@opengsd/gsd-path 1.4.0 → 1.6.0

package/scripts/pipeline_undo.py

@@ -17,10 +17,12 @@ import os
 import re
 import shutil
 import sys
+from datetime import date
 
 # Runtime helpers must not modify their immutable installation.
 sys.dont_write_bytecode = True
 import tempfile
+import traceback
 from pathlib import Path, PurePosixPath
 from typing import Optional, Sequence
 
@@ -52,7 +54,7 @@ def _load_pipeline_modules():
     try:
         from scripts import archive_milestone, isolation, pipeline_git, pipeline_state, state_checkpoint
         return archive_milestone, isolation, pipeline_git, pipeline_state, state_checkpoint
-    except ModuleNotFoundError as error:
+    except ImportError as error:  # a foreign `scripts` package
         if error.name not in {
             "scripts",
             "scripts.archive_milestone",
@@ -62,6 +64,13 @@ def _load_pipeline_modules():
             "scripts.state_checkpoint",
         }:
             raise
+        # A plain ImportError raised while a `scripts` module loaded is not a
+        # foreign package. A missing module falls back, as before.
+        if not isinstance(error, ModuleNotFoundError) and any(
+            frame.f_globals.get("__name__", "").startswith("scripts.")
+            for frame, _ in traceback.walk_tb(error.__traceback__)
+        ):
+            raise
         shared = Path(__file__).resolve().parents[2] / "gsd-path" / "scripts"
         sys.path.insert(0, str(shared))
         import archive_milestone
@@ -106,6 +115,16 @@ KINDS = ("checkpoint", "task", "member-task", "uncommitted-archive", "lookahead"
 PROMOTION_PREFIX = "router: promote lookahead milestone "
 ABANDON_PREFIX = "build: abandon milestone "
 INTEGRATE_PREFIX = "integrate: "
+SHIP_LOG_ONLY_LINE = re.compile(
+    r"- (?P<date>\d{4}-\d{2}-\d{2}) — ship — (?P<event>[^\r\n]+)\n\Z"
+)
+SHIPMENT_RECORD_LINE = re.compile(
+    r"- (?P<date>\d{4}-\d{2}-\d{2}) — shipped — (?P<event>[^\r\n]+)\n\Z"
+)
+SHIPMENT_EVENTS = {
+    "archive preflight passed; shipment recorded",
+    "archive preflight passed; shipment recorded; program complete",
+}
 
 
 class UndoError(RuntimeError):
@@ -375,6 +394,80 @@ def pending_transaction(repo: Path) -> Optional[dict[str, object]]:
         raise UndoError(str(error)) from error
 
