@opengsd/gsd-core 1.15.0 → 1.16.0

package/gsd-core/bin/gsd-tools.cjs

@@ -223,6 +223,8 @@
  * Loop Extension Point Queries (ADR-857 phase 3c):
  *   loop render-hooks <point>            Resolve + render active Capability hooks at a loop point
  *                                        [--config-dir <path>] [--runtime <r>] [--active-cap <capId>]
+ *                                        [--after-fingerprint <phaseDir>] (#5105: skip verify:post
+ *                                        steps whose declared artifact already exists in phaseDir)
  *                                        Returns JSON envelope { point, activeHooks, rendered }
  *                                        Valid points: discuss:pre/post, plan:pre/post,
  *                                        execute:pre/wave:pre/wave:post/post, verify:pre/post, ship:pre/post
@@ -245,6 +247,14 @@
  *             Import a GSD-2 (.gsd/) project back to GSD v1 (.planning/) format
  */
 
+// #5183: Node's on-disk compile cache, so later runs reuse V8's compiled code
+// for unchanged modules. Only as the entry (a test require() is unaffected),
+// skipped under V8 coverage, optional (Bun stubs it), and never fatal.
+// NODE_DISABLE_COMPILE_CACHE (any value) turns it off.
+if (require.main === module && !process.env.NODE_V8_COVERAGE) {
+  try { require('node:module').enableCompileCache?.(); } catch { /* optimization only */ }
+}
+
 const fs = require('fs');
 const path = require('path');
 
@@ -276,7 +286,7 @@ try {
 
 const { ExitError, runMain, resolveContractVersion } = require('./lib/cli-exit.cjs');
 const io = require('./lib/io.cjs');
-const { error, ERROR_REASON, setJsonErrorMode, output, formatDiagnosticToken } = io;
+const { error, ERROR_REASON, setJsonErrorMode, output, formatDiagnosticToken, captureStdoutSyncWrites, resolveAtFileOutput } = io;
 const projectRoot = require('./lib/project-root.cjs');
 // Resolve findProjectRoot lazily at call time rather than binding it at module
 // load. It is sourced from project-root.cjs; a call-time lookup is robust
@@ -491,6 +501,7 @@ function dispatchCapabilityCommand({ command, args, cwd, raw, error, registry, r
     _result = fn({ args, cwd, raw, error });
   } catch (e) {
     if (e instanceof ExitError) throw e; // intentional structured error from the router (honors --json-errors) — propagate untouched
+    if (isVerificationStatusError(e)) throw e; // #5118: translated once, centrally, by main()
     error(
       'capability command "' + command + '" router "' + entry.router + '" in module "' + entry.module + '" threw: ' + (e && e.message ? e.message : String(e)),
       ERROR_REASON.SDK_FAIL_FAST,
@@ -606,6 +617,7 @@ function dispatchOverlayCapabilityCommand({ command, args, cwd, raw, error, load
     _result = fn({ args, cwd, raw, error });
   } catch (e) {
     if (e instanceof ExitError) throw e;
+    if (isVerificationStatusError(e)) throw e; // #5118: translated once, centrally, by main()
     error(
       'capability command "' + command + '" router "' + entry.router + '" in module "' + entry.module + '" threw: ' + (e && e.message ? e.message : String(e)),
       ERROR_REASON.SDK_FAIL_FAST,
@@ -1512,7 +1524,10 @@ function dispatchOverlayCapabilityCommand({ command, args, cwd, raw, error, load
             error(`quick-tasks-append: STATE.md not found at ${statePath}`, ERROR_REASON.USAGE);
           }
 
