@opengsd/gsd-pi 1.8.0 → 1.8.1-dev.897b3c90

package/src/resources/extensions/gsd/tests/db-engine-migrate-guards.test.ts

@@ -0,0 +1,186 @@
+// GSD Extension - Migration guard tests (plan 026).
+// Covers the newer-DB refusal in migrateSchema, whole-chain rollback atomicity
+// via the _setMigrationFaultForTest seam, the legacy-data guard in initSchema,
+// and getCurrentSchemaVersion's empty-table NULL handling.
+
+import { describe, test } from 'node:test';
+import assert from 'node:assert/strict';
+import * as fs from 'node:fs';
+import * as path from 'node:path';
+import * as os from 'node:os';
+import { createRequire } from 'node:module';
+
+import {
+  openDatabase,
+  closeDatabase,
+  isDbAvailable,
+  SCHEMA_VERSION,
+  _setMigrationFaultForTest,
+} from '../gsd-db.ts';
+import { createDbAdapter } from '../db-adapter.ts';
+import { getCurrentSchemaVersion } from '../db-schema-metadata.ts';
+
+const _require = createRequire(import.meta.url);
+
+function tempDbPath(): string {
+  const dir = fs.mkdtempSync(path.join(os.tmpdir(), 'gsd-migrate-guards-'));
+  return path.join(dir, 'gsd.db');
+}
+
+function cleanup(dbPath: string): void {
+  closeDatabase();
+  fs.rmSync(path.dirname(dbPath), { recursive: true, force: true });
+}
+
+interface RawDb {
+  exec(sql: string): void;
+  prepare(sql: string): { get(...args: unknown[]): Record<string, unknown> | undefined; all(...args: unknown[]): Array<Record<string, unknown>> };
+  close(): void;
+}
+
+function openRawSqliteForTest(dbPath: string): RawDb {
+  try {
+    const mod = _require('node:sqlite') as { DatabaseSync: new (path: string) => RawDb };
+    return new mod.DatabaseSync(dbPath);
+  } catch {
+    type SqliteCtor = new (path: string) => RawDb;
+    const mod = _require('better-sqlite3') as SqliteCtor | { default: SqliteCtor };
+    const DatabaseCtor: SqliteCtor = typeof mod === 'function' ? mod : mod.default;
+    return new DatabaseCtor(dbPath);
+  }
+}
+
+function rawColumnNames(raw: RawDb, table: string): string[] {
+  return raw.prepare(`PRAGMA table_info(${table})`).all().map((r) => r['name'] as string);
+}
+
+function rawHasTable(raw: RawDb, table: string): boolean {
+  const row = raw.prepare("SELECT name FROM sqlite_master WHERE type = 'table' AND name = ?").get(table);
+  return Boolean(row);
+}
+
+function rawMaxVersion(raw: RawDb): number | null {
+  const row = raw.prepare('SELECT MAX(version) as v FROM schema_version').get();
+  return (row?.['v'] as number | null) ?? null;
+}
+
+describe('db-engine migrate guards', () => {
+  test('getCurrentSchemaVersion returns 0 on an empty schema_version table', () => {
+    const sqlite = _require('node:sqlite') as { DatabaseSync: new (path: string) => unknown };
+    const adapter = createDbAdapter(new sqlite.DatabaseSync(':memory:'));
+    try {
+      adapter.exec('CREATE TABLE schema_version (version INTEGER NOT NULL, applied_at TEXT NOT NULL)');
+      assert.equal(getCurrentSchemaVersion(adapter), 0);
+    } finally {
+      adapter.close();
+    }
+  });
+
+  test('refuses to open a DB whose schema is newer than this binary', () => {
+    const dbPath = tempDbPath();
+    try {
+      assert.ok(openDatabase(dbPath), 'fresh open should succeed');
+      closeDatabase();
+
+      const raw = openRawSqliteForTest(dbPath);
+      raw.exec(
+        `INSERT INTO schema_version (version, applied_at) VALUES (${SCHEMA_VERSION + 1}, '2026-01-01T00:00:00Z')`,
+      );
+      raw.close();
+
+      assert.throws(() => openDatabase(dbPath), /newer than/);
+      assert.equal(isDbAvailable(), false, 'no connection may stay open on refusal');
+    } finally {
+      cleanup(dbPath);
+    }
+  });
+
+  test('a mid-migration failure rolls back to the starting schema version', () => {
+    const dbPath = tempDbPath();
+    try {
+      assert.ok(openDatabase(dbPath), 'fresh open should succeed');
+      closeDatabase();
+
+      // Rewind the DB to v(SCHEMA_VERSION-1): stamp the prior version and drop
