@opengsd/gsd-pi 1.8.1 → 1.9.0-dev.5c1a3ff2

package/src/resources/extensions/gsd/context-masker.ts

@@ -1,3 +1,5 @@
+import { GSD_CONTEXT_MESSAGE_SENTINEL } from "./constants.js";
+
 /**
  * Observation masking for GSD auto-mode sessions.
  *
@@ -75,6 +77,26 @@ function findTurnBoundary(messages: MaskableMessage[], keepRecentTurns: number):
   return 0;
 }
 
+function countRealUserTurns(messages: MaskableMessage[]): number {
+  let count = 0;
+  for (const m of messages) {
+    if (m.role === "user" && !isBashResultUserMessage(m)) count++;
+  }
+  return count;
+}
+
+/**
+ * Quantizes how many recent turns stay unmasked so the boundary only moves
+ * forward once per full block of `keepRecentTurns` new turns, instead of
+ * every turn. Keeps the masked prefix byte-stable within a block, which is
+ * what lets the LLM provider's prompt cache survive across turns.
+ */
+function quantizedKeepTurns(totalTurns: number, keepRecentTurns: number): number {
+  if (keepRecentTurns <= 0 || totalTurns < 2 * keepRecentTurns) return totalTurns;
+  const maskedTurns = Math.floor((totalTurns - keepRecentTurns) / keepRecentTurns) * keepRecentTurns;
+  return totalTurns - maskedTurns;
+}
+
 /**
  * Detect user messages that originated from bashExecution.
  * After convertToLlm, these are {role: "user", content: [{type:"text", text:"Ran `cmd`\n..."}]}.
@@ -95,7 +117,8 @@ function isMaskableMessage(m: MaskableMessage): boolean {
 
 export function createObservationMask(keepRecentTurns: number = 8) {
   return (messages: MaskableMessage[]): MaskableMessage[] => {
-    const boundary = findTurnBoundary(messages, keepRecentTurns);
+    const totalTurns = countRealUserTurns(messages);
+    const boundary = findTurnBoundary(messages, quantizedKeepTurns(totalTurns, keepRecentTurns));
     if (boundary === 0) return messages;
 
     return messages.map((m, i) => {
@@ -126,6 +149,14 @@ function findResponsesTurnBoundary(items: ResponsesInputItem[], keepRecentTurns:
   return 0;
 }
 
+function countResponsesRealUserTurns(items: ResponsesInputItem[]): number {
+  let count = 0;
+  for (const item of items) {
+    if (item.role === "user" && !isResponsesBashResultUserItem(item)) count++;
+  }
+  return count;
+}
+
 /**
  * Observation masking for OpenAI/Codex Responses API payloads.
  *
@@ -135,7 +166,8 @@ function findResponsesTurnBoundary(items: ResponsesInputItem[], keepRecentTurns:
  */
 export function createResponsesInputObservationMask(keepRecentTurns: number = 8) {
   return (items: ResponsesInputItem[]): ResponsesInputItem[] => {
-    const boundary = findResponsesTurnBoundary(items, keepRecentTurns);
+    const totalTurns = countResponsesRealUserTurns(items);
+    const boundary = findResponsesTurnBoundary(items, quantizedKeepTurns(totalTurns, keepRecentTurns));
     if (boundary === 0) return items;
 