-          const date = new Date().toISOString().slice(0, 10);
+          // #4905: an operator-facing date, so the local calendar day (#2136)
+          // through the clock seam, which honors the GSD_NOW_MS pin (#474).
+          const { realClock } = require('./lib/clock.cjs');
+          const date = realClock.localToday();
           const { execGit } = require('./lib/shell-command-projection.cjs');
           const hashResult = execGit(['rev-parse', '--short', 'HEAD'], { cwd });
           const commit = hashResult.exitCode === 0 && hashResult.stdout ? hashResult.stdout : '—';
@@ -2766,6 +2781,63 @@ function dispatchOverlayCapabilityCommand({ command, args, cwd, raw, error, load
     };
     try {
       nodeFs.mkdirSync(sentinelDir, { recursive: true });
+      // Never write through a project-supplied .gsd symlink. Resolve the
+      // directory as well so an ancestor redirect cannot escape this project.
+      if (nodeFs.lstatSync(sentinelDir).isSymbolicLink() ||
+          nodePath.relative(nodeFs.realpathSync(cwd), nodeFs.realpathSync(sentinelDir)) !== '.gsd') {
+        throw new Error('sentinel directory is a symlink or resolves outside the project');
+      }
+      // User projects do not inherit gsd-core's root .gitignore. Ignore this
+      // tool-owned directory locally before writing the first sentinel. An
+      // ordinary ignore-file IO failure must not prevent recording isolation.
+      const ignorePath = nodePath.join(sentinelDir, '.gitignore');
+      try {
+        nodeFs.writeFileSync(ignorePath, '*\n', { flag: 'wx' });
+      } catch (ignoreError) {
+        if (ignoreError.code === 'EEXIST') {
+          // Keep a pre-existing ignore file. A bare '*' already ignores the
+          // whole directory, including this file and the sentinel temp file.
+          // Read through an fd opened without following links where supported;
+          // replace by rename rather than append through the path, so a link
+          // swapped in after the check cannot redirect a write elsewhere.
+          let fd;
+          let ignoreTmpPath;
+          try {
+            if (nodeFs.lstatSync(ignorePath).isSymbolicLink()) {
+              throw new Error('sentinel ignore file is a symlink');
+            }
+            fd = nodeFs.openSync(ignorePath, nodeFs.constants.O_RDONLY | (nodeFs.constants.O_NOFOLLOW || 0));
+            if (!nodeFs.fstatSync(fd).isFile()) throw new Error('sentinel ignore file is not a regular file');
+            const current = nodeFs.readFileSync(fd, 'utf8');
+            nodeFs.closeSync(fd);
+            fd = undefined;
+            if (!current.includes('# gsd-core dispatch sentinel') && !/^\*\r?$/m.test(current)) {
+              const additionalRules = `${current.endsWith('\n') ? '' : '\n'}# gsd-core dispatch sentinel\n` +
+                '/dispatch-isolation-sentinel.json\n' +
+                '/dispatch-isolation-sentinel.json.tmp-*\n' +
+                '/.gitignore\n';
+              ignoreTmpPath = `${ignorePath}.tmp-${process.pid}-${require('crypto').randomBytes(6).toString('hex')}`;
+              nodeFs.writeFileSync(ignoreTmpPath, current + additionalRules, { flag: 'wx' });
+              if (nodeFs.lstatSync(ignorePath).isSymbolicLink()) {
+                throw new Error('sentinel ignore file is a symlink');
+              }
+              nodeFs.renameSync(ignoreTmpPath, ignorePath);
+              ignoreTmpPath = null;
+            }
+          } catch (existingIgnoreError) {
+            if (existingIgnoreError.code === 'ELOOP' || existingIgnoreError.message === 'sentinel ignore file is a symlink') {
+              throw new Error('sentinel ignore file is a symlink');
+            }
+            // Ignore seeding is best-effort; the sentinel is still useful if
+            // this path cannot be read or updated.
+          } finally {
+            if (fd !== undefined) nodeFs.closeSync(fd);
+            if (ignoreTmpPath) {
+              try { nodeFs.unlinkSync(ignoreTmpPath); } catch (_) { /* best-effort cleanup */ }
+            }
+          }
+        }
+      }
       // Atomic write: unique temp file + rename, so a concurrent reader (a
       // guard hook firing mid-write) never observes a partially-written
       // sentinel. Unique per-process+time so concurrent orchestrator-worktree
@@ -3076,8 +3148,13 @@ function dispatchOverlayCapabilityCommand({ command, args, cwd, raw, error, load
             const coverage = require('./lib/coverage.cjs');
             const options = parseNamedArgsOrExit(args, { valueFlags: ['summary', 'file'], positionals: 2 }, error);
             coverage.cmdClassify(cwd, options, raw);
+          } else if (subcommand === 'complete-session') {
+            const uat = require('./lib/uat.cjs');
+            const uatPath = args[2];
+            const options = parseNamedArgsOrExit(args, { valueFlags: ['message'], positionals: 3 }, error);
+            return uat.cmdUatCompleteSession(cwd, uatPath, { message: options.message }, raw);
           } else {
-            error('Unknown uat subcommand. Available: render-checkpoint, classify-coverage', ERROR_REASON.SDK_UNKNOWN_COMMAND);
+            error('Unknown uat subcommand. Available: render-checkpoint, classify-coverage, complete-session', ERROR_REASON.SDK_UNKNOWN_COMMAND);
           }
   }
 
