@opengsd/gsd-path 1.6.2 → 1.7.1

package/CHANGELOG.md

@@ -11,6 +11,36 @@ app and the daemon have their own file,
 [daemon/app/CHANGELOG.md](daemon/app/CHANGELOG.md). Release bookkeeping and
 test-only changes are not listed; the Git history has them.
 
+## [1.7.1] - 2026-10-31
+
+### Changed
+- Focus reviews on agreed requirements and required proof, without searching for unrelated improvements.
+- Require an explicit request for adversarial review, and limit repeat reviews to repaired failures and affected checks.
+
+### Fixed
+- Resume a patch planner after its re-entry checkpoint without rejecting its task log.
+
+## [1.7.0] - 2026-10-30
+
+### Added
+- Publish runtime-store entries without installing them, and adopt approved successor runtimes on closed milestones.
+- Prepare member task environments with a declared command and retry tasks after an environment failure.
+- Recover member work that already reached its default branch, including published ancestors and rebase-merged pull requests.
+- Trace accepted task evidence through a generated evidence manifest.
+
+### Changed
+- Check task brief paths in batches and report progress during larger plans.
+- Record the actual verification directory and native agent in member task receipts.
+
+### Fixed
+- Resume patch work after a ship-stage review without losing its checkpoint.
+- Keep blocked plans and repair waves on the correct recovery route.
+- Require wave reviews to account for every task claim and authorize claim dispositions through owner corrections.
+- Preserve disabled hooks, permit safe read-only fetches, and tighten PowerShell and repository deletion guards.
+- Remove isolated worktrees without traversing symlinks or Windows junctions.
+- Pin sibling task files during member activation and resolve member markers in final-review sidecars.
+- Retry project verification after a host failure and run long verification scripts correctly on Windows.
+
 ## [1.6.2] - 2026-10-17
 
 ### Changed

package/DOCS.md

@@ -412,9 +412,35 @@ A new machine needs the selected runtime installed before status and guards can
 run. `gsd-path --runtime-restore --project /absolute/project --source-root
 /path/to/matching/package` restores that exact version without changing project
 files. The supplied package must match both the version and digest; custom source
-builds may share a release version while having different digests. No command
+builds may share a release version while having different digests. One exception:
+a pin on a runtime that names successors (below) restores from its existing
+stamped store entry when the package has the same version and files, since only
+the successors stamp differs. No command
 silently substitutes a newer runtime, and status/guards never install or download.
 
+To publish a runtime to the shared store without selecting it for any project,
+run `python3 -B <absolute runtime_store.py> publish --source /path/to/package`
+(and optionally `--provenance "hotfix for <issue>"`). It prints the runtime's
+version, digest, and verified store path as JSON. Publication alone neither
+authorizes execution nor changes a project's trusted runtime — a project runs
+new bytes only after its own pin selects that digest, or after the pinned
+runtime's own hashed manifest names them (below). `--expected-version`
+with `--expected-digest` refuses a source that does not match, `--dry-run`
+computes the identity without writing, and `--repair` replaces an entry that
+fails verification.
+
+A runtime can bless successors: publish the successor package first, then
+publish its predecessor with `--name-successor <successor digest>` (repeatable).
+The list is recorded inside the predecessor's hashed `manifest.json`, so the
+blessing is covered by the predecessor's own digest — nothing outside its bytes
+can add to it. On a closed milestone, where the pin can no longer change, the
+guard accepts a helper from a successor only when the pinned runtime's hashed
+manifest names it (directly or through a chain of blessed runtimes, each hop
+hash-locked); every unlisted runtime stays refused. Runtimes published before
+successors existed can never name one without changing their digest, so pins
+on those runtimes keep the run-from-another-cwd workaround until an
+owner-approved repin on a legal branch.
+
 For an old `.gsd-path/runtime/`, run `gsd-path --runtime-migrate --project
 /absolute/project --dry-run`, then the same command without `--dry-run` and review
 the Git diff. Migration removes the generated files from the checkout and writes

package/FULL.md

@@ -293,8 +293,8 @@ from `files` unless it is that allowed Project-verify copy.
 
