@opengsd/gsd-core 1.7.0-rc.6 → 1.7.0

package/.claude-plugin/marketplace.json

@@ -9,7 +9,7 @@
     {
       "name": "gsd-core",
       "description": "GSD Core is a meta-prompting, context engineering, and spec-driven development system for AI coding agents.",
-      "version": "1.7.0-rc.6",
+      "version": "1.7.0",
       "source": "./",
       "author": {
         "name": "open-gsd",

package/.claude-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "gsd-core",
   "displayName": "GSD Core",
-  "version": "1.7.0-rc.6",
+  "version": "1.7.0",
   "description": "GSD Core is a meta-prompting, context engineering, and spec-driven development system for AI coding agents.",
   "author": {
     "name": "open-gsd",

package/agents/gsd-executor.md

@@ -315,7 +315,7 @@ For full automation-first patterns, server lifecycle, CLI handling:
 **Auto-mode checkpoint behavior** (when `AUTO_CFG` is `"true"`):
 
 - **checkpoint:human-verify** → Auto-approve **except package-legitimacy checkpoints**. If checkpoint has `gate="blocking-human"` OR its purpose indicates package legitimacy verification (`what-built` mentions `Package verification required before install` or `Package install failed — human verification required`), do **not** auto-approve. STOP and return checkpoint_return_format for explicit human confirmation.
-- **checkpoint:decision** → Auto-select first option (planners front-load the recommended choice). Log `⚡ Auto-selected: [option name]`. Continue to next task.
+- **checkpoint:decision** → If checkpoint has `gate="blocking-human"`, do **not** auto-select — STOP and return checkpoint_return_format for an explicit human decision (a `blocking-human` decision exists because its default answer would be wrong to assume). Otherwise auto-select first option (planners front-load the recommended choice), log `⚡ Auto-selected: [option name]`, continue to next task.
 - **checkpoint:human-action** → STOP normally. Auth gates cannot be automated — return structured checkpoint message using checkpoint_return_format.
 
 **Standard checkpoint behavior** (when `AUTO_CFG` is not `"true"`):
@@ -340,6 +340,7 @@ When hitting checkpoint or auth gate, return this structure:
 ## CHECKPOINT REACHED
 
 **Type:** [human-verify | decision | human-action]
+**Gate:** [blocking | blocking-human] — copy the task's `gate` attribute verbatim so the orchestrator's carve-out sees it
 **Plan:** {phase}-{plan}
 **Progress:** {completed}/{total} tasks complete
 

package/agents/gsd-security-auditor.md

@@ -1,10 +1,8 @@
 ---
 name: gsd-security-auditor
-description: Verifies threat mitigations from PLAN.md threat model exist in implemented code. Produces SECURITY.md. Spawned by /gsd:secure-phase.
+description: Verifies threat mitigations from PLAN.md threat model exist in implemented code. Returns structured security verdict (SECURED / OPEN_THREATS / ESCALATE). Spawned by /gsd:secure-phase.
 tools:
   - Read
-  - Write
-  - Edit
   - Bash
   - Glob
   - Grep
@@ -15,11 +13,11 @@ color: red
 <role>
 An implemented phase has been submitted for security audit. Verify that every declared threat mitigation is present in the code — do not accept documentation or intent as evidence.
 
-Does NOT scan blindly for new vulnerabilities. Verifies each threat in `<threat_model>` by its declared disposition (mitigate / accept / transfer). Reports gaps. Writes SECURITY.md.
+Does NOT scan blindly for new vulnerabilities. Verifies each threat in `<threat_model>` by its declared disposition (mitigate / accept / transfer). Reports gaps. Returns a structured verdict — the orchestrator owns the SECURITY.md file write (#2119: single-writer contract).
 