@@ -3175,10 +3252,27 @@ function dispatchOverlayCapabilityCommand({ command, args, cwd, raw, error, load
               }
               loopRuntime = value;
             }
+            // --after-fingerprint <phaseDir> (#5105 R2): gate out verify:post
+            // steps whose declared artifact already exists in phaseDir.
+            let loopAfterFingerprint = undefined;
+            const afterFpEqArg = args.find(arg => arg.startsWith('--after-fingerprint='));
+            const afterFpIdx = args.indexOf('--after-fingerprint');
+            if (afterFpEqArg) {
+              const value = afterFpEqArg.slice('--after-fingerprint='.length).trim();
+              if (!value) error('Missing value for --after-fingerprint', ERROR_REASON ? ERROR_REASON.USAGE : undefined);
+              loopAfterFingerprint = value;
+            } else if (afterFpIdx !== -1) {
+              const value = args[afterFpIdx + 1];
+              if (!value || value.startsWith('--')) {
+                error('Missing value for --after-fingerprint', ERROR_REASON ? ERROR_REASON.USAGE : undefined);
+              }
+              loopAfterFingerprint = value;
+            }
             loopResolver.cmdLoopRenderHooks(cwd, args[2], raw, {
               configDir: loopConfigDir ? path.resolve(loopConfigDir) : undefined,
               activeCap: loopActiveCap,
               runtime: loopRuntime,
+              afterFingerprint: loopAfterFingerprint,
             });
           } else {
             error(
@@ -3720,13 +3814,14 @@ function dispatchOverlayCapabilityCommand({ command, args, cwd, raw, error, load
       || relPath.startsWith('agents/')
       || relPath.startsWith('commands/');
     if (isFrontmatterSurface) {
-      const block = /^---\r?\n([\s\S]*?)\r?\n---/.exec(content);
+      // The block is the one the one fence owner finds (found while implementing #5105).
+      const found = frontmatter.frontmatterRegion(content);
       const missingFields = [];
-      if (!block) {
+      if (!found || !found.terminated) {
         missingFields.push('name', 'description');
       } else {
-        if (!/^name:\s*\S/m.test(block[1])) missingFields.push('name');
-        if (!/^description:\s*\S/m.test(block[1])) missingFields.push('description');
+        if (!/^name:\s*\S/m.test(found.region)) missingFields.push('name');
+        if (!/^description:\s*\S/m.test(found.region)) missingFields.push('description');
       }
       if (missingFields.length > 0) {
         warnings.push({
@@ -4510,7 +4605,19 @@ function dispatchOverlayCapabilityCommand({ command, args, cwd, raw, error, load
             }
 
             const roadmapStatus = matchedRow.Status;
-            const result = comparePhaseStatus({ stateStatus, roadmapStatus });
+            // #5060: normalize the raw Status cell through the Phase Status
+            // Module's `matchRoadmapStatusCell` owner before comparing ranks —
+            // this recognizes a cell with trailing operator prose after its
+            // leading token (e.g. "Complete — shipped") the same way the
+            // ROADMAP writers/readers already do, rather than requiring the
+            // WHOLE cell to equal a bare token. The raw `roadmapStatus` in the
+            // output stays untouched — only the comparison input changes.
+            const { matchRoadmapStatusCell } = require('./lib/phase-status.cjs');
+            const matched = matchRoadmapStatusCell(roadmapStatus);
+            const result = comparePhaseStatus({
+              stateStatus,
+              roadmapStatus: matched ? matched.token.toLowerCase() : roadmapStatus,
+            });
             output({
               verdict: result.verdict,
               phase,
@@ -5092,6 +5199,28 @@ function resolveMainWorktreeCwd(cwd, deps = {}) {
   return worktreeRoot;
 }
 
+// ─── #5118: an out-of-set verification status thrown past a command ─────────
+// ADR-5057 Phase 4 closed the verification-status vocabulary: a
+// *-VERIFICATION.md whose frontmatter `status` is outside `passed |
+// gaps_found | human_needed` is a hard error (verification.cjs's
+// VerificationStatusError). A command that reads one report directly
+// (`verification status`, `phase uat-passed`, `phase complete`) lets it throw;
+// aggregates carry it in their own results and fail themselves. Either way
+// the CLI fails through the owner's `failOnVerificationStatusError` — the
+// error's own message and its own `.reason`; nothing here restates either.
+function isVerificationStatusError(err) {
+  return err instanceof verification.VerificationStatusError;
+}
+
+async function captureTranslatingVerificationStatus(run) {
+  try {
+    return await captureStdoutSyncWrites(run);
+  } catch (err) {
+    if (isVerificationStatusError(err)) verification.failOnVerificationStatusError(err);
+    throw err;
+  }
+}
+
 async function main() {
   let args = process.argv.slice(2);
 
