@opengsd/gsd-core 1.11.0 → 1.13.0

package/gsd-core/bin/lib/model-catalog.cjs

@@ -10,11 +10,12 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
     return (mod && mod.__esModule) ? mod : { "default": mod };
 };
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.RUNTIMES_WITH_FAST_MODE = exports.EFFORT_ARGV = exports.EFFORT_RENDERING = exports.CLAUDE_AGENT_ALIASES = exports.KNOWN_PROVIDERS = exports.PROVIDER_PRESETS = exports.RUNTIMES_WITH_REASONING_EFFORT = exports.KNOWN_RUNTIMES = exports.RUNTIME_PROFILE_MAP = exports.MODEL_ALIAS_MAP = exports.AGENT_DEFAULT_TIERS = exports.AGENT_TO_PHASE_TYPE = exports.MODEL_PROFILES = exports.ADAPTIVE_TIER_VALUES = exports.VALID_TIERS = exports.VALID_AGENT_TIERS = exports.VALID_PHASE_TYPES = exports.VALID_PROFILES = exports.catalog = void 0;
+exports.RUNTIMES_WITH_FAST_MODE = exports.EFFORT_ARGV = exports.EFFORT_RENDERING = exports.CLAUDE_AGENT_ALIASES = exports.KNOWN_PROVIDERS = exports.CODEX_MODEL_EFFORT = exports.PROVIDER_PRESETS = exports.RUNTIMES_WITH_REASONING_EFFORT = exports.KNOWN_RUNTIMES = exports.RUNTIME_PROFILE_MAP = exports.MODEL_ALIAS_MAP = exports.AGENT_DEFAULT_TIERS = exports.AGENT_TO_PHASE_TYPE = exports.MODEL_PROFILES = exports.ADAPTIVE_TIER_VALUES = exports.VALID_TIERS = exports.VALID_AGENT_TIERS = exports.VALID_PHASE_TYPES = exports.VALID_PROFILES = exports.catalog = void 0;
 exports.isAnthropicFlavoredModel = isAnthropicFlavoredModel;
 exports.nextTier = nextTier;
 exports.formatAgentToModelMapAsTable = formatAgentToModelMapAsTable;
 exports.getAgentToModelMapForProfile = getAgentToModelMapForProfile;
+exports.clampEffortForHost = clampEffortForHost;
 exports.renderEffortArgv = renderEffortArgv;
 exports.renderEffortForRuntime = renderEffortForRuntime;
 exports.mergeEffortTierDefaults = mergeEffortTierDefaults;
@@ -99,6 +100,38 @@ exports.RUNTIMES_WITH_REASONING_EFFORT = new Set(Object.entries(_catalog.runtime
     .filter(([, tiers]) => Object.values(tiers).some((entry) => entry && entry.reasoning_effort))
     .map(([runtime]) => runtime));
 exports.PROVIDER_PRESETS = _catalog.providerPresets ?? {};
+// ─── #3007 — Codex per-model effort capability ───────────────────────────────
+//
+// Codex's own `models.json` publishes `supported_reasoning_levels` per model and
+// rejects an unsupported level at request time, so GSD must be conservative
+// about what it sends: read the ceiling as DATA from the catalog (never
+// branch on model id in code) and fall back to the family baseline for any
+// model the catalog doesn't know about.
+// (b) A malformed catalog entry (e.g. a non-array value like `"gpt-x": 5`) must
+// degrade to "ignore that entry", never throw — model-catalog.cjs is required
+// across the whole CLI, so one bad JSON value must not kill every command.
+// `new Set(5)` would throw at module load; filter to array values first.
+exports.CODEX_MODEL_EFFORT = Object.fromEntries(Object.entries(_catalog.codexModelEffort ?? {})
+    .filter(([, levels]) => Array.isArray(levels))
+    .map(([model, levels]) => [model, new Set(levels)]));
+// (a) `??` only catches null/undefined. A malformed `"_baseline": null` still
+// produces `new Set(null)` above — an empty Set, which is truthy — so a bare
+// `??` fallback would never fire and every level would silently lose its
+// advertised set (every effort would render as `value: null`). Guard on
+// `.size > 0` so an empty/missing/malformed baseline always falls back to the
+// hardcoded floor instead of failing open.