 Build reviews each completed wave against task criteria and the INTENT success
 criteria that wave owns. Each wave carries a review depth — `full`,
-`verify-only` for low-risk waves, or sparingly `deep`
-for irreversible or security-critical waves. The canonical
+`verify-only` for low-risk waves, or `deep` only when INTENT.md records an
+explicit user request for adversarial review. The canonical
 [build contract](skills/gsd-path-build/SKILL.md) defines each depth's writer
 and evidence rules. Review findings are keyed by their failed criterion and
 carried forward across cycles, so a criterion failing again after its fix task
@@ -464,7 +464,8 @@ approves.
   from two sessions at the same time.
 - Do not push `gsd-path/M00N` by hand, and do not merge another branch into
   it.
-- Do not squash or rebase the integration pull request or merge request.
+- Do not squash the integration pull request or merge request, and do not
+  rebase or fast-forward an `external-landing` merge request.
 
 ---
 

package/HOOKS.md

@@ -11,13 +11,18 @@ Optional enforcement for pipeline invariants prompt contracts cannot guarantee:
 
 Closed branches still allow read-only Git inspection (`status`, `log`, `diff`, plain
 `cat-file` reads of one object, branch and worktree listing) and the router handoff helpers, including
-`git fetch origin`, SHA resolution, and next-base selection. Branch switching remains
-router-owned. The [ship contract](skills/gsd-path-ship/SKILL.md) owns integration
+`git fetch [REMOTE]`, SHA resolution, and next-base selection. They also allow a
+simple literal delete or move whose every operand is outside the closed repository,
+its member checkouts, and the pipeline state roots, and is no ancestor of them.
+Branch switching remains router-owned. The [ship contract](skills/gsd-path-ship/SKILL.md) owns integration
 conflict handling and published-validation recovery.
 
 `cat-file` options are restricted by `CLOSED_LISTING_GIT_OPTIONS` in
 [`scripts/guard_hook.py`](scripts/guard_hook.py); filter and text-conversion forms
-are blocked because they can execute external commands.
+are blocked because they can execute external commands. A closed-branch fetch takes
+no global option but `-C`, no command-line refspec or option, and a configured remote
+whose repo config fetches read-only; `_closed_fetch_allowed` in the same file owns the
+exact proof.
 
 **Docs:** [DOCS.md](DOCS.md) (hub) · [UPDATE.md](UPDATE.md) (refresh hooks) · [QUICK.md](QUICK.md) (first install with `--hooks`)
 
@@ -94,6 +99,11 @@ hook.
   the rename when the directory is tracked.
 - **`<hook>.gsd-path-chained` already exists beside a foreign hook:** the
   installer stops. Decide which of the two files you want to keep.
+- **You disabled a hook by renaming it to `<hook>.disabled*`:** while
+  `<hook>` itself is absent, the installer and `--member-of` leave it disabled
+  (`(left disabled)`), and doctor reports it as deliberately disabled instead
+  of missing. To enable the guard again, remove or rename the disabled file
+  and rerun the installer.
 