@@ -5357,7 +5486,7 @@ async function main() {
   // themselves JSON text, so resolving late would make every large result a
   // false "output was not JSON" (negative space N8).
   if (pickField) {
-    const captured = await captureStdoutSyncWrites(async () => {
+    const captured = await captureTranslatingVerificationStatus(async () => {
       await runCommand(command, args, cwd, raw, defaultValue, originalCommand, workstreamContext, preWorktreeRemapCwd);
     });
     const resolved = resolveAtFileOutput(captured);
@@ -5389,58 +5518,15 @@ async function main() {
   // already resolves this, but the normal path wrote @file: to stdout, forcing
   // every workflow to have a bash-specific `if [[ "$INIT" == @file:* ]]` check
   // that breaks on PowerShell and other non-bash shells.
-  const captured = await captureStdoutSyncWrites(async () => {
+  const captured = await captureTranslatingVerificationStatus(async () => {
     await runCommand(command, args, cwd, raw, defaultValue, originalCommand, workstreamContext, preWorktreeRemapCwd);
   });
   fs.writeSync(1, resolveAtFileOutput(captured));
 }
 
-function captureStdoutSyncWrites(run) {
-  const originalWriteSync = fs.writeSync;
-  let captured = '';
-
-  fs.writeSync = function patchedWriteSync(fd, data, ...rest) {
-    if (fd === 1) {
-      if (Buffer.isBuffer(data)) {
-        captured += data.toString('utf-8');
-        return data.length;
-      }
-      const text = String(data);
-      captured += text;
-      let encoding = 'utf-8';
-      if (typeof rest[1] === 'string') encoding = rest[1];
-      return Buffer.byteLength(text, encoding);
-    }
-    return originalWriteSync.call(fs, fd, data, ...rest);
-  };
-
-  const restore = () => {
-    fs.writeSync = originalWriteSync;
-  };
-
-  return Promise.resolve()
-    .then(() => run())
-    .then(() => {
-      restore();
-      return captured;
-    }, (err) => {
-      restore();
-      // The wrapped command may have written to stdout BEFORE it threw — e.g. a --raw
-      // command that emits a JSON result/error envelope and THEN throws ExitError to set a
-      // non-zero exit code (capability set/disable on an unknown id). Without this flush that
-      // captured output is silently discarded (the success-path flush at the call site never
-      // runs on a throw). Emit it now; the error still propagates so the exit code is preserved.
-      if (captured) {
-        try { originalWriteSync.call(fs, 1, resolveAtFileOutput(captured)); } catch { /* best-effort flush */ }
-      }
-      throw err;
-    });
-}
-
-function resolveAtFileOutput(captured) {
-  if (!captured.startsWith('@file:')) return captured;
-  return fs.readFileSync(captured.slice(6), 'utf-8');
-}
+// captureStdoutSyncWrites and resolveAtFileOutput moved to src/io.cts
+// (gsd-core/bin/lib/io.cjs) — the ONE shared pair (#5105 S9, review finding
+// 7), also used by uat.cts's cmdUatCompleteSession.
 
 // A plain object root/intermediate value — everything else (null, an array,
 // a number, a string, a boolean) is treated as non-object for NAMED-key