 **Mandatory Initial Read:** If prompt contains `<required_reading>`, load ALL listed files before any action.
 
-**Implementation files are READ-ONLY.** Only create/modify: SECURITY.md. Implementation security gaps → OPEN_THREATS or ESCALATE. Never patch implementation.
+**Implementation files are READ-ONLY.** The auditor does NOT write any files — it returns a structured verdict (SECURED / OPEN_THREATS / ESCALATE). The orchestrator persists SECURITY.md. Implementation security gaps → OPEN_THREATS or ESCALATE. Never patch implementation.
 </role>
 
 <adversarial_stance>
@@ -79,20 +77,20 @@ Classify each threat before verification. Record classification for every threat
 - L3: deep trace — follow the data flow end-to-end, check edge cases and ordering, confirm no bypass path exists.
 </step>
 
-<step name="verify_and_write">
+<step name="verify_and_return">
 For each `mitigate` threat: grep for declared mitigation pattern in cited files → found = `CLOSED`, not found = `OPEN`. Apply depth per `asvs_level` (see analyze_threats step).
-For `accept` threats: check SECURITY.md accepted risks log → entry present = `CLOSED`, absent = `OPEN`.
+For `accept` threats: check existing SECURITY.md accepted risks log → entry present = `CLOSED`, absent = `OPEN`.
 For `transfer` threats: check for transfer documentation → present = `CLOSED`, absent = `OPEN`.
 
-For each `threat_flag` in SUMMARY.md `## Threat Flags`: if maps to existing threat ID → informational. If no mapping → log as `unregistered_flag` in SECURITY.md (not a blocker).
+For each `threat_flag` in SUMMARY.md `## Threat Flags`: if maps to existing threat ID → informational. If no mapping → log as `unregistered_flag` in the structured return (not a blocker).
 
 **Severity-aware `threats_open` computation (severity order: critical > high > medium > low):**
 `threats_open` (the SECURITY.md frontmatter gate field) = the count of threats whose status is OPEN AND whose severity rank ≥ the `block_on` rank. `block_on: none` ⇒ 0 (nothing ever blocks). `block_on: low` ⇒ all open threats block. `block_on: high` (default) ⇒ only high and critical open threats block.
-Open threats BELOW the block threshold are recorded in SECURITY.md as **open — below {block_on} threshold (non-blocking)** and MUST NOT be counted in `threats_open`.
+Open threats BELOW the block threshold are recorded in the return as **open — below {block_on} threshold (non-blocking)** and MUST NOT be counted in `threats_open`.
 
 **Fail-closed for missing severity:** if an OPEN threat has no severity or an unparseable severity (e.g. a legacy register predating the Severity column), treat it as `critical` for this computation — it COUNTS toward `threats_open` (blocking). Never silently drop an unranked open threat.
 
-Write SECURITY.md. Set `threats_open` to the severity-filtered count. Return structured result.
+Return the structured result (SECURED / OPEN_THREATS / ESCALATE) with `threats_open` set to the severity-filtered count. The orchestrator writes SECURITY.md from this data — the auditor does NOT write any files (#2119).
 </step>
 
 </execution_flow>
@@ -116,7 +114,7 @@ Write SECURITY.md. Set `threats_open` to the severity-filtered count. Return str
 ### Unregistered Flags
 {none / list from SUMMARY.md ## Threat Flags with no threat mapping}
 
-SECURITY.md: {path}
+**threats_open:** {count}
 ```
 
 ## OPEN_THREATS
@@ -145,9 +143,9 @@ SECURITY.md: {path}
 
 *Only blocking-open threats count toward `threats_open` in SECURITY.md frontmatter.*
 
-Next: Implement mitigations or document as accepted in SECURITY.md accepted risks log, then re-run /gsd:secure-phase.
+Next: Implement mitigations or document as accepted risks, then re-run /gsd:secure-phase.
 
-SECURITY.md: {path}
+**threats_open:** {count}
 ```
 
 ## ESCALATE
@@ -172,6 +170,6 @@ SECURITY.md: {path}
 - [ ] Each threat verified by disposition type (mitigate / accept / transfer)
 - [ ] Threat flags from SUMMARY.md `## Threat Flags` incorporated
 - [ ] Implementation files never modified
-- [ ] SECURITY.md written to correct path
-- [ ] Structured return: SECURED / OPEN_THREATS / ESCALATE
+- [ ] No files written — structured verdict returned only (orchestrator writes SECURITY.md)
+- [ ] Structured return: SECURED / OPEN_THREATS / ESCALATE with `threats_open` count
 </success_criteria>