+const CODEX_EFFORT_BASELINE = exports.CODEX_MODEL_EFFORT['_baseline'] && exports.CODEX_MODEL_EFFORT['_baseline'].size > 0
+    ? exports.CODEX_MODEL_EFFORT['_baseline']
+    : new Set(['low', 'medium', 'high', 'xhigh', 'max']);
+function advertisedCodexEffort(model) {
+    if (typeof model !== 'string' || model.length === 0)
+        return CODEX_EFFORT_BASELINE;
+    return Object.prototype.hasOwnProperty.call(exports.CODEX_MODEL_EFFORT, model) ? exports.CODEX_MODEL_EFFORT[model] : CODEX_EFFORT_BASELINE;
+}
+// The full universal effort ladder, low-to-high. Used only to find "the
+// nearest advertised level below" when a requested level isn't supported —
+// never to invent behaviour for a level that isn't on it at all.
+const EFFORT_LADDER = ['minimal', 'low', 'medium', 'high', 'xhigh', 'max', 'ultra'];
 // KNOWN_PROVIDERS excludes 'generic' — it is a sentinel (all null entries) that
 // forces users to supply model IDs via model_profile_overrides. It is not a
 // real catalog-backed provider (#49).
@@ -124,7 +157,10 @@ exports.KNOWN_PROVIDERS = new Set(Object.entries(exports.PROVIDER_PRESETS)
 // rejects all of these.
 exports.CLAUDE_AGENT_ALIASES = new Set(['opus', 'sonnet', 'haiku', 'fable']);
 function isAnthropicFlavoredModel(model) {
-    return typeof model === 'string' && (exports.CLAUDE_AGENT_ALIASES.has(model) || model.toLowerCase().includes('claude'));
+    if (typeof model !== 'string')
+        return false;
+    const lower = model.toLowerCase();
+    return exports.CLAUDE_AGENT_ALIASES.has(lower) || lower.includes('claude');
 }
 function nextTier(currentTier) {
     const order = ['light', 'standard', 'heavy'];
@@ -165,12 +201,21 @@ exports.EFFORT_RENDERING = {
         },
     },
     codex: {
+        // #3007: 'max' and 'minimal' are stale here — Codex's per-model table
+        // (CODEX_MODEL_EFFORT above) is now the source of truth for what a given
+        // model actually advertises, and every model in the family baseline DOES
+        // advertise 'max' (no model advertises 'minimal'). This runtime-level
+        // spec is kept in sync with the family baseline so the two tables can
+        // never disagree; renderEffortForRuntime layers the per-model ceiling
+        // (and the 'ultra' policy rejection) on top of it.
+        // KEEP IN SYNC with EFFORT_ARGV.codex below — same family baseline, two
+        // channels (install-time vs invocation-time); they must never diverge.
         param: 'model_reasoning_effort',
         channel: 'api',
-        supported: new Set(['minimal', 'low', 'medium', 'high', 'xhigh']),
+        supported: new Set(['low', 'medium', 'high', 'xhigh', 'max']),
         clamp(level) {
-            if (level === 'max')
-                return 'xhigh';
+            if (level === 'minimal')
+                return 'low';
             return level;
         },
     },
@@ -191,12 +236,45 @@ exports.EFFORT_ARGV = {
     },
     // First-party Codex docs: `model_reasoning_effort` is a config-only key with no
     // dedicated flag, so the generic `-c key=value` override is the only argv route.
+    // #3007: KEEP IN SYNC with EFFORT_RENDERING.codex above — this table must match
+    // the family baseline exactly (no 'minimal', 'max' passes through unclamped),
+    // otherwise the argv channel and the install-time channel disagree about the
+    // same runtime's capability.
     codex: {
         render: (level) => ['-c', `model_reasoning_effort=${level}`],
-        supported: new Set(['minimal', 'low', 'medium', 'high', 'xhigh']),
-        clamp: (level) => (level === 'max' ? 'xhigh' : level),
+        supported: new Set(['low', 'medium', 'high', 'xhigh', 'max']),
+        clamp: (level) => (level === 'minimal' ? 'low' : level),
     },
 };
+/**
+ * Clamp a universal effort level to what a host actually accepts, or null.
+ *
+ * #3706 — extracted from `renderEffortArgv` so the two effort CHANNELS can share
+ * one capability table without one pretending to be the other. `EFFORT_ARGV[host]`
+ * describes what levels the host understands (`supported` + `clamp`); whether that
+ * reaches the host as a CLI flag or as a baked frontmatter key is the caller's
+ * business. The install-time OpenCode `variant:` writer needs the former without
+ * the latter, and hardcoding `'argv'` at that call site to borrow this logic read
+ * as if the frontmatter key were gated on the invocation-time axis. It is not —
+ * claude declares `effortSurface: "argv"` and independently bakes an `effort:` key.