package/gsd-core/bin/lib/active-workstream-store.cjs

@@ -395,6 +395,14 @@ function parseCliWorkstream(args) {
         args: args.slice(),
     };
 }
+function workstreamDirectoryExists(cwd, name) {
+    try {
+        return node_fs_1.default.readdirSync(node_path_1.default.join(planningRoot(cwd), 'workstreams')).includes(name);
+    }
+    catch {
+        return false;
+    }
+}
 function resolveActiveWorkstream(cwd, args, env = process.env, deps = {}) {
     const parsed = parseCliWorkstream(args);
     const getStored = deps.getStored || ((dir) => getActiveWorkstream(dir, deps));
@@ -415,6 +423,13 @@ function resolveActiveWorkstream(cwd, args, env = process.env, deps = {}) {
     if (ws && !validateWorkstreamName(ws)) {
         throw new Error('Invalid workstream name: must be alphanumeric, hyphens, underscores, or dots');
     }
+    // #4772: a reserved name (`none`) is rejected from every source (--ws, env,
+    // pointer) unless a directory of that name already exists (grandfathered).
+    // Grandfathering compares the directory listing exactly, so a case-insensitive
+    // filesystem (macOS, Windows) cannot let `NONE` through on the strength of `none`.
+    if (ws && (0, workstream_name_policy_cjs_1.isReservedWorkstreamName)(ws) && !workstreamDirectoryExists(cwd, ws)) {
+        throw new Error((0, workstream_name_policy_cjs_1.reservedWorkstreamNameMessage)(ws, source));
+    }
     return {
         ws,
         source,

package/gsd-core/bin/lib/agent-install-check.cjs

@@ -483,7 +483,10 @@ function agentFileExists(agentsDir, name, runtime) {
     // kimi requires BOTH the persona yaml and the prompt md (same as checkAgentsInstalled).
     const kimiYaml = node_path_1.default.join(agentsDir, 'subagents', `${name}.yaml`);
     const kimiPrompt = node_path_1.default.join(agentsDir, 'subagents', `${name}.md`);
-    return runtime === 'kimi' && node_fs_1.default.existsSync(kimiYaml) && node_fs_1.default.existsSync(kimiPrompt);
+    // #5169: descriptor-declared (`hostBehaviors.requiresSubagentPair`); a label
+    // that is not a registered runtime declares nothing, so it never requires the pair.
+    return (0, runtime_name_policy_cjs_1.hostBehaviorsFor)(runtime).requiresSubagentPair === true
+        && node_fs_1.default.existsSync(kimiYaml) && node_fs_1.default.existsSync(kimiPrompt);
 }
 /**
  * Resolve a per-plan `agent_hint` specialist name to a dispatchable subagent

