@opengsd/gsd-path 1.6.0 → 1.6.2

package/AGENTS.md

@@ -139,7 +139,7 @@ full-repo suite on a tiny edit outrank the phase brief.
   canonical contents, carry-forward, and manifest pass the bundled precommit
   validator; report shipped only after the exact `.project/`-only ship commit
   passes the postcommit validator and `validate-integrated` proves the
-  two-parent integration merge, its tag, and its ancestry on origin/main —
+  integration landing, its tag, and its ancestry on origin/main —
   while integration is pending the router routes back to ship instead of
   reporting shipped or starting the next milestone.
 

package/CHANGELOG.md

@@ -11,6 +11,50 @@ app and the daemon have their own file,
 [daemon/app/CHANGELOG.md](daemon/app/CHANGELOG.md). Release bookkeeping and
 test-only changes are not listed; the Git history has them.
 
+## [1.6.2] - 2026-10-17
+
+### Changed
+- record 1.6.2 live host release evidence
+- prepare 1.6.2 patch candidate
+- Document README What's new heading in RELEASE.md
+- update release notes for v1.6.1
+
+### Fixed
+- keep the README What's new section current from release notes
+- read quoted STATE values in the ship checkpoint guard
+- refuse a build checkpoint while STATE is ship/active
+- keep evidence-line citations when final review reuses a wave
+## [1.6.1] - 2026-10-16
+
+### Added
+- accept GitHub rebase merges in pull-request integration
+
+### Changed
+- record 1.6.1 live host release evidence
+- prepare 1.6.1 patch candidate
+- Note PR rebase-merge landing in CONTEXT, WORKFLOW, AGENTS
+- Note owner-authorized push exception in FULL.md and HOOKS.md
+- correct the minimum Git version in TEST_ENVIRONMENT.md
+- prove the landed member base through the file scope check
+- describe project Update with no project install
+- update release notes for v1.6.0
+
+### Fixed
+- run dispatch_driver subprocess helpers from the selected runtime
+- refuse a relative model_policy --record and check release before locking
+- let promote-next replace a DOCS-AUDIT carry-forward the lookahead keeps
+- let the owner authorize one exact pre-ship push to a task branch
+- post Discord changelogs from automated releases
+- stage a landing or checkpoint change set with one git add
+- pass the landing message and member paths to git through stdin
+- do not check the paths that a landed task brief names
+- accept a landed task as the only owner of an Interface contract bullet
+- say why a project has no workflow status in the desktop app
+
+### Other
+- Accept only same value or T### for pending rulings
+- list not-started projects and re-probe after project install
+- sort idle projects with shipped in legacy dashboard
 ## [1.6.0] - 2026-10-12
 
 ### Added

package/FULL.md

@@ -322,9 +322,9 @@ approve **Archive and ship**, the archive transaction begins:
 - `MANIFEST.md` records contents and ship metadata
 - One **ship commit** (subject `ship: M00N — <slug>`) touches only `.project/`
 - Ship then either merges `gsd-path/M00N` onto `main` directly or opens a
-  GitHub PR and waits for you to merge it with a merge commit. Path-created PRs
-  include a GSD Path credit footer.
-- After the two-parent merge validates, Path tags `milestone/<NNN>-<slug>`
+  GitHub PR and waits for you to merge it with a merge commit or a rebase
+  merge. Path-created PRs include a GSD Path credit footer.
+- After the landing validates, Path tags `milestone/<NNN>-<slug>`
 - Archives are **read-only** — guard hooks enforce this if installed
 
 Direct integration is the project default. Before build, ask the router to set
@@ -454,7 +454,8 @@ approves.
 - You cannot share a milestone in progress through the remote. With
   [guard hooks](HOOKS.md) installed, the pre-push hook refuses `gsd-path/M00N`
   before its ship commit. It also refuses any other branch that carries the
-  unfinished state. Hooks are optional and local to each clone. A clone
+  unfinished state, unless the owner authorizes that exact commit (see
+  [HOOKS.md](HOOKS.md)). Hooks are optional and local to each clone. A clone
   without hooks has no such check.
 