     return items.map((item, i) => {
@@ -219,3 +251,67 @@ export function truncateResponsesInputResultItems(items: ResponsesInputItem[], m
     return item;
   });
 }
+
+// GSD injects at most one context message per turn (memory/guided/forensics —
+// see buildContextMessage in bootstrap/system-context.ts), marked with
+// GSD_CONTEXT_MESSAGE_SENTINEL. convertToLlm strips the distinguishing
+// customType before the payload reaches this hook, so detection is by content
+// prefix instead. Pre-sentinel session history lacks the sentinel, so we also
+// match the stable *bracketed* GSD block labels those injections begin with,
+// letting resumed sessions dedupe older memory/guided blocks.
+//
+// Only GSD-specific bracketed markers belong here — never generic prose. A
+// message is dropped from the payload when it matches, so a natural-language
+// prefix (e.g. the forensics prompt "Debug GSD itself.") could silently delete
+// a real user message that happens to start the same way. Legacy forensics
+// injections without memory are therefore left un-deduped by design; those
+// with memory still match via the "[GSD Context Metadata]" wrapper.
+const LEGACY_GSD_CONTEXT_INJECTION_PREFIXES = [
+  "[GSD Context Metadata]",
+  "[MEMORY — Critical and prompt-relevant memories from the GSD memory store]",
+  "[GSD Guided Execute Context]",
+] as const;
+
+function isGsdContextInjectionText(text: string | undefined): boolean {
+  if (typeof text !== "string") return false;
+  if (text.startsWith(GSD_CONTEXT_MESSAGE_SENTINEL)) return true;
+  return LEGACY_GSD_CONTEXT_INJECTION_PREFIXES.some((prefix) => text.startsWith(prefix));
+}
+
+function isGsdContextInjectionMessage(m: MaskableMessage): boolean {
+  if (m.role !== "user") return false;
+  return isGsdContextInjectionText(firstTextFromContent(m.content));
+}
+
+/**
+ * Removes every GSD context-injection user message except the latest one.
+ * Each turn re-injects a near-identical memory/guided/forensics block; left
+ * in place they duplicate verbatim across an N-turn session. Removal (not
+ * masking) — an empty placeholder still costs tokens and shifts message
+ * positions, breaking cache byte-stability. Pure function: stored history is
+ * never mutated, only the outgoing payload array.
+ */
+export function filterSupersededContextInjections(messages: MaskableMessage[]): MaskableMessage[] {
+  let lastIndex = -1;
+  for (let i = 0; i < messages.length; i++) {
+    if (isGsdContextInjectionMessage(messages[i])) lastIndex = i;
+  }
+  if (lastIndex === -1) return messages;
+  return messages.filter((m, i) => i === lastIndex || !isGsdContextInjectionMessage(m));
+}
+
+function isResponsesGsdContextInjectionItem(item: ResponsesInputItem): boolean {
+  if (item.role !== "user") return false;
+  return isGsdContextInjectionText(firstTextFromContent(item.content));
+}
+
+export function filterSupersededResponsesContextInjections(
+  items: ResponsesInputItem[],
+): ResponsesInputItem[] {
+  let lastIndex = -1;
+  for (let i = 0; i < items.length; i++) {
+    if (isResponsesGsdContextInjectionItem(items[i])) lastIndex = i;
+  }
+  if (lastIndex === -1) return items;
+  return items.filter((item, i) => i === lastIndex || !isResponsesGsdContextInjectionItem(item));
+}

package/src/resources/extensions/gsd/db/command-queue.ts

@@ -15,6 +15,7 @@
 
 import {
   _getAdapter,
+  immediateTransaction,
   isDbAvailable,
   transaction,
 } from "../gsd-db.js";
@@ -75,7 +76,12 @@ export function claimNextCommand(workerId: string): CommandQueueRow | null {
   const now = new Date().toISOString();
   const db = _getAdapter()!;
 
-  return transaction((): CommandQueueRow | null => {
+  // BEGIN IMMEDIATE: this is a read-then-write claim. Under WAL, a deferred
+  // transaction that reads first and then upgrades to a writer can fail with
+  // SQLITE_BUSY_SNAPSHOT (not retried by busy_timeout) when two workers race;
+  // taking the write lock up front serializes claimants so the loser waits
+  // and then sees the row already claimed (changes !== 1 → null).
+  return immediateTransaction((): CommandQueueRow | null => {
     // Find the oldest unclaimed command targeted at this worker OR
     // broadcast. The partial index covers both via NULL-in-B-tree.
     const row = db.prepare(

package/src/resources/extensions/gsd/db/engine.ts

@@ -46,6 +46,7 @@ import {
   applyMigrationV27ArtifactHash,
   applyMigrationV28MemoryLastHitAt,
   applyMigrationV29RepositoryTargets,
+  applyMigrationV30ReworkBriefs,
 } from "../db-migration-steps.js";
 import {
   isMemoriesFtsAvailableSchema,
@@ -93,7 +94,7 @@ const providerLoader = createSqliteProviderLoader({
   nodeVersion: process.versions.node,
   writeStderr: (message: string) => process.stderr.write(message),
 });
-export const SCHEMA_VERSION = 29;
+export const SCHEMA_VERSION = 30;
 function initSchema(db: DbAdapter, fileBacked: boolean, dbPath: string | null): void {
   const conservativeFilePragmas = fileBacked && _isLikelyWslDrvFsPathForTest(dbPath);
   if (fileBacked) db.exec(conservativeFilePragmas ? "PRAGMA journal_mode=DELETE" : "PRAGMA journal_mode=WAL");
@@ -114,21 +115,39 @@ function initSchema(db: DbAdapter, fileBacked: boolean, dbPath: string | null):
 