+ *
+ * Returns null for a level the host does not accept, which every caller treats as
+ * "emit nothing". `inherit` lands here too: per #3533 (10d) it is not a wire level
+ * on any runtime, so it is in no `supported` set and must never be written out.
+ */
+function clampEffortForHost(host, universalEffort) {
+    // Own-property lookup only: a plain `EFFORT_ARGV[host]` resolves `__proto__`
+    // and friends to inherited members that carry no clamp/render.
+    if (typeof host !== 'string' || !Object.prototype.hasOwnProperty.call(exports.EFFORT_ARGV, host))
+        return null;
+    const spec = exports.EFFORT_ARGV[host];
+    if (!spec || typeof spec.clamp !== 'function')
+        return null;
+    if (typeof universalEffort !== 'string' || universalEffort.length === 0)
+        return null;
+    const clamped = spec.clamp(universalEffort);
+    return spec.supported.has(clamped) ? clamped : null;
+}
 /**
  * Render the invocation-time effort argument for a host.
  *
@@ -212,37 +290,117 @@ function renderEffortArgv(host, universalEffort, effortSurface) {
     // (and `constructor`/`toString`) to inherited members, which are truthy but
     // carry no `clamp`/`render` — a hostile host id would throw instead of
     // degrading. The host id reaches here from a descriptor, i.e. untrusted JSON.
-    if (typeof host !== 'string' || !Object.prototype.hasOwnProperty.call(exports.EFFORT_ARGV, host))
+    // #3706: the clamp/supported half lives in clampEffortForHost so the
+    // install-time channel can reuse it; this function keeps the axis gate and
+    // the argv rendering. One table, one clamp, two channels.
+    const clamped = clampEffortForHost(host, universalEffort);
+    if (clamped === null)
         return empty;
     const spec = exports.EFFORT_ARGV[host];
-    if (!spec || typeof spec.clamp !== 'function' || typeof spec.render !== 'function')
-        return empty;
-    if (typeof universalEffort !== 'string' || universalEffort.length === 0)
-        return empty;
-    const clamped = spec.clamp(universalEffort);
-    if (!spec.supported.has(clamped))
+    if (typeof spec.render !== 'function')
         return empty;
     return { argv: spec.render(clamped), value: clamped, host };
 }
 /**
  * Render a universal effort string for a specific runtime.
+ *
+ * `model` (#3007) is consulted ONLY for codex: Codex's per-model
+ * `supported_reasoning_levels` means the same universal level can be a clean
+ * pass-through on one model and a clamp (or, for 'ultra', an outright
+ * rejection) on another. Every other runtime ignores the third argument
+ * entirely — passing a model id to claude changes nothing.
  */
-function renderEffortForRuntime(runtime, universalEffort) {
+function renderEffortForRuntime(runtime, universalEffort, model) {
     // #3533 (10d): 'inherit' is not a wire level on ANY runtime — it means
     // "omit the key / pass no argument and follow the session/host default".
     // Renderers must never emit it as a literal; null param/channel tells
-    // resolve-execution consumers there is no propagation.
+    // resolve-execution consumers there is no propagation. Never measured
+    // against any supported set.
     if (universalEffort === 'inherit') {
-        return { value: 'inherit', param: null, channel: null };
+        return { value: 'inherit', param: null, channel: null, requested: 'inherit', clamped: false, reason: null };
     }
     const spec = exports.EFFORT_RENDERING[runtime];
     if (!spec) {
-        return { value: universalEffort, param: null, channel: null };
+        return { value: universalEffort, param: null, channel: null, requested: universalEffort, clamped: false, reason: null };
+    }
+    if (runtime === 'codex') {
+        // #2167 — 'ultra' turns on Codex's automatic task delegation, which would
+        // let Codex spawn agents underneath GSD's own orchestration. GSD rejects
+        // it unconditionally as a POLICY call, never as a capability clamp — this
+        // holds even for a model (e.g. gpt-5.6-sol) that DOES advertise 'ultra',
+        // so it is never softened down to 'max'.