 **Do not**

package/HOOKS.md

@@ -351,6 +351,22 @@ such as `rm -rf scratch` passes the archive check; other guard rules still apply
   without `STATE.md` passes on an ordinary ref. An absent bound ref passes
   deletion. The authorized publisher is `archive_milestone.py integrate`;
   the hook checks ref updates, not which client initiated them
+- **allows** an owner-approved push of unshipped work, such as a task
+  branch that CI must measure before the task can finish. The owner records
+  the exact commit for the exact branch, then pushes it:
+
+  ```bash
+  git update-ref refs/gsd-path/authorizations/<project>/push/refs/heads/<branch> <commit>
+  ```
+
+  `<project>` is the `project` field in that commit's `STATE.md`. The hook
+  accepts the push only at that commit; a later commit, such as one that
+  removes the measurement inputs, needs its own record. Bound `gsd-path/M###`
+  refs, the default branch, and tags never accept an authorization. The
+  authorization accepts every push of that commit to that branch until the
+  owner removes it with `git update-ref -d <same ref>`. Deleting the remote
+  branch afterwards needs no authorization. Only the owner records an
+  authorization; an agent asks the owner for one
 - **allows** adding files to archive during the ship transaction, before the
   branch closes
 
@@ -358,8 +374,8 @@ These local hooks cover pushes made by plain Git and clients that invoke
 Git with hooks enabled. Creating a PR from an already published ref does not
 run the pre-push hook. A branch cut from `main` carrying `shipped/done` passes;
 if `main` instead carries an unshipped bound state, pushes of branches carrying
-that state remain blocked until the milestone records are repaired through the
-pipeline.
+that state remain blocked, except owner-authorized commits, until the
+milestone records are repaired through the pipeline.
 
 ## GitHub-side gate
 

package/QUICK.md

@@ -14,7 +14,7 @@ One router skill drives a gated pipeline: inspect → define → research → de
 plan → build → ship. Every handoff lives in `.project/` so any session can resume from disk.
 
 **Hosts:** Codex, Claude Code, Grok, OpenCode, Antigravity, Cursor, and Kimi
-Code have a passing live milestone for release 1.6.0. Copilot CLI, Qwen, Zed,
+Code have a passing live milestone for release 1.6.2. Copilot CLI, Qwen, Zed,
 Kiro, and Muse Code install, but have no live milestone for that release. See
 [host tiers](README.md).
 

package/README.md

@@ -9,11 +9,11 @@ milestone loop. While a milestone builds, the next one can be planned in
 parallel under `.project/next/` (lookahead); a building milestone can also be
 abandoned on an explicit ruling, archiving its partial work for a re-slice.
 
-**Hosts with a passing full live milestone for release 1.6.0:** Codex, Claude
+**Hosts with a passing full live milestone for release 1.6.2:** Codex, Claude
 Code, Grok, OpenCode, Antigravity CLI, Cursor, and Kimi Code.
 
 **Hosts with an installer and a dispatch contract, but no live milestone for
-release 1.6.0:** GitHub Copilot CLI (account quota exhausted), Qwen Code, Zed,
+release 1.6.2:** GitHub Copilot CLI (account quota exhausted), Qwen Code, Zed,
 and Kiro (API credits), and Muse Code (no live release evidence recorded yet).
 These hosts are excluded from the release evaluation. Exclusion is not a pass.
 
@@ -24,14 +24,16 @@ The [host trust matrix](https://github.com/open-gsd/gsd-path/blob/main/docs/trus
 is the source of truth for live milestone proof and each host's guard tier.
 