package/gsd-core/bin/lib/audit.cjs

@@ -25,7 +25,7 @@ const coreUtils = require("./core-utils.cjs");
 const { normalizeLineEndings } = coreUtils;
 // eslint-disable-next-line @typescript-eslint/no-require-imports
 const planningWorkspace = require("./planning-workspace.cjs");
-const { planningDir, quickDirFrom, todosDir } = planningWorkspace;
+const { planningDir, quickDirFrom, debugDir, todosDir } = planningWorkspace;
 // eslint-disable-next-line @typescript-eslint/no-require-imports
 const frontmatter = require("./frontmatter.cjs");
 // #4378 (roll-in): scanSeeds publishes the SAME canonical seed identity the
@@ -33,7 +33,7 @@ const frontmatter = require("./frontmatter.cjs");
 // does not require this module, so the edge is acyclic.
 // eslint-disable-next-line @typescript-eslint/no-require-imports
 const commandsModule = require("./commands.cjs");
-const { extractFrontmatter, FRONTMATTER_UNPARSEABLE, spliceFrontmatter } = frontmatter;
+const { extractFrontmatter, frontmatterBlock, spliceFrontmatter, isFrontmatterWriteRefusal } = frontmatter;
 // eslint-disable-next-line @typescript-eslint/no-require-imports
 const phaseIdMod = require("./phase-id.cjs");
 const { PHASE_NUMBER_TOKEN_SOURCE, scopeToPhase } = phaseIdMod;
@@ -46,6 +46,11 @@ const shell_command_projection_cjs_2 = require("./shell-command-projection.cjs")
 const io = require("./io.cjs");
 const { output, error: ioError } = io;
 const command_arg_projection_cjs_1 = require("./command-arg-projection.cjs");
+// #5118: the verification-status owner's report reader and closed enum.
+// eslint-disable-next-line @typescript-eslint/no-require-imports
+const verificationMod = require("./verification.cjs");
+const { reportStatusOf, VERIFICATION_STATUS, VerificationStatusError } = verificationMod;
+const clock_cjs_1 = require("./clock.cjs");
 // The SCOPE BOUNDARY convention's filename (`agents/gsd-executor.md`), shared
 // verbatim with the #2287 phase-boundary reader in `uat.cts`.
 const DEFERRED_ITEMS_FILENAME = 'deferred-items.md';
@@ -257,19 +262,27 @@ function deriveOpenQuestionsDigest(questions) {
 }
 // ─── scanDebugSessions ────────────────────────────────────────────────────────
 /**
- * Scan .planning/debug/ for open sessions.
+ * #4869: gsd-debugger's archive_session step appends every resolved session to
+ * this file in the debug directory. It is a document, not a session: it has no
+ * frontmatter, so its status would derive `unknown` and read as open forever.
+ * Excluded by this fixed name only. Any other file with missing or unparseable
+ * frontmatter is still an open session. Every shipped debug-directory reader
+ * excludes the same name from active sessions (#5011).
+ */
+const DEBUG_KNOWLEDGE_BASE_FILENAME = 'knowledge-base.md';
+/**
+ * Scan the root-scoped .planning/debug/ directory supplied by the caller for open sessions.
  * Open = status NOT in ['resolved', 'complete'].
- * Ignores the resolved/ subdirectory.
+ * Ignores the resolved/ subdirectory and the debugger's knowledge base.
  */
-function scanDebugSessions(planDir) {
-    const debugDir = node_path_1.default.join(planDir, 'debug');
-    if (!node_fs_1.default.existsSync(debugDir))
+function scanDebugSessions(debugPath) {
+    if (!node_fs_1.default.existsSync(debugPath))
         return { items: [], acknowledged: 0 };
     const results = [];
     let acknowledged = 0;
     let files;
     try {
-        files = node_fs_1.default.readdirSync(debugDir, { withFileTypes: true });
+        files = node_fs_1.default.readdirSync(debugPath, { withFileTypes: true });
     }
     catch {
         return { items: [{ scan_error: true, slug: '', status: '', updated: '', hypothesis: '' }], acknowledged: 0 };
@@ -279,10 +292,12 @@ function scanDebugSessions(planDir) {
             continue;
         if (!entry.name.endsWith('.md'))
             continue;
-        const filePath = node_path_1.default.join(debugDir, entry.name);
+        if (entry.name === DEBUG_KNOWLEDGE_BASE_FILENAME)
+            continue;
+        const filePath = node_path_1.default.join(debugPath, entry.name);
         let safeFilePath;
         try {
-            safeFilePath = (0, security_cjs_1.requireSafePath)(filePath, planDir, 'debug session file', security_cjs_1.PathAcceptance.AbsoluteInsideRoot);
+            safeFilePath = (0, security_cjs_1.requireSafePath)(filePath, node_path_1.default.dirname(debugPath), 'debug session file', security_cjs_1.PathAcceptance.AbsoluteInsideRoot);
         }
         catch {
             continue;
@@ -291,9 +306,9 @@ function scanDebugSessions(planDir) {
         // document at this read boundary, same seam as `src/uat.cts`'s
         // `readNormalizedDocument` — `platformReadSync` performs no line-ending
         // normalization itself, and extractFrontmatter/status-derivation below
-        // degrade a lone-CR file's frontmatter to `unknown`, which every scan
-        // in this module treats as "not open" (fail-open, the permissive
-        // direction) rather than a real parse gap.
+        // degrade a lone-CR file's frontmatter to `unknown`, which this scan