+      // the objects the last migration adds, so the re-run has real work to redo.
+      const startVersion = SCHEMA_VERSION - 2;
+      const raw = openRawSqliteForTest(dbPath);
+      raw.exec('DELETE FROM schema_version');
+      raw.exec(`INSERT INTO schema_version (version, applied_at) VALUES (${startVersion}, '2026-01-01T00:00:00Z')`);
+      raw.exec('ALTER TABLE slices DROP COLUMN target_repositories');
+      raw.exec('ALTER TABLE tasks DROP COLUMN target_repositories');
+      raw.close();
+
+      _setMigrationFaultForTest(true);
+      try {
+        assert.throws(() => openDatabase(dbPath), /migration fault injected/);
+      } finally {
+        _setMigrationFaultForTest(false);
+      }
+      assert.equal(isDbAvailable(), false, 'no connection may stay open on migration failure');
+
+      const inspect = openRawSqliteForTest(dbPath);
+      try {
+        assert.equal(rawMaxVersion(inspect), startVersion, 'version must roll back to the starting version');
+        assert.ok(
+          !rawColumnNames(inspect, 'slices').includes('target_repositories'),
+          'column added by the failed migration must be rolled back',
+        );
+      } finally {
+        inspect.close();
+      }
+
+      // The DB is intact — a clean re-open migrates to the current version.
+      assert.ok(openDatabase(dbPath), 're-open without the fault should succeed');
+      closeDatabase();
+      const after = openRawSqliteForTest(dbPath);
+      try {
+        assert.equal(rawMaxVersion(after), SCHEMA_VERSION);
+        assert.ok(rawColumnNames(after, 'slices').includes('target_repositories'));
+        assert.equal(rawHasTable(after, 'rework_briefs'), true);
+        assert.equal(rawHasTable(after, 'rework_brief_findings'), true);
+      } finally {
+        after.close();
+      }
+    } finally {
+      cleanup(dbPath);
+    }
+  });
+
+  test('a DB with data but no version rows migrates from v1 instead of being stamped current', () => {
+    const dbPath = tempDbPath();
+    try {
+      assert.ok(openDatabase(dbPath), 'fresh open should succeed');
+      closeDatabase();
+
+      // Simulate a legacy DB: user data present, version table empty, and a
+      // migration-added column missing so we can observe the chain actually run.
+      const raw = openRawSqliteForTest(dbPath);
+      raw.exec("INSERT INTO milestones (id, title) VALUES ('M001', 'Legacy milestone')");
+      raw.exec('DELETE FROM schema_version');
+      raw.exec('ALTER TABLE milestones DROP COLUMN vision');
+      raw.close();
+
+      assert.ok(openDatabase(dbPath), 'legacy DB open should succeed');
+      closeDatabase();
+
+      const inspect = openRawSqliteForTest(dbPath);
+      try {
+        const versions = inspect.prepare('SELECT version FROM schema_version ORDER BY version').all()
+          .map((r) => r['version'] as number);
+        assert.equal(versions[0], 1, 'baseline v1 must be recorded, not a fresh-install stamp');
+        assert.equal(versions[versions.length - 1], SCHEMA_VERSION, 'migration chain must reach the current version');
+        assert.ok(
+          rawColumnNames(inspect, 'milestones').includes('vision'),
+          'migration-added column must be restored by the chain',
+        );
+        const row = inspect.prepare('SELECT count(*) as cnt FROM milestones').get();
+        assert.equal(row?.['cnt'], 1, 'existing data must survive');
+      } finally {
+        inspect.close();
+      }
+    } finally {
+      cleanup(dbPath);
+    }
+  });
+});

package/src/resources/extensions/gsd/tests/derive-state-db.test.ts

@@ -7,6 +7,8 @@ import { join } from 'node:path';
 import { tmpdir } from 'node:os';
 
 import { deriveState, invalidateStateCache, _deriveStateImpl, deriveStateFromDb, isGhostMilestone } from '../state.ts';
+import { readCachedDeriveState, writeCachedDeriveState } from '../state/derive/cache.ts';
+import type { GSDState } from '../types.ts';
 import {
   openDatabase,
   closeDatabase,
@@ -582,6 +584,33 @@ describe('derive-state-db', async () => {
     }
   });
 