     const existing = db.prepare("SELECT count(*) as cnt FROM schema_version").get();
     if (existing && (existing["cnt"] as number) === 0) {
-      createCoordinationTablesV24(db);
-      createRuntimeKvTableV25(db);
-
-      // Fresh install — all tables are created above with the full current schema,
-      // so it is safe to create all migration-specific indexes here.  For existing
-      // databases these indexes are created inside the individual migration guards
-      // in migrateSchema() after the corresponding columns have been added.
-      db.exec("CREATE INDEX IF NOT EXISTS idx_tasks_escalation_pending ON tasks(milestone_id, slice_id, escalation_pending)");
-      db.exec("CREATE INDEX IF NOT EXISTS idx_memories_scope ON memories(scope)");
-      db.exec("CREATE INDEX IF NOT EXISTS idx_memory_sources_kind ON memory_sources(kind)");
-      db.exec("CREATE INDEX IF NOT EXISTS idx_memory_sources_scope ON memory_sources(scope)");
-      db.exec("CREATE INDEX IF NOT EXISTS idx_memory_relations_from ON memory_relations(from_id)");
-      db.exec("CREATE INDEX IF NOT EXISTS idx_memory_relations_to ON memory_relations(to_id)");
-
-      recordSchemaVersion(db, SCHEMA_VERSION);
+      // An empty schema_version table usually means a fresh install, but it can
+      // also be a legacy/truncated DB that already holds user data. Stamping
+      // that DB SCHEMA_VERSION without running migrations would mis-mark it as
+      // fully migrated and break at first query. Probe before stamping.
+      const hasData = ["milestones", "decisions", "memories"].some((t) => {
+        try {
+          const r = db.prepare(`SELECT count(*) as cnt FROM ${t}`).get();
+          return ((r?.["cnt"] as number) ?? 0) > 0;
+        } catch { /* table absent on a truly fresh DB — treat as no data */ return false; }
+      });
+      if (hasData) {
+        // Legacy DB with data but no version row: record the baseline so
+        // migrateSchema runs the full chain instead of stamping the current version.
+        recordSchemaVersion(db, 1);
+      } else {
+        createCoordinationTablesV24(db);
+        createRuntimeKvTableV25(db);
+
+        // Fresh install — all tables are created above with the full current schema,
+        // so it is safe to create all migration-specific indexes here.  For existing
+        // databases these indexes are created inside the individual migration guards
+        // in migrateSchema() after the corresponding columns have been added.
+        db.exec("CREATE INDEX IF NOT EXISTS idx_tasks_escalation_pending ON tasks(milestone_id, slice_id, escalation_pending)");
+        db.exec("CREATE INDEX IF NOT EXISTS idx_memories_scope ON memories(scope)");
+        db.exec("CREATE INDEX IF NOT EXISTS idx_memory_sources_kind ON memory_sources(kind)");
+        db.exec("CREATE INDEX IF NOT EXISTS idx_memory_sources_scope ON memory_sources(scope)");
+        db.exec("CREATE INDEX IF NOT EXISTS idx_memory_relations_from ON memory_relations(from_id)");
+        db.exec("CREATE INDEX IF NOT EXISTS idx_memory_relations_to ON memory_relations(to_id)");
+        db.exec("CREATE INDEX IF NOT EXISTS idx_rework_briefs_task ON rework_briefs(milestone_id, slice_id, task_id)");
+        db.exec("CREATE INDEX IF NOT EXISTS idx_rework_findings_status ON rework_brief_findings(brief_id, severity, status)");
+
+        recordSchemaVersion(db, SCHEMA_VERSION);
+      }
     }
 
     db.exec("COMMIT");
@@ -183,9 +202,19 @@ function copyQualityGateRowsToRepairedTable(db: DbAdapter): void {
   `);
 }
 