package/bin/install.js

@@ -1139,9 +1139,10 @@ function writeSettings(settingsPath, settings) {
  * Used by Codex TOML and OpenCode agent file generators to embed per-agent
  * model assignments so that model_overrides is respected on non-Claude runtimes (#2256).
  */
-function readGsdGlobalModelOverrides() {
+function readGsdGlobalModelOverrides(options = {}) {
   try {
-    const defaultsPath = path.join(os.homedir(), '.gsd', 'defaults.json');
+    const home = options.homedir ? options.homedir() : os.homedir();
+    const defaultsPath = path.join(home, '.gsd', 'defaults.json');
     if (!fs.existsSync(defaultsPath)) return null;
     const raw = fs.readFileSync(defaultsPath, 'utf-8');
     const parsed = JSON.parse(raw);
@@ -1178,8 +1179,8 @@ function readGsdGlobalModelOverrides() {
  * Returns a plain `{ agentName: modelId }` object, or `null` when neither
  * source defines `model_overrides`.
  */
-function readGsdEffectiveModelOverrides(targetDir = null) {
-  const global = readGsdGlobalModelOverrides();
+function readGsdEffectiveModelOverrides(targetDir = null, options = {}) {
+  const global = readGsdGlobalModelOverrides(options);
 
   let projectOverrides = null;
   if (targetDir) {

package/commands/gsd/mempalace-capture.md

@@ -55,7 +55,33 @@ This step is `onError: skip` at `discuss:post` / `plan:post` / `verify:post` --
 On any error or timeout, stop and let the phase continue -- capture is best-effort.
 
 1. **Dedup first.** Interactive: `mempalace_check_duplicate` on the artifact's deterministic drawer id. Headless: rely on `mempalace mine`'s content-hash idempotency.
-2. **Add the drawer (verbatim).** File the exact artifact text into `room: <room>` of `wing: <wing>` with provenance (`source_file`, phase id). Interactive: `mempalace_add_drawer`. Headless: `mempalace mine <path> --wing <wing> --room <room>`.
+2. **Add the drawer (verbatim).** File the exact artifact text into `room: <room>` of `wing: <wing>` with provenance (`source_file`, phase id). Interactive: `mempalace_add_drawer`. Headless: see below.
+
+   **`mempalace mine` has no `--room` flag** — only `search` accepts `--room` ([CLI reference: https://mempalaceofficial.com/reference/cli.html](https://mempalaceofficial.com/reference/cli.html)). Room assignment is driven by `detect_room()` matching folder-path segments against the `rooms:` list in `mempalace.yaml` ([mining guide: https://mempalaceofficial.com/guide/mining.html](https://mempalaceofficial.com/guide/mining.html) — "Rooms are auto-detected from your folder structure"; [config reference: https://mempalaceofficial.com/guide/configuration.html](https://mempalaceofficial.com/guide/configuration.html)). Stage the artifact under a room-named folder so `detect_room()` assigns it correctly:
+
+   ```bash
+   STAGE=".planning/.mempalace-stage"
+   # One-time: declare the GSD room taxonomy so detect_room() recognizes these folders
+   mkdir -p "$STAGE"
+   [ -f "$STAGE/mempalace.yaml" ] || cat > "$STAGE/mempalace.yaml" <<'YAML'
+   rooms:
+     - decisions
+     - planning
+     - milestones
+     - problems
+     - general
+   YAML
+   # Suppress MemPalace cache artifacts written into the scanned tree
+   [ -f "$STAGE/.gitignore" ] || echo "mempalace_embedder.json" > "$STAGE/.gitignore"
+   # Stage under <room>/<phase-id>/<basename> — stable path so mine's content-hash
+   # idempotency (file_already_mined keys on absolute source_file + mtime) deduplicates
+   # instead of creating duplicate drawers on re-runs.
+   ROOM_DIR="$STAGE/<room>/<phase-id>"
+   mkdir -p "$ROOM_DIR"
+   cp "<artifact-path>" "$ROOM_DIR/<basename>"
+   # Mine with --wing only — no --room flag; detect_room() assigns from the folder path
+   mempalace mine "$STAGE" --wing <wing>
+   ```
 3. **Mirror KG facts** when `config.mempalace.mirror_kg` is true: extract decision/delivery facts and `mempalace_kg_add` them with `valid_from` = the phase date (e.g. `(<project>, decided, <decision>)` from CONTEXT; `(<phase>, delivered, <capability>)` from SUMMARY). Under `augment` these are an *additive* mirror of GSD's native `.planning/graphs/`. Under `kg_backend`/`replace` the palace KG is the *authoritative* fact store — GSD still produces `.planning/graphs/` through its normal graphify, so an unreachable palace never loses a fact.
 4. Re-running a phase MUST NOT create duplicate drawers (deterministic ids + `check_duplicate`).
 

