@opengsd/gsd-pi 1.7.0 → 1.8.1-dev.897b3c90

package/dist/resources/extensions/gsd/bootstrap/write-gate.js

@@ -8,6 +8,7 @@ import { loadJsonFileOrNull } from "../json-persistence.js";
 import { getIsolationMode } from "../preferences.js";
 import { compileSubagentPermissionContract } from "../unit-context-manifest.js";
 import { logWarning } from "../workflow-logger.js";
+import { acquireSyncLock, releaseSyncLock } from "../sync-lock.js";
 import { isGsdWorktreePath, resolveWorktreeProjectRoot } from "../worktree-root.js";
 import { worktreesDirs } from "../worktree-placement.js";
 import { bashReferencesProjectRootOutsideWorktree } from "../worktree-shell-guard.js";
@@ -318,12 +319,65 @@ export function refreshWriteGateStateFromDisk(basePath) {
     }
     return currentWriteGateSnapshot(basePath);
 }
+const WRITE_GATE_LOCK_NAME = "write-gate.lock";
+/**
+ * Test-only seam: fires once inside the held cross-process lock (after acquire,
+ * before the read-merge-write body) with the resolved lock root. Lets a
+ * regression test observe that a concurrent process is genuinely locked out of
+ * the critical section. Production leaves it null. Follows the repo's
+ * `_setGhAvailableForTest` naming convention.
+ */
+let interleaveHookForTest = null;
+export function _setWriteGateInterleaveHookForTest(fn) {
+    interleaveHookForTest = fn;
+}
+/**
+ * Serialize the read-merge-write critical section across the two processes
+ * that share the snapshot file (extension host + workflow MCP child). Atomic
+ * rename prevents torn files but not lost updates: without this lock the host
+ * can read the snapshot, the child can arm a gate and persist, then the host's
+ * later persist overwrites `pendingGateId`/`activeQueuePhase` (last-writer-wins
+ * fields) and silently drops the armed HARD-BLOCK gate.
+ *
+ * Fail-OPEN by contract: if a live peer holds the lock we proceed WITHOUT it —
+ * exactly the racy-but-functional behavior that shipped before this lock — and
+ * log once. The lock shrinks the race window to ~zero; it must never block,
+ * throw, or refuse a gate mutation. The lock is skipped entirely when snapshot
+ * persistence is off (no disk file, no cross-process seam).
+ */
+function withWriteGateLock(basePath, fn) {
+    if (!shouldPersistWriteGateSnapshot())
+        return fn();
+    const lockRoot = resolveWriteGateSnapshotRoot(basePath);
+    // Materialize `.gsd/` (including a dangling external-state symlink target)
+    // before locking. acquireSyncLock's own mkdir does NOT follow a symlink to
+    // create its target, so without this the O_EXCL open lands on a missing
+    // parent and the lock silently fails open — leaving the seam unserialized
+    // for exactly the external-state projects that need it. This is the same
+    // directory the persist path ensures anyway.
+    try {
+        ensureWriteGateSnapshotDirectory(basePath);
+    }
+    catch { /* best-effort; acquire fails-open below */ }
+    const { acquired } = acquireSyncLock(lockRoot, 0, WRITE_GATE_LOCK_NAME);
+    if (!acquired) {
+        logWarning("intercept", "write-gate: proceeding without cross-process lock (held by live peer)", { lockRoot });
+        return fn();
+    }
+    try {
+        interleaveHookForTest?.(lockRoot);
+        return fn();
+    }
+    finally {
+        releaseSyncLock(lockRoot, WRITE_GATE_LOCK_NAME);
+    }
+}
 /**
  * Read-modify-write primitive for gate mutations. Reconciles the disk
  * snapshot into memory (union merge), applies the mutation on top, then
- * persists. The whole sequence is synchronous, so the reconcile read
- * doubles as the pre-persist merge of concurrent writes — there is no
- * version field; the read-merge-write is simply unconditional.
+ * persists — all under the cross-process lock (withWriteGateLock). The whole
+ * sequence is synchronous, so the reconcile read doubles as the pre-persist
+ * merge of concurrent writes; there is no version field.
  *
  * The mutate callback sees the already-reconciled state, so policy checks
  * (e.g. host setPending's verified-on-disk-wins guard) can live inside it
@@ -335,23 +389,25 @@ export function refreshWriteGateStateFromDisk(basePath) {
  */
 function mutateWriteGateState(basePath, mutate, opts) {
     const state = getWriteGateState(basePath);
-    if (shouldPersistWriteGateSnapshot() && (opts?.reconcile ?? true)) {
-        const disk = readDiskSnapshot(basePath);
-        if (disk) {
-            mergeSnapshotIntoState(state, disk);
-        }
-        else {
-            // Missing OR unparseable on disk: treat as a full reset. Keeping
-            // stale in-memory state across a corrupt snapshot would persist it
-            // back on this very mutation and defeat the documented
-            // "delete the file to clear the HARD BLOCK gate" escape hatch.
-            replaceStateFromSnapshot(state, EMPTY_SNAPSHOT);
+    return withWriteGateLock(basePath, () => {
+        if (shouldPersistWriteGateSnapshot() && (opts?.reconcile ?? true)) {
+            const disk = readDiskSnapshot(basePath);
+            if (disk) {
+                mergeSnapshotIntoState(state, disk);
+            }
+            else {
+                // Missing OR unparseable on disk: treat as a full reset. Keeping
+                // stale in-memory state across a corrupt snapshot would persist it
+                // back on this very mutation and defeat the documented
+                // "delete the file to clear the HARD BLOCK gate" escape hatch.
+                replaceStateFromSnapshot(state, EMPTY_SNAPSHOT);
+            }
         }
-    }
-    if (mutate(state) === false)
-        return false;
-    persistWriteGateSnapshot(basePath, opts?.writer ?? defaultWriteGateWriter());
-    return true;
+        if (mutate(state) === false)
+            return false;
+        persistWriteGateSnapshot(basePath, opts?.writer ?? defaultWriteGateWriter());
+        return true;
+    });
 }
 export function isDepthVerified(basePath = process.cwd()) {
     return getWriteGateState(basePath).verifiedDepthMilestones.size > 0;
@@ -550,13 +606,15 @@ export const childWriteGateAdapter = {
 };
 function childMutate(basePath, mutate) {
     const state = getWriteGateState(basePath);
-    if (shouldPersistWriteGateSnapshot()) {
-        // Always-fresh: disk is the only truth for the child; discard any
-        // cross-turn in-memory residue before mutating.
-        replaceStateFromSnapshot(state, readDiskSnapshot(basePath) ?? EMPTY_SNAPSHOT);
-    }
-    mutate(state);
-    persistWriteGateSnapshot(basePath, "child");
+    withWriteGateLock(basePath, () => {
+        if (shouldPersistWriteGateSnapshot()) {
+            // Always-fresh: disk is the only truth for the child; discard any
+            // cross-turn in-memory residue before mutating.
+            replaceStateFromSnapshot(state, readDiskSnapshot(basePath) ?? EMPTY_SNAPSHOT);
+        }
+        mutate(state);
+        persistWriteGateSnapshot(basePath, "child");
+    });
 }
 /**
  * Which adapter the module-level convenience exports (markDepthVerified,

