@opengsd/gsd-core 1.6.0-rc.1 → 1.6.0-rc.3

package/gsd-core/bin/lib/intel-command-router.cjs

@@ -43,7 +43,14 @@ const io = require("./io.cjs");
 const coreUtils = require("./core-utils.cjs");
 // eslint-disable-next-line @typescript-eslint/no-require-imports
 const path = require("path");
+// Phase 2 (#1646): route through the Hub per ADR-959 §III(B) line 75.
+// eslint-disable-next-line @typescript-eslint/no-require-imports
+const commandRoutingHub = require("./command-routing-hub.cjs");
+// eslint-disable-next-line @typescript-eslint/no-require-imports
+const cjsCommandRouterAdapter = require("./cjs-command-router-adapter.cjs");
 const { ERROR_REASON } = io;
+const { makeInvalidArgs } = commandRoutingHub;
+const { routeHubCommandFamily } = cjsCommandRouterAdapter;
 // Default CoreModule implementation assembled from leaf modules.
 // _core seam overrides this entirely for test injection.
 const _defaultCore = { output: io.output, timeAgo: coreUtils.timeAgo };
@@ -52,67 +59,79 @@ function routeIntelCommand({ args, cwd, raw, error, _intel, _core }) {
     // eslint-disable-next-line @typescript-eslint/no-require-imports, @typescript-eslint/no-unsafe-assignment
     const intel = _intel ?? require('./intel.cjs');
     const c = _core ?? _defaultCore;
-    const subcommand = args[1];
-    if (subcommand === 'query') {
-        const term = args[2];
-        if (!term) {
-            error('Usage: gsd-tools intel query <term>', ERROR_REASON.USAGE);
-            return;
-        }
-        const planningDir = path.join(cwd, '.planning');
-        c.output(intel.intelQuery(term, planningDir), raw);
-    }
-    else if (subcommand === 'status') {
-        const planningDir = path.join(cwd, '.planning');
-        const status = intel.intelStatus(planningDir);
-        if (!raw && status.files) {
-            for (const file of Object.values(status.files)) {
-                if (file.updated_at) {
-                    file.updated_at = c.timeAgo(new Date(file.updated_at));
+    // Phase 2 (#1646): routes through the Command Routing Hub per ADR-959 §III(B)
+    // line 75. Validation handlers return `makeInvalidArgs(...)` Results; the
+    // Hub → adapter translation preserves ERROR_REASON granularity via the
+    // exitReason field (Phase 1, #1644). Success handlers keep direct `c.output()`
+    // calls. The timeAgo mutation in non-raw `status` is preserved. Lazy require
+    // of intel.cjs inside the function is preserved (loads only when dispatched).
+    routeHubCommandFamily({
+        family: 'intel',
+        args,
+        // Alphabetical for stable unknownMessage text; the integration test asserts
+        // inclusion of all 9 subcommands, not order.
+        subcommands: ['api-surface', 'diff', 'extract-exports', 'patch-meta', 'query', 'snapshot', 'status', 'update', 'validate'],
+        handlers: {
+            query: () => {
+                const term = args[2];
+                if (!term) {
+                    return makeInvalidArgs('term', 'Usage: gsd-tools intel query <term>', ERROR_REASON.USAGE);
+                }
+                const planningDir = path.join(cwd, '.planning');
+                c.output(intel.intelQuery(term, planningDir), raw);
+            },
+            status: () => {
+                const planningDir = path.join(cwd, '.planning');
+                const status = intel.intelStatus(planningDir);
+                if (!raw && status.files) {
+                    for (const file of Object.values(status.files)) {
+                        if (file.updated_at) {
+                            file.updated_at = c.timeAgo(new Date(file.updated_at));
+                        }
+                    }
+                }
+                c.output(status, raw);
+            },
+            diff: () => {
+                const planningDir = path.join(cwd, '.planning');
+                c.output(intel.intelDiff(planningDir), raw);
+            },
+            snapshot: () => {
+                const planningDir = path.join(cwd, '.planning');
+                c.output(intel.intelSnapshot(planningDir), raw);
+            },
+            'patch-meta': () => {
+                const filePath = args[2];
+                if (!filePath) {
+                    return makeInvalidArgs('file-path', 'Usage: gsd-tools intel patch-meta <file-path>', ERROR_REASON.USAGE);