+        if (universalEffort === 'ultra') {
+            return {
+                value: null,
+                param: null,
+                channel: null,
+                requested: 'ultra',
+                clamped: false,
+                reason: "'ultra' turns on Codex's automatic task delegation, which would let Codex spawn agents underneath GSD's own orchestration (#2167); GSD rejects it regardless of what the model advertises.",
+            };
+        }
+        const allowed = advertisedCodexEffort(model);
+        if (allowed.has(universalEffort)) {
+            return { value: universalEffort, param: spec.param, channel: spec.channel, requested: universalEffort, clamped: false, reason: null };
+        }
+        const idx = EFFORT_LADDER.indexOf(universalEffort);
+        if (idx === -1) {
+            // Not on the ladder at all (e.g. 'MAX') — preserve prior behaviour:
+            // fall through to the runtime-level clamp rather than inventing new
+            // handling for input the ladder doesn't recognize.
+            return { value: spec.clamp(universalEffort), param: spec.param, channel: spec.channel, requested: universalEffort, clamped: false, reason: null };
+        }
+        // Every model's advertised set is a contiguous run up to 'max' (or 'ultra'
+        // for sol, already handled above), so the only unsupported level in
+        // practice is 'minimal' — below every model's floor. Walk UP the ladder
+        // to the nearest level the model actually advertises (its floor): there
+        // is nothing below 'minimal' to fall back to.
+        // Walking UP is safe today only because every advertised set floors at
+        // 'low' — a future model whose floor is, say, 'high' would silently turn
+        // a requested 'low' into 'high': MORE reasoning and MORE cost than asked
+        // for, with no error. `clamped`/`reason` below is what makes that
+        // escalation visible to a caller instead of a silent cost surprise, which
+        // is why those fields are not optional decoration.
+        for (let i = idx + 1; i < EFFORT_LADDER.length; i++) {
+            const candidate = EFFORT_LADDER[i];
+            // 'ultra' is never a valid clamp target: it would re-enter, by the back
+            // door, the delegation mode the #2167 rejection above exists to keep
+            // out. A clamp may never produce a value that a direct request for
+            // that same value would have refused.
+            if (candidate === 'ultra') {
+                continue;
+            }
+            if (allowed.has(candidate)) {
+                return {
+                    value: candidate,
+                    param: spec.param,
+                    channel: spec.channel,
+                    requested: universalEffort,
+                    clamped: true,
+                    reason: `requested '${universalEffort}' is not in ${model ? `${model}'s` : "the codex family baseline's"} advertised reasoning levels; clamped up to its floor, '${candidate}'.`,
+                };
+            }
+        }
+        // No advertised level at or above the request either (shouldn't happen
+        // given today's catalog data, but never throw): reject rather than emit
+        // an unsupported level.
+        return {
+            value: null,
+            param: null,
+            channel: null,
+            requested: universalEffort,
+            clamped: false,
+            reason: `requested '${universalEffort}' is not in ${model ? `${model}'s` : "the codex family baseline's"} advertised reasoning levels, and no advertised level is available either.`,
+        };
     }
+    const value = spec.clamp(universalEffort);
     return {
-        value: spec.clamp(universalEffort),
+        value,
         param: spec.param,
         channel: spec.channel,
+        requested: universalEffort,
+        clamped: value !== universalEffort,
+        reason: value !== universalEffort ? `requested '${universalEffort}' clamped to '${value}' for ${runtime}.` : null,
     };
 }
 /**

package/gsd-core/bin/lib/model-resolver.cjs

@@ -35,6 +35,7 @@ const model_catalog_cjs_1 = require("./model-catalog.cjs");
 const node_fs_1 = __importDefault(require("node:fs"));
 const node_path_1 = __importDefault(require("node:path"));
 const runtime_name_policy_cjs_1 = require("./runtime-name-policy.cjs");
+const runtime_slash_cjs_1 = require("./runtime-slash.cjs");
 // eslint-disable-next-line @typescript-eslint/no-require-imports
 const planningWorkspaceMod = require("./planning-workspace.cjs");
 const { planningDir } = planningWorkspaceMod;
@@ -58,38 +59,19 @@ const { planningDir } = planningWorkspaceMod;
 // registry-parity test guards this set so a future alias-capable runtime fails
 // loudly here instead of silently omitting.
 const RUNTIMES_WITH_NATIVE_ALIASES = new Set(['claude']);
-let _installMarkerCache;
-function readInstallRuntimeMarker() {
-    if (_installMarkerCache !== undefined)
-        return _installMarkerCache;
-    try {
-        const markerPath = node_path_1.default.join(__dirname, '..', '..', '.gsd-runtime');
-        const raw = node_fs_1.default.readFileSync(markerPath, 'utf8').trim();
-        _installMarkerCache = raw || null;
-    }
-    catch {
-        // No marker: dev/source tree, or an install predating #2297. Fall through to
-        // the 'claude' default (keeps tier aliases — never worse than the bug).