 <!-- release-docs -->
-**Latest npm release:** [@opengsd/gsd-path@1.6.0](https://www.npmjs.com/package/@opengsd/gsd-path/v/1.6.0) — [release notes](CHANGELOG.md#160---2026-10-12)
+## What's new in 1.6.2 — 2026-10-17
+
+**Latest npm release:** [@opengsd/gsd-path@1.6.2](https://www.npmjs.com/package/@opengsd/gsd-path/v/1.6.2) — [release notes](CHANGELOG.md#162---2026-10-17)
 
 **Recent highlights**
-- let a later task supersede an earlier task and retire its Verify
-- document the default branch record of a member
-- member paths read the default branch that MEMBERS.md records
-- record the default branch of a member in MEMBERS.md
-- add --uninstall to the skill installers
+- keep the README What's new section current from release notes
+- read quoted STATE values in the ship checkpoint guard
+- refuse a build checkpoint while STATE is ship/active
+- keep evidence-line citations when final review reuses a wave
+- record 1.6.2 live host release evidence
 
 <!-- /release-docs -->
 
@@ -55,25 +57,6 @@ is the source of truth for live milestone proof and each host's guard tier.
 | [RELEASE.md](RELEASE.md) | Maintainer CI and npm release cycle |
 | [GUIDE.md](GUIDE.md) | Pointer to the guides above |
 
-## What's new — October 2, 2026
-
-These changes are merged into the source checkout; npm installs use the latest
-published release.
-
-- **Desktop app (pre-release):** one app for macOS, Windows, and Linux shows
-  your projects, manages skills in each coding agent, and updates itself. See
-  [Desktop app](#desktop-app).
-- **Skills from the published release:** the monitor installs skills from the
-  npm release, checks the download against the registry's sha512, and refuses
-  one that does not match. A release picker lets you stay on an older version.
-- **Safer monitor writes:** a monitor started by the app accepts changes only
-  with the app's local token, so another web page cannot change your setup.
-- **Environment editor:** edit a project's `.env` files with values masked and
-  a diff before each save.
-- **Usage charts:** tokens and cost per day, time per phase, tasks per wave,
-  and verify history. Missing data shows as missing, never as zero.
-- **Muse Code** is a supported host.
-
 ## Install from npm
 
 Requires **Node.js 18.17+** for the npm installer and **Python 3.9+** for
@@ -465,7 +448,8 @@ an atomic close across repos.
 Shipping moves milestone artifacts into `archive/` with a MANIFEST. It then
 either merges the milestone's `gsd-path/M00N` branch into `main` directly or
 opens/reuses a GitHub PR and waits for its user-controlled merge. Path reports
-shipped only after a two-parent merge and the milestone tag validate. Before
+shipped only after the landing (a two-parent merge, or a proven GitHub rebase
+merge of the PR) and the milestone tag validate. Before
 any next-milestone files change, the router binds
 a new `gsd-path/M00N` at the updated `origin/main`. `STATE.md`, `REPOSITORY.md`,
 `LESSONS.md`, `next/`, and the program artifacts (`CHARTER.md`, `ROADMAP.md`,

package/WORKFLOW.md

@@ -513,7 +513,11 @@ untouched.
 One exception: a DOCS-AUDIT.md with pending `planned: no` rulings is copied
 atomically back into a recreated `research/` so the alignment queue survives;
 the archived original keeps full history. Active and archived research may
-coexist only for that byte-identical carry-forward.
+coexist only for that byte-identical carry-forward. When a lookahead track
+brings its own `research/`, `promote-next` removes the carry-forward in the
+promotion commit, but only if the lookahead DOCS-AUDIT.md keeps every
+carry-forward ruling (a pending row may gain a `T###`); otherwise promotion
+stops.
 
 Archives become read-only when committed. No phase may modify a committed
 archive; the next milestone's inspection may read it. A retry with a persisted
@@ -612,9 +616,9 @@ and requires the remote default to be the recorded
 - `pull-request` requires `gh` authentication for GitHub.com and a GitHub.com
   origin. Path publishes the exact ship commit and creates or reuses the one
   eligible PR to `main` with a GSD Path credit footer. It returns
-  `awaiting-merge` until a human GitHub user merges it with a merge commit; Path
-  never enables auto-merge or merges the PR. After validation, Path creates the
-  annotated milestone tag. The [ship contract](skills/gsd-path-ship/SKILL.md)
+  `awaiting-merge` until a human GitHub user merges it with a merge commit or a
+  rebase merge; Path never enables auto-merge or merges the PR. After
+  validation, Path creates the annotated milestone tag. The [ship contract](skills/gsd-path-ship/SKILL.md)
   owns the candidate, provenance, topology, publication, and recovery rules.
 - `external-landing` is for an origin that is not GitHub.com, such as GitLab,
   Gitea, or GitHub Enterprise Server, where a merge request is the only route