+                }
+                c.output(intel.intelPatchMeta(path.resolve(cwd, filePath)), raw);
+            },
+            validate: () => {
+                const planningDir = path.join(cwd, '.planning');
+                c.output(intel.intelValidate(planningDir), raw);
+            },
+            'extract-exports': () => {
+                const filePath = args[2];
+                if (!filePath) {
+                    return makeInvalidArgs('file-path', 'Usage: gsd-tools intel extract-exports <file-path>', ERROR_REASON.USAGE);
                 }
-            }
-        }
-        c.output(status, raw);
-    }
-    else if (subcommand === 'diff') {
-        const planningDir = path.join(cwd, '.planning');
-        c.output(intel.intelDiff(planningDir), raw);
-    }
-    else if (subcommand === 'snapshot') {
-        const planningDir = path.join(cwd, '.planning');
-        c.output(intel.intelSnapshot(planningDir), raw);
-    }
-    else if (subcommand === 'patch-meta') {
-        const filePath = args[2];
-        if (!filePath) {
-            error('Usage: gsd-tools intel patch-meta <file-path>', ERROR_REASON.USAGE);
-            return;
-        }
-        c.output(intel.intelPatchMeta(path.resolve(cwd, filePath)), raw);
-    }
-    else if (subcommand === 'validate') {
-        const planningDir = path.join(cwd, '.planning');
-        c.output(intel.intelValidate(planningDir), raw);
-    }
-    else if (subcommand === 'extract-exports') {
-        const filePath = args[2];
-        if (!filePath) {
-            error('Usage: gsd-tools intel extract-exports <file-path>', ERROR_REASON.USAGE);
-            return;
-        }
-        c.output(intel.intelExtractExports(path.resolve(cwd, filePath)), raw);
-    }
-    else if (subcommand === 'update') {
-        const planningDir = path.join(cwd, '.planning');
-        c.output(intel.intelUpdate(planningDir), raw);
-    }
-    else if (subcommand === 'api-surface') {
-        const planningDir = path.join(cwd, '.planning');
-        c.output(intel.intelApiSurface(planningDir), raw);
-    }
-    else {
-        error('Unknown intel subcommand. Available: query, status, update, diff, snapshot, patch-meta, validate, extract-exports, api-surface', ERROR_REASON.SDK_UNKNOWN_COMMAND);
-    }
+                c.output(intel.intelExtractExports(path.resolve(cwd, filePath)), raw);
+            },
+            update: () => {
+                const planningDir = path.join(cwd, '.planning');
+                c.output(intel.intelUpdate(planningDir), raw);
+            },
+            'api-surface': () => {
+                const planningDir = path.join(cwd, '.planning');
+                c.output(intel.intelApiSurface(planningDir), raw);
+            },
+        },
+        unknownMessage: (subcommand, available) => `Unknown intel subcommand. Available: ${available.join(', ')}`,
+        error,
+        cwd,
+        raw,
+    });
 }
 module.exports = {
     routeIntelCommand,

package/gsd-core/bin/lib/phase-id.cjs

@@ -14,10 +14,24 @@
 function escapeRegex(value) {
     return String(value).replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
 }
+// project_code values start with an uppercase letter (e.g. PROJ, APP_CODE);
+// leading underscores are not valid project codes per .planning/config.json.
+const PROJECT_CODE_PREFIX_STRIP_RE = /^[A-Z][A-Z0-9_]*-(?=\d)/;
+const PROJECT_CODE_PREFIX_STRIP_RE_I = /^[A-Z][A-Z0-9_]*-(?=\d)/i;
+const PROJECT_CODE_PREFIX_CAPTURE_RE_I = /^([A-Z][A-Z0-9_]*)-(\d.*)/i;
+const OPTIONAL_PROJECT_CODE_PREFIX_SOURCE = '(?:[A-Z][A-Z0-9_]*-)?';
+function stripProjectCodePrefix(value, caseInsensitive = true) {
+    const input = String(value);
+    const re = caseInsensitive ? PROJECT_CODE_PREFIX_STRIP_RE_I : PROJECT_CODE_PREFIX_STRIP_RE;
+    return input.replace(re, '');
+}
+function hasProjectCodePrefix(value) {
+    return PROJECT_CODE_PREFIX_STRIP_RE_I.test(String(value));
+}
 function normalizePhaseName(phase) {
     const str = String(phase);
     // Strip optional project_code prefix (e.g., 'CK-01' → '01')
-    const stripped = str.replace(/^[A-Z]{1,6}-(?=\d)/, '');
+    const stripped = stripProjectCodePrefix(str, false);
     // Milestone-prefixed phase IDs: M-NN or M-N-N (deep decomposition).