-        _installMarkerCache = null;
-    }
-    return _installMarkerCache;
-}
-// Test seams for the install-marker rung (the dev/source tree has no marker, so
-// the file read always bottoms out at 'claude' — these let tests exercise the
-// third precedence rung and reset the module-level cache between cases).
-function _setInstallRuntimeMarkerForTests(value) {
-    _installMarkerCache = value;
-}
-function _resetInstallRuntimeMarkerCacheForTests() {
-    _installMarkerCache = undefined;
-}
+// #3897 rung 2: the marker reader + its cache and test seams were promoted to
+// the canonical owner, `runtime-slash.cts` (imported above) — this module now
+// consumes that single implementation instead of holding its own copy. N5:
+// behaviour and the seam contract are unchanged by the move; the re-exports
+// below (`export =` at the bottom of this file) preserve every existing
+// caller's `require('./model-resolver.cjs')` surface byte-for-behaviour.
 // The runtime whose install is actually resolving, canonicalized so an alias or
 // case variant (e.g. "claude-code"/"Claude") cannot defeat the native-alias
 // check below (#2297 review). Precedence mirrors resolveRuntime()
 // (runtime-slash.cts): GSD_RUNTIME env → project config.runtime → per-install
 // .gsd-runtime marker → 'claude'.
 function resolveActiveRuntime(config) {
-    return (0, runtime_name_policy_cjs_1.resolveRuntimeNameFromCandidates)(process.env['GSD_RUNTIME'], config['runtime'], readInstallRuntimeMarker()) || 'claude';
+    return (0, runtime_name_policy_cjs_1.resolveRuntimeNameFromCandidates)(process.env['GSD_RUNTIME'], config['runtime'], (0, runtime_slash_cjs_1.readInstallRuntimeMarker)()) || 'claude';
 }
 // Did the PROJECT's own config (root `.planning/config.json` or the active
 // workstream/project override) explicitly set resolve_model_ids to "omit"?
@@ -841,8 +823,8 @@ module.exports = {
     resolveTierFromConfig,
     _resetModelPolicyWarningCacheForTests,
     _resetModelOverrideWarningCacheForTests,
-    _setInstallRuntimeMarkerForTests,
-    _resetInstallRuntimeMarkerCacheForTests,
+    _setInstallRuntimeMarkerForTests: runtime_slash_cjs_1._setInstallRuntimeMarkerForTests,
+    _resetInstallRuntimeMarkerCacheForTests: runtime_slash_cjs_1._resetInstallRuntimeMarkerCacheForTests,
     VALID_GRANULARITIES,
     resolveGranularityInternal,
     assertValidGranularityOverride,

package/gsd-core/bin/lib/onboard-projection.cjs

@@ -117,7 +117,11 @@ function listPlanningDocCandidates(cwd) {
     return [...candidates].sort();
 }
 function listCodebaseMapFiles(cwd) {
-    const codebaseDir = node_path_1.default.join(planningRoot(cwd), 'codebase');
+    // #3964: project-scoped, agreeing with init's map-codebase surface and
+    // verify.cts's codebase drift check — a flat-root read made
+    // has_codebase_map/needs_codebase_map answer for the wrong project under
+    // GSD_PROJECT.
+    const codebaseDir = node_path_1.default.join(planningDir(cwd), 'codebase');
     if (!node_fs_1.default.existsSync(codebaseDir))
         return [];
     return REQUIRED_CODEBASE_MAP_FILES.filter((file) => node_fs_1.default.existsSync(node_path_1.default.join(codebaseDir, file)));

package/gsd-core/bin/lib/phase-command-router.cjs

@@ -6,7 +6,7 @@
  * Unsupported in this router:
  * - scaffold: routed through top-level scaffold command.
  *
- * CJS-only subcommands: mvp-mode (dispatched directly, before hub).
+ * CJS-only subcommands: mvp-mode, tdd-applicable (dispatched directly, before hub).
  *
  * #3788: dispatch is mediated by CommandRoutingHub. The public entry point
  * and observable CLI behaviour are unchanged.