 Git hooks are local to a clone. A bot that merges on the server, such as
 Renovate, never runs them, and its commits on the default branch do not
@@ -195,6 +205,18 @@ See [UPDATE.md](UPDATE.md).
   target a routing control (`.git`, `.project/STATE.md`, `.project/next`,
   `.gsd-path`) while `.project/STATE.md` exists, or target a product file
   outside the routed build phase (same rule as direct file-edit tools)
+- PowerShell expression forms the guard cannot inspect: a .NET static member
+  call (`[System.IO.File]::WriteAllText`) outside a small read-only type list
+  (`[Math]`, `[string]`, number, date, and similar types), anywhere in the
+  command, including script blocks; dynamic-execution commands and their
+  aliases (`Invoke-Expression`/`iex`, `Invoke-Command`, `Add-Type`,
+  `Start-Process`, `Start-Job`, `New-Object`) as the program or inside a
+  script block; the `&` call operator; and the same forms inside wrapped
+  `-Command` payloads. A `$name = value` or `$env:NAME = value` assignment
+  with only plain literal words is process-local and passes; a bare-word
+  value is checked as the command it runs. A richer value keeps the
+  unresolvable-executable denial, and `$env:HOME`, `$env:XDG_CONFIG_HOME`,
+  and `$env:GIT_*` are denied like the `env` form
 - repeated assignments to the same shell variable within one command; split
   these into separate tool calls so write targets can be resolved
 - copies whose destinations, including nested recursive-copy entries, resolve
@@ -220,6 +242,10 @@ See [UPDATE.md](UPDATE.md).
   backticks, glob characters (`*`, `?`, `[`, `]`), braces, or `..` path components,
   and must not start with `~`. Quoted spaces in paths and quoted punctuation
   within arguments, such as the shipment event's semicolon, are allowed
+- deletion or move commands, in every phase, that target or contain a
+  pipeline state root (`~/.gsd-path`, `GSD_PATH_WORKTREE_ROOT`, or a pinned
+  workspace root). Deletes inside the agent's own managed worktree under such
+  a root stay allowed. Workspace receipts that cannot be read deny the command
 - deletion or move commands outside a single simple segment, including command
   chains, pipes, newlines, grouping, directory changes, and command substitution
 - deletion or move commands with any argument outside the literal-path character
@@ -229,6 +255,10 @@ See [UPDATE.md](UPDATE.md).
   tilde paths are denied even when quoted. This also applies to
   `find -delete` and supported destructive aliases
 - destructive Git commands nested in supported shell and command wrappers
+- the operator-only `isolation.py runtime-hotfix` recovery, and every Git
+  command with a word that contains `refs/gsd-path/` or `runtime-hotfix`;
+  see [runtime selection](skills/gsd-path/references/runtime-selection.md)
+  for the receipt, the covered spellings, and the limits
 - Git arguments that contain a shell parameter. Only plain `$name` and
   `${name}` expansions pass, and only inside plain double-quoted spans of
   read-only subcommands (`status`, `log`, `diff`, `show`, and the other
@@ -339,7 +369,11 @@ such as `rm -rf scratch` passes the archive check; other guard rules still apply
   `files:`, and a `Files:` list of exactly the staged paths. Outside build the
   reviewed HEAD is frozen; product fixes reopen through the patch plan.
   The validated integration merge is allowed to complete before publication
-  proof exists; an ordinary commit with an integration subject is not exempt
+  proof exists; an ordinary commit with an integration subject is not exempt.
+  A landing commit may also stage `.gsd-path/runtime.json` only when a
+  runtime-hotfix receipt exists for that task and base and the staged pin
+  names exactly the receipt's runtime; see
+  [runtime selection](skills/gsd-path/references/runtime-selection.md)
 - deleting the recorded branch or switching to another branch while carrying
   unfinished state does not release product commit protection
 - pushes (to any remote) that move a `gsd-path/M###` ref anywhere but its

package/QUICK.md

@@ -14,7 +14,7 @@ One router skill drives a gated pipeline: inspect → define → research → de
 plan → build → ship. Every handoff lives in `.project/` so any session can resume from disk.
 
 **Hosts:** Codex, Claude Code, Grok, OpenCode, Antigravity, Cursor, and Kimi
-Code have a passing live milestone for release 1.6.2. Copilot CLI, Qwen, Zed,
+Code have a passing live milestone for release 1.7.1. Copilot CLI, Qwen, Zed,
 Kiro, and Muse Code install, but have no live milestone for that release. See
 [host tiers](README.md).
 

package/README.md

@@ -9,11 +9,11 @@ milestone loop. While a milestone builds, the next one can be planned in
 parallel under `.project/next/` (lookahead); a building milestone can also be
 abandoned on an explicit ruling, archiving its partial work for a re-slice.
 
-**Hosts with a passing full live milestone for release 1.6.2:** Codex, Claude
+**Hosts with a passing full live milestone for release 1.7.1:** Codex, Claude
 Code, Grok, OpenCode, Antigravity CLI, Cursor, and Kimi Code.
 
 **Hosts with an installer and a dispatch contract, but no live milestone for
-release 1.6.2:** GitHub Copilot CLI (account quota exhausted), Qwen Code, Zed,
+release 1.7.1:** GitHub Copilot CLI (account quota exhausted), Qwen Code, Zed,
 and Kiro (API credits), and Muse Code (no live release evidence recorded yet).
 These hosts are excluded from the release evaluation. Exclusion is not a pass.
 
@@ -24,16 +24,16 @@ The [host trust matrix](https://github.com/open-gsd/gsd-path/blob/main/docs/trus
 is the source of truth for live milestone proof and each host's guard tier.
 