package/dist/resources/extensions/gsd/command-feedback.js

@@ -57,19 +57,23 @@ export function notifyDiscussNeedsInteractiveMenu(ctx, reason) {
         hints: DISCUSS_HINTS,
     });
 }
-/** Hub picker for /gsd queue (reorder vs add) is unavailable. */
+/**
+ * Hub picker for /gsd queue (reorder vs add) is unavailable.
+ *
+ * Unlike the other picker-guidance notices, /gsd queue does NOT dead-end here:
+ * the caller falls through to the add-work flow, which runs headlessly. So this
+ * notice must avoid the "did not start:" picker-failure phrasing — the headless
+ * host classifies that as a blocked dead-end (see stop-notice.ts / #1294) and
+ * would exit 10 before the add-work run starts.
+ */
 export function notifyQueueHubNeedsInteractiveMenu(ctx, reason) {
-    notifyPickerCommandNeedsInteractiveMenu(ctx, {
-        command: "/gsd queue",
-        reason,
-        alternatives: [
-            "Add-work flow can run headless — continuing with queue discussion.",
-        ],
-        hints: [
-            "/gsd queue — run from the GSD TUI to reorder pending milestones",
-            "/gsd status — see milestone order and phase",
-        ],
-    });
+    ctx.ui.notify([
+        `/gsd queue reorder menu needs an interactive session (${reason}).`,
+        "Continuing headless with the add-work flow.",
+        "",
+        "  • /gsd queue — run from the GSD TUI to reorder pending milestones",
+        "  • /gsd status — see milestone order and phase",
+    ].join("\n"), "warning");
 }
 /** /gsd, /gsd new-milestone, /gsd new-project wizard menus. */
 export function notifySmartEntryNeedsInteractiveMenu(ctx, reason) {