+let _migrationFaultForTest = false;
+/** Test-only: force migrateSchema to throw after applying its steps but before COMMIT. */
+export function _setMigrationFaultForTest(v: boolean): void { _migrationFaultForTest = v; }
+
 function migrateSchema(db: DbAdapter, dbPath: string | null): void {
   const currentVersion = getCurrentSchemaVersion(db);
-  if (currentVersion >= SCHEMA_VERSION) return;
+  if (currentVersion > SCHEMA_VERSION) {
+    throw new Error(
+      `gsd.db schema is v${currentVersion}, newer than the v${SCHEMA_VERSION} this gsd-pi supports. ` +
+      `Update gsd-pi (npm i -g @opengsd/gsd-pi) before opening this project.`,
+    );
+  }
+  if (currentVersion === SCHEMA_VERSION) return;
 
   backupDatabaseBeforeMigration(db, dbPath, currentVersion, {
     existsSync,
@@ -351,6 +380,13 @@ function migrateSchema(db: DbAdapter, dbPath: string | null): void {
       recordSchemaVersion(db, 29);
     }
 
+    if (currentVersion < 30) {
+      applyMigrationV30ReworkBriefs(db);
+      recordSchemaVersion(db, 30);
+    }
+
+    if (_migrationFaultForTest) throw new Error("migration fault injected for test");
+
     db.exec("COMMIT");
   } catch (err) {
     db.exec("ROLLBACK");

package/src/resources/extensions/gsd/db/writers/cascades.ts

@@ -211,7 +211,11 @@ export function skipSliceCascade(milestoneId: string, sliceId: string): SkipSlic
   transaction(() => {
     const slice = getSlice(milestoneId, sliceId);
     if (!slice) { outcome = { ok: false, reason: "slice-not-found" }; return; }
-    if (slice.status === "complete" || slice.status === "done") {
+    // Reject any closed slice except "skipped" (which falls through to the
+    // wasAlreadySkipped no-op). isClosedStatus covers the "closed"/"done"
+    // aliases too — hand-picking literals here nulls a completed slice's
+    // completed_at on re-skip.
+    if (isClosedStatus(slice.status) && slice.status !== "skipped") {
       outcome = { ok: false, reason: "slice-already-complete" };
       return;
     }

package/src/resources/extensions/gsd/db/writers/status.ts

@@ -19,11 +19,18 @@ import { getDbOrNull } from "../engine.js";
 import { GSDError, GSD_STALE_STATE } from "../../errors.js";
 import { isClosedStatus } from "../../status-guards.js";
 
-/** A single row-level status write, discriminated by entity (the faces' arity). */
+/**
+ * A single row-level status write, discriminated by entity (the faces' arity).
+ *
+ * preserveCompletion (#1291): when true, an existing non-null completed_at on the
+ * row is kept rather than overwritten. Mirrors the task upsert's guard so a
+ * markdown re-import cannot re-stamp an already-complete slice/milestone with the
+ * current import time — the DB row is strictly richer than the plan.
+ */
 export type StatusTransition =
-  | { entity: "task"; milestoneId: string; sliceId: string; taskId: string; status: string; completedAt?: string | null }
-  | { entity: "slice"; milestoneId: string; sliceId: string; status: string; completedAt?: string | null }
-  | { entity: "milestone"; milestoneId: string; status: string; completedAt?: string | null };
+  | { entity: "task"; milestoneId: string; sliceId: string; taskId: string; status: string; completedAt?: string | null; preserveCompletion?: boolean }
+  | { entity: "slice"; milestoneId: string; sliceId: string; status: string; completedAt?: string | null; preserveCompletion?: boolean }
+  | { entity: "milestone"; milestoneId: string; status: string; completedAt?: string | null; preserveCompletion?: boolean };
 
 function requireDb() {
   const db = getDbOrNull();
@@ -44,15 +51,19 @@ function requireDb() {
 export function applyStatusTransition(t: StatusTransition): void {
   const db = requireDb();
   const completedAt = t.completedAt ?? null;
+  const preserve = t.preserveCompletion ? 1 : 0;
 