+  // ─── Test 7b: lock flip must not serve a basePath-keyed cache hit ─────
+  // The derive cache is keyed on basePath only, but deriveStateFromDb filters
+  // by GSD_MILESTONE_LOCK. auto.ts's capture/restoreMilestoneLockEnv call
+  // invalidateStateCache() on every flip; this guards that the cache is
+  // genuinely lock-blind (so that invalidate call is load-bearing, not
+  // redundant) and that invalidation defeats the stale read.
+  test('derive-state-db: a milestone-lock flip needs explicit cache invalidation', () => {
+    const prevLock = process.env.GSD_MILESTONE_LOCK;
+    try {
+      const base = '/tmp/gsd-lock-flip-fixture';
+      const stateA = { phase: 'planning' } as unknown as GSDState;
+      process.env.GSD_MILESTONE_LOCK = 'M001';
+      writeCachedDeriveState(base, stateA);
+
+      // Lock flips but basePath is unchanged → the cache still hits.
+      process.env.GSD_MILESTONE_LOCK = 'M002';
+      assert.strictEqual(readCachedDeriveState(base), stateA, 'basePath-only cache ignores the lock flip');
+
+      // What the lock-env functions do on flip:
+      invalidateStateCache();
+      assert.strictEqual(readCachedDeriveState(base), null, 'invalidation defeats the stale-lock read');
+    } finally {
+      if (prevLock === undefined) delete process.env.GSD_MILESTONE_LOCK;
+      else process.env.GSD_MILESTONE_LOCK = prevLock;
+    }
+  });
+
   // ═════════════════════════════════════════════════════════════════════════
   // New: deriveStateFromDb() cross-validation tests
   // ═════════════════════════════════════════════════════════════════════════

package/src/resources/extensions/gsd/tests/discuss-routing-fixes.test.ts

@@ -80,6 +80,43 @@ function makeDiscussCtx(notifications: Array<{ message: string; level?: string }
   };
 }
 
+async function runDiscussTargetFixture(
+  target: string,
+  milestones: Array<{ id: string; title?: string; status?: string }>,
+  writeArtifacts?: (base: string) => void,
+) {
+  const base = mkdtempSync(join(tmpdir(), "gsd-discuss-target-"));
+  const notifications: Array<{ message: string; level?: string }> = [];
+  const harness = makeDiscussPi();
+  try {
+    mkdirSync(join(base, ".gsd", "milestones"), { recursive: true });
+    writeArtifacts?.(base);
+    const dbPath = join(base, ".gsd", "gsd.db");
+    assert.equal(openDatabase(dbPath), true);
+    for (const milestone of milestones) {
+      insertMilestone(milestone);
+    }
+
+    await showDiscuss(
+      makeDiscussCtx(notifications) as any,
+      harness.pi as any,
+      base,
+      { target },
+    );
+
+    return {
+      notifications: [...notifications],
+      sent: [...harness.sent],
+    };
+  } finally {
+    harness.restore();
+    if (isDbAvailable()) closeDatabase();
+    invalidateStateCache();
+    clearGuidedUnitContext();
+    rmSync(base, { recursive: true, force: true });
+  }
+}
+
 describe("discuss target normalization", () => {
   test("canonicalizes milestone and slice casing", () => {
     assert.equal(normalizeDiscussTarget("m014"), "M014");
@@ -90,6 +127,92 @@ describe("discuss target normalization", () => {
   });
 });
 