 
+def _valid_state_event_line(line: str, phase: str) -> bool:
+    pattern = SHIP_LOG_ONLY_LINE if phase == "ship" else SHIPMENT_RECORD_LINE
+    match = pattern.fullmatch(line)
+    if match is None:
+        return False
+    try:
+        event_date = date.fromisoformat(match.group("date"))
+    except ValueError:
+        return False
+    event = match.group("event")
+    return event_date.isoformat() == match.group("date") and event == " ".join(event.split())
+
+
+def _owned_ship_log_events(
+    prepared_state: str,
+    current_state: str,
+    phase: object,
+    status: object,
+) -> Optional[str]:
+    """Return only ship log lines appended around a helper-owned archive event.
+
+    The prepared text must remain byte-for-byte unchanged. For shipped/done,
+    record-shipment changes only phase and status before appending its one
+    generated shipment event, so validate that exact prefix and event shape.
+    """
+    if (phase, status) == ("ship", "active"):
+        if current_state == prepared_state:
+            return ""
+        if not current_state.startswith(prepared_state):
+            return None
+        suffix = current_state[len(prepared_state):]
+        separator = "" if prepared_state.endswith("\n") else "\n"
+        if separator:
+            if not suffix.startswith(separator):
+                return None
+            suffix = suffix[len(separator):]
+        lines = suffix.splitlines(keepends=True)
+        if not lines or "".join(lines) != suffix:
+            return None
+        if not all(_valid_state_event_line(line, "ship") for line in lines):
+            return None
+        return separator + suffix
+
+    if (phase, status) != ("shipped", "done"):
+        return None
+    try:
+        shipped_prefix = pipeline_state._set_frontmatter(
+            prepared_state,
+            {"phase": "shipped", "status": "done"},
+        )
+    except PipelineStateError:
+        return None
+    if not current_state.startswith(shipped_prefix):
+        return None
+    suffix = current_state[len(shipped_prefix):]
+    separator = "" if shipped_prefix.endswith("\n") else "\n"
+    if separator:
+        if not suffix.startswith(separator):
+            return None
+        suffix = suffix[len(separator):]
+    lines = suffix.splitlines(keepends=True)
+    if not lines or "".join(lines) != suffix:
+        return None
+    shipment_event = lines[-1]
+    if not _valid_state_event_line(shipment_event, "shipped"):
+        return None
+    if SHIPMENT_RECORD_LINE.fullmatch(shipment_event).group("event") not in SHIPMENT_EVENTS:
+        return None
+    ship_events = lines[:-1]
+    if not all(_valid_state_event_line(line, "ship") for line in ship_events):
+        return None
+    return separator + "".join(ship_events) if ship_events else ""
+
+
 def _archive_metadata_error(
     repo: Path,
     state_fields: dict[str, object],
@@ -420,8 +513,13 @@ def _archive_metadata_error(
         if final_review.exists() or gap_reviews:
             reviewed_head, _ = archive_milestone.parse_final_review(archive_path)
             archive_milestone.validate_gap_reviews(archive_path, reviewed_head)
-            if reviewed_head != _optional_rev(repo, "HEAD"):
-                return "archive undo final review does not match current HEAD"
+            if not archive_milestone.reviewed_head_covers(
+                repo, reviewed_head, _optional_rev(repo, "HEAD")
+            ):
+                return (
+                    "archive undo final review does not match current HEAD; "
+                    f"{archive_milestone._common.RUNTIME_PIN_ALLOWANCE}"
+                )
             expected_inventory.add("review/FINAL.md")
             expected_inventory.update(
                 path.relative_to(archive_path).as_posix() for path in gap_reviews
@@ -476,10 +574,14 @@ def _archive_metadata_error(
         "archive",
         configured,
     )
-    current_state = (repo / ".project" / "STATE.md").read_text(encoding="utf-8")
+    current_state = (repo / ".project" / "STATE.md").read_bytes().decode("utf-8")
     phase = state_fields.get("phase")
     status = state_fields.get("status")
+    ship_events = _owned_ship_log_events(prepared_state, current_state, phase, status)
     if (phase, status) == ("ship", "active"):
+        if ship_events is None:
+            return "archive undo found unowned STATE.md changes"
+        prepared_state += ship_events
         if current_state != prepared_state:
             return "archive undo found unowned STATE.md changes"
         if ".project/ROADMAP.md" in dirty:
@@ -487,14 +589,13 @@ def _archive_metadata_error(
         return None
     if (phase, status) != ("shipped", "done"):
         return "archive undo requires ship/active or shipped/done"
+    if ship_events is None:
+        return "archive undo found unowned shipment STATE.md changes"
+    prepared_state += ship_events
 
     prepared = _state_from_text(prepared_state, "prepared archive STATE.md")
-    events = (
-        "archive preflight passed; shipment recorded",
-        "archive preflight passed; shipment recorded; program complete",
-    )
     rendered_states = []
-    for event in events:
+    for event in SHIPMENT_EVENTS:
         try:
             _, _, rendered = _render_transition(
                 prepared,
@@ -679,14 +780,15 @@ def _member_undo_parent(repo: Path, member: str, landing: str) -> str:
     bound = entry["branch"]
     if _run_git(checkout, "rev-parse", f"refs/heads/{bound}").stdout.strip() != landing:
         raise UndoError(f"member {member} {bound} moved past this landing")
-    _require_member_unpublished(checkout, member, landing, bound)
+    _require_member_unpublished(repo, checkout, member, landing, bound)
     return _run_git(checkout, "rev-parse", f"{landing}^").stdout.strip()
 