package/dist/resources/extensions/gsd/compat/compat-marker.js

@@ -6,7 +6,7 @@
 // (drift to import). gsd-core is oblivious to this file and ignores it.
 import { createHash } from "node:crypto";
 import { existsSync, readFileSync, renameSync, unlinkSync, writeFileSync, mkdirSync } from "node:fs";
-import { dirname, join } from "node:path";
+import { dirname, join, isAbsolute, normalize } from "node:path";
 /** Current marker schema version. Bump on breaking format changes + migrate. */
 export const COMPAT_MARKER_SCHEMA = 2;
 /** Marker returned when no marker exists yet (fresh project, first gsd-pi run). */
@@ -170,10 +170,27 @@ function isValidProjectionEntry(x) {
         return false;
     return true;
 }
+/**
+ * Projection-map keys are repo-relative paths under .gsd/ or .planning/.
+ * The marker is repo-controlled content, so a key must never escape its
+ * root: reject absolute paths, drive letters, backslashes, and any
+ * normalized form that starts with "..". Mirrors the write-side guard in
+ * db-writer.ts.
+ */
+function isSafeProjectionKey(key) {
+    if (key.length === 0 || key.includes("\\") || key.includes("\0"))
+        return false;
+    if (isAbsolute(key) || /^[A-Za-z]:/.test(key))
+        return false;
+    const norm = normalize(key);
+    return norm !== ".." && !norm.startsWith("../") && !isAbsolute(norm);
+}
 function isValidProjectionMap(x) {
     if (typeof x !== "object" || x === null)
         return false;
-    for (const v of Object.values(x)) {
+    for (const [k, v] of Object.entries(x)) {
+        if (!isSafeProjectionKey(k))
+            return false;
         if (!isValidProjectionEntry(v))
             return false;
     }

package/dist/resources/extensions/gsd/db/command-queue.js

@@ -12,7 +12,7 @@
 //   - broadcast queries: WHERE target_worker IS NULL
 // Workers should poll for both forms (their own ID + broadcasts) on each
 // claim cycle.
-import { _getAdapter, isDbAvailable, transaction, } from "../gsd-db.js";
+import { _getAdapter, immediateTransaction, isDbAvailable, transaction, } from "../gsd-db.js";
 /**
  * Enqueue a command. Returns the new row id. Broadcast commands
  * (targetWorker=null) will be claimed by exactly one worker — the IPC
@@ -47,7 +47,12 @@ export function claimNextCommand(workerId) {
         return null;
     const now = new Date().toISOString();
     const db = _getAdapter();
-    return transaction(() => {
+    // BEGIN IMMEDIATE: this is a read-then-write claim. Under WAL, a deferred
+    // transaction that reads first and then upgrades to a writer can fail with
+    // SQLITE_BUSY_SNAPSHOT (not retried by busy_timeout) when two workers race;
+    // taking the write lock up front serializes claimants so the loser waits
+    // and then sees the row already claimed (changes !== 1 → null).
+    return immediateTransaction(() => {
         // Find the oldest unclaimed command targeted at this worker OR
         // broadcast. The partial index covers both via NULL-in-B-tree.
         const row = db.prepare(`SELECT id, target_worker, command, args_json, enqueued_at,