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@opengsd/gsd-path",
-  "version": "1.6.0",
+  "version": "1.6.2",
   "description": "Disk-backed AI agent pipeline. Docs: DOCS.md (start here), QUICK.md, FULL.md, UPDATE.md",
   "license": "MIT",
   "repository": {

package/scripts/_common.py

@@ -361,6 +361,49 @@ def run_git(
     return _run_exact(git_command(repo, *arguments), input=input)
 
 
+def _patch_ids(repo: Path, commits: Sequence[str]) -> list[Optional[str]]:
+    """`git patch-id --stable` per commit, in order; None for an empty commit."""
+    log = run_git(repo, "log", "--no-walk=unsorted", "-p", "--binary", "--no-color",
+                  "--no-ext-diff", *commits)
+    if log.returncode != 0:
+        raise ValueError("could not read commit patches")
+    ids = run_git(repo, "patch-id", "--stable", input=log.stdout)
+    if ids.returncode != 0:
+        raise ValueError("could not compute patch ids")
+    by_commit = {commit: patch for patch, commit in (line.split() for line in ids.stdout.splitlines())}
+    return [by_commit.get(commit) for commit in commits]
+
+
+def rebase_landing_problem(repo: Path, ship: str, landing: str) -> Optional[str]:
+    """Why landing is not a forge rebase merge of ship, or None when it is (#418).
+
+    A rebase merge replays ship's own commits onto the default branch. Proof:
+    the first-parent run that ends at landing has one non-merge commit per
+    non-merge commit of landing..ship, with equal patch ids in the same order;
+    when that run starts at ship's fork point, landing's tree equals ship's.
+    """
+    listed = run_git(repo, "rev-list", "--reverse", "--topo-order", "--no-merges", f"{landing}..{ship}")
+    if listed.returncode != 0:
+        return "could not list the ship commits"
+    originals = listed.stdout.split()
+    if not originals:
+        return "landing already contains the ship commit"
+    walked = run_git(repo, "rev-list", "--first-parent", "--parents", "-n", str(len(originals)), landing)
+    rows = [line.split() for line in walked.stdout.splitlines()][::-1]
+    if walked.returncode != 0 or len(rows) != len(originals) or any(len(row) != 2 for row in rows):
+        return "landing is not a linear run of rebased commits"
+    try:
+        if _patch_ids(repo, originals) != _patch_ids(repo, [row[0] for row in rows]):
+            return "rebased commits do not replay the ship commits in order"
+    except ValueError as error:
+        return str(error)
+    fork = run_git(repo, "merge-base", ship, landing).stdout.strip()
+    trees = run_git(repo, "rev-parse", f"{ship}^{{tree}}", f"{landing}^{{tree}}").stdout.split()
+    if rows[0][1] == fork and (len(trees) != 2 or trees[0] != trees[1]):
+        return "rebased tree differs from the ship tree"
+    return None
+
+
 def git_command(repo: Path, *arguments: str) -> tuple[str, ...]:
     """Git argv for repo, including WSL drvfs workarounds when needed."""
     return ("git", "-C", str(repo), *git_drvfs_config_flags(repo), *arguments)

package/scripts/check_task_briefs.py

@@ -387,7 +387,9 @@ def _lint_task(
                     )
                     break
 
-    for name in PROSE_SECTIONS:
+    # A landed brief is history that nobody can edit: only an unlanded brief must name present paths.
+    landed = task_id in (landed_bases or {})
+    for name in () if landed else PROSE_SECTIONS:
         body = sections.get(name)
         if body is None or not _clean(body):
             continue
@@ -400,8 +402,6 @@ def _lint_task(
                 and token not in supplied
                 and not _supplied_contract(repo, path, token)
                 and not _pipeline_workspace_file(repo, path, token)
-                # A landed brief is history: the pipeline moves its own files (build recovery, archive) later.
-                and not (task_id in (landed_bases or {}) and _pipeline_workspace_path(repo, path, token))
                 and not _base_exists(git_root, base, token)
             ):
                 problems.append(f"## {name} names a path missing at the layer base: {token}")
@@ -411,7 +411,7 @@ def _lint_task(
         block = VERIFY_BLOCK_PATTERN.search(verify_body)
         if block is None or not block.group("block").strip():
             problems.append("## Verify must contain a non-empty fenced bash block")
-        else:
+        elif not landed:
             for token in _verify_tokens(
                 block.group("block"),
                 repo=repo,
@@ -448,9 +448,10 @@ def validate_task_briefs(
 