 
-def _require_member_unpublished(checkout: Path, member: str, landing: str, bound: str) -> None:
-    for ref, where in (("refs/remotes/origin/main", "origin/main"), (f"refs/remotes/origin/{bound}", f"origin/{bound}")):
+def _require_member_unpublished(repo: Path, checkout: Path, member: str, landing: str, bound: str) -> None:
+    for branch in (isolation.member_default_branch(repo, member), bound):
+        ref = f"refs/remotes/origin/{branch}"
         if _run_git(checkout, "merge-base", "--is-ancestor", landing, ref, check=False).returncode == 0:
-            raise UndoError(f"member {member} landing is already on {where}")
+            raise UndoError(f"member {member} landing is already on origin/{branch}")
 
 
 def _require_no_member_landing_journal(repo: Path) -> None:
@@ -701,7 +803,7 @@ def _undo_member_landing(repo: Path, transaction: dict[str, object]) -> None:
     checkout, _, entry = isolation._member_context(repo, member)
     tip = _run_git(checkout, "rev-parse", f"refs/heads/{entry['branch']}").stdout.strip()
     if tip == transaction["member_parent"]:
-        _require_member_unpublished(checkout, member, str(transaction["landing"]), entry["branch"])
+        _require_member_unpublished(repo, checkout, member, str(transaction["landing"]), entry["branch"])
         return
     if tip != transaction["landing"]:
         raise UndoError(f"member {member} bound branch moved during undo")
@@ -768,7 +870,7 @@ def classify_undo(repo: Path) -> dict[str, object]:
             [f"an in-progress helper journal exists ({names}); resume that transaction first"]
         )
     if git.get("ancestor_of_origin_main"):
-        return _blocked(["HEAD is an ancestor of origin/main; undo would rewrite shipped history"])
+        return _blocked(["HEAD is an ancestor of the origin default branch; undo would rewrite shipped history"])
 
     product = _product_dirty(dirty)
     if product:
@@ -988,7 +1090,7 @@ def _require_unpublished_reset(repo: Path, expected_branch: str) -> None:
     if git.get("published"):
         raise UndoError("HEAD became published on its recorded remote branch")
     if git.get("ancestor_of_origin_main"):
-        raise UndoError("HEAD became published through origin/main")
+        raise UndoError("HEAD became published through the origin default branch")
 
 
 def _remove_untracked_tree(repo: Path, relative: str) -> None:

package/scripts/promote_lookahead.py

@@ -198,10 +198,10 @@ def select_fetched_base(
     use_lookahead: bool,
 ) -> dict:
     root = repo.resolve()
-    if not re.fullmatch(r"origin/[A-Za-z0-9][A-Za-z0-9._/-]*", remote_default):
+    if not remote_default.startswith("origin/") or not _common.valid_default_branch(
+        remote_default.removeprefix("origin/")
+    ):
         raise LookaheadError("remote default must be an origin branch")
-    if ".." in remote_default or "//" in remote_default:
-        raise LookaheadError("remote default is invalid")
     resolved = subprocess.run(
         ["git", "-C", str(root), "rev-parse", "--verify", f"{remote_default}^{{commit}}"],
         capture_output=True,

package/scripts/review_findings.py

@@ -8,20 +8,29 @@ canonical review files, and every skeptic file for this wave. It groups
 blocking findings by canonical criterion locator (`t001_ac2`, `sc3`,
 `t001_files`, `t001_interface_contract`), collapses true duplicate
 observations, selects the groups that need a skeptic, carries refutations
-forward across cycles, batches fix-task groups by disjoint file scope, keeps
-structural blockers out of skeptic accounting, and reports whether the cycle
-cap is reached. It never decides the wave verdict.
+forward across cycles, batches fix-task groups by repo and disjoint file
+scope, keeps structural blockers out of skeptic accounting, and reports
+whether the cycle cap is reached. It never decides the wave verdict.
 """
 
 from __future__ import annotations
 
 import argparse
+import functools
 import json
 import re
 import sys
+
+# Runtime helpers must not modify their immutable installation.
+sys.dont_write_bytecode = True
 from pathlib import Path
 from typing import Dict, List, Optional, Sequence
 