package/dist/resources/extensions/gsd/db/engine.js

@@ -18,7 +18,7 @@ import { createBaseSchemaObjects } from "../db-base-schema.js";
 import { createCoordinationTablesV24 } from "../db-coordination-schema.js";
 import { createDbConnectionCache } from "../db-connection-cache.js";
 import { backupDatabaseBeforeMigration, isMigrationBackupError } from "../db-migration-backup.js";
-import { applyMigrationV2Artifacts, applyMigrationV3Memories, applyMigrationV4DecisionMadeBy, applyMigrationV5HierarchyTables, applyMigrationV6SliceSummaries, applyMigrationV7Dependencies, applyMigrationV8PlanningFields, applyMigrationV9Ordering, applyMigrationV10ReplanTrigger, applyMigrationV11TaskPlanning, applyMigrationV12QualityGates, applyMigrationV13HotPathIndexes, applyMigrationV14SliceDependencies, applyMigrationV15AuditTables, applyMigrationV16EscalationSource, applyMigrationV17TaskEscalation, applyMigrationV18MemorySources, applyMigrationV19MemoryFts, applyMigrationV20MemoryRelations, applyMigrationV21StructuredMemories, applyMigrationV22QualityGateRepair, applyMigrationV23MilestoneQueue, applyMigrationV26MilestoneCommitAttributions, applyMigrationV27ArtifactHash, applyMigrationV28MemoryLastHitAt, applyMigrationV29RepositoryTargets, } from "../db-migration-steps.js";
+import { applyMigrationV2Artifacts, applyMigrationV3Memories, applyMigrationV4DecisionMadeBy, applyMigrationV5HierarchyTables, applyMigrationV6SliceSummaries, applyMigrationV7Dependencies, applyMigrationV8PlanningFields, applyMigrationV9Ordering, applyMigrationV10ReplanTrigger, applyMigrationV11TaskPlanning, applyMigrationV12QualityGates, applyMigrationV13HotPathIndexes, applyMigrationV14SliceDependencies, applyMigrationV15AuditTables, applyMigrationV16EscalationSource, applyMigrationV17TaskEscalation, applyMigrationV18MemorySources, applyMigrationV19MemoryFts, applyMigrationV20MemoryRelations, applyMigrationV21StructuredMemories, applyMigrationV22QualityGateRepair, applyMigrationV23MilestoneQueue, applyMigrationV26MilestoneCommitAttributions, applyMigrationV27ArtifactHash, applyMigrationV28MemoryLastHitAt, applyMigrationV29RepositoryTargets, applyMigrationV30ReworkBriefs, } from "../db-migration-steps.js";
 import { isMemoriesFtsAvailableSchema, rebuildMemoriesFtsSchemaOnce, tryCreateMemoriesFtsSchema, } from "../db-memory-fts-schema.js";
 import { createDbOpenState } from "../db-open-state.js";
 import { createRuntimeKvTableV25 } from "../db-runtime-kv-schema.js";
@@ -55,7 +55,7 @@ const providerLoader = createSqliteProviderLoader({
     nodeVersion: process.versions.node,
     writeStderr: (message) => process.stderr.write(message),
 });
-export const SCHEMA_VERSION = 29;
+export const SCHEMA_VERSION = 30;
 function initSchema(db, fileBacked, dbPath) {
     const conservativeFilePragmas = fileBacked && _isLikelyWslDrvFsPathForTest(dbPath);
     if (fileBacked)
@@ -80,19 +80,41 @@ function initSchema(db, fileBacked, dbPath) {
         });
         const existing = db.prepare("SELECT count(*) as cnt FROM schema_version").get();
         if (existing && existing["cnt"] === 0) {
-            createCoordinationTablesV24(db);
-            createRuntimeKvTableV25(db);
-            // Fresh install — all tables are created above with the full current schema,
-            // so it is safe to create all migration-specific indexes here.  For existing
-            // databases these indexes are created inside the individual migration guards
-            // in migrateSchema() after the corresponding columns have been added.
-            db.exec("CREATE INDEX IF NOT EXISTS idx_tasks_escalation_pending ON tasks(milestone_id, slice_id, escalation_pending)");
-            db.exec("CREATE INDEX IF NOT EXISTS idx_memories_scope ON memories(scope)");
-            db.exec("CREATE INDEX IF NOT EXISTS idx_memory_sources_kind ON memory_sources(kind)");
-            db.exec("CREATE INDEX IF NOT EXISTS idx_memory_sources_scope ON memory_sources(scope)");
-            db.exec("CREATE INDEX IF NOT EXISTS idx_memory_relations_from ON memory_relations(from_id)");