     Plain lint uses the layer base without overrides. Plan approval and dispatch
     supply transitive dependency files for unlanded tasks and resolved historical
-    bases for landed tasks, whose immutable briefs must survive later file changes.
+    bases for landed tasks. A landed brief is immutable: its `files` scope is
+    checked at that base, and the paths its prose and Verify name are not checked.
     The caller validates the task graph and landed metadata before supplying
-    these mappings; landed tasks receive no dependency-file allowance.
+    these mappings.
     """
 
     resolved_base = _resolve_base(root, base)
@@ -481,6 +482,9 @@ def validate_task_briefs(
     for shape, task_ids in contracts.items():
         if len(task_ids) == 1:
             task_id = next(iter(task_ids))
+            # A landed brief is history: a later repair may reword the bullet in its partner.
+            if task_id in (landed_bases or {}):
+                continue
             problems.append(
                 f"{task_id}: interface contract is not shared by any other task: {shape}"
             )
@@ -592,7 +596,6 @@ def plan_validation_bases(
                 )
             except IsolationError as error:
                 raise BriefError(f"{task_id} landed task has invalid historical base: {error}") from error
-            dependency_files[task_id] = set()
     except check_handoffs.HandoffError as error:
         raise BriefError(str(error)) from error
     return tasks, dependency_files, landed_bases

package/scripts/dispatch_driver.py

@@ -117,9 +117,21 @@ def _refresh_stop_errors() -> None:
                    model_policy.PolicyError)
 
 
+# The selected Project runtime directory once _reload_pinned_modules ran; None keeps bundled helpers.
+_RUNTIME_ROOT: Optional[Path] = None
+
+
+def helper_script(name: str) -> Path:
+    """A subprocess helper from the selected runtime when it ships one, else the bundled sibling."""
+    if _RUNTIME_ROOT is not None and (_RUNTIME_ROOT / name).is_file():
+        return _RUNTIME_ROOT / name
+    return Path(__file__).resolve().parent / name
+
+
 def _reload_pinned_modules(runtime_root: Path) -> None:
     global isolation, build_state, task_context, contracts, pipeline_state
-    global archive_milestone, review_findings, model_policy
+    global archive_milestone, review_findings, model_policy, _RUNTIME_ROOT
+    _RUNTIME_ROOT = runtime_root
     if _bundled_helpers():
         path = str(runtime_root)
         if path not in sys.path:
@@ -981,7 +993,7 @@ class Round:
                 diagnose = shlex.join([
                     sys.executable,
                     "-B",
-                    str(Path(__file__).with_name("pipeline_diagnose.py")),
+                    str(helper_script("pipeline_diagnose.py")),
                     "diagnose",
                     "--repo",
                     str(self.primary),
@@ -1677,8 +1689,8 @@ class Review:
 
 
 def helper_json(receipt: Dict[str, object], script: str, *arguments: str, cwd: Path) -> Dict[str, object]:
-    """Run a bundled helper and return its JSON stdout; a non-zero exit is a typed stop."""
-    command = [sys.executable, "-B", str(Path(__file__).resolve().parent / script), *arguments]
+    """Run a helper (runtime-selected, else bundled) and return its JSON stdout; a non-zero exit is a typed stop."""
+    command = [sys.executable, "-B", str(helper_script(script)), *arguments]
     completed = subprocess.run(command, cwd=cwd, capture_output=True, encoding="utf-8", errors="replace")
     step = {"script": script, "command": command, "exit_code": completed.returncode,
             "stdout": completed.stdout, "stderr": completed.stderr}
@@ -2290,7 +2302,7 @@ Heavy: {'yes' if heavy else 'no'}
         if plan_changed:
             _common.atomic_write(plan_path, updated)
         receipt["plan_wave"] = fix_wave
-        lint = subprocess.run([sys.executable, "-B", str(Path(__file__).resolve().parent / "check_task_briefs.py"),
+        lint = subprocess.run([sys.executable, "-B", str(helper_script("check_task_briefs.py")),
                                "--repo", str(primary), "--base", isolation.current_sha(primary),
                                "--tasks-dir", f"{options.project_dir}/tasks",
                                "--project-dir", options.project_dir], capture_output=True, encoding="utf-8", errors="replace")

package/scripts/git_guard.py

@@ -69,6 +69,11 @@ PUBLICATION_HINT = (
     "(STATE shipped/done) through archive_milestone.py integrate; findings during "
     "ship reopen through the patch plan (see SHIP.md)"
 )
+AUTHORIZED_PUSH_HINT = (
+    "an owner-approved push of one exact commit to a branch other than the bound "
+    "or default branch needs refs/gsd-path/authorizations/<project>/push/<ref> "
+    "at that commit (see HOOKS.md)"
+)
 LEGACY_STATE_FIELDS = {
     "pipeline",
     "project",
@@ -621,14 +626,25 @@ def pre_push_violations(lines):
             continue
         state = state_at(local_sha)
         owed = unshipped_bound_branch(state) if state is not None else None
-        if owed is not None:
+        if owed is not None and not authorized_publication(state, remote_ref, local_sha):
             found.append(
                 f"{remote_ref} <- {local_sha[:12]} carries unshipped {owed} work "
-                f"({state.get('phase')}/{state.get('status')}); {PUBLICATION_HINT}"
+                f"({state.get('phase')}/{state.get('status')}); {PUBLICATION_HINT}; "
+                f"{AUTHORIZED_PUSH_HINT}"
             )
     return found
 
 
+def authorized_publication(state, remote_ref, sha):
+    """The owner authorized this exact commit on this one non-default branch."""
+    project = state.get("project")
+    if not isinstance(project, str) or not members.NAME_RE.fullmatch(project):
+        return False
+    if not remote_ref.startswith("refs/heads/") or remote_ref == f"refs/heads/{default_branch()}":
+        return False
+    return members.authorized(repo_root(), project, "push", remote_ref, sha)
+
+
 def is_ship_commit(subject):
     return bool(subject and subject.strip().casefold().startswith("ship:"))
 

package/scripts/integration.py

@@ -845,6 +845,8 @@ def require_pull_request_merge(
     merge_commit: str,
     ship_commit: str,
     remote_default: str,
+    *,
+    allow_rebase: bool = False,
 ) -> None:
     resolved = optional_ref(project, merge_commit)
     if resolved != merge_commit:
@@ -853,9 +855,16 @@ def require_pull_request_merge(
         run_git(project, "rev-list", "--parents", "-n", "1", merge_commit),
         "inspect pull-request merge parents",
     ).split()
-    if len(parents) != 3:
+    if allow_rebase and len(parents) == 2:
+        problem = _common.rebase_landing_problem(project, ship_commit, merge_commit)
+        if problem is not None:
+            raise ArchiveError(
+                "pull-request integration must use a two-parent merge commit "
+                f"or a rebase merge of the ship commits: {problem}"
+            )
+    elif len(parents) != 3:
         raise ArchiveError("pull-request integration must use a two-parent merge commit")
-    if parents[2] != ship_commit:
+    elif parents[2] != ship_commit:
         raise ArchiveError("pull-request merge second parent is not the ship commit")
     first_parent = archive_milestone.require_git_success(
         run_git(project, "rev-list", "--first-parent", remote_default),
@@ -1026,7 +1035,9 @@ def integrate_pull_request(
         merge_commit,
     )
     remote_default = refresh_origin(project)["remote_default"]
-    require_pull_request_merge(project, merge_commit, ship_commit, remote_default)
+    require_pull_request_merge(
+        project, merge_commit, ship_commit, remote_default, allow_rebase=True
+    )
     pull = update_pull_request_body(
         repository,
         pull,
@@ -1473,7 +1484,9 @@ def validate_integrated(
             pull["number"],
             merge_commit,
         )
-        require_pull_request_merge(project, merge_commit, ship_commit, remote_default)
+        require_pull_request_merge(
+            project, merge_commit, ship_commit, remote_default, allow_rebase=True
+        )
         require_annotated_tag(
             project,
             tag_ref,

