pipeline_undo.py

@@ -17,6 +17,7 @@ import os
 import re
 import shutil
 import sys
+from datetime import date
 
 # Runtime helpers must not modify their immutable installation.
 sys.dont_write_bytecode = True
@@ -106,6 +107,16 @@ KINDS = ("checkpoint", "task", "member-task", "uncommitted-archive", "lookahead"
 PROMOTION_PREFIX = "router: promote lookahead milestone "
 ABANDON_PREFIX = "build: abandon milestone "
 INTEGRATE_PREFIX = "integrate: "
+SHIP_LOG_ONLY_LINE = re.compile(
+    r"- (?P<date>\d{4}-\d{2}-\d{2}) — ship — (?P<event>[^\r\n]+)\n\Z"
+)
+SHIPMENT_RECORD_LINE = re.compile(
+    r"- (?P<date>\d{4}-\d{2}-\d{2}) — shipped — (?P<event>[^\r\n]+)\n\Z"
+)
+SHIPMENT_EVENTS = {
+    "archive preflight passed; shipment recorded",
+    "archive preflight passed; shipment recorded; program complete",
+}
 
 
 class UndoError(RuntimeError):
@@ -375,6 +386,80 @@ def pending_transaction(repo: Path) -> Optional[dict[str, object]]:
         raise UndoError(str(error)) from error
 
 
+def _valid_state_event_line(line: str, phase: str) -> bool:
+    pattern = SHIP_LOG_ONLY_LINE if phase == "ship" else SHIPMENT_RECORD_LINE
+    match = pattern.fullmatch(line)
+    if match is None:
+        return False
+    try:
+        event_date = date.fromisoformat(match.group("date"))
+    except ValueError:
+        return False
+    event = match.group("event")
+    return event_date.isoformat() == match.group("date") and event == " ".join(event.split())
+
+
+def _owned_ship_log_events(
+    prepared_state: str,
+    current_state: str,
+    phase: object,
+    status: object,
+) -> Optional[str]:
+    """Return only ship log lines appended around a helper-owned archive event.
+
+    The prepared text must remain byte-for-byte unchanged. For shipped/done,
+    record-shipment changes only phase and status before appending its one
+    generated shipment event, so validate that exact prefix and event shape.
+    """
+    if (phase, status) == ("ship", "active"):
+        if current_state == prepared_state:
+            return ""
+        if not current_state.startswith(prepared_state):
+            return None
+        suffix = current_state[len(prepared_state):]
+        separator = "" if prepared_state.endswith("\n") else "\n"
+        if separator:
+            if not suffix.startswith(separator):
+                return None
+            suffix = suffix[len(separator):]
+        lines = suffix.splitlines(keepends=True)
+        if not lines or "".join(lines) != suffix:
+            return None
+        if not all(_valid_state_event_line(line, "ship") for line in lines):
+            return None
+        return separator + suffix
+
+    if (phase, status) != ("shipped", "done"):
+        return None
+    try:
+        shipped_prefix = pipeline_state._set_frontmatter(
+            prepared_state,
+            {"phase": "shipped", "status": "done"},
+        )
+    except PipelineStateError:
+        return None
+    if not current_state.startswith(shipped_prefix):
+        return None
+    suffix = current_state[len(shipped_prefix):]
+    separator = "" if shipped_prefix.endswith("\n") else "\n"
+    if separator:
+        if not suffix.startswith(separator):
+            return None
+        suffix = suffix[len(separator):]
+    lines = suffix.splitlines(keepends=True)
+    if not lines or "".join(lines) != suffix:
+        return None
+    shipment_event = lines[-1]
+    if not _valid_state_event_line(shipment_event, "shipped"):
+        return None
+    if SHIPMENT_RECORD_LINE.fullmatch(shipment_event).group("event") not in SHIPMENT_EVENTS:
+        return None
+    ship_events = lines[:-1]
+    if not all(_valid_state_event_line(line, "ship") for line in ship_events):
+        return None
+    return separator + "".join(ship_events) if ship_events else ""
+
+
 def _archive_metadata_error(
     repo: Path,
     state_fields: dict[str, object],
@@ -420,8 +505,13 @@ def _archive_metadata_error(
         if final_review.exists() or gap_reviews:
             reviewed_head, _ = archive_milestone.parse_final_review(archive_path)
             archive_milestone.validate_gap_reviews(archive_path, reviewed_head)
-            if reviewed_head != _optional_rev(repo, "HEAD"):
-                return "archive undo final review does not match current HEAD"
+            if not archive_milestone.reviewed_head_covers(
+                repo, reviewed_head, _optional_rev(repo, "HEAD")
+            ):
+                return (
+                    "archive undo final review does not match current HEAD; "
+                    f"{archive_milestone._common.RUNTIME_PIN_ALLOWANCE}"
+                )
             expected_inventory.add("review/FINAL.md")
             expected_inventory.update(
                 path.relative_to(archive_path).as_posix() for path in gap_reviews
@@ -476,10 +566,14 @@ def _archive_metadata_error(
         "archive",
         configured,
     )
-    current_state = (repo / ".project" / "STATE.md").read_text(encoding="utf-8")
+    current_state = (repo / ".project" / "STATE.md").read_bytes().decode("utf-8")
     phase = state_fields.get("phase")
     status = state_fields.get("status")
+    ship_events = _owned_ship_log_events(prepared_state, current_state, phase, status)
     if (phase, status) == ("ship", "active"):
+        if ship_events is None:
+            return "archive undo found unowned STATE.md changes"
+        prepared_state += ship_events
         if current_state != prepared_state:
             return "archive undo found unowned STATE.md changes"
         if ".project/ROADMAP.md" in dirty:
@@ -487,14 +581,13 @@ def _archive_metadata_error(
         return None
     if (phase, status) != ("shipped", "done"):
         return "archive undo requires ship/active or shipped/done"
+    if ship_events is None:
+        return "archive undo found unowned shipment STATE.md changes"
+    prepared_state += ship_events
 