     const milestoneMatch = stripped.match(/^(\d+)((?:-\d+)+)([A-Z]?(?:\.\d+)*)$/i);
     if (milestoneMatch) {
@@ -39,8 +53,7 @@ function normalizePhaseName(phase) {
     return str;
 }
 function getMilestoneFromPhaseId(phaseId) {
-    const str = String(phaseId);
-    const stripped = str.replace(/^[A-Z]{1,6}-(?=\d)/i, '');
+    const stripped = stripProjectCodePrefix(phaseId);
     const m = stripped.match(/^0*(\d+)-\d/);
     if (!m)
         return null;
@@ -50,8 +63,7 @@ function getMilestoneFromPhaseId(phaseId) {
     return `v${major}.0`;
 }
 function getPhaseDirFromPhaseId(phaseId, phaseName, projectCode) {
-    const str = String(phaseId);
-    const stripped = str.replace(/^[A-Z]{1,6}-(?=\d)/i, '');
+    const stripped = stripProjectCodePrefix(phaseId);
     const m = stripped.match(/^0*(\d+)-(0*(\d+(?:-\d+)*))$/);
     if (!m)
         return null;
@@ -70,7 +82,7 @@ function getPhaseDirFromPhaseId(phaseId, phaseName, projectCode) {
  * prose regardless of zero-padding on either side.
  */
 function phaseMarkdownRegexSource(phaseNum) {
-    const stripped = String(phaseNum).replace(/^[A-Z]{1,6}-(?=\d)/i, '');
+    const stripped = stripProjectCodePrefix(phaseNum);
     // Milestone-prefixed IDs: M-NN or M-N-N (deep).
     const milestoneSegments = stripped.match(/^(\d+)((?:-\d+)*)([A-Z]?(?:\.\d+)*)$/i);
     if (milestoneSegments && milestoneSegments[2]) {
@@ -99,14 +111,14 @@ function phaseMarkdownRegexSource(phaseNum) {
  */
 function phaseMarkdownRegexSourceExact(phaseNum) {
     const raw = String(phaseNum);
-    if (!/^[A-Z]{1,6}-(?=\d)/i.test(raw))
+    if (!hasProjectCodePrefix(raw))
         return null;
     return escapeRegex(raw);
 }
 function comparePhaseNum(a, b) {
     // Strip optional project_code prefix before comparing
-    const sa = String(a).replace(/^[A-Z]{1,6}-(?=\d)/i, '');
-    const sb = String(b).replace(/^[A-Z]{1,6}-(?=\d)/i, '');
+    const sa = stripProjectCodePrefix(a);
+    const sb = stripProjectCodePrefix(b);
     const milestoneA = sa.match(/^(\d+)((?:-\d+)+)([A-Z]?(?:\.\d+)*)$/i);
     const milestoneB = sb.match(/^(\d+)((?:-\d+)+)([A-Z]?(?:\.\d+)*)$/i);
     if (milestoneA && milestoneB) {
@@ -162,7 +174,7 @@ function comparePhaseNum(a, b) {
  * Extract the phase token from a directory name.