 <!-- release-docs -->
-## What's new in 1.6.2 — 2026-10-17
+## What's new in 1.7.1 — 2026-10-31
 
-**Latest npm release:** [@opengsd/gsd-path@1.6.2](https://www.npmjs.com/package/@opengsd/gsd-path/v/1.6.2) — [release notes](CHANGELOG.md#162---2026-10-17)
+**Latest npm release:** [@opengsd/gsd-path@1.7.1](https://www.npmjs.com/package/@opengsd/gsd-path/v/1.7.1) — [release notes](CHANGELOG.md#171---2026-10-31)
 
 **Recent highlights**
-- keep the README What's new section current from release notes
-- read quoted STATE values in the ship checkpoint guard
-- refuse a build checkpoint while STATE is ship/active
-- keep evidence-line citations when final review reuses a wave
-- record 1.6.2 live host release evidence
+- scope reviews to agreed acceptance criteria
+- accept a resumed patch planner's re-entry checkpoint
+- Point current-release docs at 1.7.1 evidence
+- complete 1.7.1 release trust evidence
+- record Cursor proof and pending 1.7.1 release checks
 
 <!-- /release-docs -->
 
@@ -196,7 +196,8 @@ What the app does:
 - **Project setup:** runtime version, guard hooks, health check, and, for a
   multi-repo coordinator, member hooks and marker repair.
 - **Settings:** updates, Path settings (shipping mode, models, review panel),
-  watched folders, model prices, launch at login, and appearance.
+  watched folders, model prices, launch at login, appearance, and language
+  (English or Simplified Chinese).
 - **Stats** and the per-project **Environment** editor.
 - **Tray:** a compact project list, items that need attention, and controls
   to start, restart, and quit.
@@ -379,7 +380,7 @@ default branch of the coordinator and of the other members. See
 [ADR 0002](docs/adr/0002-multi-repo-coordinator.md) for the design.
 