+        // reports as an open session (#4869) — so an un-normalized resolved
+        // session would resurface as open.
         const rawContent = (0, shell_command_projection_cjs_1.platformReadSync)(safeFilePath);
         if (rawContent === null)
             continue;
@@ -591,9 +606,11 @@ function scanTodos(todosBase) {
     }
     const displayFiles = openFiles.slice(0, 5);
     for (const { entry, content, fm } of displayFiles) {
-        // Extract first line of body after frontmatter
-        const bodyMatch = content.replace(/^---[\s\S]*?---\r?\n?/, '');
-        const firstLine = (0, text_lines_cjs_1.splitLines)(bodyMatch.trim())[0] || '';
+        // Extract first line of body after frontmatter — the block `extractFrontmatter` read above
+        // (the one fence owner), so a `---` inside a value cannot end it early.
+        const block = frontmatterBlock(content);
+        const todoBody = block ? block.rest : content;
+        const firstLine = (0, text_lines_cjs_1.splitLines)(todoBody.trim())[0] || '';
         const summary = (0, security_cjs_1.sanitizeForDisplay)(firstLine.slice(0, 100));
         results.push({
             filename: (0, security_cjs_1.sanitizeLabel)(entry.name),
@@ -816,9 +833,9 @@ function scanUatGaps(planDir, cwd) {
             // document at this read boundary, same seam as `src/uat.cts`'s
             // `readNormalizedDocument` — `platformReadSync` performs no line-ending
             // normalization itself, and extractFrontmatter/status-derivation below
-            // degrade a lone-CR file's frontmatter to `unknown`, which every scan
-            // in this module treats as "not open" (fail-open, the permissive
-            // direction) rather than a real parse gap.
+            // degrade a lone-CR file's frontmatter to `unknown`, which this scan
+            // reports as an open gap unless `result: all_pass` (#4869 triage) — so
+            // an un-normalized terminal UAT would resurface as open.
             const rawContent = (0, shell_command_projection_cjs_1.platformReadSync)(safeFilePath);
             if (rawContent === null)
                 continue;
@@ -897,8 +914,10 @@ function scanVerificationGaps(planDir, cwd) {
                 continue;
             const content = normalizeLineEndings(rawContent);
             const fm = extractFrontmatter(content, safeFilePath);
-            const status = (fm.status || 'unknown').toLowerCase();
-            if (status !== 'gaps_found' && status !== 'human_needed')
+            // #5118: the owner's report reader judges `status` — exact match, no
+            // case folding; an out-of-set value throws VerificationStatusError.
+            const status = reportStatusOf(fm, safeFilePath);
+            if (status !== VERIFICATION_STATUS.GAPS_FOUND && status !== VERIFICATION_STATUS.HUMAN_NEEDED)
                 continue;
             if (isAuditItemAcknowledged(fm, { snapshotKey: 'status', currentValue: status })) {
                 acknowledged++;
@@ -1074,8 +1093,10 @@ function scanDeferredItems(planDir, cwd) {
 function auditOpenArtifacts(cwd) {
     const planDir = planningDir(cwd);
     const debugSessions = (() => {
+        // #5042: debug sessions are shared project state; workflow writers use
+        // the root .planning/debug directory even when a workstream is active.
         try {
-            return scanDebugSessions(planDir);
+            return scanDebugSessions(debugDir(cwd));
         }
         catch {
             return { items: [{ scan_error: true, slug: '', status: '', updated: '', hypothesis: '' }], acknowledged: 0 };
@@ -1098,7 +1119,7 @@ function auditOpenArtifacts(cwd) {
         }
     })();
     const todos = (() => {
-        // #4256: the ONE root-scoped category — todos are shared project state,
+        // #4256: todos are shared project state, like debug sessions (#5042),
         // so the close gate reads todosDir(cwd) (the root), not the workstream-
         // scoped planDir every other scan below receives. Reading planDir here
         // made audit-open print "All artifact types clear. Safe to proceed."
@@ -1130,7 +1151,11 @@ function auditOpenArtifacts(cwd) {
         try {
             return scanVerificationGaps(planDir, cwd);
         }
-        catch {
+        catch (err) {
+            // #5118: an out-of-set report status is the owner's hard error, not a
+            // scan failure to fold into a sentinel — let it reach the CLI seam.
+            if (err instanceof VerificationStatusError)
+                throw err;
             return { items: [{ scan_error: true, phase: '', file: '', status: '' }], acknowledged: 0 };
         }
     })();
@@ -1399,6 +1424,26 @@ function resolvePhaseTargetDir(planDir, cwd, phase, archivedMilestone) {
  * artifact identifier that resolves outside the project is refused before
  * any read or write is attempted.
  */
+/**
+ * #4802: splice the acknowledgement marker, surfacing `spliceFrontmatter`'s
+ * write refusal (the one owner of that decision) as an `ioError` naming the
+ * file — an unparseable frontmatter block is NOT an empty one, and splicing