  */
 function extractPhaseToken(dirName) {
-    const codePrefixMatch = dirName.match(/^([A-Z]{1,6})-(\d.*)/i);
+    const codePrefixMatch = dirName.match(PROJECT_CODE_PREFIX_CAPTURE_RE_I);
     let prefix = '';
     let rest = dirName;
     if (codePrefixMatch) {
@@ -192,7 +204,7 @@ function phaseTokenMatches(dirName, normalized) {
     const token = extractPhaseToken(dirName);
     if (token.toUpperCase() === normalized.toUpperCase())
         return true;
-    const stripped = dirName.replace(/^[A-Z]{1,6}-(?=\d)/i, '');
+    const stripped = stripProjectCodePrefix(dirName);
     if (stripped !== dirName) {
         const strippedToken = extractPhaseToken(stripped);
         if (strippedToken.toUpperCase() === normalized.toUpperCase())
@@ -202,6 +214,8 @@ function phaseTokenMatches(dirName, normalized) {
 }
 module.exports = {
     escapeRegex,
+    OPTIONAL_PROJECT_CODE_PREFIX_SOURCE,
+    stripProjectCodePrefix,
     normalizePhaseName,
     getMilestoneFromPhaseId,
     getPhaseDirFromPhaseId,

package/gsd-core/bin/lib/phase.cjs

@@ -32,7 +32,7 @@ const coreUtilsMod = require("./core-utils.cjs");
 const { toPosixPath, generateSlugInternal, readSubdirectories } = coreUtilsMod;
 // eslint-disable-next-line @typescript-eslint/no-require-imports -- phase-id.cjs is an export= CommonJS module
 const phaseIdMod = require("./phase-id.cjs");
-const { escapeRegex, normalizePhaseName, phaseMarkdownRegexSource, comparePhaseNum, phaseTokenMatches } = phaseIdMod;
+const { escapeRegex, normalizePhaseName, phaseMarkdownRegexSource, comparePhaseNum, phaseTokenMatches, OPTIONAL_PROJECT_CODE_PREFIX_SOURCE, } = phaseIdMod;
 // eslint-disable-next-line @typescript-eslint/no-require-imports -- phase-locator.cjs is an export= CommonJS module
 const phaseLocatorMod = require("./phase-locator.cjs");
 const { findPhaseInternal, getArchivedPhaseDirs } = phaseLocatorMod;
@@ -167,7 +167,7 @@ function cmdPhaseNextDecimal(cwd, basePhase, raw) {
             const entries = node_fs_1.default.readdirSync(phasesDir, { withFileTypes: true });
             const dirs = entries.filter((e) => e.isDirectory()).map((e) => e.name);
             baseExists = dirs.some((d) => phaseTokenMatches(d, normalized));
-            const dirPattern = new RegExp(`^(?:[A-Z]{1,6}-)?${escapeRegex(normalized)}\\.(\\d+)`);
+            const dirPattern = new RegExp(`^${OPTIONAL_PROJECT_CODE_PREFIX_SOURCE}${escapeRegex(normalized)}\\.(\\d+)`);
             for (const dir of dirs) {
                 const match = dir.match(dirPattern);
                 if (match)
@@ -310,7 +310,7 @@ function cmdFindPhase(cwd, phase, raw) {
             const match = dirs.find((d) => phaseTokenMatches(d, normalized));
             if (!match)
                 continue;
-            const dirMatch = match.match(/^(?:[A-Z]{1,6}-)(\d+[A-Z]?(?:\.\d+)*)-?(.*)/i) ||
+            const dirMatch = match.match(new RegExp(`^${OPTIONAL_PROJECT_CODE_PREFIX_SOURCE}(\\d+[A-Z]?(?:\\.\\d+)*)-?(.*)`, 'i')) ||
                 match.match(/^(\d+[A-Z]?(?:\.\d+)*)-?(.*)/i);
             const phaseNumber = dirMatch ? dirMatch[1] : normalized;
             const phaseName = dirMatch && dirMatch[2] ? dirMatch[2] : null;
@@ -756,7 +756,7 @@ function cmdPhaseInsert(cwd, afterPhase, description, raw) {
         try {
             const entries = node_fs_1.default.readdirSync(phasesDir, { withFileTypes: true });
             const dirs = entries.filter((e) => e.isDirectory()).map((e) => e.name);
-            const decimalPattern = new RegExp(`^(?:[A-Z]{1,6}-)?${escapeRegex(normalizedBase)}\\.(\\d+)`);
+            const decimalPattern = new RegExp(`^${OPTIONAL_PROJECT_CODE_PREFIX_SOURCE}${escapeRegex(normalizedBase)}\\.(\\d+)`);
             for (const dir of dirs) {
                 const dm = dir.match(decimalPattern);
                 if (dm)

package/gsd-core/bin/lib/planning-workspace.cjs

@@ -33,6 +33,54 @@ process.on('exit', () => {
         catch { /* already gone */ }
     }
 });
+// ---------------------------------------------------------------------------
+// Lock liveness probe (test seam) — audit M1
+//
+// mtime is a leaky proxy for "the holder is alive". The prior withPlanningLock
+// timeout fallback unconditionally unlinked WHATEVER lock existed — even a fresh,
+// live holder's — and re-acquired it, force-stealing a live writer's critical
+// section. We backport capability-lock.cts's pid-liveness gate: a dead holder is
+// stolen promptly inside the polite loop; a live holder is waited on. The
+// indirection lets unit tests inject a deterministic isPidAlive without real pids.