-            db.exec("CREATE INDEX IF NOT EXISTS idx_memory_relations_to ON memory_relations(to_id)");
-            recordSchemaVersion(db, SCHEMA_VERSION);
+            // An empty schema_version table usually means a fresh install, but it can
+            // also be a legacy/truncated DB that already holds user data. Stamping
+            // that DB SCHEMA_VERSION without running migrations would mis-mark it as
+            // fully migrated and break at first query. Probe before stamping.
+            const hasData = ["milestones", "decisions", "memories"].some((t) => {
+                try {
+                    const r = db.prepare(`SELECT count(*) as cnt FROM ${t}`).get();
+                    return (r?.["cnt"] ?? 0) > 0;
+                }
+                catch { /* table absent on a truly fresh DB — treat as no data */
+                    return false;
+                }
+            });
+            if (hasData) {
+                // Legacy DB with data but no version row: record the baseline so
+                // migrateSchema runs the full chain instead of stamping the current version.
+                recordSchemaVersion(db, 1);
+            }
+            else {
+                createCoordinationTablesV24(db);
+                createRuntimeKvTableV25(db);
+                // Fresh install — all tables are created above with the full current schema,
+                // so it is safe to create all migration-specific indexes here.  For existing
+                // databases these indexes are created inside the individual migration guards
+                // in migrateSchema() after the corresponding columns have been added.
+                db.exec("CREATE INDEX IF NOT EXISTS idx_tasks_escalation_pending ON tasks(milestone_id, slice_id, escalation_pending)");
+                db.exec("CREATE INDEX IF NOT EXISTS idx_memories_scope ON memories(scope)");
+                db.exec("CREATE INDEX IF NOT EXISTS idx_memory_sources_kind ON memory_sources(kind)");
+                db.exec("CREATE INDEX IF NOT EXISTS idx_memory_sources_scope ON memory_sources(scope)");
+                db.exec("CREATE INDEX IF NOT EXISTS idx_memory_relations_from ON memory_relations(from_id)");
+                db.exec("CREATE INDEX IF NOT EXISTS idx_memory_relations_to ON memory_relations(to_id)");
+                db.exec("CREATE INDEX IF NOT EXISTS idx_rework_briefs_task ON rework_briefs(milestone_id, slice_id, task_id)");
+                db.exec("CREATE INDEX IF NOT EXISTS idx_rework_findings_status ON rework_brief_findings(brief_id, severity, status)");
+                recordSchemaVersion(db, SCHEMA_VERSION);
+            }
         }
         db.exec("COMMIT");
     }
@@ -143,9 +165,16 @@ function copyQualityGateRowsToRepairedTable(db) {
     FROM quality_gates
   `);
 }
+let _migrationFaultForTest = false;
+/** Test-only: force migrateSchema to throw after applying its steps but before COMMIT. */
+export function _setMigrationFaultForTest(v) { _migrationFaultForTest = v; }
 function migrateSchema(db, dbPath) {
     const currentVersion = getCurrentSchemaVersion(db);
-    if (currentVersion >= SCHEMA_VERSION)
+    if (currentVersion > SCHEMA_VERSION) {
+        throw new Error(`gsd.db schema is v${currentVersion}, newer than the v${SCHEMA_VERSION} this gsd-pi supports. ` +
+            `Update gsd-pi (npm i -g @opengsd/gsd-pi) before opening this project.`);
+    }
+    if (currentVersion === SCHEMA_VERSION)
         return;
     backupDatabaseBeforeMigration(db, dbPath, currentVersion, {
         existsSync,
@@ -282,6 +311,12 @@ function migrateSchema(db, dbPath) {
             applyMigrationV29RepositoryTargets(db);
             recordSchemaVersion(db, 29);
         }
+        if (currentVersion < 30) {
+            applyMigrationV30ReworkBriefs(db);
+            recordSchemaVersion(db, 30);
+        }
+        if (_migrationFaultForTest)
+            throw new Error("migration fault injected for test");
         db.exec("COMMIT");
     }
     catch (err) {