   switch (t.entity) {
     case "task":
       db.prepare(
-        `UPDATE tasks SET status = :status, completed_at = :completed_at
+        `UPDATE tasks SET status = :status,
+           completed_at = CASE WHEN :preserve_completion = 1 AND tasks.completed_at IS NOT NULL
+                               THEN tasks.completed_at ELSE :completed_at END
          WHERE milestone_id = :milestone_id AND slice_id = :slice_id AND id = :id`,
       ).run({
         ":status": t.status,
         ":completed_at": completedAt,
+        ":preserve_completion": preserve,
         ":milestone_id": t.milestoneId,
         ":slice_id": t.sliceId,
         ":id": t.taskId,
@@ -61,11 +72,14 @@ export function applyStatusTransition(t: StatusTransition): void {
 
     case "slice":
       db.prepare(
-        `UPDATE slices SET status = :status, completed_at = :completed_at
+        `UPDATE slices SET status = :status,
+           completed_at = CASE WHEN :preserve_completion = 1 AND slices.completed_at IS NOT NULL
+                               THEN slices.completed_at ELSE :completed_at END
          WHERE milestone_id = :milestone_id AND id = :id`,
       ).run({
         ":status": t.status,
         ":completed_at": completedAt,
+        ":preserve_completion": preserve,
         ":milestone_id": t.milestoneId,
         ":id": t.sliceId,
       });
@@ -80,8 +94,11 @@ export function applyStatusTransition(t: StatusTransition): void {
         );
       }
       db.prepare(
-        `UPDATE milestones SET status = :status, completed_at = :completed_at WHERE id = :id`,
-      ).run({ ":status": t.status, ":completed_at": completedAt, ":id": t.milestoneId });
+        `UPDATE milestones SET status = :status,
+           completed_at = CASE WHEN :preserve_completion = 1 AND milestones.completed_at IS NOT NULL
+                               THEN milestones.completed_at ELSE :completed_at END
+         WHERE id = :id`,
+      ).run({ ":status": t.status, ":completed_at": completedAt, ":preserve_completion": preserve, ":id": t.milestoneId });
       return;
     }
   }

package/src/resources/extensions/gsd/db-base-schema.ts

@@ -245,6 +245,34 @@ export function createBaseSchemaObjects(db: DbAdapter, hooks: BaseSchemaHooks):
     )
   `);
 
+  db.exec(`
+    CREATE TABLE IF NOT EXISTS rework_briefs (
+      id TEXT PRIMARY KEY,
+      milestone_id TEXT NOT NULL DEFAULT '',
+      slice_id TEXT NOT NULL DEFAULT '',
+      task_id TEXT NOT NULL DEFAULT '',
+      created_at TEXT NOT NULL DEFAULT '',
+      updated_at TEXT NOT NULL DEFAULT ''
+    )
+  `);
+
+  db.exec(`
+    CREATE TABLE IF NOT EXISTS rework_brief_findings (
+      brief_id TEXT NOT NULL,
+      finding_id TEXT NOT NULL,
+      severity TEXT NOT NULL DEFAULT 'blocking',
+      description TEXT NOT NULL DEFAULT '',
+      required_fix TEXT NOT NULL DEFAULT '',
+      verification_commands TEXT NOT NULL DEFAULT '[]',
+      status TEXT NOT NULL DEFAULT 'pending',
+      evidence TEXT NOT NULL DEFAULT '',
+      decision_ref TEXT NOT NULL DEFAULT '',
+      updated_at TEXT NOT NULL DEFAULT '',
+      PRIMARY KEY (brief_id, finding_id),
+      FOREIGN KEY (brief_id) REFERENCES rework_briefs(id)
+    )
+  `);
+
   db.exec(`
     CREATE TABLE IF NOT EXISTS assessments (
       path TEXT PRIMARY KEY,
@@ -367,6 +395,8 @@ export function createBaseSchemaObjects(db: DbAdapter, hooks: BaseSchemaHooks):
 
   db.exec("CREATE INDEX IF NOT EXISTS idx_memories_active ON memories(superseded_by)");
   db.exec("CREATE INDEX IF NOT EXISTS idx_replan_history_milestone ON replan_history(milestone_id, created_at)");
+  db.exec("CREATE INDEX IF NOT EXISTS idx_rework_briefs_task ON rework_briefs(milestone_id, slice_id, task_id)");
+  db.exec("CREATE INDEX IF NOT EXISTS idx_rework_findings_status ON rework_brief_findings(brief_id, severity, status)");
   db.exec("CREATE INDEX IF NOT EXISTS idx_tasks_active ON tasks(milestone_id, slice_id, status)");
   db.exec("CREATE INDEX IF NOT EXISTS idx_slices_active ON slices(milestone_id, status)");
   db.exec("CREATE INDEX IF NOT EXISTS idx_milestones_status ON milestones(status)");

package/src/resources/extensions/gsd/db-migration-steps.ts

@@ -462,3 +462,35 @@ export function applyMigrationV22QualityGateRepair(db: DbAdapter, hooks: Migrati
   ensureColumn(db, "quality_gates", "scope", "ALTER TABLE quality_gates ADD COLUMN scope TEXT NOT NULL DEFAULT 'slice'");
   ensureColumn(db, "assessments", "scope", "ALTER TABLE assessments ADD COLUMN scope TEXT NOT NULL DEFAULT ''");
 }
+
+
+export function applyMigrationV30ReworkBriefs(db: DbAdapter): void {
+  db.exec(`
+    CREATE TABLE IF NOT EXISTS rework_briefs (
+      id TEXT PRIMARY KEY,
+      milestone_id TEXT NOT NULL DEFAULT '',
+      slice_id TEXT NOT NULL DEFAULT '',
+      task_id TEXT NOT NULL DEFAULT '',
+      created_at TEXT NOT NULL DEFAULT '',
+      updated_at TEXT NOT NULL DEFAULT ''
+    )
+  `);
+  db.exec(`
+    CREATE TABLE IF NOT EXISTS rework_brief_findings (
+      brief_id TEXT NOT NULL,
+      finding_id TEXT NOT NULL,
+      severity TEXT NOT NULL DEFAULT 'blocking',
+      description TEXT NOT NULL DEFAULT '',
+      required_fix TEXT NOT NULL DEFAULT '',
+      verification_commands TEXT NOT NULL DEFAULT '[]',
+      status TEXT NOT NULL DEFAULT 'pending',
+      evidence TEXT NOT NULL DEFAULT '',
+      decision_ref TEXT NOT NULL DEFAULT '',
+      updated_at TEXT NOT NULL DEFAULT '',
+      PRIMARY KEY (brief_id, finding_id),
+      FOREIGN KEY (brief_id) REFERENCES rework_briefs(id)
+    )
+  `);
+  db.exec("CREATE INDEX IF NOT EXISTS idx_rework_briefs_task ON rework_briefs(milestone_id, slice_id, task_id)");
+  db.exec("CREATE INDEX IF NOT EXISTS idx_rework_findings_status ON rework_brief_findings(brief_id, severity, status)");
+}

package/src/resources/extensions/gsd/db-schema-metadata.ts

@@ -19,8 +19,11 @@ export function ensureColumn(db: DbAdapter, table: string, column: string, ddl:
 }
 
 export function getCurrentSchemaVersion(db: DbAdapter): number {
+  // MAX(version) on an empty table returns a row whose value is NULL —
+  // treat that (and any non-numeric value) as version 0, not NULL-as-number.
   const row = db.prepare("SELECT MAX(version) as v FROM schema_version").get();
-  return row ? (row["v"] as number) : 0;
+  const v = row?.["v"];
+  return typeof v === "number" ? v : 0;
 }
 
 export function recordSchemaVersion(db: DbAdapter, version: number): void {

package/src/resources/extensions/gsd/docs/preferences-reference.md

@@ -128,7 +128,7 @@ Diagnostics record the file path, scope (global/project), severity (error/warnin
   - Two equivalent ways to set it: inline as `models.<phase>.thinking`, or as a separate `thinking:` block keyed by phase. For the same phase, the inline value wins over the block; project preferences win over global; a phase that's unset inherits via the same sibling chain as `models` (e.g. `discuss → planning`).
   - If no thinking is configured for a phase, the session level (set via `/model`) is used, exactly as before — this is fully backward-compatible.
   - `execute-task` (code-writing) has a measured reasoning floor of `medium`: at lower levels models stop planning edits and thrash on file re-reads. The floor applies to the session/default path. An **explicit** `execution` thinking level bypasses the floor and is honored verbatim (with a one-time advisory) — set `execution: low` deliberately if you want it.
-  - Levels a model can't support are clamped to the nearest supported level at dispatch and never sent to the provider, so a model/level mismatch never fails a unit mid-run. `xhigh` is only honored by select model families.
+  - Levels a model can't support are clamped to the nearest supported level at dispatch and never sent to the provider, so a model/level mismatch never fails a unit mid-run. `xhigh` support is model-dependent; current examples include OpenAI Codex Max models and Claude Sonnet 5 on Amazon Bedrock.
 
 - `skill_staleness_days`: number — skills unused for this many days get deprioritized during discovery. Set to `0` to disable staleness tracking. Default: `60`.
 
@@ -357,6 +357,28 @@ In `"parent"` mode, slice/task `targetRepositories` default to the declared chil
   - `"replace"` requires `prompt`.
   - `"skip"` is valid with no additional fields.
 
+- `planning_subagents`: object — project-local widening for read-only planning subagent dispatch. Supported unit keys are `plan-milestone` and `plan-slice`; each has:
+  - `allowed`: string[] — additional planning-safe agents for that unit.
+
+  Agents must already be classified by GSD as read-only planning specialists: `mnemo`, `scout`, `planner`, `reviewer`, `security`, or `tester`. The write gate still blocks source writes outside `.gsd/**`, unrestricted bash, stale subagent calls without agent identities, agents outside the global read-only registry, and agents not listed for the active unit.
+
+  Example:
+
+  ```yaml
+  planning_subagents:
+    plan-milestone:
+      allowed:
+        - scout
+        - planner
+        - security
+    plan-slice:
+      allowed:
+        - scout
+        - planner
+        - reviewer
+        - security
+  ```
+
   **Known unit types for `before`/`after`:** `research-milestone`, `plan-milestone`, `research-slice`, `plan-slice`, `execute-task`, `complete-slice`, `replan-slice`, `reassess-roadmap`, `run-uat`.
 
 - `experimental`: opt-in experimental features. All features here are **off by default** — you must explicitly set each one to `true` to enable it. Features in this block may change or be removed without a deprecation cycle while in experimental status. Keys:
@@ -482,13 +504,13 @@ Inline form — thinking pinned alongside the model:
 version: 1
 models:
   planning:
-    model: openai-codex/gpt-5.4
+    model: bedrock/global.anthropic.claude-sonnet-5
     thinking: xhigh
   execution:
-    model: openai-codex/gpt-5.4
+    model: bedrock/global.anthropic.claude-sonnet-5
     thinking: low      # explicit → bypasses the execute-task medium floor
   validation:
-    model: openai-codex/gpt-5.4
+    model: bedrock/global.anthropic.claude-sonnet-5
     thinking: high
 ---
 ```

package/src/resources/extensions/gsd/doctor-engine-checks.ts

@@ -15,13 +15,13 @@ import {
 import { MEMORIES_FTS_REBUILT_KEY } from "./db-memory-fts-schema.js";
 import { isAfter, latestExplicitReopenAt } from "./milestone-reopen-events.js";
 import {
-  buildTaskFileName,
   gsdProjectionRoot,
   gsdRoot,
   resolveGsdPathContract,
   resolveMilestoneFile,
   resolveMilestonePath,
   resolveSliceFile,
+  resolveTaskFile,
 } from "./paths.js";
 import { deriveState } from "./state.js";
 import { isClosedStatus } from "./status-guards.js";
@@ -208,10 +208,8 @@ function resolveFlatPhaseArtifactDiskPath(basePath: string, row: ArtifactRow): s
   if (!artifactType) return null;
 
   if (row.slice_id && row.task_id) {
-    const phaseDir = resolveMilestonePath(basePath, row.milestone_id);
-    if (!phaseDir || !isFlatPhaseDiskPath(basePath, phaseDir)) return null;
-    const candidate = join(phaseDir, buildTaskFileName(row.task_id, artifactType));
-    return existsSync(candidate) ? candidate : null;
+    const candidate = resolveTaskFile(basePath, row.milestone_id, row.slice_id, row.task_id, artifactType);
+    return candidate && isFlatPhaseDiskPath(basePath, candidate) ? candidate : null;
   }
 
   const candidate = row.slice_id