+describe("showDiscuss targeted milestone guardrails (#1320)", () => {
+  test("missing, complete, and parked milestone targets get actionable messages", async () => {
+    const cases = [
+      {
+        target: "M006",
+        milestones: [{ id: "M005", title: "Current", status: "active" }],
+        level: "warning",
+        message: /Milestone M006 was not found in the roadmap\. Use \/gsd new-milestone to add it, or \/gsd status to see available milestones\./,
+      },
+      {
+        target: "M006/S01",
+        milestones: [{ id: "M005", title: "Current", status: "active" }],
+        level: "warning",
+        message: /Milestone M006 was not found in the roadmap\. Use \/gsd new-milestone to add it, or \/gsd status to see available milestones\./,
+      },
+      {
+        target: "M006",
+        milestones: [{ id: "M006", title: "Done", status: "complete" }],
+        level: "info",
+        message: /Milestone M006 is already complete\./,
+      },
+      {
+        target: "M006/S01",
+        milestones: [{ id: "M006", title: "Done", status: "complete" }],
+        level: "info",
+        message: /Milestone M006 is already complete\./,
+      },
+      {
+        target: "M006",
+        milestones: [{ id: "M006", title: "Deferred", status: "parked" }],
+        level: "warning",
+        message: /Milestone M006 is parked\. Run \/gsd unpark M006 to reactivate\./,
+      },
+      {
+        target: "M006/S01",
+        milestones: [{ id: "M006", title: "Deferred", status: "parked" }],
+        level: "warning",
+        message: /Milestone M006 is parked\. Run \/gsd unpark M006 to reactivate\./,
+      },
+    ];
+
+    for (const testCase of cases) {
+      const result = await runDiscussTargetFixture(testCase.target, testCase.milestones);
+      assert.equal(result.sent.length, 0, `${testCase.target} must not dispatch`);
+      assert.equal(result.notifications.length, 1, `${testCase.target} must emit one notification`);
+      assert.equal(result.notifications[0]?.level, testCase.level);
+      assert.match(result.notifications[0]?.message ?? "", testCase.message);
+      assert.doesNotMatch(result.notifications[0]?.message ?? "", /not discussable/i);
+    }
+  });
+
+  test("bare milestone targets match unique-suffix milestone IDs", async () => {
+    const result = await runDiscussTargetFixture("M006", [
+      { id: "M006-abc123", title: "Unique milestone", status: "active" },
+    ]);
+
+    assert.equal(result.notifications.length, 0);
+    assert.equal(result.sent.length, 1, "bare ID must dispatch the suffixed milestone");
+    assert.match(String(result.sent[0]?.content), /M006-abc123|Unique milestone|guided-discuss-milestone/i);
+  });
+
+  test("bare slice targets match unique-suffix milestone IDs", async () => {
+    const result = await runDiscussTargetFixture(
+      "M006/S01",
+      [{ id: "M006-abc123", title: "Unique milestone", status: "active" }],
+      (base) => {
+        mkdirSync(join(base, ".gsd", "milestones", "M006-abc123"), { recursive: true });
+        writeFileSync(
+          join(base, ".gsd", "milestones", "M006-abc123", "M006-abc123-ROADMAP.md"),
+          `# M006-abc123 Roadmap
+
+## Slices
+- [ ] **S01: Unique slice** \`risk:medium\` \`depends:[]\`
+  > After this: the suffixed milestone slice can be discussed
+`,
+          "utf-8",
+        );
+      },
+    );
+
+    assert.equal(result.notifications.length, 0);
+    assert.equal(result.sent.length, 1, "bare ID slice target must dispatch through the suffixed milestone");
+    assert.match(String(result.sent[0]?.content), /M006-abc123|S01|Unique slice|guided-discuss-slice/i);
+  });
+});
+
 describe("loadDiscussNormSlices roadmap fallback (#2892)", () => {
   test("falls back to ROADMAP when DB has no slice rows", async () => {
     const base = mkdtempSync(join(tmpdir(), "gsd-discuss-slices-"));

package/src/resources/extensions/gsd/tests/dispatch-missing-task-plans.test.ts

@@ -330,6 +330,56 @@ test("dispatch: session milestone mismatch stops before missing-task-plan recove
   assert.match(result.reason, /context mid "M001" does not match session\.currentMilestoneId "M002"/);
 });
 