package/dist/resources/extensions/gsd/db/writers/cascades.js

@@ -172,7 +172,11 @@ export function skipSliceCascade(milestoneId, sliceId) {
             outcome = { ok: false, reason: "slice-not-found" };
             return;
         }
-        if (slice.status === "complete" || slice.status === "done") {
+        // Reject any closed slice except "skipped" (which falls through to the
+        // wasAlreadySkipped no-op). isClosedStatus covers the "closed"/"done"
+        // aliases too — hand-picking literals here nulls a completed slice's
+        // completed_at on re-skip.
+        if (isClosedStatus(slice.status) && slice.status !== "skipped") {
             outcome = { ok: false, reason: "slice-already-complete" };
             return;
         }

package/dist/resources/extensions/gsd/db/writers/status.js

@@ -37,22 +37,29 @@ function requireDb() {
 export function applyStatusTransition(t) {
     const db = requireDb();
     const completedAt = t.completedAt ?? null;
+    const preserve = t.preserveCompletion ? 1 : 0;
     switch (t.entity) {
         case "task":
-            db.prepare(`UPDATE tasks SET status = :status, completed_at = :completed_at
+            db.prepare(`UPDATE tasks SET status = :status,
+           completed_at = CASE WHEN :preserve_completion = 1 AND tasks.completed_at IS NOT NULL
+                               THEN tasks.completed_at ELSE :completed_at END
          WHERE milestone_id = :milestone_id AND slice_id = :slice_id AND id = :id`).run({
                 ":status": t.status,
                 ":completed_at": completedAt,
+                ":preserve_completion": preserve,
                 ":milestone_id": t.milestoneId,
                 ":slice_id": t.sliceId,
                 ":id": t.taskId,
             });
             return;
         case "slice":
-            db.prepare(`UPDATE slices SET status = :status, completed_at = :completed_at
+            db.prepare(`UPDATE slices SET status = :status,
+           completed_at = CASE WHEN :preserve_completion = 1 AND slices.completed_at IS NOT NULL
+                               THEN slices.completed_at ELSE :completed_at END
          WHERE milestone_id = :milestone_id AND id = :id`).run({
                 ":status": t.status,
                 ":completed_at": completedAt,
+                ":preserve_completion": preserve,
                 ":milestone_id": t.milestoneId,
                 ":id": t.sliceId,
             });
@@ -63,7 +70,10 @@ export function applyStatusTransition(t) {
             if (currentStatus && isClosedStatus(currentStatus) && !isClosedStatus(t.status)) {
                 throw new Error(`Cannot update closed milestone ${t.milestoneId} from ${currentStatus} to ${t.status}; use gsd_milestone_reopen for an explicit reopen.`);
             }
-            db.prepare(`UPDATE milestones SET status = :status, completed_at = :completed_at WHERE id = :id`).run({ ":status": t.status, ":completed_at": completedAt, ":id": t.milestoneId });
+            db.prepare(`UPDATE milestones SET status = :status,
+           completed_at = CASE WHEN :preserve_completion = 1 AND milestones.completed_at IS NOT NULL
+                               THEN milestones.completed_at ELSE :completed_at END
+         WHERE id = :id`).run({ ":status": t.status, ":completed_at": completedAt, ":preserve_completion": preserve, ":id": t.milestoneId });
             return;
         }
     }

package/dist/resources/extensions/gsd/db-base-schema.js

@@ -221,6 +221,32 @@ export function createBaseSchemaObjects(db, hooks) {
       created_at TEXT NOT NULL DEFAULT '',
       FOREIGN KEY (milestone_id) REFERENCES milestones(id)
     )
+  `);
+    db.exec(`
+    CREATE TABLE IF NOT EXISTS rework_briefs (
+      id TEXT PRIMARY KEY,
+      milestone_id TEXT NOT NULL DEFAULT '',
+      slice_id TEXT NOT NULL DEFAULT '',
+      task_id TEXT NOT NULL DEFAULT '',
+      created_at TEXT NOT NULL DEFAULT '',
+      updated_at TEXT NOT NULL DEFAULT ''
+    )
+  `);
+    db.exec(`
+    CREATE TABLE IF NOT EXISTS rework_brief_findings (
+      brief_id TEXT NOT NULL,
+      finding_id TEXT NOT NULL,
+      severity TEXT NOT NULL DEFAULT 'blocking',
+      description TEXT NOT NULL DEFAULT '',
+      required_fix TEXT NOT NULL DEFAULT '',
+      verification_commands TEXT NOT NULL DEFAULT '[]',
+      status TEXT NOT NULL DEFAULT 'pending',
+      evidence TEXT NOT NULL DEFAULT '',
+      decision_ref TEXT NOT NULL DEFAULT '',
+      updated_at TEXT NOT NULL DEFAULT '',
+      PRIMARY KEY (brief_id, finding_id),
+      FOREIGN KEY (brief_id) REFERENCES rework_briefs(id)
+    )
   `);
     db.exec(`
     CREATE TABLE IF NOT EXISTS assessments (
@@ -336,6 +362,8 @@ export function createBaseSchemaObjects(db, hooks) {
   `);
     db.exec("CREATE INDEX IF NOT EXISTS idx_memories_active ON memories(superseded_by)");
     db.exec("CREATE INDEX IF NOT EXISTS idx_replan_history_milestone ON replan_history(milestone_id, created_at)");
+    db.exec("CREATE INDEX IF NOT EXISTS idx_rework_briefs_task ON rework_briefs(milestone_id, slice_id, task_id)");
+    db.exec("CREATE INDEX IF NOT EXISTS idx_rework_findings_status ON rework_brief_findings(brief_id, severity, status)");
     db.exec("CREATE INDEX IF NOT EXISTS idx_tasks_active ON tasks(milestone_id, slice_id, status)");
     db.exec("CREATE INDEX IF NOT EXISTS idx_slices_active ON slices(milestone_id, status)");
     db.exec("CREATE INDEX IF NOT EXISTS idx_milestones_status ON milestones(status)");