package/scripts/isolation.py

@@ -1219,9 +1219,17 @@ def _commit_member_source(sidecar: Path, journal: Dict[str, object], allowed: Se
         undeclared = undeclared_paths(sidecar, member_base, pending, allowed)
         if undeclared:
             raise IsolationError("undeclared paths: " + ", ".join(undeclared))
-        git_output(sidecar, "add", "-A", "--", *sorted(pending))
         body = member_commit_body(str(journal["task_file"]), sorted(pending), member_base, str(journal["base"]))
-        git_output(sidecar, "commit", "-q", "-m", str(journal["subject"]), "-m", body.strip())
+        # The paths and the body grow with the change set, so both go through
+        # stdin: a Windows command line holds about 32 KiB.
+        for arguments, text in (
+            (("add", "-A", "--pathspec-from-file=-", "--pathspec-file-nul"),
+             "".join(f"{path}\0" for path in sorted(pending))),
+            (("commit", "-q", "-F", "-"), _commit_message(str(journal["subject"]), body)),
+        ):
+            result = run_git(sidecar, *arguments, input=text)
+            if result.returncode != 0:
+                raise IsolationError((result.stderr or result.stdout).strip() or "git command failed")
     source = current_sha(sidecar)
     if source == member_base:
         raise IsolationError("no changes to land")
@@ -1669,6 +1677,25 @@ def committed_paths_since(repo: Path, base: str) -> Set[str]:
     )
 
 
+def _stage_paths(repo: Path, mode: str, paths: Set[str]) -> None:
+    """Stage `paths` with one `git add`.
+
+    One call for each path fails when a file replaces a tracked directory: the
+    first call drops the files below the directory from the index, and then
+    their pathspecs match no file. The `./` prefix stops pathspec magic, so a
+    name such as `:!b` cannot exclude another path of the set. Git names the
+    path in its error text.
+    """
+    if not paths:
+        return
+    added = run_git(
+        repo, "add", mode, "--pathspec-from-file=-", "--pathspec-file-nul",
+        input="".join(f"./{path}\0" for path in sorted(paths)),
+    )
+    if added.returncode != 0:
+        raise IsolationError(f"could not stage the change set: {added.stderr.strip()}")
+
+
 def ignored_legacy_ledger(repo: Path) -> bool:
     """True when a verify ledger absent from HEAD is hidden by an ignore rule.
 
@@ -1684,17 +1711,25 @@ def ignored_legacy_ledger(repo: Path) -> bool:
     return run_git(repo, "check-ignore", "-q", "--no-index", "--", VERIFY_LEDGER_PATH).returncode == 0
 
