Add outcome-sensitive Bash cwd analysis

IMPLEMENTATION_PLAN.md

@@ -293,6 +293,9 @@ priorities.
       decoded-wrapper state, and dynamic fail-closed compatibility attribution
       whenever cwd joins to Unknown. Keep OpenSpec task 6.5 open, then add the
       remaining loop cases and Netclaw approval matrix after implementation.
+      The non-loop state engine is now implemented for lists, pipelines,
+      substitutions, subshells, and decoded wrappers; loop iteration state and
+      removal of the temporary mutation rejection remain next.
 - [ ] Complete PowerShell `$()` discovery in `foreach` expressions and add the
       Netclaw approval-matrix cases. The simple-command slice is delivered for
       ordinary, adjacent, quoted, here-string, redirect, standalone,

openspec/changes/v0-3-structured-shell-analysis/specs/bounded-shell-analysis/spec.md

@@ -297,6 +297,14 @@ unless all executable regions and transfers are discovered.
 - **THEN** the `pwd` cwd is unknown because `cd` may fail and `;` still continues
 - **THEN** the analyzer does not publish `/maybe` as the sole cwd
 
+#### Scenario: Bash cd environment and physical resolution stay explicit
+- **WHEN** Bash parses a bare relative `cd sub` without proved `CDPATH` and `cdable_vars` state
+- **THEN** the successful cwd is unknown rather than a lexical `<cwd>/sub` guess
+- **WHEN** Bash parses `cd ./sub` or `cd ../sub` with an exact incoming cwd
+- **THEN** the successful cwd may remain exact because those operands bypass directory search
+- **WHEN** Bash parses `cd -P`, `cd -@`, `pushd`, or `popd` without the required filesystem or directory-stack facts
+- **THEN** the successful cwd is unknown
+
 #### Scenario: Zero-iteration loop path
 - **WHEN** a loop may execute zero times and its body changes cwd
 - **THEN** the post-loop state includes the pre-loop possibility

openspec/changes/v0-3-structured-shell-analysis/specs/consumer-compatibility/spec.md

@@ -47,6 +47,22 @@ signal.
 - **THEN** the clause contains a synthetic `<dynamic-cwd>` `DynamicSkip` attribution argument with `Resolved=null`
 - **THEN** no synthetic cwd-attribution argument selects one possible exact path
 
+#### Scenario: Cwd rebasing preserves resolver-owned operand semantics
+- **WHEN** an executable-specific rule transforms an authored path operand such as curl `@../request.json`
+- **THEN** outcome-sensitive cwd rebasing uses the retained logical resolver operand rather than reconstructing it from `Arg.Raw` or `ClauseElement.Value`
+- **THEN** split and equals-form options update their exact corresponding Arg and ClauseElement coordinates
+- **THEN** decoded wrappers retain the same resolver provenance while inheriting their invocation cwd
+
+#### Scenario: Exact outcome partition recovers a cwd-blocked path
+- **WHEN** parse-order attribution initially makes a relative argument or redirect dynamic, but outcome analysis later proves its execution cwd exact
+- **THEN** retained path-slot provenance permits an exact compatibility path without rescanning decoded text
+- **THEN** a sibling partition whose cwd remains unknown keeps the operand dynamic
+
+#### Scenario: Dynamic redirect preserves authored target spelling
+- **WHEN** a quoted relative redirect target becomes dynamic after cwd outcomes join
+- **THEN** its compatibility `Redirect.Target` retains the target-only authored spelling including quotes
+- **THEN** the redirect is marked `IsDynamicSkip=true` and its ClauseElement exact resolution is cleared
+
 ### Requirement: Unparseable results are never authorization evidence
 When `ParsedCommand.IsUnparseable=true`, `Commands` and `Clauses` SHALL be
 empty. `Syntax` MAY contain partial diagnostic evidence, and the consumer guide

openspec/changes/v0-3-structured-shell-analysis/tasks.md

@@ -77,6 +77,11 @@
     conservative `lastpipe` / `pipefail`, ordered iteration plans,
     decoded-wrapper inheritance, and dynamic fail-closed compatibility
     sanitization before implementing the state pass.
+  - [x] 6.5b Apply outcome-sensitive cwd analysis to existing Bash lists,
+    pipelines, substitutions, subshells, and decoded wrappers; rebase exact
+    compatibility paths and retain `<dynamic-cwd>` after conservative joins.
+  - [ ] 6.5c Carry ordered loop binding and cwd state through zero-or-more
+    iterations, then remove the temporary loop-mutation rejection.
   - The first static-value slice deliberately leaves occurrence cwd Unknown
     and rejects loop shell-state mutation, nested active-binding reuse, or
     loops reached after recognized prior shell-state mutation. A separate