+try:
+    from . import _common
+except ImportError:  # installed standalone helper
+    import _common
+
 DEFAULT_PROJECT_DIR = ".project"
 DEFAULT_MAX_REVIEW_CYCLES = 3
 CONFIG_KEYS = ("max_review_cycles", "wave_budget", "review_panel", "finding_skeptics")
@@ -143,15 +152,25 @@ def _frontmatter_list(frontmatter: str, key: str) -> List[str]:
 
 
 def _numbered_items(section: Optional[str]) -> List[str]:
-    items: List[str] = []
+    """Numbered criteria; each also carries its text without sub-bullet markers (issue #392)."""
     if section is None:
-        return items
+        return []
+    bare = _numbered_texts(_common.without_sub_bullet_markers(section))
+    return [_common.Criterion(text, other) for text, other in zip(_numbered_texts(section), bare)]
+
+
+def _numbered_texts(section: str) -> List[str]:
+    items: List[str] = []
+    open_item = False
     for line in _strip_comments(section).splitlines():
         match = NUMBERED_ITEM.match(line.strip())
         if match:
             items.append(_normalize(match.group(2)))
-        elif items and line.startswith("   ") and line.strip():
+            open_item = True
+        elif open_item and line[:1].isspace() and line.strip():
             items[-1] = _normalize(items[-1] + " " + line.strip())
+        elif line.strip():
+            open_item = False
     return items
 
 
@@ -183,9 +202,11 @@ def load_wave_tasks(project: Path, wave: int) -> Dict[str, dict]:
         if not task_wave or int(task_wave.group(1)) != wave:
             continue
         body = parts[2]
+        member = re.search(r"(?m)^repo:[ \t]*(?P<name>[^\s#]+)", frontmatter)
         tasks[named.group("id")] = {
             "id": named.group("id"),
             "path": str(path),
+            "repo": member.group("name").strip("\"'") if member else None,  # None is the coordinator
             "files": _frontmatter_list(frontmatter, "files"),
             "acceptance": _numbered_items(_section(body, "Acceptance criteria")),
             "interface": [
@@ -270,17 +291,20 @@ def parse_lens(text: str, lens: str, tasks: Dict[str, dict]) -> dict:
                 continue
             zones[zone].append(line)
         for observation in _fail_items(zones["criteria"]):
-            criterion = _criterion_of(observation)
-            locator = None
-            if criterion in task["acceptance"]:
-                locator = f"{task_id.lower()}_ac{task['acceptance'].index(criterion) + 1}"
-            elif criterion in task["interface"]:
-                locator = f"{task_id.lower()}_interface_contract"
-            if locator is None:
+            # Issue #392: match as the wave gate does, then report the task's own text.
+            criteria = task["acceptance"] + task["interface"]
+            quoted = _common.quoted_criterion(observation, criteria)
+            if quoted is None:
                 problems.append(
-                    f"{lens} lens {task_id} finding names no task criterion: {criterion}"
+                    f"{lens} lens {task_id} finding names no task criterion: "
+                    f"{_criterion_of(observation)}"
                 )
                 continue
+            criterion = criteria[quoted[0]]
+            if quoted[0] < len(task["acceptance"]):
+                locator = f"{task_id.lower()}_ac{quoted[0] + 1}"
+            else:
+                locator = f"{task_id.lower()}_interface_contract"
             findings.append(
                 {"locator": locator, "criterion": criterion, "task": task_id,
                  "lens": lens, "observation": observation}
@@ -433,21 +457,27 @@ def _earlier_lens_locators(project: Path, wave: int, cycle: int, depth: str, tas
 
 
 def _fix_batches(groups: Sequence[dict], tasks: Dict[str, dict]) -> List[dict]:
-    """One batch per disjoint file scope: groups whose task files overlap share a batch."""
+    """One batch per repo and disjoint file scope: groups whose task files overlap in one repo share a batch.
+
+    A member batch names its `repo`; a coordinator batch has no such key.
+    """
 
     batches: List[dict] = []
     for group in groups:
-        files = sorted({path for task_id in group["tasks"] for path in tasks.get(task_id, {}).get("files", [])})
-        merged = {"locators": [group["locator"]], "files": files}
-        keep: List[dict] = []
-        for batch in batches:
-            if set(batch["files"]) & set(files):
-                merged["locators"] = batch["locators"] + merged["locators"]
-                merged["files"] = sorted(set(batch["files"]) | set(merged["files"]))
-            else:
-                keep.append(batch)
-        keep.append(merged)
-        batches = keep
+        owners = [tasks.get(task_id, {}) for task_id in group["tasks"]]
+        for repo in sorted({task.get("repo") or "" for task in owners}) or [""]:
+            files = sorted({path for task in owners if (task.get("repo") or "") == repo
+                            for path in task.get("files", [])})
+            merged = {"locators": [group["locator"]], "files": files, **({"repo": repo} if repo else {})}
+            keep: List[dict] = []
+            for batch in batches:
+                if batch.get("repo") == merged.get("repo") and _common.overlapping_paths(batch["files"], files):
+                    merged["locators"] = batch["locators"] + merged["locators"]
+                    merged["files"] = sorted(set(batch["files"]) | set(merged["files"]))
+                else:
+                    keep.append(batch)
+            keep.append(merged)
+            batches = keep
     return batches
 
 
@@ -604,7 +634,7 @@ def repair_evidence(repo: Path, project_dir: str, wave: int, cycle: int, task_id
         )["tasks"][0]
         if proof["verdict"] != "recovered":
             raise ReviewFindingsError("repair requires a proven landing")
-        base, commit = proof["base"], proof["commit"]
+        base = proof["base"]  # in the coordinator, where the source review is
         findings = _section(text, "Review findings") or ""
         headings = list(re.finditer(r"(?m)^### ([a-z0-9_]+)\s*$", findings))
         locators = [heading.group(1) for heading in headings]
@@ -613,10 +643,28 @@ def repair_evidence(repo: Path, project_dir: str, wave: int, cycle: int, task_id
         source = compute(repo, project_dir, wave, cycle)
         if source["structural_blockers"]:
             raise ReviewFindingsError("source findings have structural blockers")
+        member = fields.get("repo")  # a finding in two repos has one batch per repo with the same locators
         batches = [batch for batch in source["fix_batches"]
-                   if set(batch["locators"]) == set(locators)]
+                   if batch.get("repo") == member and set(batch["locators"]) == set(locators)]
         if len(batches) != 1:
             raise ReviewFindingsError("repair must carry one eligible source finding batch")
+        # A member task's product is in the member repository: its commits, its bound branch, its Verify rows.
+        where, tip = repo, []  # the coordinator product is judged in the working tree
+        if member:
+            where, _, lock = isolation._member_context(repo, member)
+            tip = [f"refs/heads/{lock['branch']}"]
+
+        def entry(landing: dict, path: Path, paths: List[str]) -> dict:
+            """A proven landing as the receipt shows it; a member landing adds its commits in the member."""
+            item = {"task": landing["task_id"], "base": landing["base"], "commit": landing["commit"], "files": paths}
+            if member:
+                item.update(member_base=isolation.task_frontmatter(_read(path, "task"))[0]["member_base"],
+                            member_commit=landing["landing"])
+            return item
+
+        def at(item: dict, point: str = "commit") -> str:
+            return item.get(f"member_{point}", item[point])
+
         groups = [group for group in source["groups"] if group["locator"] in locators]
         for index, heading in enumerate(headings):
             end = headings[index + 1].start() if index + 1 < len(headings) else len(findings)
@@ -627,22 +675,101 @@ def repair_evidence(repo: Path, project_dir: str, wave: int, cycle: int, task_id
                 raise ReviewFindingsError("repair does not carry the exact criterion and observations")
         frontmatter = text.split("---", 2)[1]
         files = _frontmatter_list(frontmatter, "files")
-        originals = sorted({task for group in groups for task in group["tasks"]})
+        sources = load_wave_tasks(project, wave)
+        originals = sorted({task for group in groups for task in group["tasks"] if sources[task]["repo"] == member})
+        # A repair names the files it needs. They can be fewer than the batch files, and a plan repair
+        # can add a fix site that the source tasks did not declare.
         if (task_id in originals or not set(originals) <= set(_frontmatter_list(frontmatter, "deps"))
-                or set(files) != set(batches[0]["files"])):
+                or not files):
             raise ReviewFindingsError("repair dependencies/files do not match its source batch")
-        sources = load_wave_tasks(project, wave)
+        repair = {"task_file": repair_path.relative_to(repo).as_posix(), **entry(proof, repair_path, files),
+                  **({"member": member} if member else {})}
+
+        def differ(start: str, end: List[str], paths: List[str]) -> bool:
+            return bool(isolation.run_git(where, "diff", "--quiet", start, *end, "--", *paths).returncode)
+
+        def before(start: str, end: str) -> bool:
+            return not isolation.run_git(where, "merge-base", "--is-ancestor", start, end).returncode
+
+        @functools.lru_cache(maxsize=None)
+        def linked() -> tuple:
+            """Landed repairs of the same findings that `deps` join to this repair, in landing order.
+
+            A linked task is done, is in the same repo, carries a finding of this repair in its
+            `## Review findings`, and depends on this repair or on a linked task, or the reverse.
+            """
+            tasks, carried = {task_id: (repair_path, fields)}, {}
+            for path in (project / "tasks").glob("T*-*.md"):
+                other = _read(path, "task")
+                other_fields = isolation.task_frontmatter(other)[0] or {}
+                tasks[str(other_fields.get("id"))] = (path, other_fields)
+                blocks = re.split(r"(?m)^### ([a-z0-9_]+)\s*$", _section(other, "Review findings") or "")
+                carried[str(other_fields.get("id"))] = {
+                    (locator, _normalize(line)) for locator, block in zip(blocks[1::2], blocks[2::2])
+                    for line in re.findall(r"(?m)^Criterion:(.*)$", block)}
+
+            def traced(finding: tuple, seen: frozenset = frozenset()) -> set:
+                """The finding as it started: its locator and criterion in the review of the source tasks.
+
+                A finding on an acceptance criterion of a fix task (`fix-tasks` copies the carried criteria
+                there) is the finding with the same criterion that this fix task carries. Two findings with
+                the same criterion text and other locators stay two findings.
+                """
+                owner = re.fullmatch(r"t(\d{3})_ac\d+", finding[0])
+                sources = () if not owner else {
+                    item for item in carried.get(f"T{owner.group(1)}", ()) if item[1] == finding[1]} - seen
+                return {origin for item in sources for origin in traced(item, seen | {finding})} or {finding}
+
+            def origins(other: str) -> set:
+                return {origin for finding in carried.get(other, ()) for origin in traced(finding)}
+
+            repairs = {other: task for other, task in tasks.items() if other == task_id or (
+                task[1].get("status") == "done" and task[1].get("repo") == member
+                and origins(task_id) & origins(other))}
+            joined, more = set(), {task_id}
+            while more:
+                joined |= more
+                more = {other for other, (_, other_fields) in repairs.items() if other not in joined and (
+                    joined & set(other_fields.get("deps") or [])
+                    or any(other in (repairs[item][1].get("deps") or []) for item in joined))}
+            others = sorted(joined - {task_id})
+            proofs = isolation.verify_landed_task_files(
+                repo, [repairs[other][0] for other in others], f"{project_dir}/tasks", head)["tasks"] if others else []
+            links = []
+            for landing in proofs:
+                path, other_fields = repairs[landing["task_id"]]
+                if landing["verdict"] == "recovered":
+                    links.append({"task_file": path.relative_to(repo).as_posix(),
+                                  **entry(landing, path, list(other_fields.get("files") or []))})
+            return tuple(sorted(links, key=lambda link: int(isolation.git_output(where, "rev-list", "--count", at(link)))))
+
+        def linked_changes(start: str, end: List[str], paths: List[str]) -> Optional[List[dict]]:
+            """The linked repairs whose landings are every change to `paths` from `start` to `end`, else None."""
+            if not differ(start, end, paths):
+                return []
+            links = [link for link in linked()
+                     if before(start, f"{at(link)}^") and (not end or before(at(link), end[0]))]
+            for link in links:
+                if differ(start, [f"{at(link)}^"], paths):
+                    return None
+                start = at(link)
+            return None if differ(start, end, paths) else links
+
         original_paths = [Path(sources[task]["path"]) for task in originals]
         original_proofs = isolation.verify_landed_task_files(
             repo, original_paths, f"{project_dir}/tasks", head
         )["tasks"]
-        for original in original_proofs:
-            original_id = original["task_id"]
-            if (original["verdict"] != "recovered"
-                    or isolation.run_git(repo, "merge-base", "--is-ancestor", original["commit"], base).returncode
-                    or isolation.run_git(repo, "diff", "--quiet", original["commit"], base,
-                                         "--", *sources[original_id]["files"]).returncode):
+        landed, earlier = [], set()
+        for landing in original_proofs:
+            links = None
+            if landing["verdict"] == "recovered":
+                original = entry(landing, Path(sources[landing["task_id"]]["path"]), sources[landing["task_id"]]["files"])
+                if before(at(original), at(repair, "base")):
+                    links = linked_changes(at(original), [at(repair, "base")], original["files"])
+            if links is None:
                 raise ReviewFindingsError("repair base contains unlinked changes to original product")
+            landed.append(original)
+            earlier.update(link["task"] for link in links)
         source_paths = list(review_paths(project, wave, cycle, source["depth"]).values())
         source_paths.extend(Path(group["skeptic"]["path"]) for group in groups if group["skeptic"])
         for path in set(source_paths):
@@ -650,19 +777,28 @@ def repair_evidence(repo: Path, project_dir: str, wave: int, cycle: int, task_id
             at_base = isolation.run_git(repo, "show", f"{base}:{relative}")
             if at_base.returncode or at_base.stdout != _read(path, "source review"):
                 raise ReviewFindingsError("source review must be unchanged and precede the repair")
-        verification = build_state.verify_lookup(str(repo), _common.task_verify_command(text), commit)
+        # A later linked repair supersedes this one: the last one is the product at the tip, and its
+        # landing and its Verify are the evidence. The reviewer applies every patch of the chain, so the
+        # files of every later linked repair must also change only through the landings of the chain.
+        later = linked_changes(at(repair), tip, files)
+        chain_files = sorted({*files, *(path for link in later or [] for path in link["files"])})
+        last = later[-1] if later else repair
+        verification = build_state.verify_lookup(
+            str(repo), _common.task_verify_command(_read(repo / last["task_file"], "repair task")), at(last), member)
         if not verification["reuse"]:
             raise ReviewFindingsError("repair has no reusable passing Verify at its landing")
-        if isolation.run_git(repo, "diff", "--quiet", commit, "--", *files).returncode:
+        if later is None or (later and linked_changes(at(repair), tip, chain_files) is None):
             raise ReviewFindingsError("product changed after the repair landing")
+        # A parallel landing can have a parent that is newer than the repair base. The reviewer builds the
+        # product from the base, so no other landing between the two can change a file of the chain.
+        if differ(at(repair, "base"), [f"{at(repair)}^"], chain_files):
+            raise ReviewFindingsError("product changed between the repair base and the repair landing")
         return {
             "status": "ok", "command": "repair-evidence", "head": head,
             "source": {"wave": wave, "cycle": cycle}, "groups": groups,
-            "originals": [{"task": item["task_id"], "base": item["base"],
-                           "commit": item["commit"], "files": sources[item["task_id"]]["files"]}
-                          for item in original_proofs],
-            "repair": {"task": task_id, "task_file": repair_path.relative_to(repo).as_posix(),
-                       "base": base, "commit": commit, "files": files},
+            "originals": landed, "repair": repair,
+            **({"earlier_repairs": [link for link in linked() if link["task"] in earlier]} if earlier else {}),
+            **({"later_repairs": later, "chain_files": chain_files} if later else {}),
             "verification": verification,
             "verdict": "evidence-ready; reviewer judges the original unchanged criteria",
         }