@@ -57,6 +57,13 @@ function routePhaseCommand({ phase, args, cwd, raw, error }) {
         phase.cmdPhaseMvpMode(cwd, args.slice(2), raw);
         return;
     }
+    // `tdd-applicable` (#4273): same CJS-native dispatch shape as `mvp-mode`
+    // immediately above — a precedence cascade over plan/task/config sources
+    // with its own typed JSON result, not routed through the SDK query layer.
+    if (subcommand === 'tdd-applicable') {
+        phase.cmdPhaseTddApplicable(cwd, args.slice(2), raw);
+        return;
+    }
     // ── Build the CJS registry ──────────────────────────────────────────────────
     // Each handler receives a ctx object from the hub and must return a HubResult.
     const cjsRegistry = {
@@ -224,14 +231,14 @@ function routePhaseCommand({ phase, args, cwd, raw, error }) {
     // ── Build manifest (available subcommands for UnknownCommand detection) ─────
     // `availableSubcommands` is what the error message shows. It excludes
     // unsupported commands (already handled above) but does NOT include 'mvp-mode'
-    // because it was absent from PHASE_SUBCOMMANDS in the original and was not
-    // shown in the "Available:" list there either.
+    // or 'tdd-applicable' (#4273) because both are absent from PHASE_SUBCOMMANDS
+    // and were not shown in the "Available:" list there either.
     //
     // `manifestSubcommands` is the full routing set for the hub — it includes
-    // 'mvp-mode' (which the original code routed via a handler even without a
-    // manifest entry) so the hub's UnknownCommand check passes for it.
+    // 'mvp-mode' and 'tdd-applicable' (both routed via a handler even without a
+    // manifest entry) so the hub's UnknownCommand check passes for them.
     const availableSubcommands = command_aliases_cjs_1.PHASE_SUBCOMMANDS.filter(s => !UNSUPPORTED[s]);
-    const manifestSubcommands = ['mvp-mode', ...availableSubcommands];
+    const manifestSubcommands = ['mvp-mode', 'tdd-applicable', ...availableSubcommands];
     const manifest = { phase: manifestSubcommands };
     // ── Construct hub ──────────────────────────────────────────────────────────
     // #175: Hub is CJS-only — no mode param, no sdkLoader.

package/gsd-core/bin/lib/phase-estimation.cjs

@@ -218,14 +218,23 @@ function applyCalibration(rawTokens, factor) {
  * Extract a two-space-indented scalar block (`estimate:` / `actuals:`) out of a
  * document's leading YAML frontmatter.
  *
- * Hand-rolled because gsd-core ships no external dependencies (CONTRIBUTING.md
- * "No external dependencies in core") — js-yaml is a devDependency and is not
- * available at runtime. Scope is deliberately narrow: the leading `---` block
- * only, so a `estimate:` line inside a fenced code block in the body cannot be
- * mistaken for frontmatter (the DEFECT.FRONTMATTER-SCALAR-BROAD-GREP class).
- *
- * Numeric-looking values are returned as numbers so parseEstimate/parseActuals
- * see the types they validate; everything else stays a string.
+ * Hand-rolled for its TYPE CONTRACT, not for dependency availability — js-yaml
+ * is vendored and available at runtime as of ADR-3473 §8.1 (#3881), which
+ * migrated `src/frontmatter.cts`'s `extractFrontmatter` onto it. That parser
+ * runs under js-yaml's FAILSAFE_SCHEMA, which resolves every scalar as a
+ * string, whereas this function deliberately returns numbers for
+ * numeric-looking values (`out[m[1]] = asNumber : rawValue`) so
+ * `parseEstimate`/`parseActuals` see the types they validate. A naive swap
+ * onto `extractFrontmatter` would turn `tokens: 5000` into `"5000"` and make
+ * `isPositiveInt` reject every estimate. Scope is deliberately narrow: the
+ * leading `---` block only, so an `estimate:` line inside a fenced code
+ * block in the body cannot be mistaken for frontmatter (the
+ * DEFECT.FRONTMATTER-SCALAR-BROAD-GREP class). Migrating this function onto
+ * the shared parser (with a typed coercion layer over its string-only
+ * output) is tracked as follow-on work under ADR-3473 §8.1, not done here —
+ * this module is calibration-critical and has a history of subtle numeric
+ * defects shipping past a large green suite (#2631 factor², #2632
+ * self-defeating loop).
  */
 function extractFrontmatterBlock(text, key) {
     if (typeof text !== 'string')