@opengsd/gsd-path 1.6.0 → 1.6.2

package/skills/path/scripts/check_task_briefs.py

@@ -387,7 +387,9 @@ def _lint_task(
                     )
                     break
 
-    for name in PROSE_SECTIONS:
+    # A landed brief is history that nobody can edit: only an unlanded brief must name present paths.
+    landed = task_id in (landed_bases or {})
+    for name in () if landed else PROSE_SECTIONS:
         body = sections.get(name)
         if body is None or not _clean(body):
             continue
@@ -400,8 +402,6 @@ def _lint_task(
                 and token not in supplied
                 and not _supplied_contract(repo, path, token)
                 and not _pipeline_workspace_file(repo, path, token)
-                # A landed brief is history: the pipeline moves its own files (build recovery, archive) later.
-                and not (task_id in (landed_bases or {}) and _pipeline_workspace_path(repo, path, token))
                 and not _base_exists(git_root, base, token)
             ):
                 problems.append(f"## {name} names a path missing at the layer base: {token}")
@@ -411,7 +411,7 @@ def _lint_task(
         block = VERIFY_BLOCK_PATTERN.search(verify_body)
         if block is None or not block.group("block").strip():
             problems.append("## Verify must contain a non-empty fenced bash block")
-        else:
+        elif not landed:
             for token in _verify_tokens(
                 block.group("block"),
                 repo=repo,
@@ -448,9 +448,10 @@ def validate_task_briefs(
 
     Plain lint uses the layer base without overrides. Plan approval and dispatch
     supply transitive dependency files for unlanded tasks and resolved historical
-    bases for landed tasks, whose immutable briefs must survive later file changes.
+    bases for landed tasks. A landed brief is immutable: its `files` scope is
+    checked at that base, and the paths its prose and Verify name are not checked.
     The caller validates the task graph and landed metadata before supplying
-    these mappings; landed tasks receive no dependency-file allowance.
+    these mappings.
     """
 
     resolved_base = _resolve_base(root, base)
@@ -481,6 +482,9 @@ def validate_task_briefs(
     for shape, task_ids in contracts.items():
         if len(task_ids) == 1:
             task_id = next(iter(task_ids))
+            # A landed brief is history: a later repair may reword the bullet in its partner.
+            if task_id in (landed_bases or {}):
+                continue
             problems.append(
                 f"{task_id}: interface contract is not shared by any other task: {shape}"
             )
@@ -592,7 +596,6 @@ def plan_validation_bases(
                 )
             except IsolationError as error:
                 raise BriefError(f"{task_id} landed task has invalid historical base: {error}") from error
-            dependency_files[task_id] = set()
     except check_handoffs.HandoffError as error:
         raise BriefError(str(error)) from error
     return tasks, dependency_files, landed_bases

package/skills/path/scripts/dispatch_driver.py

@@ -117,9 +117,21 @@ def _refresh_stop_errors() -> None:
                    model_policy.PolicyError)
 
 
+# The selected Project runtime directory once _reload_pinned_modules ran; None keeps bundled helpers.
+_RUNTIME_ROOT: Optional[Path] = None
+
+
+def helper_script(name: str) -> Path:
+    """A subprocess helper from the selected runtime when it ships one, else the bundled sibling."""
+    if _RUNTIME_ROOT is not None and (_RUNTIME_ROOT / name).is_file():
+        return _RUNTIME_ROOT / name
+    return Path(__file__).resolve().parent / name
+
+
 def _reload_pinned_modules(runtime_root: Path) -> None:
     global isolation, build_state, task_context, contracts, pipeline_state
-    global archive_milestone, review_findings, model_policy
+    global archive_milestone, review_findings, model_policy, _RUNTIME_ROOT
+    _RUNTIME_ROOT = runtime_root
     if _bundled_helpers():
         path = str(runtime_root)
         if path not in sys.path:
@@ -981,7 +993,7 @@ class Round:
                 diagnose = shlex.join([
                     sys.executable,
                     "-B",
-                    str(Path(__file__).with_name("pipeline_diagnose.py")),
+                    str(helper_script("pipeline_diagnose.py")),
                     "diagnose",
                     "--repo",
                     str(self.primary),
@@ -1677,8 +1689,8 @@ class Review:
 
 
 def helper_json(receipt: Dict[str, object], script: str, *arguments: str, cwd: Path) -> Dict[str, object]:
-    """Run a bundled helper and return its JSON stdout; a non-zero exit is a typed stop."""
-    command = [sys.executable, "-B", str(Path(__file__).resolve().parent / script), *arguments]
+    """Run a helper (runtime-selected, else bundled) and return its JSON stdout; a non-zero exit is a typed stop."""
+    command = [sys.executable, "-B", str(helper_script(script)), *arguments]
     completed = subprocess.run(command, cwd=cwd, capture_output=True, encoding="utf-8", errors="replace")
     step = {"script": script, "command": command, "exit_code": completed.returncode,
             "stdout": completed.stdout, "stderr": completed.stderr}
@@ -2290,7 +2302,7 @@ Heavy: {'yes' if heavy else 'no'}
         if plan_changed:
             _common.atomic_write(plan_path, updated)
         receipt["plan_wave"] = fix_wave
-        lint = subprocess.run([sys.executable, "-B", str(Path(__file__).resolve().parent / "check_task_briefs.py"),
+        lint = subprocess.run([sys.executable, "-B", str(helper_script("check_task_briefs.py")),
                                "--repo", str(primary), "--base", isolation.current_sha(primary),
                                "--tasks-dir", f"{options.project_dir}/tasks",
                                "--project-dir", options.project_dir], capture_output=True, encoding="utf-8", errors="replace")

package/skills/path/scripts/git_guard.py

@@ -69,6 +69,11 @@ PUBLICATION_HINT = (
     "(STATE shipped/done) through archive_milestone.py integrate; findings during "
     "ship reopen through the patch plan (see SHIP.md)"
 )
+AUTHORIZED_PUSH_HINT = (
+    "an owner-approved push of one exact commit to a branch other than the bound "
+    "or default branch needs refs/gsd-path/authorizations/<project>/push/<ref> "
+    "at that commit (see HOOKS.md)"
+)
 LEGACY_STATE_FIELDS = {
     "pipeline",
     "project",
@@ -621,14 +626,25 @@ def pre_push_violations(lines):
             continue
         state = state_at(local_sha)
         owed = unshipped_bound_branch(state) if state is not None else None
-        if owed is not None:
+        if owed is not None and not authorized_publication(state, remote_ref, local_sha):
             found.append(
                 f"{remote_ref} <- {local_sha[:12]} carries unshipped {owed} work "
-                f"({state.get('phase')}/{state.get('status')}); {PUBLICATION_HINT}"
+                f"({state.get('phase')}/{state.get('status')}); {PUBLICATION_HINT}; "
+                f"{AUTHORIZED_PUSH_HINT}"
             )
     return found
 
 
+def authorized_publication(state, remote_ref, sha):
+    """The owner authorized this exact commit on this one non-default branch."""
+    project = state.get("project")
+    if not isinstance(project, str) or not members.NAME_RE.fullmatch(project):
+        return False
+    if not remote_ref.startswith("refs/heads/") or remote_ref == f"refs/heads/{default_branch()}":
+        return False
+    return members.authorized(repo_root(), project, "push", remote_ref, sha)
+
+
 def is_ship_commit(subject):
     return bool(subject and subject.strip().casefold().startswith("ship:"))
 

package/skills/path/scripts/integration.py

@@ -845,6 +845,8 @@ def require_pull_request_merge(
     merge_commit: str,
     ship_commit: str,
     remote_default: str,
+    *,
+    allow_rebase: bool = False,
 ) -> None:
     resolved = optional_ref(project, merge_commit)
     if resolved != merge_commit:
@@ -853,9 +855,16 @@ def require_pull_request_merge(
         run_git(project, "rev-list", "--parents", "-n", "1", merge_commit),
         "inspect pull-request merge parents",
     ).split()
-    if len(parents) != 3:
+    if allow_rebase and len(parents) == 2:
+        problem = _common.rebase_landing_problem(project, ship_commit, merge_commit)
+        if problem is not None:
+            raise ArchiveError(
+                "pull-request integration must use a two-parent merge commit "
+                f"or a rebase merge of the ship commits: {problem}"
+            )
+    elif len(parents) != 3:
         raise ArchiveError("pull-request integration must use a two-parent merge commit")
-    if parents[2] != ship_commit:
+    elif parents[2] != ship_commit:
         raise ArchiveError("pull-request merge second parent is not the ship commit")
     first_parent = archive_milestone.require_git_success(
         run_git(project, "rev-list", "--first-parent", remote_default),
@@ -1026,7 +1035,9 @@ def integrate_pull_request(
         merge_commit,
     )
     remote_default = refresh_origin(project)["remote_default"]
-    require_pull_request_merge(project, merge_commit, ship_commit, remote_default)
+    require_pull_request_merge(
+        project, merge_commit, ship_commit, remote_default, allow_rebase=True
+    )
     pull = update_pull_request_body(
         repository,
         pull,
@@ -1473,7 +1484,9 @@ def validate_integrated(
             pull["number"],
             merge_commit,
         )
-        require_pull_request_merge(project, merge_commit, ship_commit, remote_default)
+        require_pull_request_merge(
+            project, merge_commit, ship_commit, remote_default, allow_rebase=True
+        )
         require_annotated_tag(
             project,
             tag_ref,

package/skills/path/scripts/isolation.py

@@ -1219,9 +1219,17 @@ def _commit_member_source(sidecar: Path, journal: Dict[str, object], allowed: Se
         undeclared = undeclared_paths(sidecar, member_base, pending, allowed)
         if undeclared:
             raise IsolationError("undeclared paths: " + ", ".join(undeclared))
-        git_output(sidecar, "add", "-A", "--", *sorted(pending))
         body = member_commit_body(str(journal["task_file"]), sorted(pending), member_base, str(journal["base"]))
-        git_output(sidecar, "commit", "-q", "-m", str(journal["subject"]), "-m", body.strip())
+        # The paths and the body grow with the change set, so both go through
+        # stdin: a Windows command line holds about 32 KiB.
+        for arguments, text in (
+            (("add", "-A", "--pathspec-from-file=-", "--pathspec-file-nul"),
+             "".join(f"{path}\0" for path in sorted(pending))),
+            (("commit", "-q", "-F", "-"), _commit_message(str(journal["subject"]), body)),
+        ):
+            result = run_git(sidecar, *arguments, input=text)
+            if result.returncode != 0:
+                raise IsolationError((result.stderr or result.stdout).strip() or "git command failed")
     source = current_sha(sidecar)
     if source == member_base:
         raise IsolationError("no changes to land")
@@ -1669,6 +1677,25 @@ def committed_paths_since(repo: Path, base: str) -> Set[str]:
     )
 
 
+def _stage_paths(repo: Path, mode: str, paths: Set[str]) -> None:
+    """Stage `paths` with one `git add`.
+
+    One call for each path fails when a file replaces a tracked directory: the
+    first call drops the files below the directory from the index, and then
+    their pathspecs match no file. The `./` prefix stops pathspec magic, so a
+    name such as `:!b` cannot exclude another path of the set. Git names the
+    path in its error text.
+    """
+    if not paths:
+        return
+    added = run_git(
+        repo, "add", mode, "--pathspec-from-file=-", "--pathspec-file-nul",
+        input="".join(f"./{path}\0" for path in sorted(paths)),
+    )
+    if added.returncode != 0:
+        raise IsolationError(f"could not stage the change set: {added.stderr.strip()}")
+
+
 def ignored_legacy_ledger(repo: Path) -> bool:
     """True when a verify ledger absent from HEAD is hidden by an ignore rule.
 
@@ -1684,17 +1711,25 @@ def ignored_legacy_ledger(repo: Path) -> bool:
     return run_git(repo, "check-ignore", "-q", "--no-index", "--", VERIFY_LEDGER_PATH).returncode == 0
 
 
+def _commit_message(subject: str, body: str) -> str:
+    """The message for `git commit -F -`.
+
+    A landing body lists every changed path. As a `-m` argument it can exceed
+    the Windows command-line limit, so the message goes through stdin. Like
+    `-m`, the message ends its last line.
+    """
+    message = f"{subject}\n\n{body}"
+    return message if message.endswith("\n") else message + "\n"
+
+
 def _commit_pending(
     repo: Path, pending: Set[str], subject: str, body: str, forced: Set[str] = frozenset()
 ) -> str:
     reset = run_git(repo, "reset", "-q", "HEAD")
     if reset.returncode != 0:
         raise IsolationError("could not clear the index before commit")
-    for path in sorted(pending):
-        mode = "-f" if path in forced else "-A"
-        added = run_git(repo, "add", mode, "--", path)
-        if added.returncode != 0:
-            raise IsolationError(f"could not stage {path}: {added.stderr.strip()}")
+    _stage_paths(repo, "-A", pending - forced)
+    _stage_paths(repo, "-f", pending & forced)
     staged = _split_paths(
         git_output(
             repo,
@@ -1707,7 +1742,7 @@ def _commit_pending(
     )
     if staged != pending:
         raise IsolationError("staged paths do not match the uncommitted change set")
-    committed = run_git(repo, "commit", "-q", "-m", subject, "-m", body)
+    committed = run_git(repo, "commit", "-q", "-F", "-", input=_commit_message(subject, body))
     if committed.returncode != 0:
         raise IsolationError((committed.stderr or committed.stdout).strip() or "commit failed")
     return current_sha(repo)
@@ -1786,18 +1821,15 @@ def commit_allowed_changes(
     reset = run_git(repo, "reset", "-q", "HEAD")
     if reset.returncode != 0:
         raise IsolationError("could not clear the index before landing")
-    for path in sorted(staging):
-        added = run_git(repo, "add", "-A", "--", path)
-        if added.returncode != 0:
-            raise IsolationError(f"could not stage {path}: {added.stderr.strip()}")
+    _stage_paths(repo, "-A", staging)
     staged = _split_paths(
-        git_output(repo, "diff", "--cached", "--name-only", "--relative")
+        git_output(repo, "diff", "--no-renames", "--cached", "--name-only", "--relative")
     )
     if staged != staging:
         raise IsolationError("staged paths do not match the uncommitted change set")
     verified_tree = git_output(repo, "write-tree")
     verified_delta = _tree_delta(repo, base, verified_tree)
-    committed = run_git(repo, "commit", "-q", "-m", subject, "-m", body)
+    committed = run_git(repo, "commit", "-q", "-F", "-", input=_commit_message(subject, body))
     if committed.returncode != 0:
         raise IsolationError(
             (committed.stderr or committed.stdout).strip() or "commit failed"
@@ -4470,6 +4502,20 @@ def attest(
     }
 
 
+def _committed_ship_active(repo: Path) -> bool:
+    """True when the STATE.md committed at HEAD is ship/active."""
+
+    result = run_git(repo, "show", "HEAD:.project/STATE.md")
+    if result.returncode != 0:
+        return False
+    frontmatter = result.stdout.split("\n---", 1)[0]
+    fields = {
+        key: _unquote(value)
+        for key, value in re.findall(r"(?m)^(phase|status):(.*)$", frontmatter)
+    }
+    return fields.get("phase") == "ship" and fields.get("status") == "active"
+
+
 def checkpoint(
     repo: Path,
     expected_head: str,
@@ -4519,6 +4565,12 @@ def checkpoint(
                 "subject": subject.strip(),
             }
         raise IsolationError("primary HEAD differs from --expected-head")
+    if subject.strip().startswith("build:") and _committed_ship_active(repo):
+        raise IsolationError(
+            "STATE is ship/active: final review creates no pre-ship commit; leave its "
+            "outputs uncommitted for archive_milestone.py, and send findings through "
+            "the patch plan (see SHIP.md)"
+        )
     pending = uncommitted_paths(repo)
     forced: Set[str] = set()
     # Build only: an approval undo resets to a parent without the ledger and would drop it.

package/skills/path/scripts/lean_verification.py

@@ -108,10 +108,14 @@ def _final_view(relative, text, criteria, reviewed, head, surfaces=None):
                 fields[field] = contracts._raw_source_field(block, field, relative)
         if "Surface" in fields and not {"Check", "Observed"}.issubset(fields):
             raise contracts.HandoffError(f"{criterion} lacks its recorded surface walkthrough")
+        reference = f"{relative} — {criterion}"
+        if "Observed" in fields and evidence:
+            # The reviewer may cite held-out and judgment ids on the evidence line.
+            reference += f"; evidence: {evidence}"
         lines += [f"### {criterion} — {title}", "", "- **Verdict**: met",
                   f"- **Check**: {fields.get('Check', 'none')}",
                   f"- **Observed**: {fields.get('Observed', evidence)}",
-                  f"- **Reference**: {relative} — {criterion}",
+                  f"- **Reference**: {reference}",
                   "- **Finding**: none", "- **Fix direction**: none"]
         if "Surface" in fields:
             expected = (surfaces or {}).get(criterion)

package/skills/path/scripts/model_policy.py

@@ -196,7 +196,14 @@ def task_settings(path):
 
 def native_record(args):
     """The parent owns lifecycle; release requires its recorded terminal-result receipt."""
+    # A relative path would resolve against cwd, which may be the immutable runtime store.
+    if not args.record.is_absolute():
+        raise PolicyError(f'--record must be an absolute path: {args.record}')
     record = args.record.resolve()
+    missing = f'release requires an existing record and terminal-result evidence: {record}'
+    # Check before log_lock creates the record directory and its lock file.
+    if args.action == 'release' and not record.exists():
+        raise PolicyError(missing)
     with log_lock({'log': str(record)}):
         data = read_json(record) if record.exists() else None
         identity = {'repo': str(args.repo.resolve()), 'project_dir': args.project_dir,
@@ -209,7 +216,7 @@ def native_record(args):
             raise PolicyError(f'record belongs to another assignment or milestone/track/cycle ({differing})')
         if args.action == 'release':
             if data is None or not args.terminal_result:
-                raise PolicyError('release requires an existing record and terminal-result evidence')
+                raise PolicyError(missing)
             data.update(active=False, terminal_result=args.terminal_result)
         else:
             if args.capabilities is None:

package/skills/path/scripts/pipeline_git.py

@@ -484,7 +484,12 @@ def _require_tag_integration_proof(
         "1",
         landing,
     ).stdout.split()
-    if len(parents) != 3 or parents[2] != ship:
+    rebased = (
+        mode == "pull-request"
+        and len(parents) == 2
+        and _common.rebase_landing_problem(repo, ship, landing) is None
+    )
+    if not rebased and (len(parents) != 3 or parents[2] != ship):
         raise PipelineGitError(f"{mode} integration proof has invalid merge topology")
     first_parent = _run_git(repo, "rev-list", "--first-parent", base).stdout.splitlines()
     if landing not in first_parent:
@@ -694,6 +699,7 @@ def retire_previous_branch(
     expected_sha: str,
     *,
     allow_remote_absent: bool = False,
+    rebased: bool = False,
 ) -> None:
     """Delete an integrated previous bound branch, locally and on origin.
 
@@ -741,7 +747,8 @@ def retire_previous_branch(
     if _ref_exists(repo, tracking_ref):
         _run_git(repo, "update-ref", "-d", tracking_ref)
     if _ref_exists(repo, local_ref):
-        _run_git(repo, "branch", "-d", previous_branch)
+        # A rebased ship is not an ancestor of HEAD, so -d would refuse it.
+        _run_git(repo, "branch", "-D" if rebased else "-d", previous_branch)
 
 
 def _retire_members(repo: Path, ship_sha: str) -> None:
@@ -840,9 +847,15 @@ def bind_next_milestone_branch(
         landing_sha,
         check=False,
     )
-    if integrated.returncode == 1:
+    # A forge rebase merge lands copies of the ship commits (#418); the
+    # pull-request milestone tag must then prove the landing.
+    rebased = (
+        integrated.returncode == 1
+        and _common.rebase_landing_problem(repo, ship_sha, landing_sha) is None
+    )
+    if integrated.returncode == 1 and not rebased:
         raise PipelineGitError("milestone landing does not contain the ship commit")
-    if integrated.returncode != 0:
+    if integrated.returncode not in (0, 1):
         detail = integrated.stderr.strip() or integrated.stdout.strip()
         raise PipelineGitError(f"could not verify milestone landing: {detail}")
     landing_integrated = _run_git(
@@ -858,7 +871,7 @@ def bind_next_milestone_branch(
     if landing_integrated.returncode != 0:
         detail = landing_integrated.stderr.strip() or landing_integrated.stdout.strip()
         raise PipelineGitError(f"could not verify integrated branch: {detail}")
-    if allow_remote_absent:
+    if allow_remote_absent or rebased:
         proven_landing = _require_tag_integration_proof(
             repo,
             ship_sha,
@@ -994,6 +1007,7 @@ def bind_next_milestone_branch(
         allow_remote_absent=(
             allow_remote_absent or journal["stage"] in {"switched", "retired"}
         ),
+        rebased=rebased,
     )
     _retire_members(repo, ship_sha)
     journal["stage"] = "retired"

package/skills/path/scripts/pipeline_state.py

@@ -1024,7 +1024,9 @@ def _bind_next_journal_recovery(
     )
     if resolved_landing.returncode != 0 or resolved_landing.stdout.strip() != landing:
         raise PipelineStateError("bind-next journal landing is not an existing full SHA")
-    if not _is_ancestor(repo, ship, landing):
+    if not _is_ancestor(repo, ship, landing) and _common.rebase_landing_problem(
+        repo, ship, landing
+    ) is not None:
         raise PipelineStateError("bind-next journal landing does not contain ship")
     if not _is_ancestor(repo, landing, base):
         raise PipelineStateError("bind-next journal landing is not an ancestor of base")