+// ---------------------------------------------------------------------------
+/** Is `pid` a live process? process.kill(pid, 0) succeeds for a live (signalable) process. */
+function _realIsPidAlive(pid) {
+    try {
+        process.kill(pid, 0);
+        return true; // signalable → alive
+    }
+    catch (err) {
+        // EPERM = process exists but we cannot signal it (still ALIVE). ESRCH = gone.
+        return err.code === 'EPERM';
+    }
+}
+const _planningLockProbes = { isPidAlive: _realIsPidAlive };
+function _planningLockIsPidAlive(pid) {
+    return _planningLockProbes.isPidAlive(pid);
+}
+const _planningLockTestHooks = {};
+// Monotonic sequence for unique stale-steal rename targets (no crypto dependency).
+let _planningStealSeq = 0;
+/**
+ * Is the holder recorded in the .lock body VERIFIED-LIVE? The body is JSON
+ * { pid, cwd, acquired }. Returns true ONLY when the body parses AND the recorded
+ * pid signals alive. A garbage / pid-less / unreadable body (or a dead pid) is NOT
+ * verified-live, so the lock stays stealable — corrupt locks never block forever,
+ * and a live holder is never force-stolen.
+ */
+function _planningHolderVerifiedLive(lockPath) {
+    let parsed;
+    try {
+        parsed = JSON.parse(node_fs_1.default.readFileSync(lockPath, 'utf-8'));
+    }
+    catch {
+        return false; // unreadable / unparseable body → cannot verify → not verified-live
+    }
+    const pid = parsed?.pid;
+    if (typeof pid !== 'number' || !Number.isInteger(pid) || pid <= 0)
+        return false;
+    return _planningLockIsPidAlive(pid);
+}
 // Transient errno codes that indicate a temporary filesystem condition under
 // concurrent O_EXCL races — Docker overlay-fs (ENOENT/EINVAL/EIO), NFS
 // (ESTALE), and OS-level interrupt/retry signals (EAGAIN/EINTR).  These are
@@ -97,6 +145,12 @@ function withPlanningLock(cwd, fn, clock) {
         clock = clock_cjs_1.realClock;
     const lockPath = node_path_1.default.join(planningDir(cwd), '.lock');
     const lockTimeout = 10000; // 10 seconds
+    // Deadman ceiling (audit M1 / R4-FIX) — set ABOVE lockTimeout so a holder that reads
+    // as alive but is actually a pid-reuse alias (the .lock body has no startTime, so
+    // liveness alone cannot detect reuse) is still recovered once its lock ages past this
+    // absolute ceiling. Without it, a false-alive holder would make withPlanningLock throw
+    // on every call with no self-heal. Mirrors acquireStateLock's deadmanCeilingMs.
+    const deadmanCeilingMs = 60000;
     const start = clock.now();
     // Ensure .planning/ exists
     try {
@@ -143,31 +197,104 @@ function withPlanningLock(cwd, fn, clock) {
                 continue;
             }
             if (nodeErr.code === 'EEXIST') {
-                // Lock exists — check if stale (>30s old)
+                // Liveness-gated steal (audit M1). Steal the lock PROMPTLY only when its
+                // recorded holder is NOT verified-live (crashed/dead pid or garbage body).
+                // A verified-live holder is waited on — never force-stolen — because nuking
+                // a slow-but-live writer's lock corrupts the .planning/ critical section.
+                // The steal is an ATOMIC rename-then-recreate guarded by an identity re-confirm
+                // so a racer that recreates a fresh lock in the decision→steal gap never has
+                // its replacement deleted (audit M2 / PR #1532 review, window b). The body is
+                // written atomically (writeFileSync …{flag:'wx'}) so there is no empty-body
+                // create window here — only the double-steal needs hardening.
                 try {
-                    const stat = node_fs_1.default.statSync(lockPath);
-                    if (clock.now() - stat.mtimeMs > 30000) {
-                        node_fs_1.default.unlinkSync(lockPath);
-                        continue; // retry
+                    const decisionStat = node_fs_1.default.statSync(lockPath);
+                    // Snapshot the decision-time body too: (dev, ino) alone is defeated by inode
+                    // REUSE (a racer's unlink+recreate can land on the same inode), so the body
+                    // content binds the identity as well — mirrors capability-lock.cts's (dev,
+                    // ino, ts) re-confirm.