package/dist/resources/extensions/gsd/db-migration-steps.js

@@ -418,3 +418,33 @@ export function applyMigrationV22QualityGateRepair(db, hooks) {
     ensureColumn(db, "quality_gates", "scope", "ALTER TABLE quality_gates ADD COLUMN scope TEXT NOT NULL DEFAULT 'slice'");
     ensureColumn(db, "assessments", "scope", "ALTER TABLE assessments ADD COLUMN scope TEXT NOT NULL DEFAULT ''");
 }
+export function applyMigrationV30ReworkBriefs(db) {
+    db.exec(`
+    CREATE TABLE IF NOT EXISTS rework_briefs (
+      id TEXT PRIMARY KEY,
+      milestone_id TEXT NOT NULL DEFAULT '',
+      slice_id TEXT NOT NULL DEFAULT '',
+      task_id TEXT NOT NULL DEFAULT '',
+      created_at TEXT NOT NULL DEFAULT '',
+      updated_at TEXT NOT NULL DEFAULT ''
+    )
+  `);
+    db.exec(`
+    CREATE TABLE IF NOT EXISTS rework_brief_findings (
+      brief_id TEXT NOT NULL,
+      finding_id TEXT NOT NULL,
+      severity TEXT NOT NULL DEFAULT 'blocking',
+      description TEXT NOT NULL DEFAULT '',
+      required_fix TEXT NOT NULL DEFAULT '',
+      verification_commands TEXT NOT NULL DEFAULT '[]',
+      status TEXT NOT NULL DEFAULT 'pending',
+      evidence TEXT NOT NULL DEFAULT '',
+      decision_ref TEXT NOT NULL DEFAULT '',
+      updated_at TEXT NOT NULL DEFAULT '',
+      PRIMARY KEY (brief_id, finding_id),
+      FOREIGN KEY (brief_id) REFERENCES rework_briefs(id)
+    )
+  `);
+    db.exec("CREATE INDEX IF NOT EXISTS idx_rework_briefs_task ON rework_briefs(milestone_id, slice_id, task_id)");
+    db.exec("CREATE INDEX IF NOT EXISTS idx_rework_findings_status ON rework_brief_findings(brief_id, severity, status)");
+}

package/dist/resources/extensions/gsd/db-schema-metadata.js

@@ -12,8 +12,11 @@ export function ensureColumn(db, table, column, ddl) {
         db.exec(ddl);
 }
 export function getCurrentSchemaVersion(db) {
+    // MAX(version) on an empty table returns a row whose value is NULL —
+    // treat that (and any non-numeric value) as version 0, not NULL-as-number.
     const row = db.prepare("SELECT MAX(version) as v FROM schema_version").get();
-    return row ? row["v"] : 0;
+    const v = row?.["v"];
+    return typeof v === "number" ? v : 0;
 }
 export function recordSchemaVersion(db, version) {
     db.prepare("INSERT INTO schema_version (version, applied_at) VALUES (:version, :applied_at)").run({

package/dist/resources/extensions/gsd/docs/preferences-reference.md

@@ -128,7 +128,7 @@ Diagnostics record the file path, scope (global/project), severity (error/warnin
   - Two equivalent ways to set it: inline as `models.<phase>.thinking`, or as a separate `thinking:` block keyed by phase. For the same phase, the inline value wins over the block; project preferences win over global; a phase that's unset inherits via the same sibling chain as `models` (e.g. `discuss → planning`).
   - If no thinking is configured for a phase, the session level (set via `/model`) is used, exactly as before — this is fully backward-compatible.
   - `execute-task` (code-writing) has a measured reasoning floor of `medium`: at lower levels models stop planning edits and thrash on file re-reads. The floor applies to the session/default path. An **explicit** `execution` thinking level bypasses the floor and is honored verbatim (with a one-time advisory) — set `execution: low` deliberately if you want it.
-  - Levels a model can't support are clamped to the nearest supported level at dispatch and never sent to the provider, so a model/level mismatch never fails a unit mid-run. `xhigh` is only honored by select model families.
+  - Levels a model can't support are clamped to the nearest supported level at dispatch and never sent to the provider, so a model/level mismatch never fails a unit mid-run. `xhigh` support is model-dependent; current examples include OpenAI Codex Max models and Claude Sonnet 5 on Amazon Bedrock.
 