package/commands/gsd/surface.md

@@ -37,9 +37,9 @@ Parse the first token of $ARGUMENTS:
 ## list / status
 
 Load the capability registry and call `listSurface(runtimeConfigDir, manifest, CLUSTERS, registry)` from
-`gsd-core/bin/lib/surface.cjs`. The registry is loaded via:
+the engine module at `${runtimeConfigDir}/gsd-core/bin/lib/surface.cjs`. The registry is loaded via:
 ```js
-const registry = require('gsd-core/bin/lib/capability-registry.cjs');
+const registry = require(runtimeConfigDir + '/gsd-core/bin/lib/capability-registry.cjs');
 ```
 Display:
 
@@ -71,7 +71,7 @@ Install profile: standard  (from .gsd-profile)
 3. `writeSurface(runtimeConfigDir, surfaceState)`.
 4. Resolve and re-apply:
    ```js
-   const registry = require('gsd-core/bin/lib/capability-registry.cjs');
+   const registry = require(runtimeConfigDir + '/gsd-core/bin/lib/capability-registry.cjs');
    const layout = resolveRuntimeArtifactLayout(runtime, runtimeConfigDir, scope);
    applySurface(runtimeConfigDir, layout, manifest, CLUSTERS, registry);
    ```
@@ -89,7 +89,7 @@ Valid cluster names: `core_loop`, `audit_review`, `milestone`, `research_ideate`
 3. Add cluster to `surfaceState.disabledClusters` (deduplicate).
 4. `writeSurface` → resolve layout → `applySurface`:
    ```js
-   const registry = require('gsd-core/bin/lib/capability-registry.cjs');
+   const registry = require(runtimeConfigDir + '/gsd-core/bin/lib/capability-registry.cjs');
    const layout = resolveRuntimeArtifactLayout(runtime, runtimeConfigDir, scope);
    applySurface(runtimeConfigDir, layout, manifest, CLUSTERS, registry);
    ```
@@ -103,7 +103,7 @@ Valid cluster names: `core_loop`, `audit_review`, `milestone`, `research_ideate`
 2. Remove cluster from `surfaceState.disabledClusters`.
 3. `writeSurface` → resolve layout → `applySurface`:
    ```js
-   const registry = require('gsd-core/bin/lib/capability-registry.cjs');
+   const registry = require(runtimeConfigDir + '/gsd-core/bin/lib/capability-registry.cjs');
    const layout = resolveRuntimeArtifactLayout(runtime, runtimeConfigDir, scope);
    applySurface(runtimeConfigDir, layout, manifest, CLUSTERS, registry);
    ```
@@ -151,7 +151,7 @@ All paths can be overridden by reading the `CLAUDE_CONFIG_DIR` env var if set.
 
 - Unknown cluster name → list valid cluster names, exit without writing.
 - Unknown profile name → list known profiles (`core`, `standard`, `full`), exit.
-- Missing `surface.cjs` → prompt: "Run `npm i -g gsd-core` to reinstall GSD."
+- Missing `surface.cjs` → prompt: "Run `npm i -g @opengsd/gsd-core` to reinstall GSD."
 
 <execution_context>
 Surface state file: `~/.claude/.gsd-surface.json`

package/gsd-core/bin/gsd-tools.cjs

@@ -27,6 +27,12 @@
  *   list-todos [area]                  Count and enumerate pending todos
  *   list-seeds [status]                List captured seeds (optional status filter)
  *   verify-path-exists <path>          Check file/directory existence
+ *   quick-tasks-append --task <text>   Append a row to STATE.md's "Quick Tasks
+ *                                      Completed" table (schema-backed via
+ *                                      markdown-table.cjs; #2133/ADR-2143).
+ *                                      Fails loud (non-zero exit) on a missing
+ *                                      or unrecognized table instead of the old
+ *                                      awk NF-2 silent-skip guess.
  *   config-ensure-section              Initialize .planning/config.json
  *   history-digest                     Aggregate all SUMMARY.md data
  *   summary-extract <path> [--fields]  Extract structured data from SUMMARY.md
@@ -693,7 +699,7 @@ async function main() {
     'from-gsd2, frontmatter, gap-analysis, generate-claude-md, generate-claude-profile, ' +
     'generate-dev-preferences, generate-slug, graphify, history-digest, init, intel, ' +
     'capability, classify-confidence, git, learnings, list-seeds, list-todos, loop, milestone, package-legitimacy, phase, phase-plan-index, phases, profile-questionnaire, ' +
-    'profile-sample, progress, project-instruction-file, prompt-budget, requirements, research-plan, research-store, resolve-granularity, resolve-model, roadmap, scaffold, smart-entry, state, ' +
+    'profile-sample, progress, project-instruction-file, prompt-budget, quick-tasks-append, requirements, research-plan, research-store, resolve-granularity, resolve-model, roadmap, scaffold, smart-entry, state, ' +
     'task, template, user-story, validate, verify, verify-path-exists, verify-summary, eval, workstream, worktree\n\n' +
     'Global flags:\n' +
     '  --raw              Emit raw output without post-processing\n' +
@@ -1213,6 +1219,59 @@ async function runCommand(command, args, cwd, raw, defaultValue, originalCommand
       break;
     }
 
+    case 'quick-tasks-append': {
+      // #2133 / ADR-2143 §3,§7: schema-backed replacement for fast.md's inline
+      // `awk NF-2` Quick Tasks column arithmetic. Row construction is delegated
+      // to the pure appendQuickTaskRow (markdown-table.cjs); this case only
+      // handles the I/O (read STATE.md, resolve date/commit, write STATE.md).
+      const qtaArgs = args.slice(1);
+      const qtaTask = parseNamedArgs(qtaArgs, ['task']).task || args[1];
+      if (!qtaTask) {
+        error('quick-tasks-append requires --task <description> (or a positional description)', ERROR_REASON.USAGE);
+      }
+
+      const statePath = path.join(cwd, '.planning', 'STATE.md');
+      if (!fs.existsSync(statePath)) {
+        error(`quick-tasks-append: STATE.md not found at ${statePath}`, ERROR_REASON.USAGE);
+      }
+
+      const date = new Date().toISOString().slice(0, 10);
+      const { execGit } = require('./lib/shell-command-projection.cjs');
+      const hashResult = execGit(['rev-parse', '--short', 'HEAD'], { cwd });
+      const commit = hashResult.exitCode === 0 && hashResult.stdout ? hashResult.stdout : '—';
+
+      const { appendQuickTaskRow } = require('./lib/markdown-table.cjs');
+
+      // #2242 review fix: route the read -> mutate -> write cycle through
+      // state.readModifyWriteStateMd (lib/state.cjs) instead of a raw
+      // fs.readFileSync + fs.writeFileSync pair, so the whole read-modify-write
+      // is atomic under STATE.md's lockfile — closing the lost-update race a
+      // raw read/write pair left open (cf. #500/#905/#1230). This mirrors the
+      // pattern every other STATE.md-mutating case in state.cts uses (e.g.
+      // cmdStateAddBlocker, cmdStateAddDecision): a mutable outer variable
+      // captures the pure helper's side output, and a fail-loud reason throws
+      // ExitError from INSIDE the transform (readModifyWriteStateMd's finally
+      // still releases the lock before the throw propagates; the transform
+      // throws before returning new content, so nothing is ever written).
+      let mutation;
+      state.readModifyWriteStateMd(statePath, (content) => {
+        const result = appendQuickTaskRow(content, { description: qtaTask, date, commit });
+        if (!result.ok) {
+          // Mirrors fast.md's old "skip with a brief log" behaviour (#2133): this
+          // is an expected, recoverable condition (no table / unrecognized
+          // schema), not a hard crash. ExitError sets a non-zero exit code (so
+          // fast.md's `|| echo ...` fallback fires) without calling
+          // process.exit() directly — stdout stays flushed and untouched.
+          throw new ExitError(1, `⚠ quick-tasks-append: ${result.reason}`);
+        }
+        mutation = result.value;
+        return result.value.content;
+      }, cwd);
+
+      output({ ok: true, row: mutation.row, variant: mutation.variant }, raw, mutation.row);
+      break;
+    }
+
     case 'config-ensure-section': {
       // Phase 6 (#3575): dispatch via SDK executeForCjs. The catalog rebinds
       // 'config-ensure-section' to configNewProject in
@@ -1500,7 +1559,9 @@ async function runCommand(command, args, cwd, raw, defaultValue, originalCommand
         // new-milestone never inherits un-archived dirs. --no-archive-phases opts out.
         const archivePhases = !args.includes('--no-archive-phases');
         const force = args.includes('--force');
-        milestone.cmdMilestoneComplete(cwd, args[2], { name: milestoneName, archivePhases, force }, raw);
+        // #2118: --dry-run prints a preview plan without mutating.
+        const dryRun = args.includes('--dry-run');
+        milestone.cmdMilestoneComplete(cwd, args[2], { name: milestoneName, archivePhases, force, dryRun }, raw);
       } else {
         error('Unknown milestone subcommand. Available: complete', ERROR_REASON.SDK_UNKNOWN_COMMAND);
       }

package/gsd-core/bin/lib/api-coverage.cjs

@@ -264,13 +264,12 @@ function parseCoverageMatrix(text) {
     const src = text.replace(/\r\n/g, '\n');
     // (1) fenced ```coverage JSON block takes precedence if present.
     // Case-insensitive info string (```coverage and ```Coverage are both legal CommonMark).
-    // allow-adhoc-markdown: extracting a NAMED ```coverage fence (extraction of one tagged block), not stripping all fences — stripFencedCode/extractTaggedBlocks do not cover named-fence extraction.
-    const fenceMatch = src.match(/```coverage\s*\n([\s\S]*?)\n```/i);
-    if (fenceMatch && fenceMatch[1]) {
+    const fenceBody = (0, markdown_sectionizer_cjs_1.extractFencedBlock)(src, 'coverage');
+    if (fenceBody) {
         out.format = 'json';
         let parsed;
         try {
-            parsed = JSON.parse(fenceMatch[1]);
+            parsed = JSON.parse(fenceBody);
         }
         catch {
             out.errors.push('fenced ```coverage block is not valid JSON');

package/gsd-core/bin/lib/audit.cjs

@@ -17,6 +17,7 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
 const node_fs_1 = __importDefault(require("node:fs"));
 const node_path_1 = __importDefault(require("node:path"));
 const shell_command_projection_cjs_1 = require("./shell-command-projection.cjs");
+const markdown_sectionizer_cjs_1 = require("./markdown-sectionizer.cjs");
 // eslint-disable-next-line @typescript-eslint/no-require-imports
 const planningWorkspace = require("./planning-workspace.cjs");
 const { planningDir } = planningWorkspace;
@@ -71,9 +72,9 @@ function scanDebugSessions(planDir) {
             continue;
         // Extract hypothesis from "Current Focus" block if parseable
         let hypothesis = '';
-        const focusMatch = content.match(/##\s*Current Focus[^\n]*\n([\s\S]*?)(?=\n##\s|$)/i); // allow-adhoc-markdown: pre-seam read-only section extract in audit.cts; pending migration #1372
-        if (focusMatch) {
-            const focusText = focusMatch[1].trim().split('\n')[0].trim();
+        const focusSection = (0, markdown_sectionizer_cjs_1.collectSection)(content, (h) => h.level === 2 && h.text.trim().toLowerCase().startsWith('current focus'), { levelBounded: true });
+        if (focusSection) {
+            const focusText = focusSection.body.trim().split('\n')[0].trim();
             hypothesis = (0, security_cjs_1.sanitizeForDisplay)(focusText.slice(0, 100));
         }
         const slug = node_path_1.default.basename(entry.name, '.md');
@@ -509,9 +510,9 @@ function scanContextQuestions(planDir) {
             }
             // Also check for ## Open Questions section in body
             if (questions.length === 0) {
-                const oqMatch = content.match(/##\s*Open Questions[^\n]*\n([\s\S]*?)(?=\n##\s|$)/i); // allow-adhoc-markdown: pre-seam read-only section extract in audit.cts; pending migration #1372
-                if (oqMatch) {
-                    const oqBody = oqMatch[1].trim();
+                const oqSection = (0, markdown_sectionizer_cjs_1.collectSection)(content, (h) => h.level === 2 && h.text.trim().toLowerCase().startsWith('open questions'), { levelBounded: true });
+                if (oqSection) {
+                    const oqBody = oqSection.body.trim();
                     if (oqBody && oqBody.length > 0 && !/^\s*none\s*$/i.test(oqBody)) {
                         const items = oqBody.split('\n')
                             .map((l) => l.trim())