package/scripts/roadmap.py

@@ -252,7 +252,12 @@ def activate_milestone(text: str, milestone: str) -> str:
     return "".join(lines)
 
 
-def reslice(before: str, candidate: str, phase: str, selected: str) -> str:
+def _entry_identity(block: dict) -> tuple:
+    """Heading, Status, Depends on, Archive and Integrated of one entry."""
+    return block["id"], block["title"], {name: value for name, (_, value) in block["fields"].items()}
+
+
+def reslice(before: str, candidate: str, phase: str, selected: str, amend_active: bool = False) -> str:
     old_blocks = roadmap_blocks(before)
     before_lines = before.splitlines(keepends=True)
     candidate_lines = candidate.splitlines(keepends=True)
@@ -264,6 +269,9 @@ def reslice(before: str, candidate: str, phase: str, selected: str) -> str:
         new = milestone_block(candidate, slug)
         if status == "shipped":
             changed = roadmap_contract(before, slug) != roadmap_contract(candidate, slug)
+        elif status == "active" and amend_active:
+            # Intent is not approved: the scope may change, the identity may not.
+            changed = _entry_identity(block) != _entry_identity(new)
         else:
             changed = before_lines[block["start"]:block["end"]] != candidate_lines[new["start"]:new["end"]]
         if changed:

package/scripts/runtime_store.py

@@ -24,9 +24,19 @@ RUNTIME_FILES = (
     "state_checkpoint.py", "state_promote.py", "discussion_validate.py", "integration.py",
     "build_state.py", "lean_verification.py", "check_docs_audit.py",
     "path_config.py", "model_policy.py", "loop_run.py", "members.py",
+    "review_findings.py", "task_context.py",
 )
 GUARDS = ("guard_hook.py", "git_guard.py")
 
+# Optional owner-recorded provenance on .gsd-path/runtime.json declarations,
+# e.g. {"source": "<npm version or package id>", "patch_ref": "<commit sha
+# or patch list>", "note": "<owner label>"}. Provenance is display/audit
+# metadata ONLY: it never joins the hashed manifest input (manifest_digest
+# covers exactly {"version", "files"}), never acts as an alternate accepted
+# digest, and never bypasses or weakens validate_runtime. A declaration
+# without provenance is stock and stays exactly as valid as one with it.
+PROVENANCE_KEYS = ("source", "patch_ref", "note")
+
 # Access denied and sharing violation: on Windows a scanner or indexer that
 # briefly opens a freshly written file blocks renaming the directory holding it.
 _WINDOWS_BUSY_ERRORS = (5, 32)
@@ -220,7 +230,7 @@ def recover_migration(project):
     journal.unlink()
 
 
-def operate(source, project, action, *, dry_run=False):
+def operate(source, project, action, *, dry_run=False, provenance=None):
     if project.is_symlink() or (project / ".gsd-path").is_symlink():
         raise ValueError("unsafe project runtime directory")
     if action == "restore":
@@ -228,8 +238,17 @@ def operate(source, project, action, *, dry_run=False):
         publish(source, expected=pin, dry_run=dry_run, repair=True)
         return pin
     if action == "upgrade":
-        status_runtime.declaration(project)
+        previous = status_runtime.declaration(project)
         pin = publish(source, dry_run=dry_run)
+        # Explicit provenance replaces the recorded object. Without new flags,
+        # an existing entry carries forward only while the pinned digest is
+        # unchanged — a different source drops stale hotfix metadata instead
+        # of stamping it onto bytes it no longer describes. Metadata only —
+        # it never changes the pinned digest.
+        if provenance is None and previous.get("digest") == pin["digest"]:
+            provenance = previous.get("provenance")
+        if provenance:
+            pin = {**pin, "provenance": provenance}
         if not dry_run:
             launcher = project / ".gsd-path/status_runtime.py"
             # Exact bytes: read_text() would turn CRLF into LF, leaving the