+                    let decisionBody;
+                    try {
+                        decisionBody = node_fs_1.default.readFileSync(lockPath, 'utf-8');
+                    }
+                    catch {
+                        decisionBody = null;
+                    }
+                    let stealable = !_planningHolderVerifiedLive(lockPath);
+                    if (!stealable) {
+                        // Verified-live, but recover anyway once the lock crosses the absolute
+                        // deadman ceiling — defeats a pid-reuse false-alive that would otherwise
+                        // block forever (R4-FIX; mtime age is from lock creation, not this call).
+                        const age = clock.now() - decisionStat.mtimeMs;
+                        stealable = age > deadmanCeilingMs;
+                    }
+                    if (stealable) {
+                        if (_planningLockTestHooks.beforeSteal)
+                            _planningLockTestHooks.beforeSteal({ lockPath });
+                        // Identity re-confirm immediately before the steal: a racer that stole +
+                        // recreated a fresh lock in the decision→steal gap changes (dev, ino) → do
+                        // NOT delete the replacement; back off and re-evaluate.
+                        let confirmStat;
+                        try {
+                            confirmStat = node_fs_1.default.statSync(lockPath);
+                        }
+                        catch {
+                            continue; // vanished between decision and steal — retry the create.
+                        }
+                        let confirmBody;
+                        try {
+                            confirmBody = node_fs_1.default.readFileSync(lockPath, 'utf-8');
+                        }
+                        catch {
+                            confirmBody = null;
+                        }
+                        const sameInstance = typeof decisionStat.dev === 'number' && typeof decisionStat.ino === 'number' &&
+                            confirmStat.dev === decisionStat.dev && confirmStat.ino === decisionStat.ino &&
+                            decisionBody !== null && confirmBody === decisionBody;
+                        if (!sameInstance) {
+                            clock.sleep(100); // a racer won the steal + recreated — re-evaluate, don't delete it.
+                            continue;
+                        }
+                        // Atomic steal: rename the inode aside, then remove it. Only ONE racer can
+                        // win the rename; a failed rename means another process already stole it, so
+                        // we must NOT fall through to a delete — back off and retry the create.
+                        const stolen = lockPath + '.stale-' + process.pid + '-' + clock.now() + '-' + (_planningStealSeq++);
+                        let renamed = false;
+                        try {
+                            node_fs_1.default.renameSync(lockPath, stolen);
+                            renamed = true;
+                        }
+                        catch { /* another racer won */ }
+                        if (renamed) {
+                            try {
+                                node_fs_1.default.rmSync(stolen, { force: true });
+                            }
+                            catch { /* best-effort */ }
+                            continue; // dead/garbage/expired holder freed — retry immediately to grab it.
+                        }
+                        clock.sleep(100); // lost the steal race — back off and retry.
+                        continue;
                     }
                 }
                 catch {
                     continue;
                 }
-                // Wait and retry (cross-platform, no shell dependency)
+                // Live holder — wait and retry (cross-platform, no shell dependency).
                 clock.sleep(100);
                 continue;
             }
             throw err;
         }
     }
-    // Timeout — stale-lock recovery, then re-acquire atomically before entering critical section.
-    try {
-        node_fs_1.default.unlinkSync(lockPath);
-    }
-    catch { /* ok */ }
-    acquireLock();
-    return runWithHeldLock();
+    // Timeout against a holder still present at budget exhaustion. The polite loop
+    // already stole any DEAD holder; reaching here means the holder is verified-live
+    // (or a pid-reuse alias we must not corrupt). Do NOT force-steal — the prior
+    // unconditional `unlinkSync(lockPath); acquireLock()` here (audit M1) robbed live
+    // writers, and its re-acquire sat OUTSIDE any try so a concurrent re-create raced
+    // a raw EEXIST out of the helper (audit M2). Surface a clear timeout error instead.
+    const timeoutErr = new Error('withPlanningLock: ' + lockPath + ' held by a live process for ' +
+        (clock.now() - start) + 'ms (exceeded ' + lockTimeout + 'ms budget)');
+    timeoutErr.lockTimeout = true;
+    throw timeoutErr;
 }
 function createPlanningWorkspace(cwd, opts = {}) {
     return {
@@ -242,4 +369,21 @@ module.exports = {
     getActiveWorkstream,
     setActiveWorkstream,
     findContextMdIn,
+    // Test seam (audit M1): inject a deterministic isPidAlive so the liveness-gated
+    // steal decision is exercised without real pids. Mirrors capability-lock.cts.