+test("dispatch: bare context milestone maps to suffixed active session milestone", async (t) => {
+  const tmp = mkdtempSync(join(tmpdir(), "gsd-suffixed-session-milestone-"));
+  t.after(() => rmSync(tmp, { recursive: true, force: true }));
+
+  const worktreeRoot = join(tmp, ".gsd", "worktrees", "M003-vaz73w");
+  scaffoldLegacyMilestoneContext(worktreeRoot, "M003-vaz73w");
+  scaffoldLegacySlicePlan(worktreeRoot, "M003-vaz73w", "S01");
+  scaffoldLegacyTaskPlan(worktreeRoot, "M003-vaz73w", "S01", "T02");
+
+  const ctx = makeContextFor(tmp, "M003", "S01", "T02", {
+    basePath: worktreeRoot,
+    originalBasePath: tmp,
+    currentMilestoneId: "M003-vaz73w",
+  });
+  const result = await resolveDispatch(ctx);
+
+  assert.equal(result.action, "dispatch");
+  assert.ok(result.action === "dispatch" && result.unitType === "execute-task",
+    `unitType should be execute-task, got: ${result.action === "dispatch" ? result.unitType : "(stop)"}`);
+  assert.ok(result.action === "dispatch" && result.unitId === "M003-vaz73w/S01/T02",
+    `unitId should use suffixed milestone, got: ${result.action === "dispatch" ? result.unitId : "(stop)"}`);
+});
+
+test("dispatch: suffixed context milestone keeps suffix when scoped alias is bare", async (t) => {
+  // Inverse of the case above: dispatch context carries the suffixed id but the
+  // scoped alias (session.currentMilestoneId) is bare. resolveEffectiveDispatchMilestoneId
+  // must keep the suffixed id so slice/task artifacts resolve under the suffixed
+  // worktree layout (milestones/M003-xxxxxx/) rather than the bare milestones/M003/.
+  const tmp = mkdtempSync(join(tmpdir(), "gsd-suffixed-context-bare-scope-"));
+  t.after(() => rmSync(tmp, { recursive: true, force: true }));
+
+  const worktreeRoot = join(tmp, ".gsd", "worktrees", "M003-vaz73w");
+  scaffoldLegacyMilestoneContext(worktreeRoot, "M003-vaz73w");
+  scaffoldLegacySlicePlan(worktreeRoot, "M003-vaz73w", "S01");
+  scaffoldLegacyTaskPlan(worktreeRoot, "M003-vaz73w", "S01", "T02");
+
+  const ctx = makeContextFor(tmp, "M003-vaz73w", "S01", "T02", {
+    basePath: worktreeRoot,
+    originalBasePath: tmp,
+    currentMilestoneId: "M003",
+  });
+  const result = await resolveDispatch(ctx);
+
+  assert.equal(result.action, "dispatch");
+  assert.ok(result.action === "dispatch" && result.unitType === "execute-task",
+    `unitType should be execute-task, got: ${result.action === "dispatch" ? result.unitType : "(stop)"}`);
+  assert.ok(result.action === "dispatch" && result.unitId === "M003-vaz73w/S01/T02",
+    `unitId should keep suffixed milestone, got: ${result.action === "dispatch" ? result.unitId : "(stop)"}`);
+});
+
 test("dispatch: worktree path mismatch stops before planning a different milestone", async (t) => {
   const tmp = mkdtempSync(join(tmpdir(), "gsd-worktree-path-milestone-mismatch-"));
   t.after(() => rmSync(tmp, { recursive: true, force: true }));

package/src/resources/extensions/gsd/tests/dispatch-rule-coverage.test.ts

@@ -146,6 +146,55 @@ test("dispatch-rule-coverage: pre-planning, no CONTEXT → discuss-milestone", a
   );
 });
 
+test("dispatch-rule-coverage: pre-planning worktree sees project-root CONTEXT", async (t) => {
+  const tmp = mkdtempSync(join(tmpdir(), "gsd-disp-cov-wt-context-"));
+  t.after(() => rmSync(tmp, { recursive: true, force: true }));
+
+  const projectPhaseDir = join(tmp, ".gsd", "phases", "01-foundation");
+  mkdirSync(projectPhaseDir, { recursive: true });
+  writeFileSync(join(projectPhaseDir, "01-CONTEXT.md"), "# Context\n");
+
+  const worktree = join(tmp, ".gsd", "worktrees", "M001");
+  mkdirSync(join(worktree, ".gsd", "milestones", "M001"), { recursive: true });
+  writeFileSync(
+    join(worktree, ".gsd", "milestones", "M001", "M001-META.json"),
+    '{"branch":"milestone/M001"}',
+  );
+
+  const rule = DISPATCH_RULES.find(
+    (candidate) => candidate.name === "pre-planning (no context) → discuss-milestone",
+  );
+  assert.ok(rule, "pre-planning missing-context rule should exist");
+
+  const result = await rule.match(makeCtx(worktree, makeState({ phase: "pre-planning" })));
+  assert.equal(result, null, "project-root CONTEXT must prevent a second discuss-milestone dispatch");
+});
+
+test("dispatch-rule-coverage: pre-planning worktree sees worktree-only CONTEXT", async (t) => {
+  // Mirror image of the project-root test: discuss-milestone mirrors CONTEXT into
+  // the worktree's own .gsd, and it may not yet exist at the project root (the
+  // worktree→root sync deliberately does not flow markdown projections back).
+  // A project-root-only check would miss it and re-fire discuss-milestone.
+  const tmp = mkdtempSync(join(tmpdir(), "gsd-disp-cov-wt-only-context-"));
+  t.after(() => rmSync(tmp, { recursive: true, force: true }));
+
+  // No CONTEXT at the project root — only the milestone dir exists there.
+  mkdirSync(join(tmp, ".gsd", "phases"), { recursive: true });
+
+  const worktree = join(tmp, ".gsd", "worktrees", "M001");
+  const worktreePhaseDir = join(worktree, ".gsd", "phases", "01-foundation");
+  mkdirSync(worktreePhaseDir, { recursive: true });
+  writeFileSync(join(worktreePhaseDir, "01-CONTEXT.md"), "# WT Context\n");
+
+  const rule = DISPATCH_RULES.find(
+    (candidate) => candidate.name === "pre-planning (no context) → discuss-milestone",
+  );
+  assert.ok(rule, "pre-planning missing-context rule should exist");
+
+  const result = await rule.match(makeCtx(worktree, makeState({ phase: "pre-planning" })));
+  assert.equal(result, null, "worktree-only CONTEXT must prevent a second discuss-milestone dispatch");
+});
+
 test("dispatch-rule-coverage: pre-planning, has CONTEXT, no RESEARCH → research-milestone", async (t) => {
   const tmp = mkdtempSync(join(tmpdir(), "gsd-disp-cov-res-"));
   t.after(() => rmSync(tmp, { recursive: true, force: true }));

package/src/resources/extensions/gsd/tests/doctor-history-public-api.test.ts

@@ -0,0 +1,25 @@
+import test from "node:test";
+import assert from "node:assert/strict";
+import { mkdirSync, mkdtempSync, rmSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+
+import { readDoctorHistory, runGSDDoctor, type DoctorHistoryEntry } from "../doctor.ts";
+
+test("doctor.ts preserves readDoctorHistory public API and records doctor runs", async (t) => {
+  const base = mkdtempSync(join(tmpdir(), "gsd-doctor-history-api-"));
+  mkdirSync(join(base, ".gsd"), { recursive: true });
+
+  t.after(() => rmSync(base, { recursive: true, force: true }));
+
+  const report = await runGSDDoctor(base, { fix: false });
+  const history: DoctorHistoryEntry[] = await readDoctorHistory(base, 1);
+
+  assert.equal(history.length, 1);
+  assert.equal(history[0].ok, report.ok);
+  assert.equal(history[0].errors, report.issues.filter(issue => issue.severity === "error").length);
+  assert.equal(history[0].warnings, report.issues.filter(issue => issue.severity === "warning").length);
+  assert.equal(history[0].fixes, 0);
+  assert.ok(Array.isArray(history[0].codes));
+  assert.equal(typeof history[0].summary, "string");
+});

package/src/resources/extensions/gsd/tests/evidence-cross-ref.test.ts

@@ -54,6 +54,87 @@ test("passing retry evidence is not invalidated by an earlier failed run of the
   assert.deepEqual(mismatches, []);
 });
 
+test("newer script-wrapped pass is not shadowed by a stale exact failing run", () => {
+  const command = "npm test";
+  const mismatches = crossReferenceEvidence(
+    [{ command, exitCode: 0, verdict: "passed after retry" }],
+    [
+      {
+        kind: "bash",
+        toolCallId: "call-1",
+        command,
+        exitCode: 1,
+        outputSnippet: "failed",
+        timestamp: 1,
+      },
+      {
+        kind: "bash",
+        toolCallId: "call-2",
+        command: `cd /work && ${command}`,
+        exitCode: 0,
+        outputSnippet: "passed",
+        timestamp: 2,
+      },
+    ] as EvidenceEntry[],
+  );
+
+  assert.deepEqual(mismatches, []);
+});
+
+test("later containing script does not override an exact successful run", () => {
+  const command = "npm test";
+  const mismatches = crossReferenceEvidence(
+    [{ command, exitCode: 0, verdict: "passed" }],
+    [
+      {
+        kind: "bash",
+        toolCallId: "call-1",
+        command,
+        exitCode: 0,
+        outputSnippet: "passed",
+        timestamp: 1,
+      },
+      {
+        kind: "bash",
+        toolCallId: "call-2",
+        command: `cd /work && ${command} && npm run lint`,
+        exitCode: 1,
+        outputSnippet: "lint failed",
+        timestamp: 2,
+      },
+    ] as EvidenceEntry[],
+  );
+
+  assert.deepEqual(mismatches, []);
+});
+
+test("same-timestamp retry evidence prefers the later recorded run", () => {
+  const command = "npm test";
+  const mismatches = crossReferenceEvidence(
+    [{ command, exitCode: 0, verdict: "passed after retry" }],
+    [
+      {
+        kind: "bash",
+        toolCallId: "call-1",
+        command,
+        exitCode: 1,
+        outputSnippet: "failed",
+        timestamp: 1,
+      },
+      {
+        kind: "bash",
+        toolCallId: "call-2",
+        command,
+        exitCode: 0,
+        outputSnippet: "passed",
+        timestamp: 1,
+      },
+    ] as EvidenceEntry[],
+  );
+
+  assert.deepEqual(mismatches, []);
+});
+
 test("stale verification evidence batches are ignored when a newer completion batch exists", () => {
   const command = "node todo.js add 'Task A' && node todo.js add 'Task B' && node todo.js done 1";
   const resetCommand = `rm -f "$HOME/.config/todo/data.json" && ${command}`;

package/src/resources/extensions/gsd/tests/evidence-xref-gsd-exec.test.ts

@@ -60,6 +60,28 @@ test("evidence-xref: verification run through gsd_exec script matches the claime
   assert.deepEqual(mismatches, [], "gsd_exec-executed verification must not be flagged as missing");
 });
 
+test("evidence-xref: gsd_exec runtime-purpose label matches the recorded sandbox run", () => {
+  resetEvidence();
+
+  recordToolCall("tc-exec-label", "gsd_exec", {
+    runtime: "node",
+    code: "const plan = 'T02-PLAN'; if (!plan.includes('T02')) process.exit(1);",
+    purpose: "validate T02-PLAN contains canonical Cargo command, state seam, d",
+  });
+  recordToolResult("tc-exec-label", "gsd_exec", gsdExecResult(0), false);
+
+  const mismatches = crossReferenceEvidence(
+    [{
+      command: "gsd_exec node: validate T02-PLAN contains canonical Cargo command, state seam, d",
+      exitCode: 0,
+      verdict: "passed",
+    }],
+    getEvidence(),
+  );
+
+  assert.deepEqual(mismatches, [], "gsd_exec purpose labels must match sandbox evidence");
+});
+
 test("evidence-xref: multi-line gsd_exec script matches claims for each embedded command", () => {
   resetEvidence();