     prepared = _state_from_text(prepared_state, "prepared archive STATE.md")
-    events = (
-        "archive preflight passed; shipment recorded",
-        "archive preflight passed; shipment recorded; program complete",
-    )
     rendered_states = []
-    for event in events:
+    for event in SHIPMENT_EVENTS:
         try:
             _, _, rendered = _render_transition(
                 prepared,

package/scripts/runtime_store.py

@@ -27,6 +27,15 @@ RUNTIME_FILES = (
 )
 GUARDS = ("guard_hook.py", "git_guard.py")
 
+# Optional owner-recorded provenance on .gsd-path/runtime.json declarations,
+# e.g. {"source": "<npm version or package id>", "patch_ref": "<commit sha
+# or patch list>", "note": "<owner label>"}. Provenance is display/audit
+# metadata ONLY: it never joins the hashed manifest input (manifest_digest
+# covers exactly {"version", "files"}), never acts as an alternate accepted
+# digest, and never bypasses or weakens validate_runtime. A declaration
+# without provenance is stock and stays exactly as valid as one with it.
+PROVENANCE_KEYS = ("source", "patch_ref", "note")
+
 # Access denied and sharing violation: on Windows a scanner or indexer that
 # briefly opens a freshly written file blocks renaming the directory holding it.
 _WINDOWS_BUSY_ERRORS = (5, 32)
@@ -220,7 +229,7 @@ def recover_migration(project):
     journal.unlink()
 
 
-def operate(source, project, action, *, dry_run=False):
+def operate(source, project, action, *, dry_run=False, provenance=None):
     if project.is_symlink() or (project / ".gsd-path").is_symlink():
         raise ValueError("unsafe project runtime directory")
     if action == "restore":
@@ -228,8 +237,17 @@ def operate(source, project, action, *, dry_run=False):
         publish(source, expected=pin, dry_run=dry_run, repair=True)
         return pin
     if action == "upgrade":
-        status_runtime.declaration(project)
+        previous = status_runtime.declaration(project)
         pin = publish(source, dry_run=dry_run)
+        # Explicit provenance replaces the recorded object. Without new flags,
+        # an existing entry carries forward only while the pinned digest is
+        # unchanged — a different source drops stale hotfix metadata instead
+        # of stamping it onto bytes it no longer describes. Metadata only —
+        # it never changes the pinned digest.
+        if provenance is None and previous.get("digest") == pin["digest"]:
+            provenance = previous.get("provenance")
+        if provenance:
+            pin = {**pin, "provenance": provenance}
         if not dry_run:
             launcher = project / ".gsd-path/status_runtime.py"
             # Exact bytes: read_text() would turn CRLF into LF, leaving the