 `MEMBERS.md` has one section per member, in ship order. `members.py` writes
-it; do not edit it by hand:
+it; do not edit it by hand (except `Prepare`, below):
 
 ```markdown
 ## web
@@ -394,6 +395,13 @@ records it one time, from the member's local `origin/HEAD`; run
 `git remote set-head origin --auto` in the member first. A section without
 the field means `main`. See [default branch](WORKFLOW.md#default-branch).
 
+`Prepare` is optional. It is a shell command that the runtime runs inside
+each fresh member isolate before any Verify, to provision what a bare
+worktree lacks (submodules, gitignored build inputs). It must copy, never
+link. `members.py` has no subcommand for it: add it to the member's section
+through a reviewed change. The `gsd-path` skill describes the rules and an
+offline submodule recipe.
+
 - Add members at a milestone boundary: ask the router to add an existing repo
   (`members.py add`) or to create a new one (`members.py add --create`, after
   you approve the exact owner, name, visibility, and checkout; a new

package/RUNTIME.md

@@ -33,8 +33,10 @@ never changes a recorded base, retries a failed mutation, or repairs state itsel
 Checkpoint inputs must use the top-level `.project` entries defined by
 [`isolation.PROJECT_ENTRIES`](scripts/isolation.py); ship verification uses the
 same allowlist. `isolation.py checkpoint` refuses pending paths under any other
-top-level entry and asks for their removal before checkpointing. This check does
-not inspect nested entries inside an allowed directory.
+top-level entry that still exist in the worktree and asks for their removal; a
+pending removal (`git rm`, `git mv`, or a deleted file) passes and the checkpoint
+commits it. This check does not inspect nested entries inside an allowed
+directory.
 
 For serial work, keep the returned verification sidecar until the coder finishes.
 Validate the full task diff, reproduce only that patch in the sidecar, compare the
@@ -68,7 +70,7 @@ skeptic attempts under `skeptics/`.
 | `skeptics --repo <root> --wave <N> --cycle <C> --child-command '<cmd>' [--wait <s>] [--child-timeout <s>]` | Step 7 skeptic branch: one read-only skeptic per `skeptic_groups` locator in its own sidecar at the recorded review base, briefed with the criterion, every observation, and the cited tasks verbatim; validate with `review_findings.py`, collect, retire, then rerun the helper. `none` without skeptic groups; `escalate` for structural blockers or the cycle cap. The skeptic files stay uncommitted for the fix-task or ruling checkpoint. |
 | `fix-tasks --repo <root> --wave <N> --cycle <C>` | Step 7 batching: one fix task per `review_findings.py collect` batch with the failed criteria and observations verbatim, lint-checked; `escalate` for structural blockers, skeptic groups, cycle cap, or all-refuted. |
 | `complete --repo <root>` | Completion: clean primary at `build/active` (or a crash-left `build/done`), no unfinished wave, the archive-time review cycle check (`discussion_validate.review_cycle_counts`: contiguous cycles, passing last cycle, panel and skeptic artifacts present); `workflow_run.py build-evidence` at HEAD; `pipeline_state.py transition` to `ship/active` with event `build done; final review pending`; checkpoint `build: complete milestone`. |
-| `finish --repo <root> --task-id <id>` | Recover first; return a proven landing without repeating Verify, or verify, land, record, and retire one returned task. Without a dispatch record, or when the newest record is settled and its base differs from the task's current in-progress base (a native retry after a driver block), read the primary task's in-progress state; if it lacks a recorded base, use the parallel task isolate's state only if that worktree is authorized. A blocked record at the same base still refuses the retry, except a host-dispatched record (no child command) while the task is still in progress at that base: `finish` may run again after a failed Verify. A deactivated isolate stays blocked. |
+| `finish --repo <root> --task-id <id>` | Recover first; return a proven landing without repeating Verify, or verify, land, record, and retire one returned task. Without a dispatch record, or when the newest record is settled and its base differs from the task's current in-progress base (a native retry after a driver block), read the primary task's in-progress state; if it lacks a recorded base, use the parallel task isolate's state only if that worktree is authorized. A blocked record at the same base still refuses the retry, except a host-dispatched record (no child command) while the task is still in progress at that base: `finish` may run again after a failed Verify. A deactivated isolate stays blocked. Receipt status `landed`, `question` (the child ended in a question), or `blocked`; a blocked receipt without a blocked entry carries a `reason`. |
 | `answer --repo <root> --task-id <id> --answer '<text>'` | Append `Orchestrator answer:` to the isolate's task Log; the next `round` redispatches that isolate. |
 | `status --repo <root>` | Every task's newest dispatch record. |
 

package/WORKFLOW.md

@@ -232,8 +232,10 @@ the user's ruling per applicable edge in INTENT.md `## Edge coverage`:
 `criterion SCn` (stated in a success criterion), `held-out` (a named test
 pins it), or `dismissed` with a reason. The prohibition probe asks what each