+ * over it would discard every field the author actually wrote.
+ */
+function spliceAcknowledgement(content, fm, fileLabel) {
+    try {
+        return spliceFrontmatter(content, fm);
+    }
+    catch (err) {
+        if (!isFrontmatterWriteRefusal(err))
+            throw err;
+        if (err.code === 'FRONTMATTER_UNPARSEABLE') {
+            ioError(`refusing to acknowledge — the frontmatter of "${fileLabel}" is not parseable YAML (splicing would discard every other frontmatter field); fix the YAML syntax error first, then re-run`);
+        }
+        ioError(`refusing to acknowledge "${fileLabel}" — ${err.message}`);
+        throw err; // unreachable — ioError throws
+    }
+}
 function cmdAuditAcknowledge(cwd, args, raw) {
     // args already has the family + subcommand tokens stripped by the caller
     // (audit-command-router.cts:147 passes `hubArgs.slice(2)`), so validation
@@ -1418,7 +1463,9 @@ function cmdAuditAcknowledge(cwd, args, raw) {
     // All declared flags above are value flags, so each resolves to `string |
     // null` at runtime; the cast narrows away the `boolean` arm of
     // ParsedNamedArgs's value type that this call site never produces.
-    const at = atFlag || new Date().toISOString().slice(0, 10);
+    // #4905: without --at, the operator-facing local calendar day (#2136)
+    // through the clock seam, which honors the GSD_NOW_MS pin (#474).
+    const at = atFlag || clock_cjs_1.realClock.localToday();
     const planDir = planningDir(cwd);
     const markerBase = { milestone: milestone, at };
     // #3078-CR MEDIUM 2: every `fs.readFileSync` in this function (below, and
@@ -1479,13 +1526,6 @@ function cmdAuditAcknowledge(cwd, args, raw) {
         }
         const content = node_fs_1.default.readFileSync(safeFilePath, 'utf-8');
         const fm = extractFrontmatter(content, safeFilePath);
-        // #4802: an unparseable frontmatter block is NOT an empty one — splicing
-        // the marker-marked object over the file would discard every field the
-        // author actually wrote. Refuse and name the file (the write-path
-        // counterpart of the read-side FRONTMATTER_UNPARSEABLE contract).
-        if (fm[FRONTMATTER_UNPARSEABLE] === true) {
-            ioError(`refusing to acknowledge — the frontmatter of "${file}" is not parseable YAML (splicing would discard every other frontmatter field); fix the YAML syntax error first, then re-run`);
-        }
         // Mixed-frame fix (security review, 4th instance on this branch): the
         // splice above and below stays keyed to RAW `content` (raw byte offsets
         // must not shift), but `scanUatGaps`/`scanContextQuestions` now derive
@@ -1516,7 +1556,7 @@ function cmdAuditAcknowledge(cwd, args, raw) {
             currentValue = deriveOpenQuestionsDigest(deriveOpenQuestions(normalizedContent, fm));
         }
         fm.audit_acknowledged = { ...markerBase, [snapshotKey]: currentValue };
-        const newContent = spliceFrontmatter(content, fm);
+        const newContent = spliceAcknowledgement(content, fm, file);
         (0, shell_command_projection_cjs_2.platformWriteSync)(safeFilePath, newContent);
         output({ acknowledged: true, category, phase, file, [snapshotKey]: currentValue }, raw, 'true');
         return;
@@ -1645,18 +1685,12 @@ function cmdAuditAcknowledge(cwd, args, raw) {
         return; // unreachable — ioError throws — satisfies TS control-flow analysis
     }
     const presenceOnly = category === 'todos';
-    const fm = createIfMissing ? fmForCreate : extractFrontmatter(node_fs_1.default.readFileSync(safeFilePath, 'utf-8'), safeFilePath);
-    // #4802: same unparseable-frontmatter refusal as the phase-scoped branch —
-    // createIfMissing never reaches this extract (it only fires when the file is
-    // absent), so an existing file with broken YAML refuses instead of splicing
-    // a near-empty object over every field the author wrote.
-    if (!createIfMissing && fm[FRONTMATTER_UNPARSEABLE] === true) {
-        ioError(`refusing to acknowledge — the frontmatter of "${safeFilePath}" is not parseable YAML (splicing would discard every other frontmatter field); fix the YAML syntax error first, then re-run`);
-    }
+    const existingContent = createIfMissing ? '' : node_fs_1.default.readFileSync(safeFilePath, 'utf-8');
+    const fm = createIfMissing ? fmForCreate : extractFrontmatter(existingContent, safeFilePath);
     fm.audit_acknowledged = presenceOnly ? { ...markerBase } : { ...markerBase, [snapshotKey]: currentValue };
-    const newContent = createIfMissing
-        ? spliceFrontmatter('', fm)
-        : spliceFrontmatter(node_fs_1.default.readFileSync(safeFilePath, 'utf-8'), fm);
+    // #4802: createIfMissing splices into '' (no block to refuse on); an existing
+    // file with broken YAML is refused by `spliceAcknowledgement`.
+    const newContent = spliceAcknowledgement(existingContent, fm, safeFilePath);
     (0, shell_command_projection_cjs_2.platformWriteSync)(safeFilePath, newContent);
     output({ acknowledged: true, category, ...(presenceOnly ? {} : { [snapshotKey]: currentValue }) }, raw, 'true');
 }