 - `skill_staleness_days`: number — skills unused for this many days get deprioritized during discovery. Set to `0` to disable staleness tracking. Default: `60`.
 
@@ -482,13 +482,13 @@ Inline form — thinking pinned alongside the model:
 version: 1
 models:
   planning:
-    model: openai-codex/gpt-5.4
+    model: bedrock/global.anthropic.claude-sonnet-5
     thinking: xhigh
   execution:
-    model: openai-codex/gpt-5.4
+    model: bedrock/global.anthropic.claude-sonnet-5
     thinking: low      # explicit → bypasses the execute-task medium floor
   validation:
-    model: openai-codex/gpt-5.4
+    model: bedrock/global.anthropic.claude-sonnet-5
     thinking: high
 ---
 ```

package/dist/resources/extensions/gsd/doctor-history.js

@@ -0,0 +1,65 @@
+import { existsSync, readFileSync } from "node:fs";
+import { join } from "node:path";
+import { saveFile } from "./files.js";
+import { gsdRoot } from "./paths.js";
+function buildDoctorHistorySummary(report, errorCount, warningCount, issueDetails) {
+    const summaryParts = [];
+    if (report.ok) {
+        summaryParts.push("Clean");
+    }
+    else {
+        const counts = [];
+        if (errorCount > 0)
+            counts.push(`${errorCount} error${errorCount > 1 ? "s" : ""}`);
+        if (warningCount > 0)
+            counts.push(`${warningCount} warning${warningCount > 1 ? "s" : ""}`);
+        summaryParts.push(counts.join(", "));
+    }
+    if (report.fixesApplied.length > 0) {
+        summaryParts.push(`${report.fixesApplied.length} fixed`);
+    }
+    if (issueDetails && issueDetails.length > 0) {
+        const topIssue = issueDetails.find(i => i.severity === "error") ?? issueDetails[0];
+        summaryParts.push(topIssue.message);
+    }
+    return summaryParts.join(" · ");
+}
+export async function appendDoctorHistory(basePath, report) {
+    try {
+        const historyPath = join(gsdRoot(basePath), "doctor-history.jsonl");
+        const errorCount = report.issues.filter(i => i.severity === "error").length;
+        const warningCount = report.issues.filter(i => i.severity === "warning").length;
+        const issueDetails = report.issues
+            .filter(i => i.severity === "error" || i.severity === "warning")
+            .slice(0, 10) // cap to keep JSONL lines bounded
+            .map(i => ({ severity: i.severity, code: i.code, message: i.message, unitId: i.unitId }));
+        const entry = JSON.stringify({
+            ts: new Date().toISOString(),
+            ok: report.ok,
+            errors: errorCount,
+            warnings: warningCount,
+            fixes: report.fixesApplied.length,
+            codes: [...new Set(report.issues.map(i => i.code))],
+            issues: issueDetails.length > 0 ? issueDetails : undefined,
+            fixDescriptions: report.fixesApplied.length > 0 ? report.fixesApplied : undefined,
+            scope: report.scope,
+            summary: buildDoctorHistorySummary(report, errorCount, warningCount, issueDetails),
+        });
+        const existing = existsSync(historyPath) ? readFileSync(historyPath, "utf-8") : "";
+        await saveFile(historyPath, existing + entry + "\n");
+    }
+    catch { /* non-fatal */ }
+}
+/** Read the last N doctor history entries. Returns most-recent-first. */
+export async function readDoctorHistory(basePath, lastN = 50) {
+    try {
+        const historyPath = join(gsdRoot(basePath), "doctor-history.jsonl");
+        if (!existsSync(historyPath))
+            return [];
+        const lines = readFileSync(historyPath, "utf-8").split("\n").filter(l => l.trim());
+        return lines.slice(-lastN).reverse().map(l => JSON.parse(l));
+    }
+    catch {
+        return [];
+    }
+}