 criterion must never silently become and records kept items in
-`## Prohibitions` as `criterion SCn`, `judgment`, or `dismissed`. Define
-never rules on an edge itself. `scripts/check_handoffs.py intent` checks
+`## Prohibitions` as `criterion SCn`, `judgment`, or `dismissed`. An
+absence criterion ("X does not exist") must state its search space, its
+check, and the result that counts as absent; reviewers judge it over that
+space only. Define never rules on an edge itself. `scripts/check_handoffs.py intent` checks
 both tables before every approval question, and the `define/done` transition
 refuses an intent whose tables are incomplete. An INTENT.md without these
 sections predates the probes and is not rechecked.
@@ -334,6 +336,11 @@ exists).
 `.project/research/SYNTHESIS.md`, plus relevant existing code. **Output:**
 `.project/plan/PLAN.md` and one full task file per task in `.project/tasks/`.
 
+A failed plan revision records `plan/blocked`. The router stops there and asks
+for the correction or user decision named by the plan gate. It does not
+automatically restart planning. After resolving the blocker, invoke
+`$gsd-path-plan` explicitly; its resume records `planning resumed`.
+
 Order work by risk and dependency:
 
 1. Wave one burns down assumptions that could invalidate the plan.
@@ -366,8 +373,8 @@ require a verdict per owned SC id. Acceptance criteria,
 owned SCs, and Verify are the contract; the coder owns
 implementation decisions inside the stated constraints. The planner reads
 `.project/LESSONS.md` when present and assigns each wave a `Review depth` —
-`full`, `verify-only` for low-risk waves, or sparingly `deep` for
-irreversible or security-critical waves; wave 1 and any wave touching
+`full`, `verify-only` for low-risk waves, or `deep` only when INTENT.md
+records an explicit user request for adversarial review; wave 1 and any wave touching
 authentication, payments, data migration, or concurrency stays `full` or
 `deep`. PLAN.md Config may name an optional `review_panel` (`off` by
 default, or `detected` / a named family list). In program flow CHARTER.md

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@opengsd/gsd-path",
-  "version": "1.6.2",
+  "version": "1.7.1",
   "description": "Disk-backed AI agent pipeline. Docs: DOCS.md (start here), QUICK.md, FULL.md, UPDATE.md",
   "license": "MIT",
   "repository": {

package/scripts/_common.py

@@ -14,6 +14,7 @@ import sys
 # Runtime helpers must not modify their immutable installation.
 sys.dont_write_bytecode = True
 
+import atexit
 import contextlib
 import errno
 import json
@@ -23,9 +24,10 @@ import shlex
 import shutil
 import signal
 import subprocess
+import tempfile
 import time
 from pathlib import Path
-from typing import BinaryIO, Iterable, Iterator, List, Optional, Sequence, Tuple
+from typing import BinaryIO, Iterable, Iterator, List, Optional, Sequence, Set, Tuple
 
 
 # Chosen by what imports, not os.name, so tests can emulate Windows on POSIX.
@@ -65,6 +67,23 @@ VERIFY_LEDGER_PATH = ".project/build/verify-ledger.jsonl"
 VERIFY_RESULTS = ("pass", "fail")
 VERIFY_LEDGER_SCHEMA = "gsd-path/verify-ledger/v2"
 VERIFY_BLOCK_PATTERN = re.compile(r"```bash[ \t]*\n(?P<block>.*?)```", re.DOTALL)
+# The owner citation a withdrawn task tombstone must carry in its Log (#483).
+# One definition shared by every gate that reads the representation.
+WITHDRAWN_CITATION = re.compile(
+    r"^- Withdrawn — (?P<date>\d{4}-\d{2}-\d{2}): (?P<ruling>.+)$", re.MULTILINE)
+
+
+def withdrawn_citations(task_text: str) -> list[str]:
+    """The owner citations in a withdrawn task's Log, as `date: ruling`.
+
+    The Log is the append-only record of rulings; a Withdrawn line in any
+    other section is not the citation the gates accept (#483).
+    """
+    body = section_body(task_text, "Log")
+    if body is None:
+        return []
+    return [f"{m.group('date')}: {m.group('ruling')}"
+            for m in WITHDRAWN_CITATION.finditer(body)]
 
 REVIEW_BULLET_HEADING_PATTERN = re.compile(r"^#{2,3} ")
 REVIEW_BULLET_FIELD_LABEL_PATTERN = re.compile(r"^- \*\*[^*]+\*\*:")
@@ -197,6 +216,19 @@ def section_body(text: str, heading: str) -> Optional[str]:
     return match.group("body") if match else None
 
 
+def contract_shapes(body: str) -> Set[str]:
+    """The whitespace-normalized `- ` entries of an Interface contract body.
+
+    HTML comments are dropped and continuation lines join their entry. A
+    body that says only `None` has no shapes.
+    """
+    cleaned = re.sub(r"(?s)<!--.*?-->", "", body).strip()
+    if " ".join(cleaned.split()) in {"", "None", "- None"}:
+        return set()
+    entries = re.split(r"(?m)^-[ \t]+", cleaned)
+    return {shape for shape in (" ".join(entry.split()) for entry in entries) if shape}
+
+
 def overlapping_paths(left: Sequence[str], right: Sequence[str]) -> List[str]:
     """Return the sorted paths that two task `files` lists both cover.
 
@@ -875,8 +907,50 @@ def find_bash() -> str:
     )
 
 
+def _remove_quietly(path: str) -> None:
+    try:
+        os.remove(path)
+    except OSError:
+        pass
+
+
+def _command_script_dir() -> str:
+    """A temp directory for command scripts that cannot dirty the running tree.
+
+    TMPDIR/TEMP/TMP may point into the tree being verified, and a script file
+    there shows up in git status and blocks landings (#448), so fall back to a