package/skills/path/scripts/state_promote.py

@@ -343,6 +343,67 @@ def _completed_promotion(
     }
 
 
+def _ruling_rows(text: str) -> dict[str, list[str]]:
+    """Map Queue # to the cells of each `## User rulings` table row."""
+    rows: dict[str, list[str]] = {}
+    in_rulings = False
+    for line in text.splitlines():
+        if line == "## User rulings":
+            in_rulings = True
+            continue
+        if in_rulings and line.startswith("## "):
+            break
+        if in_rulings and line.lstrip().startswith("|"):
+            cells = [cell.strip() for cell in line.strip().strip("|").split("|")]
+            if len(cells) == 4 and cells[0].isdigit():
+                rows[cells[0]] = cells
+    return rows
+
+
+def _superseded_carry_forward(
+    repo: Path,
+    active_state: PipelineState,
+    source: Path,
+    destination: Path,
+) -> bool:
+    """True when active research is only the shipped DOCS-AUDIT carry-forward
+    and the lookahead audit keeps every one of its rulings."""
+    if not active_state.archive or destination.is_symlink() or not destination.is_dir():
+        return False
+    archived = repo / active_state.archive / "research" / "DOCS-AUDIT.md"
+    active = destination / "DOCS-AUDIT.md"
+    lookahead = source / "DOCS-AUDIT.md"
+    entries = [
+        path for path in destination.iterdir() if not state_checkpoint._is_junk_file(path)
+    ]
+    if entries != [active] or any(
+        path.is_symlink() or not path.is_file() for path in (archived, active, lookahead)
+    ):
+        return False
+    carried = active.read_bytes()
+    if carried != archived.read_bytes():
+        return False
+    rulings = _ruling_rows(carried.decode("utf-8"))
+    if not any(cells[3] == "no" for cells in rulings.values()):
+        return False
+    kept = _ruling_rows(lookahead.read_text(encoding="utf-8"))
+    for number, cells in rulings.items():
+        other = kept.get(number)
+        # Plan may record a T### for a pending ruling; nothing else may change.
+        if (
+            other is None
+            or other[:3] != cells[:3]
+            or (
+                other[3] != cells[3]
+                and not (cells[3] == "no" and re.fullmatch(r"T\d{3}", other[3]))
+            )
+        ):
+            raise PipelineStateError(
+                f"lookahead DOCS-AUDIT.md does not keep carry-forward ruling #{number}"
+            )
+    return True
+
+
 def _prepare_promotion(
     repo: Path,
     project: Path,
@@ -475,12 +536,17 @@ def _prepare_promotion(
         raise PipelineStateError("lookahead STATE branch and archive must be null")
 
     tracks: dict[str, str] = {}
+    carry_forward: Optional[str] = None
     for name in PROMOTION_TRACKS:
         source = next_root / name
         destination = project / name
         if source.exists() or source.is_symlink():
             if destination.exists() or destination.is_symlink():
-                raise PipelineStateError(f"promotion destination already exists: {destination}")
+                if name != "research" or not _superseded_carry_forward(
+                    repo, active_state, source, destination
+                ):
+                    raise PipelineStateError(f"promotion destination already exists: {destination}")
+                carry_forward = state_checkpoint._tree_digest(destination)
             tracks[name] = state_checkpoint._tree_digest(source)
     if not tracks:
         raise PipelineStateError("lookahead track has no promotable artifacts")
@@ -507,6 +573,7 @@ def _prepare_promotion(
         "landing": landing,
         "base": base,
         "tracks": tracks,
+        "carry_forward_sha256": carry_forward,
         "residual_sha256": state_checkpoint._tree_digest(next_root, tuple(tracks)),
         "next_state_sha256": state_checkpoint._sha256(next_text),
         "active_state_sha256": state_checkpoint._sha256(active_text),
@@ -559,6 +626,15 @@ def _resume_track_moves(project: Path, journal: dict[str, object], path: Path) -
         destination = project / name
         source_exists = source.exists() or source.is_symlink()
         destination_exists = destination.exists() or destination.is_symlink()
+        carry_forward = journal.get("carry_forward_sha256")
+        if name == "research" and source_exists and destination_exists and carry_forward:
+            if state_checkpoint._tree_digest(destination) != carry_forward:
+                raise PipelineStateError("DOCS-AUDIT carry-forward drifted during promotion")
+            # The archive and the ship commit keep the carry-forward copy.
+            shutil.rmtree(destination)
+            journal["stage"] = "removed:carry-forward"
+            pipeline_state._write_json(path, journal)
+            destination_exists = False
         if source_exists and destination_exists:
             raise PipelineStateError(f"promotion has both source and destination: {name}")
         if not source_exists and not destination_exists: