@opengsd/gsd-core 1.9.0 → 1.10.0

package/gsd-core/bin/lib/uat.cjs

@@ -22,7 +22,7 @@ const markdownSectionizer = require("./markdown-sectionizer.cjs");
 const { collectSection, tokenizeHeadings } = markdownSectionizer;
 // eslint-disable-next-line @typescript-eslint/no-require-imports
 const markdownTable = require("./markdown-table.cjs");
-const { splitTableRow } = markdownTable;
+const { splitTableRow, isDelimiterRow } = markdownTable;
 // eslint-disable-next-line @typescript-eslint/no-require-imports
 const roadmapParser = require("./roadmap-parser.cjs");
 const { getMilestonePhaseFilter } = roadmapParser;
@@ -38,6 +38,9 @@ const { extractFrontmatter } = frontmatter;
 // eslint-disable-next-line @typescript-eslint/no-require-imports
 const phaseIdMod = require("./phase-id.cjs");
 const { PHASE_NUMBER_TOKEN_SOURCE } = phaseIdMod;
+// eslint-disable-next-line @typescript-eslint/no-require-imports
+const phaseLocator = require("./phase-locator.cjs");
+const { getArchivedPhaseDirs } = phaseLocator;
 const security_cjs_1 = require("./security.cjs");
 // eslint-disable-next-line @typescript-eslint/no-require-imports -- config-loader.cjs is an export= CommonJS module
 const configLoader = require("./config-loader.cjs");
@@ -45,21 +48,50 @@ const { loadConfig } = configLoader;
 // ─── cmdAuditUat ─────────────────────────────────────────────────────────────
 function cmdAuditUat(cwd, raw) {
     const phasesDir = node_path_1.default.join(planningDir(cwd), 'phases');
-    if (!node_fs_1.default.existsSync(phasesDir)) {
+    const hasActivePhases = node_fs_1.default.existsSync(phasesDir);
+    // #2766: on milestone completion `milestone.cts` MOVES each phase dir into
+    // `.planning/milestones/<version>-phases/` (archive-by-default since #1871),
+    // leaving `.planning/phases/` empty or absent. Scanning only the active tree
+    // meant a partly-archived project silently omitted the archived phases, and a
+    // fully-archived one hard-errored with "No phases directory found" —
+    // indistinguishable from a broken install. Outstanding UAT items do not stop
+    // mattering when a milestone closes: a deferred human-UAT scenario or a
+    // `skipped` live-stack test is exactly what gets archived still-open.
+    //
+    // Reuses the canonical `getArchivedPhaseDirs` seam (phase-locator.cts), which
+    // `findPhaseInternal` already uses for this same fallback, so the archive
+    // layout convention stays owned by one module.
+    const archivedDirs = getArchivedPhaseDirs(cwd);
+    if (!hasActivePhases && archivedDirs.length === 0) {
         error('No phases directory found in planning directory');
     }
     const isDirInMilestone = getMilestonePhaseFilter(cwd);
     const results = [];
-    // Scan all phase directories
-    const dirs = node_fs_1.default.readdirSync(phasesDir, { withFileTypes: true })
-        .filter(e => e.isDirectory())
-        .map(e => e.name)
-        .filter(isDirInMilestone)
-        .sort();
-    for (const dir of dirs) {
+    // Active dirs are milestone-filtered; archived dirs deliberately are NOT.
+    // getMilestonePhaseFilter derives the CURRENT milestone's phase numbers from
+    // ROADMAP.md, and archived phases belong to past milestones by definition — so
+    // applying it to them discards every one and silently reinstates the bug.
+    const scanTargets = [];
+    if (hasActivePhases) {
+        const dirs = node_fs_1.default.readdirSync(phasesDir, { withFileTypes: true })
+            .filter(e => e.isDirectory())
+            .map(e => e.name)
+            .filter(isDirInMilestone)
+            .sort();
+        for (const dir of dirs) {
+            scanTargets.push({ dir, phaseDir: node_path_1.default.join(phasesDir, dir) });
+        }
+    }
+    for (const archived of archivedDirs) {
+        scanTargets.push({
+            dir: archived.name,
+            phaseDir: archived.fullPath,
+            milestone: archived.milestone,
+        });
+    }
+    for (const { dir, phaseDir, milestone } of scanTargets) {
         const phaseMatch = dir.match(new RegExp(`^(${PHASE_NUMBER_TOKEN_SOURCE})`, 'i'));
         const phaseNum = phaseMatch ? phaseMatch[1] : dir;
-        const phaseDir = node_path_1.default.join(phasesDir, dir);
         const files = node_fs_1.default.readdirSync(phaseDir);
         // Process UAT files
         for (const file of files.filter(f => f.includes('-UAT') && f.endsWith('.md'))) {
@@ -74,6 +106,7 @@ function cmdAuditUat(cwd, raw) {
                     file_path: toPosixPath(node_path_1.default.relative(cwd, node_path_1.default.join(phaseDir, file))),
                     type: 'uat',
                     status: (extractFrontmatter(content, uatFilePath).status || 'unknown'),
+                    archived_milestone: milestone,
                     items,
                 });
             }
@@ -93,6 +126,7 @@ function cmdAuditUat(cwd, raw) {
                         file_path: toPosixPath(node_path_1.default.relative(cwd, node_path_1.default.join(phaseDir, file))),
                         type: 'verification',
                         status,
+                        archived_milestone: milestone,
                         items,
                     });
                 }
@@ -117,6 +151,7 @@ function cmdAuditUat(cwd, raw) {
                     file_path: toPosixPath(node_path_1.default.relative(cwd, node_path_1.default.join(phaseDir, deferredFile))),
                     type: 'deferred',
                     status: 'unresolved',
+                    archived_milestone: milestone,
                     items,
                 });
             }
@@ -308,6 +343,43 @@ const CHECKPOINT_FRAMES = {
         banner: 'PUNTO DI CONTROLLO: Verifica richiesta',
         instruction: 'Digita `pass` o descrivi cosa non va.',
     },
+    dutch: {
+        banner: 'CONTROLEPUNT: Verificatie vereist',
+        instruction: 'Typ `pass` of beschrijf wat er mis is.',
+    },
+    polish: {
+        banner: 'PUNKT KONTROLNY: Wymagana weryfikacja',
+        instruction: 'Wpisz `pass` lub opisz, co jest nie tak.',
+    },
+    russian: {
+        banner: 'КОНТРОЛЬНАЯ ТОЧКА: требуется проверка',
+        instruction: 'Введите `pass` или опишите, что не так.',
+    },
+    ukrainian: {
+        banner: 'КОНТРОЛЬНА ТОЧКА: потрібна перевірка',
+        instruction: 'Введіть `pass` або опишіть, що не так.',
+    },
+    turkish: {
+        banner: 'KONTROL NOKTASI: Doğrulama gerekli',
+        instruction: '`pass` yazın veya sorunu açıklayın.',
+    },
+    hindi: {
+        banner: 'चेकपॉइंट: सत्यापन आवश्यक',
+        instruction: '`pass` लिखें या बताएं कि क्या गलत है।',
+    },
+    arabic: {
+        banner: 'نقطة تحقق: المراجعة مطلوبة',
+        instruction: 'اكتب `pass` أو صف المشكلة.',
+        direction: 'rtl',
+    },
+    vietnamese: {
+        banner: 'ĐIỂM KIỂM TRA: Cần xác minh',
+        instruction: 'Nhập `pass` hoặc mô tả vấn đề.',
+    },
+    indonesian: {
+        banner: 'TITIK PEMERIKSAAN: Verifikasi diperlukan',
+        instruction: 'Ketik `pass` atau jelaskan apa yang salah.',
+    },
 };
 // Free-form response_language aliases → canonical CHECKPOINT_FRAMES key.
 const CHECKPOINT_LANGUAGE_ALIASES = {
@@ -320,21 +392,27 @@ const CHECKPOINT_LANGUAGE_ALIASES = {
     chinese: 'chinese', zh: 'chinese', 'zh-cn': 'chinese', 'zh-tw': 'chinese', mandarin: 'chinese', 'simplified chinese': 'chinese', 'traditional chinese': 'chinese', '中文': 'chinese',
     korean: 'korean', ko: 'korean', '한국어': 'korean',
     italian: 'italian', it: 'italian', italiano: 'italian',
+    dutch: 'dutch', nl: 'dutch', nederlands: 'dutch', flemish: 'dutch', vlaams: 'dutch',
+    polish: 'polish', pl: 'polish', polski: 'polish',
+    russian: 'russian', ru: 'russian', 'ru-ru': 'russian', 'русский': 'russian',
+    ukrainian: 'ukrainian', uk: 'ukrainian', ua: 'ukrainian', 'українська': 'ukrainian',
+    turkish: 'turkish', tr: 'turkish', 'türkçe': 'turkish', turkce: 'turkish',
+    hindi: 'hindi', hi: 'hindi', 'हिन्दी': 'hindi', 'हिंदी': 'hindi',
+    arabic: 'arabic', ar: 'arabic', 'العربية': 'arabic',
+    vietnamese: 'vietnamese', vi: 'vietnamese', 'tiếng việt': 'vietnamese', 'tieng viet': 'vietnamese',
+    indonesian: 'indonesian', id: 'indonesian', 'bahasa indonesia': 'indonesian',
 };
 function resolveCheckpointFrame(responseLanguage) {
     if (!responseLanguage)
         return CHECKPOINT_FRAMES.english;
-    const key = CHECKPOINT_LANGUAGE_ALIASES[responseLanguage.trim().toLowerCase()];
+    const key = CHECKPOINT_LANGUAGE_ALIASES[responseLanguage.trim().normalize('NFC').toLowerCase()];
     return (key && CHECKPOINT_FRAMES[key]) || CHECKPOINT_FRAMES.english;
 }
-// Approximate East Asian Width ranges (Unicode property values W and F) — the
-// CJK scripts CHECKPOINT_FRAMES ships (Japanese/Chinese/Korean) render each
-// matching code point at 2 terminal/display columns, not 1. Padding computed
-// from `.length` (UTF-16 code units) undercounts these by one column per
-// wide character, visually misaligning the box's right border (#2402 review
-// medium finding). Latin-script frames (English/Spanish/French/German/
-// Portuguese/Italian) contain no wide code points, so displayWidth === length
-// for them — no behavior change there.
+// Approximate terminal-cell width. East Asian Width W/F code points occupy two
+// cells, while Unicode combining marks occupy no additional cell beyond their
+// base character. Counting only W/F ranges is insufficient for scripts such as
+// Devanagari: Hindi vowel signs and viramas are combining marks, and treating
+// each as a full cell visibly shifts the checkpoint box's right border.
 function isWideCodePoint(codePoint) {
     return ((codePoint >= 0x1100 && codePoint <= 0x115f) || // Hangul Jamo
         codePoint === 0x2329 || codePoint === 0x232a ||
@@ -351,11 +429,17 @@ function isWideCodePoint(codePoint) {
         (codePoint >= 0x20000 && codePoint <= 0x3fffd) // CJK Unified Ideographs Extension B+ / supplementary
     );
 }
+// Non-spacing/enclosing marks and format controls occupy zero terminal cells.
+// Spacing combining marks (General_Category=Mc), such as Devanagari vowel
+// signs, still advance the cursor and must contribute one column.
+const ZERO_WIDTH_MARK_RE = /\p{gc=Mn}|\p{gc=Me}|\p{gc=Cf}/u;
 // Iterates by Unicode code point (not UTF-16 code unit) so astral characters
 // are measured once, not as two surrogate units.
 function displayWidth(text) {
     let width = 0;
     for (const ch of text) {
+        if (ZERO_WIDTH_MARK_RE.test(ch))
+            continue;
         width += isWideCodePoint(ch.codePointAt(0)) ? 2 : 1;
     }
     return width;
@@ -370,11 +454,20 @@ function checkpointBoxLine(text) {
     const padded = padLength > 0 ? content + ' '.repeat(padLength) : content;
     return `║${padded}║`;
 }
+const RTL_ISOLATE = '\u2067';
+const POP_DIRECTIONAL_ISOLATE = '\u2069';
+function isolateCheckpointFrameText(text, frame) {
+    return frame.direction === 'rtl'
+        ? `${RTL_ISOLATE}${text}${POP_DIRECTIONAL_ISOLATE}`
+        : text;
+}
 function buildCheckpoint(currentTest, responseLanguage) {
     const frame = resolveCheckpointFrame(responseLanguage);
+    const banner = isolateCheckpointFrameText(frame.banner, frame);
+    const instruction = isolateCheckpointFrameText(frame.instruction, frame);
     return [
         '╔══════════════════════════════════════════════════════════════╗',
-        checkpointBoxLine(frame.banner),
+        checkpointBoxLine(banner),
         '╚══════════════════════════════════════════════════════════════╝',
         '',
         `**Test ${currentTest.number}: ${currentTest.name}**`,
@@ -382,7 +475,7 @@ function buildCheckpoint(currentTest, responseLanguage) {
         currentTest.expected,
         '',
         '──────────────────────────────────────────────────────────────',
-        frame.instruction,
+        instruction,
         '──────────────────────────────────────────────────────────────',
     ].join('\n');
 }
@@ -486,6 +579,165 @@ function parseGapsItems(content) {
             item.reason = reason;
         items.push(item);
     }
+    // #2766: union with the table form. A `|`-leading line is never a `- ` bullet
+    // opener, so a section mixing bullet entries and a table surfaces both with no
+    // double-counting.
+    items.push(...parseGapsTableItems(gapsSection.body));
+    return items;
+}
+/**
+ * Split a section body into its GFM pipe tables, one entry per table (#2766).
+ *
+ * Shared by `parseGapsTableItems` and `parseDeferredTableItems` so the
+ * header/delimiter/table-boundary handling — the fiddly part — lives in exactly
+ * one place, and the two consumers only decide what a data row MEANS.
+ *
+ * Header detection is lookahead-free: the last data-shaped row is held in
+ * `pending` until the NEXT line decides its fate — a delimiter row
+ * (`|---|---|`) proves the held row was a header, anything else promotes it to a
+ * data row. So a conventional table drops exactly its header, a HEADERLESS table
+ * keeps every row (hand-authored planning tables often omit the delimiter), and
+ * a header with no data rows yields nothing. A prose or blank line ends the
+ * current table, so two tables separated by text are read independently and each
+ * drops its own header.
+ *
+ * Reuses the canonical `isDelimiterRow` shape check from markdown-table.cts
+ * rather than re-deriving it. Deliberately NOT routed through
+ * `parseMarkdownTable`, which reads only the FIRST table in a body and treats
+ * ragged/headerless shapes as errors (ADR-2143 §3) — correct for the mandated
+ * tables in STATE.md/ROADMAP.md, but the wrong contract here, where a malformed
+ * hand-written table must still surface its rows rather than be dropped.
+ */
+function collectTableRows(sectionBody) {
+    const tables = [];
+    let current = null;
+    let pending = null;
+    const ensure = () => {
+        if (!current)
+            current = { header: null, rows: [] };
+    };
+    const flushPending = () => {
+        if (pending) {
+            ensure();
+            current.rows.push(pending);
+            pending = null;
+        }
+    };
+    const endTable = () => {
+        flushPending();
+        if (current) {
+            tables.push(current);
+            current = null;
+        }
+    };
+    for (const rawLine of sectionBody.split('\n')) {
+        const line = rawLine.replace(/\r$/, '').trim();
+        if (!line.startsWith('|')) {
+            endTable();
+            continue;
+        }
+        const cells = splitTableRow(line);
+        if (cells.length === 0)
+            continue;
+        if (isDelimiterRow(cells)) {
+            ensure();
+            current.header = pending; // may be null for a delimiter-first table
+            pending = null;
+            continue;
+        }
+        flushPending();
+        pending = cells;
+    }
+    endTable();
+    return tables;
+}
+/**
+ * Header-name → canonical Gaps field (#2766).
+ *
+ * Anchored on the `## Gaps` field vocabulary `templates/UAT.md` mandates for the
+ * YAML-lite bullet form (truth/status/reason/severity/test), plus the obvious
+ * synonyms a human writing the same information as a table reaches for instead.
+ */
+const GAPS_COLUMN_ALIASES = {
+    truth: 'truth', gap: 'truth', finding: 'truth', item: 'truth',
+    description: 'truth', issue: 'truth', name: 'truth',
+    status: 'status', result: 'status', state: 'status',
+    reason: 'reason', note: 'reason', notes: 'reason',
+    detail: 'reason', details: 'reason', evidence: 'reason',
+    severity: 'severity',
+    test: 'test', '#': 'test', 'test #': 'test', 'test number': 'test',
+};
+function mapGapsHeader(header) {
+    if (!header)
+        return null;
+    const columns = {};
+    header.forEach((cell, idx) => {
+        const key = GAPS_COLUMN_ALIASES[cell.trim().toLowerCase().replace(/\*+/g, '')];
+        if (key && !(key in columns))
+            columns[key] = idx;
+    });
+    return Object.keys(columns).length > 0 ? columns : null;
+}
+/**
+ * Extract gap entries from GFM pipe tables in a `## Gaps` section (#2766) — a
+ * UNION with the YAML-lite bullet scan in `parseGapsItems`, for the same reason
+ * `parseDeferredTableItems` exists: `splitGapsEntries` keys entirely on `- `
+ * bullet openers, so a table-shaped `## Gaps` section yielded ZERO items and
+ * every finding in it was silently invisible.
+ *
+ * Neither `templates/UAT.md` nor `templates/verification-report.md` documents a
+ * table for this section (both mandate the bullet/numbered form), so a table
+ * here is off-template hand-authoring — which is precisely why it must not fail
+ * silently. Note `parseVerificationItems` in this same file already reads table
+ * rows AND numbered AND bullet items as a union because the live sections mix
+ * shapes; the Gaps and deferred parsers never got the same treatment.
+ *
+ * When a header row is present its columns are mapped by name against the
+ * template's own field vocabulary (see GAPS_COLUMN_ALIASES) so a tabled gap
+ * carries the same status/reason/test fields as its bullet equivalent and
+ * `categorizeItem` classifies it identically. With no recognizable header, the
+ * row degrades to a joined-cells name with status `unknown` — surfaced, not
+ * dropped, matching this module's established fail-safe stance.
+ *
+ * Resolution follows the bullet path exactly: an entry is skipped ONLY on an
+ * explicit resolved marker — the mapped `status` column reading `resolved`, or,
+ * absent a status column, any cell reading exactly `resolved`. A gap with no
+ * parseable status is NEVER treated as resolved.
+ */
+function parseGapsTableItems(sectionBody) {
+    const items = [];
+    for (const { header, rows } of collectTableRows(sectionBody)) {
+        const columns = mapGapsHeader(header);
+        for (const cells of rows) {
+            const at = (key) => (columns && key in columns ? (cells[columns[key]] ?? '').trim() : '');
+            const rawStatus = at('status');
+            if (rawStatus && rawStatus.toLowerCase() === 'resolved')
+                continue;
+            // No status column: fall back to an explicit resolved marker in any cell
+            // (the headerless-table equivalent of `status: resolved`).
+            if (!columns || !('status' in columns)) {
+                if (cells.some(c => /^resolved$/i.test(c.trim())))
+                    continue;
+            }
+            const truth = at('truth');
+            const reason = at('reason');
+            const testNum = at('test');
+            const name = truth || cells.filter(c => c !== '').join(' — ');
+            if (!name)
+                continue;
+            const status = rawStatus || 'unknown';
+            const item = {
+                name,
+                result: status,
+                category: categorizeItem(status, reason || undefined, undefined),
+            };
+            if (testNum && /^\d+$/.test(testNum))
+                item.test = parseInt(testNum, 10);
+            if (reason)
+                item.reason = reason;
+            items.push(item);
+        }
+    }
     return items;
 }
 // ─── parseDeferredItems ────────────────────────────────────────────────────────
@@ -533,6 +785,49 @@ function parseDeferredItems(content) {
             category: 'deferred',
         });
     }
+    // #2766: union with the table form — see parseDeferredTableItems. Executors
+    // write this file by hand with no mandated shape, and a GFM table is a natural
+    // choice for the common "test → failing seeds" case, which produced ZERO items.
+    items.push(...parseDeferredTableItems(sectionBody));
+    return items;
+}
+/**
+ * Extract deferred entries from GFM pipe tables in a deferred-items.md body
+ * (#2766) — a UNION with the bullet scan in `parseDeferredItems`.
+ *
+ * Cells are joined with ` — ` rather than taking only the first: these tables
+ * carry the useful detail in the later columns (the failing seeds, the reason,
+ * the owner), and dropping them would surface a name with no context.
+ *
+ * A row is skipped when any cell reads exactly `resolved`/`done`/`pass`
+ * (case-insensitive), mirroring the "explicit resolution only" convention
+ * `parseGapsItems` uses for `status: resolved` and `parseVerificationItems` uses
+ * for its `hasPassResult` cell scan — so a human can close a tabled deferred
+ * item in place and keep deferred-items.md the single source of truth.
+ *
+ * Deliberately permissive: an unrelated table in a deferred-items.md (say a
+ * table of environment notes) will surface as deferred entries. That is the
+ * correct fail-safe direction for a false-NEGATIVE bug — the whole file exists to
+ * record outstanding work, and this module's established stance (see
+ * parseGapsItems' 'unknown'-status fallback) is to surface a questionable entry
+ * rather than silently drop a real one.
+ */
+function parseDeferredTableItems(sectionBody) {
+    const items = [];
+    for (const { rows } of collectTableRows(sectionBody)) {
+        for (const cells of rows) {
+            if (cells.some(c => /^(resolved|done|pass)$/i.test(c)))
+                continue;
+            const name = cells.filter(c => c !== '').join(' — ');
+            if (!name)
+                continue;
+            items.push({
+                name,
+                result: 'unresolved',
+                category: 'deferred',
+            });
+        }
+    }
     return items;
 }
 /**
@@ -834,5 +1129,9 @@ module.exports = {
     cmdRenderCheckpoint,
     parseCurrentTest,
     buildCheckpoint,
+    CHECKPOINT_FRAMES,
+    CHECKPOINT_LANGUAGE_ALIASES,
+    resolveCheckpointFrame,
+    checkpointBoxLine,
     parseDeferredItems,
 };

package/gsd-core/bin/lib/unusable-input.cjs

@@ -50,11 +50,20 @@ const UNUSABLE_REASON = Object.freeze({
      * simply has no ROADMAP yet: absence returns the same sentinel, silently. (#1881)
      */
     ROADMAP_UNREADABLE: 'roadmap_unreadable',
+    /**
+     * A `last_activity` value in STATE.md frontmatter is present but unparseable as a date.
+     * Distinct from absent: absence means the field was never set, while an unparseable value
+     * means it was set to something Date.parse rejects. Per ADR-1411 amendment: corrupt is not
+     * absent — the fallback (stale_activity: false) stays, but a diagnostic is emitted so the
+     * silent degradation is visible. (#3099, sixth #1879 site)
+     */
+    LAST_ACTIVITY_UNPARSEABLE: 'last_activity_unparseable',
 });
 /** One human-readable clause per reason. Prose lives here, never in a test assertion. */
 const REASON_PROSE = Object.freeze({
     [UNUSABLE_REASON.FRONTMATTER_UNTERMINATED]: 'frontmatter opens with "---" but never closes; metadata was NOT applied',
     [UNUSABLE_REASON.ROADMAP_UNREADABLE]: 'ROADMAP.md exists but could not be read; phase and milestone lookups fell back to defaults',
+    [UNUSABLE_REASON.LAST_ACTIVITY_UNPARSEABLE]: 'last_activity in STATE.md is present but unparseable as a date; stale_activity fell back to false (idle-stranded suppressed)',
 });
 // ─── Dedup state ──────────────────────────────────────────────────────────────
 /**

package/gsd-core/bin/lib/verification.cjs

@@ -213,23 +213,26 @@ function missingResult(runtime, phaseArg) {
 }
 function findStaleVerificationSummary(phaseDir, fsImpl = node_fs_1.default, phaseCleanCommitTimesMs = defaultPhaseCleanCommitTimesMs) {
     // FS errors (TOCTOU: a SUMMARY listed by scanPhasePlans then removed before statSync;
-    // unreadable dir; broken symlink; file->dir swap) must degrade to "not stale" rather
-    // than throw uncaught into callers that are NOT under the planning lock
-    // (init.manager / init.progress / uat-predicate). Mirrors readVerificationStatus's
-    // no-throw contract; `fsImpl` threads the same injectable-fs seam for parity/testing.
-    // (Review B1 on #1548.)
+    // unreadable dir; broken symlink; file->dir swap) must degrade rather than throw
+    // uncaught into callers that are NOT under the planning lock (init.manager /
+    // init.progress / uat-predicate). Mirrors readVerificationStatus's no-throw
+    // contract; `fsImpl` threads the same injectable-fs seam for parity/testing.
+    // (Review B1 on #1548.) The degraded result is `{determined:false}`, NOT the
+    // same value as a completed "nothing is stale" check — see StaleCheckResult
+    // doc and #3057 B3. The caller decides how to route an indeterminate result;
+    // this function only reports what it actually knows.
     try {
         const phaseFiles = fsImpl.readdirSync(phaseDir);
         const verificationFile = phaseFiles.filter((f) => f.endsWith('-VERIFICATION.md')).sort()[0];
         if (!verificationFile)
-            return null;
+            return { determined: true, stale: false };
         const summaryFiles = scanPhasePlans(phaseDir).summaryFiles
             .slice()
             .sort();
         // No summary can be newer than the verification → never stale. Return before
         // touching git so a phase with no summaries costs zero subprocesses. (#2348)
         if (summaryFiles.length === 0)
-            return null;
+            return { determined: true, stale: false };
         // Each file's effective "last changed" time = its commit time when committed
         // AND clean (content-tied and clone-stable), else its filesystem mtime (the
         // uncommitted working-tree edit). Both are real wall-clock change times, so
@@ -244,13 +247,13 @@ function findStaleVerificationSummary(phaseDir, fsImpl = node_fs_1.default, phas
             // The caller only needs whether the phase is stale, not which summary —
             // the first stale summary (in sorted order) is enough. Short-circuit.
             if (effectiveTimeMs(summaryFile) > verificationTimeMs) {
-                return { verificationFile, summaryFile };
+                return { determined: true, stale: true, verificationFile, summaryFile };
             }
         }
-        return null;
+        return { determined: true, stale: false };
     }
     catch {
-        return null;
+        return { determined: false };
     }
 }
 /**
@@ -265,6 +268,12 @@ function findStaleVerificationSummary(phaseDir, fsImpl = node_fs_1.default, phas
  *    If no frontmatter block or no `status` key → status 'missing'.
  * 3. Map to routing table. Unknown non-empty value → status 'unknown'.
  *
+ * The internal staleness check can itself fail (fs / scanPhasePlans / clock
+ * error); when it does, `status` is routed as if nothing were stale (the
+ * pre-existing no-throw fail-open contract — unchanged), but the returned
+ * result carries `staleCheckIndeterminate: true` so a caller can distinguish
+ * "checked; nothing is stale" from "could not check" (#3057 B3).
+ *
  * @param phaseDir - Absolute path to the phase directory.
  * @param opts     - Options. `opts.fs` allows test injection (defaults to node:fs).
  *                   `opts.runtime` selects the command surface `next_command` is
@@ -331,8 +340,8 @@ function readVerificationStatus(phaseDir, opts = {}) {
             next_command: projectNextCommand('plan-phase', runtime, `${phaseArg} --gaps`),
         };
     }
-    const staleVerification = findStaleVerificationSummary(phaseDir, fsImpl, phaseCleanCommitTimesMs);
-    if (staleVerification) {
+    const staleCheck = findStaleVerificationSummary(phaseDir, fsImpl, phaseCleanCommitTimesMs);
+    if (staleCheck.determined && staleCheck.stale) {
         const entry = VERIFICATION_ROUTING_TABLE['stale'];
         return {
             status: entry.status,
@@ -340,6 +349,12 @@ function readVerificationStatus(phaseDir, opts = {}) {
             next_command: projectNextCommand('verify-work', runtime, phaseArg),
         };
     }
+    // staleCheck is either {determined:true, stale:false} (checked; nothing
+    // stale) or {determined:false} (could not check — fs/scan/clock failure).
+    // Both fall through to normal routing below (the pre-existing no-throw
+    // fail-open contract is unchanged), but the indeterminate case is flagged
+    // on the returned result so a caller can tell the two apart (#3057 B3).
+    const staleCheckIndeterminate = !staleCheck.determined;
     // 3. Route — exclude internal sentinels from raw-file lookup (they are
     // constructed internally above, never written by the verifier).
     if (rawStatus in VERIFICATION_ROUTING_TABLE &&
@@ -352,6 +367,7 @@ function readVerificationStatus(phaseDir, opts = {}) {
             status: entry.status,
             next_action: entry.next_action,
             next_command: projectNextCommand(entry.next_command, runtime, phaseArg),
+            ...(staleCheckIndeterminate ? { staleCheckIndeterminate: true } : {}),
         };
     }
     // Unknown value
@@ -360,6 +376,7 @@ function readVerificationStatus(phaseDir, opts = {}) {
         status: unknownRoute.status,
         next_action: `Unexpected verification status '${rawStatus}'. Re-run execute-phase verification.`,
         next_command: projectNextCommand(unknownRoute.next_command, runtime, phaseArg),
+        ...(staleCheckIndeterminate ? { staleCheckIndeterminate: true } : {}),
     };
 }
 /**

package/gsd-core/bin/lib/verify.cjs

@@ -161,6 +161,15 @@ function verifySummaryCore(cwd, summaryPath, checkFileCount, opts) {
     // is still not read. Recovering it needs a real frontmatter parse, which is
     // deliberately left as a follow-up rather than smuggled in here.
     const mentionedFiles = new Set();
+    // #2844: Pattern 1 matches any backticked path-like token. A SUMMARY body is
+    // predominantly about what the phase DID, so a backticked path in prose ("Built
+    // `src/kept.ts`", a `- \`src/x.ts\`` list item) is a legitimate claim (#2685
+    // pins this). The false-positive class #2844 fixes is a path mentioned as a
+    // FUTURE/CONDITIONAL deliverable — "next phase will add `shared/types.ts`",
+    // "planned", "would", "to be created" — which is NOT a claim about this phase.
+    // Exclude those lines rather than requiring an explicit claim verb (which would
+    // drop the legitimate "Built …" / list-item forms #2685 protects).
+    const isFutureMention = (line) => /\b(?:will(?:\s+(?:add|create|build|land))?(?:[^.])?|(?:next|later|future)\s+phase|planned?|would\s+(?:be|add|create|build)|to\s+be\s+(?:added|created|built)|eventually|not\s+yet)\b/i.test(line);
     const patterns = [
         /`([^`]+\.[a-zA-Z]+)`/g,
         /(?:Created|Modified|Added|Updated|Edited):\s*`?([^\s`[\]]+\.[a-zA-Z]+)`?/gi,
@@ -169,9 +178,16 @@ function verifySummaryCore(cwd, summaryPath, checkFileCount, opts) {
         let m;
         while ((m = pattern.exec(content)) !== null) {
             const filePath = m[1];
-            if (filePath && isProbableProjectFile(filePath)) {
-                mentionedFiles.add(filePath);
-            }
+            if (!filePath || !isProbableProjectFile(filePath))
+                continue;
+            // #2844: skip a backticked path on a future/conditional line — it names a
+            // deliverable this phase did NOT produce, so probing it is a false positive.
+            const lineStart = content.lastIndexOf('\n', m.index) + 1;
+            const lineEnd = content.indexOf('\n', m.index);
+            const line = content.slice(lineStart, lineEnd === -1 ? undefined : lineEnd);
+            if (isFutureMention(line))
+                continue;
+            mentionedFiles.add(filePath);
         }
     }
     const filesToCheck = Array.from(mentionedFiles).slice(0, checkCount);
@@ -1596,7 +1612,7 @@ function cmdValidateHealth(cwd, options, raw) {
         }
     }
     try {
-        const agentStatus = checkAgentsInstalled();
+        const agentStatus = checkAgentsInstalled(_slashRuntime, cwd);
         if (!agentStatus.agents_installed) {
             if ((agentStatus.installed_agents).length === 0) {
                 addIssue('warning', 'W010', `No GSD agents found in ${agentStatus.agents_dir} — Task(subagent_type="gsd-*") will fall back to general-purpose`, `Run the GSD installer: npx ${package_identity_cjs_1.PACKAGE_NAME}@latest`);
@@ -1719,6 +1735,14 @@ function cmdValidateHealth(cwd, options, raw) {
                     if (isActiveWorktree)
                         continue;
                     addIssue('warning', 'W017', `Stale git worktree: ${worktreePath} (last modified ${finding['ageMinutes']} minutes ago)`, `Run: git worktree remove ${worktreePath} --force`);
+                    continue;
+                }
+                // #3050/#3057 (B5): a 'unverified' finding means existsSync confirmed
+                // the worktree is present but statSync threw, so orphan/stale status
+                // could not be determined for THIS entry — it must not be silently
+                // dropped (that would be the exact fail-open the row exists to close).
+                if (finding['kind'] === 'unverified') {
+                    addIssue('warning', 'W020', `Worktree health check degraded: could not stat ${finding['path']} — presence/staleness could not be verified`, 'Check filesystem permissions on the worktree path, or investigate why statSync failed for it');
                 }
             }
         }
@@ -2023,7 +2047,7 @@ function cmdValidateHealth(cwd, options, raw) {
     return result;
 }
 function cmdValidateAgents(cwd, raw) {
-    const agentStatus = checkAgentsInstalled();
+    const agentStatus = checkAgentsInstalled((0, runtime_slash_cjs_1.resolveRuntime)(cwd), cwd);
     const expected = Object.keys(MODEL_PROFILES);
     output({
         agents_dir: agentStatus.agents_dir,