+    system directory when the environment temp sits inside the current tree.
+    """
+    candidate = os.path.realpath(tempfile.gettempdir())
+    tree = os.path.realpath(os.getcwd())
+    if candidate != tree and not candidate.startswith(tree + os.sep):
+        return candidate
+    for fallback in (
+        os.path.join(os.environ.get("SystemRoot", r"C:\Windows"), "Temp"),
+        "/var/tmp",
+        "/tmp",
+    ):
+        resolved = os.path.realpath(fallback)
+        if os.path.isdir(resolved) and resolved != tree and not resolved.startswith(tree + os.sep):
+            return resolved
+    raise OSError("no temp directory outside the current worktree for a command script")
+
+
 def bash_argv(command: str) -> List[str]:
-    return [find_bash(), "-c", command]
+    if os.name != "nt":
+        return [find_bash(), "-c", command]
+    # Git for Windows' bash (MSYS2) cuts an argument that carries a double
+    # quote near 8 KB before bash sees it, so a long Verify dies mid-script
+    # or silently passes when the cut lands in comments (#448). Run the exact
+    # bytes from a temp file outside every worktree instead.
+    bash = find_bash()
+    descriptor, path = tempfile.mkstemp(
+        prefix="gsd-path-command-", suffix=".sh", dir=_command_script_dir()
+    )
+    with os.fdopen(descriptor, "w", encoding="utf-8", newline="\n") as handle:
+        handle.write(command)
+    atexit.register(_remove_quietly, path)
+    return [bash, path]
 
 
 # cmd.exe re-parses the arguments of a .cmd or .bat target, so these would

package/scripts/archive_milestone.py

@@ -781,7 +781,14 @@ def validate_panel_skip_receipt(path: Path, expected_mode: str) -> None:
         not isinstance(item, dict)
         or set(item) != {"family", "reason"}
         or item["family"] not in KNOWN_FAMILIES
-        or item["reason"] not in {"parent family", "not advertised", "cap"}
+        # review_panel resolve writes every one of these reasons (#460);
+        # the receipt must validate whatever the helper can produce.
+        or item["reason"] not in {
+            "parent family",
+            "not advertised",
+            "cap",
+            "excluded reviewer family",
+        }
         for item in skipped
     ):
         raise ArchiveError(f"{path.name} has invalid skipped families")
@@ -1998,6 +2005,62 @@ def member_ship_rows(project: Path, archive: Path, ship_commit: str) -> list:
     return rows
 
 
+def tag_metadata_fields(project: Path, tag_ref: str) -> dict[str, str]:
+    """The Key: value fields of an annotated milestone tag's message."""
+    message = require_git_success(
+        run_git(project, "for-each-ref", "--format=%(contents)", tag_ref),
+        "inspect milestone tag",
+    )
+    fields: dict[str, str] = {}
+    for line in message.splitlines():
+        match = re.fullmatch(r"(Mode|Pull-Request|Ship|Landing): (.+)", line)
+        if match:
+            if match.group(1) in fields:
+                raise ArchiveError("milestone tag repeats metadata")
+            fields[match.group(1)] = match.group(2)
+    return fields
+
+
+def accept_rebased_ship(
+    project: Path, archive: Path, ship_commit: str, reviewed_head: str
+) -> Optional[str]:
+    """Accept the rebased ship copy a rebase merge landed, keyed by the milestone tag.
+
+    Historical validation only (issue #450): after a rebase merge the landed
+    ship copy's parent is never the reviewed HEAD, so the strict check cannot
+    pass over landed history. Acceptance requires the milestone tag to name
+    exactly this commit as its Landing, the original ship commit the tag
+    names to still resolve, the strict invariant re-proven against the
+    original ship's parent, and the rebase replay to hold. Returns the tag's
+    original Ship sha, or None when the landing is not a proven rebase: a
+    landing whose originals no longer resolve anywhere is refused, because
+    the per-task landing proofs elsewhere in validation pin the original
+    commits and a tag receipt alone cannot carry a full validation.
+    """
+    tag_ref = f"refs/tags/milestone/{archive.name}"
+    if run_git(project, "rev-parse", "--verify", "--quiet", tag_ref).returncode != 0:
+        return None
+    try:
+        fields = tag_metadata_fields(project, tag_ref)
+    except ArchiveError:
+        return None
+    if fields.get("Mode") != "pull-request":
+        return None
+    original = fields.get("Ship")
+    if not original or fields.get("Landing") != ship_commit:
+        return None
+    if run_git(project, "cat-file", "-e", f"{original}^{{commit}}").returncode != 0:
+        return None
+    original_parent = require_git_success(
+        run_git(project, "rev-parse", f"{original}^"), "resolve original ship parent"
+    )
+    if not reviewed_head_covers(project, reviewed_head, original_parent):
+        return None
+    if _common.rebase_landing_problem(project, original, ship_commit) is not None:
+        return None
+    return original
+
+
 def validate(repo: Path, *, historical: bool = False) -> dict:
     project, _, state, configured, archive, archived_files, reviewed_head = prepared_transaction(
         repo,
@@ -2093,11 +2156,17 @@ def validate(repo: Path, *, historical: bool = False) -> dict:
 
     members = member_ship_rows(project, archive, ship_commit)