+    _setLockProbes(probes) {
+        if (typeof probes.isPidAlive === 'function')
+            _planningLockProbes.isPidAlive = probes.isPidAlive;
+    },
+    _resetLockProbes() {
+        _planningLockProbes.isPidAlive = _realIsPidAlive;
+    },
+    // Test seam (PR #1532 review): script the steal decision→steal gap (window b).
+    _setPlanningLockTestHooks(hooks) {
+        if ('beforeSteal' in hooks)
+            _planningLockTestHooks.beforeSteal = hooks.beforeSteal;
+    },
+    _resetPlanningLockTestHooks() {
+        delete _planningLockTestHooks.beforeSteal;
+    },
 };

package/gsd-core/bin/lib/probe-core.cjs

@@ -288,6 +288,13 @@ function projectProhibitions(items) {
             if (typeof p.check_violation_fixture === 'string' && p.check_violation_fixture.trim() !== '') {
                 entry.check_violation_fixture = String(p.check_violation_fixture);
             }
+            // `check_clean_fixture` (#1346) rides BOTH kinds — the KNOWN-CLEAN control subject the prover
+            // requires to stay GREEN (content-dependence proof). Emit ONLY a non-empty fixture (blank ->
+            // absent so no control runs; the documented residual remains). Like the violation fixture it is
+            // meaningless without the descriptor, so it lives inside this well-formed-descriptor branch.
+            if (typeof p.check_clean_fixture === 'string' && p.check_clean_fixture.trim() !== '') {
+                entry.check_clean_fixture = String(p.check_clean_fixture);
+            }
         }
         out.push(entry);
     }

package/gsd-core/bin/lib/profile-output.cjs

@@ -1010,19 +1010,31 @@ function cmdGenerateClaudeMd(cwd, options, raw) {
     // repo-root `CLAUDE.md`, so generated GSD content does not land next to — or
     // pollute — a hand-crafted repo-root CLAUDE.md. An explicit `claude_md_path`
     // config value or `--output` still wins.
-    let configClaudeMdPath = './.claude/CLAUDE.md';
+    let configClaudeMdPath = '.claude/CLAUDE.md';
     try {
         const config = loadConfig(cwd);
         if (config['claude_md_path'])
             configClaudeMdPath = config['claude_md_path'];
         if (config['claude_md_assembly'])
             assemblyConfig = config['claude_md_assembly'];
-        // #3163: When runtime is codex, override the output target to AGENTS.md
-        // regardless of claude_md_path, so Codex projects never write to CLAUDE.md.
-        // GSD_RUNTIME env var takes precedence over config.runtime, mirroring detectRuntime().
+        // #1529: When no explicit --output is provided, derive the instruction
+        // file from the runtime via the shared `getProjectInstructionFile` policy
+        // (single source of truth in runtime-name-policy.cjs, shared with the
+        // new-project.md bash workflow via `gsd-tools query
+        // project-instruction-file`). Previously this was a codex-only override
+        // (#3163) that left AGENTS-native runtimes (opencode/kilo/kimi) emitting
+        // CLAUDE.md; copilot now resolves to .github/copilot-instructions.md, and
+        // antigravity/gemini to GEMINI.md. GSD_RUNTIME env var takes precedence
+        // over config.runtime, mirroring detectRuntime().
+        //
+        // Non-claude runtimes always win over a stale `claude_md_path` (the #3163
+        // rationale: a Codex/AGENTS-native project must never write to CLAUDE.md
+        // even if a prior Claude setup left a `claude_md_path` behind). For the
+        // claude runtime, `claude_md_path` config is honored — it IS the
+        // Claude-specific output setting (per #1098 and the #3163 non-codex test).
         const effectiveRuntime = (0, runtime_name_policy_cjs_1.resolveRuntimeNameFromCandidates)(process.env['GSD_RUNTIME'], config['runtime']);
-        if (!options.output && effectiveRuntime === 'codex') {
-            configClaudeMdPath = './AGENTS.md';
+        if (!options.output && effectiveRuntime && effectiveRuntime !== 'claude') {
+            configClaudeMdPath = (0, runtime_name_policy_cjs_1.getProjectInstructionFile)(effectiveRuntime);
         }
     }
     catch { /* use default */ }