 
+def _commit_message(subject: str, body: str) -> str:
+    """The message for `git commit -F -`.
+
+    A landing body lists every changed path. As a `-m` argument it can exceed
+    the Windows command-line limit, so the message goes through stdin. Like
+    `-m`, the message ends its last line.
+    """
+    message = f"{subject}\n\n{body}"
+    return message if message.endswith("\n") else message + "\n"
+
+
 def _commit_pending(
     repo: Path, pending: Set[str], subject: str, body: str, forced: Set[str] = frozenset()
 ) -> str:
     reset = run_git(repo, "reset", "-q", "HEAD")
     if reset.returncode != 0:
         raise IsolationError("could not clear the index before commit")
-    for path in sorted(pending):
-        mode = "-f" if path in forced else "-A"
-        added = run_git(repo, "add", mode, "--", path)
-        if added.returncode != 0:
-            raise IsolationError(f"could not stage {path}: {added.stderr.strip()}")
+    _stage_paths(repo, "-A", pending - forced)
+    _stage_paths(repo, "-f", pending & forced)
     staged = _split_paths(
         git_output(
             repo,
@@ -1707,7 +1742,7 @@ def _commit_pending(
     )
     if staged != pending:
         raise IsolationError("staged paths do not match the uncommitted change set")
-    committed = run_git(repo, "commit", "-q", "-m", subject, "-m", body)
+    committed = run_git(repo, "commit", "-q", "-F", "-", input=_commit_message(subject, body))
     if committed.returncode != 0:
         raise IsolationError((committed.stderr or committed.stdout).strip() or "commit failed")
     return current_sha(repo)
@@ -1786,18 +1821,15 @@ def commit_allowed_changes(
     reset = run_git(repo, "reset", "-q", "HEAD")
     if reset.returncode != 0:
         raise IsolationError("could not clear the index before landing")
-    for path in sorted(staging):
-        added = run_git(repo, "add", "-A", "--", path)
-        if added.returncode != 0:
-            raise IsolationError(f"could not stage {path}: {added.stderr.strip()}")
+    _stage_paths(repo, "-A", staging)
     staged = _split_paths(
-        git_output(repo, "diff", "--cached", "--name-only", "--relative")
+        git_output(repo, "diff", "--no-renames", "--cached", "--name-only", "--relative")
     )
     if staged != staging:
         raise IsolationError("staged paths do not match the uncommitted change set")
     verified_tree = git_output(repo, "write-tree")
     verified_delta = _tree_delta(repo, base, verified_tree)
-    committed = run_git(repo, "commit", "-q", "-m", subject, "-m", body)
+    committed = run_git(repo, "commit", "-q", "-F", "-", input=_commit_message(subject, body))
     if committed.returncode != 0:
         raise IsolationError(
             (committed.stderr or committed.stdout).strip() or "commit failed"
@@ -4470,6 +4502,20 @@ def attest(
     }
 
 
+def _committed_ship_active(repo: Path) -> bool:
+    """True when the STATE.md committed at HEAD is ship/active."""
+
+    result = run_git(repo, "show", "HEAD:.project/STATE.md")
+    if result.returncode != 0:
+        return False
+    frontmatter = result.stdout.split("\n---", 1)[0]
+    fields = {
+        key: _unquote(value)
+        for key, value in re.findall(r"(?m)^(phase|status):(.*)$", frontmatter)
+    }
+    return fields.get("phase") == "ship" and fields.get("status") == "active"
+
+
 def checkpoint(
     repo: Path,
     expected_head: str,
@@ -4519,6 +4565,12 @@ def checkpoint(
                 "subject": subject.strip(),
             }
         raise IsolationError("primary HEAD differs from --expected-head")
+    if subject.strip().startswith("build:") and _committed_ship_active(repo):
+        raise IsolationError(
+            "STATE is ship/active: final review creates no pre-ship commit; leave its "
+            "outputs uncommitted for archive_milestone.py, and send findings through "
+            "the patch plan (see SHIP.md)"
+        )
     pending = uncommitted_paths(repo)
     forced: Set[str] = set()
     # Build only: an approval undo resets to a parent without the ledger and would drop it.

package/scripts/lean_verification.py

@@ -108,10 +108,14 @@ def _final_view(relative, text, criteria, reviewed, head, surfaces=None):
                 fields[field] = contracts._raw_source_field(block, field, relative)
         if "Surface" in fields and not {"Check", "Observed"}.issubset(fields):
             raise contracts.HandoffError(f"{criterion} lacks its recorded surface walkthrough")
+        reference = f"{relative} — {criterion}"
+        if "Observed" in fields and evidence:
+            # The reviewer may cite held-out and judgment ids on the evidence line.
+            reference += f"; evidence: {evidence}"
         lines += [f"### {criterion} — {title}", "", "- **Verdict**: met",
                   f"- **Check**: {fields.get('Check', 'none')}",
                   f"- **Observed**: {fields.get('Observed', evidence)}",
-                  f"- **Reference**: {relative} — {criterion}",
+                  f"- **Reference**: {reference}",
                   "- **Finding**: none", "- **Fix direction**: none"]
         if "Surface" in fields:
             expected = (surfaces or {}).get(criterion)