     ship_parent = require_git_success(run_git(project, "rev-parse", f"{ship_commit}^"), "resolve ship parent")
+    rebased_ship: Optional[str] = None
     if not reviewed_head_covers(project, reviewed_head, ship_parent):
-        raise ArchiveError(
-            f"FINAL.md Reviewed HEAD {reviewed_head} does not match ship parent {ship_parent}; "
-            f"{_common.RUNTIME_PIN_ALLOWANCE}"
+        rebased_ship = (
+            accept_rebased_ship(project, archive, ship_commit, reviewed_head)
+            if historical else None
         )
+        if rebased_ship is None:
+            raise ArchiveError(
+                f"FINAL.md Reviewed HEAD {reviewed_head} does not match ship parent {ship_parent}; "
+                f"{_common.RUNTIME_PIN_ALLOWANCE}"
+            )
     require_canonical_commit_body(
         project,
         ship_commit,
@@ -2141,6 +2210,8 @@ def validate(repo: Path, *, historical: bool = False) -> dict:
         )
 
     result = {"archive": configured, "commit": ship_commit}
+    if rebased_ship is not None:
+        result["rebased_ship"] = rebased_ship
     if members:
         result["members"] = members
     return result
@@ -2178,6 +2249,15 @@ def parser() -> argparse.ArgumentParser:
     )
     validate_integrated_parser.add_argument("--repo", required=True, type=Path)
     validate_integrated_parser.add_argument("--slug", required=True)
+    validate_integrated_parser.add_argument(
+        "--historical",
+        action="store_true",
+        help=(
+            "validate from the landed default branch after the milestone closed "
+            "(the bound branch may be gone; a rebase-merged landing is proven "
+            "through the milestone tag)"
+        ),
+    )
 
     refresh_parser = subparsers.add_parser(
         "refresh-origin",
@@ -2190,6 +2270,17 @@ def parser() -> argparse.ArgumentParser:
         help="after preflight, integrate each locked member in lock order before the ship commit",
     )
     close_members_parser.add_argument("--repo", required=True, type=Path)
+    close_members_parser.add_argument(
+        "--adopt-landed-member",
+        action="append",
+        default=[],
+        metavar="MEMBER=SHA",
+        help=(
+            "user-approved recovery for a member whose reviewed HEAD already reached its "
+            "default branch outside Path; MEMBER=SHA names the live default-branch tip "
+            "to adopt as the landing"
+        ),
+    )
 
     integrate_parser = subparsers.add_parser(
         "integrate",
@@ -2197,6 +2288,16 @@ def parser() -> argparse.ArgumentParser:
     )
     integrate_parser.add_argument("--repo", required=True, type=Path)
     integrate_parser.add_argument("--slug", required=True)
+    integrate_parser.add_argument(
+        "--adopt-published-bound",
+        metavar="SHA",
+        help=(
+            "user-approved recovery when origin's bound branch is a strict ancestor "
+            "of the ship commit (a build task pushed it as a deploy pin, #464); "
+            "the 40-hex SHA must equal the live remote tip exactly; the publish "
+            "fast-forwards under the existing exact lease. Direct integration only"
+        ),
+    )
 
     abandon_parser = subparsers.add_parser(
         "abandon",
@@ -2225,13 +2326,34 @@ def main(argv: Optional[Sequence[str]] = None) -> int:
         elif arguments.command == "abandon":
             result = abandon(arguments.repo, arguments.slug, arguments.reason)
         elif arguments.command == "validate-integrated":
-            result = integration.validate_integrated(arguments.repo, arguments.slug)
+            result = integration.validate_integrated(
+                arguments.repo, arguments.slug, historical=arguments.historical
+            )
         elif arguments.command == "refresh-origin":
             result = integration.refresh_origin(arguments.repo)
         elif arguments.command == "close-members":
-            result = integration.close_members(arguments.repo)
+            adopt: dict[str, str] = {}
+            for item in arguments.adopt_landed_member:
+                name, separator, sha = item.partition("=")
+                if not name or not separator or not re.fullmatch(r"[0-9a-f]{40}", sha):
+                    parser_error = (
+                        f"--adopt-landed-member expects MEMBER=SHA (40-hex), got {item!r}"
+                    )
+                    print(parser_error, file=sys.stderr)
+                    return 2
+                adopt[name] = sha
+            result = integration.close_members(arguments.repo, adopt=adopt or None)
         elif arguments.command == "integrate":
-            result = integration.integrate(arguments.repo, arguments.slug)
+            adopt_bound = arguments.adopt_published_bound
+            if adopt_bound is not None:
+                adopt_bound = adopt_bound.lower()
+            if adopt_bound is not None and not re.fullmatch(r"[0-9a-f]{40}", adopt_bound):
+                print(
+                    f"--adopt-published-bound expects a 40-hex SHA, got {adopt_bound!r}",
+                    file=sys.stderr,
+                )
+                return 2
+            result = integration.integrate(arguments.repo, arguments.slug, adopt_bound)
         else:
             result = validate(arguments.repo)
     except (ArchiveError, OSError) as error: