gsd-pi 2.57.0 → 2.58.0

package/src/resources/extensions/gsd/bootstrap/db-tools.ts

@@ -924,7 +924,7 @@ export function registerDbTools(pi: ExtensionAPI): void {
     promptSnippet: "Validate a GSD milestone (DB write + VALIDATION.md render)",
     promptGuidelines: [
       "Use gsd_validate_milestone when all slices are done and the milestone needs validation before completion.",
-      "Parameters: milestoneId, verdict, remediationRound, successCriteriaChecklist, sliceDeliveryAudit, crossSliceIntegration, requirementCoverage, verdictRationale, remediationPlan (optional).",
+      "Parameters: milestoneId, verdict, remediationRound, successCriteriaChecklist, sliceDeliveryAudit, crossSliceIntegration, requirementCoverage, verificationClasses (optional), verdictRationale, remediationPlan (optional).",
       "If verdict is 'needs-remediation', also provide remediationPlan and use gsd_reassess_roadmap to add remediation slices to the roadmap.",
       "On success, returns validationPath where VALIDATION.md was written.",
     ],
@@ -936,6 +936,7 @@ export function registerDbTools(pi: ExtensionAPI): void {
       sliceDeliveryAudit: Type.String({ description: "Markdown table auditing each slice's claimed vs delivered output" }),
       crossSliceIntegration: Type.String({ description: "Markdown describing any cross-slice boundary mismatches" }),
       requirementCoverage: Type.String({ description: "Markdown describing any unaddressed requirements" }),
+      verificationClasses: Type.Optional(Type.String({ description: "Markdown describing verification class compliance and gaps" })),
       verdictRationale: Type.String({ description: "Why this verdict was chosen" }),
       remediationPlan: Type.Optional(Type.String({ description: "Remediation plan (required if verdict is needs-remediation)" })),
     }),

package/src/resources/extensions/gsd/dispatch-guard.ts

@@ -26,9 +26,20 @@ export function getPriorSliceCompletionBlocker(
   const { milestone: targetMid, slice: targetSid } = parseUnitId(unitId);
   if (!targetMid || !targetSid) return null;
 
+  // Parallel worker isolation: when GSD_MILESTONE_LOCK is set, this worker
+  // is scoped to a single milestone. Skip the cross-milestone dependency
+  // check — other milestones are being handled by their own workers.
+  // Without this, the dispatch guard sees incomplete slices in M010/M011
+  // (cloned into the worktree DB) and blocks M012 from ever starting. #2797
+  const milestoneLock = process.env.GSD_MILESTONE_LOCK;
+
   // Use findMilestoneIds to respect custom queue order.
   // Only check milestones that come BEFORE the target in queue order.
-  const allIds = findMilestoneIds(base);
+  // When locked to a specific milestone, only check that milestone's
+  // intra-slice dependencies — skip all cross-milestone checks.
+  const allIds = milestoneLock && targetMid === milestoneLock
+    ? [targetMid]
+    : findMilestoneIds(base);
   const targetIdx = allIds.indexOf(targetMid);
   if (targetIdx < 0) return null;
   const milestoneIds = allIds.slice(0, targetIdx + 1);

package/src/resources/extensions/gsd/gsd-db.ts

@@ -6,7 +6,7 @@
 // Schema is initialized on first open with WAL mode for file-backed DBs.
 
 import { createRequire } from "node:module";
-import { existsSync, copyFileSync, mkdirSync } from "node:fs";
+import { existsSync, copyFileSync, mkdirSync, realpathSync } from "node:fs";
 import { dirname } from "node:path";
 import type { Decision, Requirement, GateRow, GateId, GateScope, GateStatus, GateVerdict } from "./types.js";
 import { GSDError, GSD_STALE_STATE } from "./errors.js";
@@ -1761,6 +1761,11 @@ export function reconcileWorktreeDb(
 ): ReconcileResult {
   const zero: ReconcileResult = { decisions: 0, requirements: 0, artifacts: 0, milestones: 0, slices: 0, tasks: 0, memories: 0, verification_evidence: 0, conflicts: [] };
   if (!existsSync(worktreeDbPath)) return zero;
+  // Guard: bail when both paths resolve to the same physical file.
+  // ATTACHing a WAL-mode DB to itself corrupts the WAL (#2823).
+  try {
+    if (realpathSync(mainDbPath) === realpathSync(worktreeDbPath)) return zero;
+  } catch { /* path resolution failed — fall through to existing checks */ }
   // Sanitize path: reject any characters that could break ATTACH syntax.
   // ATTACH DATABASE doesn't support parameterized paths in all providers,
   // so we use strict allowlist validation instead.

package/src/resources/extensions/gsd/parallel-orchestrator.ts

@@ -519,8 +519,19 @@ function createMilestoneWorktree(basePath: string, milestoneId: string): string
 
 /**
  * Spawn a worker process for a milestone.
- * The worker runs `gsd --print "/gsd auto"` in the milestone's worktree
+ * The worker runs `gsd headless --json auto` in the milestone's worktree
  * with GSD_MILESTONE_LOCK set to isolate state derivation.
+ *
+ * IMPORTANT: We use `headless --json auto` instead of `--print "/gsd auto"`.
+ * --print mode calls session.prompt() which returns immediately after the
+ * extension command handler fires, because auto-mode's ctx.newSession()
+ * resets the session and unblocks the outer prompt() await. This causes
+ * process.exit(0) to fire before any LLM work happens. See #2792.
+ *
+ * The headless subcommand uses an RPC client that keeps the process alive
+ * until auto-mode emits a terminal notification or the idle timer fires.
+ * It outputs NDJSON events to stdout (with --json), which our
+ * processWorkerLine() parser already understands.
  */
 export function spawnWorker(
   basePath: string,
@@ -537,7 +548,7 @@ export function spawnWorker(
 
   let child: ChildProcess;
   try {
-    child = spawn(process.execPath, [binPath, "--mode", "json", "--print", "/gsd auto"], {
+    child = spawn(process.execPath, [binPath, "headless", "--json", "auto"], {
       cwd: worker.worktreePath,
       env: {
         ...process.env,
@@ -577,9 +588,10 @@ export function spawnWorker(
   }
 
   // ── NDJSON stdout monitoring ────────────────────────────────────────
-  // Workers run with --mode json, emitting one JSON event per line.
-  // We parse message_end events to extract cost/token usage, keeping
-  // the coordinator's cost tracking in sync with actual API spend.
+  // Workers run via `headless --json`, which forwards all RPC events
+  // as NDJSON to stdout. We parse message_end events to extract
+  // cost/token usage, keeping the coordinator's cost tracking in sync
+  // with actual API spend.
   if (child.stdout) {
     let stdoutBuffer = "";
     child.stdout.on("data", (data: Buffer) => {
@@ -808,7 +820,12 @@ export async function stopParallel(
       } catch { /* process may already be dead */ }
     }
 
-    const exitedAfterTerm = await waitForWorkerExit(worker, 750);
+    // Wait for the headless process to cascade SIGTERM to its RPC child.
+    // The headless signal handler calls client.stop() which sends SIGTERM
+    // to the RPC child and waits up to 1000ms. The previous 750ms window
+    // was insufficient — the parent got SIGKILL before the child died,
+    // leaving orphaned RPC processes holding auto.lock. See #2798.
+    const exitedAfterTerm = await waitForWorkerExit(worker, 3000);
     if (!exitedAfterTerm && worker.pid > 0) {
       try {
         if (worker.process) {

package/src/resources/extensions/gsd/preferences.ts

@@ -22,6 +22,7 @@ import { normalizeStringArray } from "../shared/format-utils.js";
 import { resolveProfileDefaults as _resolveProfileDefaults } from "./preferences-models.js";
 
 import {
+  KNOWN_PREFERENCE_KEYS,
   MODE_DEFAULTS,
   type WorkflowMode,
   type GSDPreferences,
@@ -250,7 +251,7 @@ function parseFrontmatterBlock(frontmatter: string): GSDPreferences {
  *   - planner: sonnet
  */
 function parseHeadingListFormat(content: string): GSDPreferences {
-  const result: Record<string, Record<string, string>> = {};
+  const result: Record<string, string[]> = {};
   let currentSection: string | null = null;
 
   for (const rawLine of content.split('\n')) {
@@ -258,27 +259,44 @@ function parseHeadingListFormat(content: string): GSDPreferences {
     const headingMatch = line.match(/^##\s+(.+)$/);
     if (headingMatch) {
       currentSection = headingMatch[1].trim().toLowerCase().replace(/\s+/g, '_');
+      if (!result[currentSection]) result[currentSection] = [];
       continue;
     }
-    if (currentSection) {
-      const itemMatch = line.match(/^-\s+([^:]+):\s*(.*)$/);
-      if (itemMatch) {
-        if (!result[currentSection]) result[currentSection] = {};
-        const value = itemMatch[2].trim();
-        // Coerce "true"/"false" strings and numbers
-        result[currentSection][itemMatch[1].trim()] = value;
-      }
+    if (currentSection && line.trim() && !line.trimStart().startsWith('#')) {
+      result[currentSection].push(line);
     }
   }
 
-  // Convert string values to appropriate types via YAML parser for each section
   const typed: Record<string, unknown> = {};
-  for (const [section, entries] of Object.entries(result)) {
-    const yamlLines = Object.entries(entries).map(([k, v]) => `${k}: ${v}`).join('\n');
+  for (const [section, lines] of Object.entries(result)) {
+    if (lines.length === 0) continue;
+
+    const usesLegacyListItems = lines.every((line) => /^\s*-\s+[^:]+:\s*.*$/.test(line));
+    const yamlBlock = usesLegacyListItems
+      ? lines.map((line) => line.replace(/^\s*-\s+/, '')).join('\n')
+      : lines.join('\n');
+
     try {
-      typed[section] = parseYaml(yamlLines);
+      const parsed = parseYaml(yamlBlock);
+      if (typeof parsed !== 'object' || parsed === null) continue;
+
+      let targetSection = section;
+      let value: unknown = parsed;
+
+      if (!Array.isArray(parsed)) {
+        const keys = Object.keys(parsed);
+        if (keys.length === 1) {
+          const [onlyKey] = keys;
+          if (onlyKey === section || (!KNOWN_PREFERENCE_KEYS.has(section) && KNOWN_PREFERENCE_KEYS.has(onlyKey))) {
+            targetSection = onlyKey;
+            value = (parsed as Record<string, unknown>)[onlyKey];
+          }
+        }
+      }
+
+      typed[targetSection] = value;
     } catch {
-      typed[section] = entries;
+      /* malformed section — skip */
     }
   }
 

package/src/resources/extensions/gsd/prompts/validate-milestone.md

@@ -26,7 +26,7 @@ All relevant context has been preloaded below — the roadmap, all slice summari
 4. Check **requirement coverage** — are all active requirements addressed by at least one slice?
 5. If **Verification Classes** are provided in the inlined context above, check each non-empty class:
    - For each verification class (Contract, Integration, Operational, UAT), determine whether slice summaries, UAT results, or observable behavior provide evidence that this verification tier was addressed.
-   - Document the compliance status of each class in your verdict rationale.
+   - Document the compliance status of each class in a dedicated verification classes section.
    - If `Operational` verification is non-empty and no evidence of operational verification exists, flag this explicitly — it means planned operational checks (migrations, deployments, runtime verification) were not proven.
    - A milestone with unaddressed verification classes may still pass if the gaps are minor, but the gaps MUST be documented in the Deferred Work Inventory.
 6. Determine a verdict:
@@ -36,7 +36,7 @@ All relevant context has been preloaded below — the roadmap, all slice summari
 
 ## Persist Validation
 
-**Persist validation results through `gsd_validate_milestone`.** Call it with: `milestoneId`, `verdict`, `remediationRound`, `successCriteriaChecklist`, `sliceDeliveryAudit`, `crossSliceIntegration`, `requirementCoverage`, `verdictRationale`, and `remediationPlan` (if verdict is `needs-remediation`). The tool writes the validation to the DB and renders VALIDATION.md to disk.
+**Persist validation results through `gsd_validate_milestone`.** Call it with: `milestoneId`, `verdict`, `remediationRound`, `successCriteriaChecklist`, `sliceDeliveryAudit`, `crossSliceIntegration`, `requirementCoverage`, `verificationClasses` (when non-empty), `verdictRationale`, and `remediationPlan` (if verdict is `needs-remediation`). The tool writes the validation to the DB and renders VALIDATION.md to disk.
 
 If verdict is `needs-remediation`:
 - After calling `gsd_validate_milestone`, use `gsd_reassess_roadmap` to add remediation slices. Pass `milestoneId`, a synthetic `completedSliceId` (e.g. "VALIDATION"), `verdict: "roadmap-adjusted"`, `assessment` text, and `sliceChanges` with the new slices in the `added` array. The tool persists the changes to the DB and re-renders ROADMAP.md.

package/src/resources/extensions/gsd/tests/auto-loop.test.ts

@@ -1233,6 +1233,24 @@ test("startAuto calls selfHealRuntimeRecords before autoLoop (#1727)", { skip: "
   );
 });
 
+test("startAuto guards against concurrent invocation (#2923)", () => {
+  const src = readFileSync(
+    resolve(import.meta.dirname, "..", "auto.ts"),
+    "utf-8",
+  );
+  const fnIdx = src.indexOf("export async function startAuto");
+  assert.ok(fnIdx > -1, "startAuto must exist in auto.ts");
+  // The guard must appear before any other logic in the function body
+  const fnBody = src.slice(fnIdx, fnIdx + 500);
+  const activeGuard = fnBody.indexOf("if (s.active)");
+  assert.ok(activeGuard > -1, "startAuto must check s.active to prevent concurrent auto-loops");
+  const returnIdx = fnBody.indexOf("return;", activeGuard);
+  assert.ok(
+    returnIdx > -1 && returnIdx < activeGuard + 120,
+    "s.active guard must early-return to prevent a second concurrent loop",
+  );
+});
+
 test("agent_end handler calls resolveAgentEnd (not handleAgentEnd)", () => {
   const hooksSrc = readFileSync(
     resolve(import.meta.dirname, "..", "bootstrap", "register-hooks.ts"),

package/src/resources/extensions/gsd/tests/dispatch-guard.test.ts

@@ -216,3 +216,50 @@ test("dispatch guard works without git repo", (t) => {
 
   assert.equal(getPriorSliceCompletionBlocker(repo, "main", "plan-slice", "M001/S02"), null);
 });
+
+test("dispatch guard skips cross-milestone check when GSD_MILESTONE_LOCK is set (#2797)", (t) => {
+  const repo = setupRepo();
+  t.after(() => {
+    delete process.env.GSD_MILESTONE_LOCK;
+    teardownRepo(repo);
+  });
+
+  mkdirSync(join(repo, ".gsd", "milestones", "M010"), { recursive: true });
+  mkdirSync(join(repo, ".gsd", "milestones", "M011"), { recursive: true });
+  mkdirSync(join(repo, ".gsd", "milestones", "M012"), { recursive: true });
+
+  // M010 and M011 have incomplete slices
+  insertMilestone({ id: "M010", title: "Analytics" });
+  insertSlice({ id: "S01", milestoneId: "M010", title: "Data Quality", status: "pending", depends: [], sequence: 1 });
+
+  insertMilestone({ id: "M011", title: "Builder Onboarding" });
+  insertSlice({ id: "S01", milestoneId: "M011", title: "Schema", status: "pending", depends: [], sequence: 1 });
+
+  insertMilestone({ id: "M012", title: "Shared Components" });
+  insertSlice({ id: "S01", milestoneId: "M012", title: "Foundation", status: "pending", depends: [], sequence: 1 });
+  insertSlice({ id: "S02", milestoneId: "M012", title: "Migrate Pages", status: "pending", depends: ["S01"], sequence: 2 });
+
+  writeFileSync(join(repo, ".gsd", "milestones", "M010", "M010-ROADMAP.md"), "# M010\n");
+  writeFileSync(join(repo, ".gsd", "milestones", "M011", "M011-ROADMAP.md"), "# M011\n");
+  writeFileSync(join(repo, ".gsd", "milestones", "M012", "M012-ROADMAP.md"), "# M012\n");
+
+  // Without lock: M012 blocked by M010's incomplete S01
+  delete process.env.GSD_MILESTONE_LOCK;
+  assert.match(
+    getPriorSliceCompletionBlocker(repo, "main", "execute-task", "M012/S01/T01") ?? "",
+    /earlier slice M010\/S01 is not complete/,
+  );
+
+  // With lock: M012 only checks its own intra-milestone deps — S01 has none, so unblocked
+  process.env.GSD_MILESTONE_LOCK = "M012";
+  assert.equal(
+    getPriorSliceCompletionBlocker(repo, "main", "execute-task", "M012/S01/T01"),
+    null,
+  );
+
+  // With lock: M012/S02 still blocked by M012/S01 (intra-milestone dep preserved)
+  assert.equal(
+    getPriorSliceCompletionBlocker(repo, "main", "execute-task", "M012/S02/T01"),
+    "Cannot dispatch execute-task M012/S02/T01: dependency slice M012/S01 is not complete.",
+  );
+});

package/src/resources/extensions/gsd/tests/parallel-worker-monitoring.test.ts

@@ -131,14 +131,15 @@ describe("parallel-worker-monitoring", () => {
     assert.ok(!(5.01 < ceiling), "5.01 is over ceiling");
   });
 
-  it("worker spawn args include --mode json", () => {
-    // Verify the spawn command includes JSON mode for NDJSON output.
-    // We can't easily test the actual spawn, but we verify the args pattern.
-    const expectedArgs = ["--mode", "json", "--print", "/gsd auto"];
-    assert.ok(expectedArgs.includes("--mode"), "args include --mode");
-    assert.ok(expectedArgs.includes("json"), "args include json");
-    assert.ok(expectedArgs.indexOf("--mode") < expectedArgs.indexOf("json"),
-      "--mode comes before json");
+  it("worker spawn args use headless --json auto (#2792)", () => {
+    // Verify the spawn command uses headless mode (not --print which exits
+    // before auto-mode can run). See #2792.
+    const expectedArgs = ["headless", "--json", "auto"];
+    assert.ok(expectedArgs.includes("headless"), "args include headless");
+    assert.ok(expectedArgs.includes("--json"), "args include --json");
+    assert.ok(expectedArgs.includes("auto"), "args include auto");
+    assert.ok(expectedArgs.indexOf("headless") < expectedArgs.indexOf("auto"),
+      "headless comes before auto");
   });
 
   it("refreshWorkerStatuses restores persisted workers from disk", () => {

package/src/resources/extensions/gsd/tests/preferences.test.ts

@@ -352,6 +352,40 @@ test("handles empty models config", () => {
   assert.equal(prefs!.models, undefined);
 });
 
+test("parses raw YAML blocks under headings", () => {
+  const content = `## Parallel
+enabled: true
+max_workers: 3
+`;
+  const prefs = parsePreferencesMarkdown(content);
+  assert.notEqual(prefs, null);
+  assert.equal(prefs!.parallel?.enabled, true);
+  assert.equal(prefs!.parallel?.max_workers, 3);
+});
+
+test("unwraps nested top-level preference key under descriptive headings", () => {
+  const content = `## Parallel Orchestration
+parallel:
+  enabled: true
+  max_workers: 3
+`;
+  const prefs = parsePreferencesMarkdown(content);
+  assert.notEqual(prefs, null);
+  assert.equal(prefs!.parallel?.enabled, true);
+  assert.equal(prefs!.parallel?.max_workers, 3);
+});
+
+test("preserves legacy heading list format", () => {
+  const content = `## Git
+- isolation: branch
+- auto_push: true
+`;
+  const prefs = parsePreferencesMarkdown(content);
+  assert.notEqual(prefs, null);
+  assert.equal(prefs!.git?.isolation, "branch");
+  assert.equal(prefs!.git?.auto_push, true);
+});
+
 // ── Warn-once for unrecognized format (#2373) ────────────────────────────────
 
 test("unrecognized format warning is emitted at most once (#2373)", () => {

package/src/resources/extensions/gsd/tests/prompt-contracts.test.ts

@@ -181,6 +181,13 @@ test("reassess-roadmap prompt references gsd_reassess_roadmap tool", () => {
   assert.match(prompt, /gsd_reassess_roadmap/);
 });
 
+test("validate-milestone prompt persists verification classes through gsd_validate_milestone", () => {
+  const prompt = readPrompt("validate-milestone");
+  assert.match(prompt, /verification classes section/i);
+  assert.match(prompt, /verificationClasses/);
+  assert.match(prompt, /gsd_validate_milestone/);
+});
+
 // ─── Prompt migration: replan-slice → gsd_replan_slice ────────────────
 
 test("replan-slice prompt names gsd_replan_slice as the tool to use", () => {

package/src/resources/extensions/gsd/tests/validate-milestone-write-order.test.ts

@@ -1,6 +1,6 @@
 import { describe, it, afterEach } from "node:test";
 import assert from "node:assert/strict";
-import { mkdirSync, existsSync, rmSync, writeFileSync } from "node:fs";
+import { mkdirSync, existsSync, readFileSync, rmSync, writeFileSync } from "node:fs";
 import { join } from "node:path";
 import { tmpdir } from "node:os";
 import { randomUUID } from "node:crypto";
@@ -24,6 +24,7 @@ const VALID_PARAMS = {
   sliceDeliveryAudit: "| S01 | delivered |",
   crossSliceIntegration: "No issues",
   requirementCoverage: "All covered",
+  verificationClasses: "- Contract: covered\n- Integration: covered\n- Operational: gap noted",
   verdictRationale: "Everything checks out",
 };
 
@@ -59,6 +60,27 @@ describe("handleValidateMilestone write ordering (#2725)", () => {
     // Disk file exists
     const filePath = join(base, ".gsd", "milestones", "M001", "M001-VALIDATION.md");
     assert.ok(existsSync(filePath), "VALIDATION.md should exist on disk");
+    const validationMd = readFileSync(filePath, "utf-8");
+    assert.match(validationMd, /## Verification Class Compliance/);
+    assert.match(validationMd, /- Contract: covered/);
+    assert.match(validationMd, /## Verdict Rationale/);
+  });
+
+  it("omits verification class section when no verification classes are supplied", async () => {
+    base = makeTmpBase();
+    const dbPath = join(base, ".gsd", "gsd.db");
+    openDatabase(dbPath);
+    insertMilestone({ id: "M001" });
+
+    const result = await handleValidateMilestone(
+      { ...VALID_PARAMS, verificationClasses: undefined },
+      base,
+    );
+    assert.ok(!("error" in result), `unexpected error: ${"error" in result ? result.error : ""}`);
+
+    const filePath = join(base, ".gsd", "milestones", "M001", "M001-VALIDATION.md");
+    const validationMd = readFileSync(filePath, "utf-8");
+    assert.doesNotMatch(validationMd, /## Verification Class Compliance/);
   });
 
   it("rolls back DB row when disk write fails", async () => {

package/src/resources/extensions/gsd/tests/validation-gate-patterns.test.ts

@@ -23,9 +23,9 @@ import assert from "node:assert/strict";
 function hasOperationalEvidence(validationContent: string): boolean {
   const structuredMatch =
     validationContent.includes("Operational") &&
-    (validationContent.includes("MET") || validationContent.includes("N/A"));
+    (validationContent.includes("MET") || validationContent.includes("N/A") || validationContent.includes("SATISFIED"));
   const proseMatch =
-    /[Oo]perational[\s:][^\n]*(?:pass|verified|confirmed|met|complete|true|yes|addressed|covered|n\/a|not\s+applicable)/i.test(
+    /[Oo]perational[\s\S]{0,500}?(?:✅|pass|verified|confirmed|met|complete|true|yes|addressed|covered|satisfied|partially|n\/a|not[\s-]+applicable)/i.test(
       validationContent,
     );
   return structuredMatch || proseMatch;
@@ -104,6 +104,48 @@ test('prose: "Operational: complete" passes', () => {
   assert.ok(hasOperationalEvidence(content));
 });
 
+// ─── Issue #2862: checkmark emoji ────────────────────────────────────────────
+
+test('prose: "Operational: ✅" checkmark emoji passes (issue #2862)', () => {
+  const content = `- **Operational:** ✅ DECISIONS.md documents D009-D013`;
+  assert.ok(hasOperationalEvidence(content));
+});
+
+// ─── Issue #2866: multi-line, "satisfied", markdown bold ─────────────────────
+
+test('multi-line: verdict on next line after Operational heading passes (issue #2866)', () => {
+  const content = `### Operational Verification
+All endpoints responsive. Health checks pass.`;
+  assert.ok(hasOperationalEvidence(content));
+});
+
+test('prose: "PARTIALLY SATISFIED" passes (issue #2866)', () => {
+  const content = `Operational class: ⚠️ PARTIALLY SATISFIED`;
+  assert.ok(hasOperationalEvidence(content));
+});
+
+test('prose: "FULLY SATISFIED" passes (issue #2866)', () => {
+  const content = `**Operational**: FULLY SATISFIED — all monitoring in place.`;
+  assert.ok(hasOperationalEvidence(content));
+});
+
+test('structured: Operational + SATISFIED passes (issue #2866)', () => {
+  const content = `| Criteria       | Status    |
+| Operational    | SATISFIED |`;
+  assert.ok(hasOperationalEvidence(content));
+});
+
+test('table with markdown bold: **Operational** passes (issue #2866)', () => {
+  const content = `| **Operational** | ⚠️ Partially satisfied — monitoring gap noted |`;
+  assert.ok(hasOperationalEvidence(content));
+});
+
+test('multi-line: Operational label and "confirmed" separated by line break passes (issue #2866)', () => {
+  const content = `## Operational
+Smoke tests confirmed all services healthy after deploy.`;
+  assert.ok(hasOperationalEvidence(content));
+});
+
 // ─── Rejection cases ─────────────────────────────────────────────────────────
 
 test("no operational evidence: unrelated content fails", () => {

package/src/resources/extensions/gsd/tests/worktree-db-same-file.test.ts

@@ -0,0 +1,175 @@
+/**
+ * worktree-db-same-file.test.ts — Regression test for #2823.
+ *
+ * Verifies that reconcileWorktreeDb() does not ATTACH a WAL-mode DB file
+ * to itself when the worktree DB path resolves to the same physical file
+ * as the main DB path (shared-WAL / symlink layout).
+ *
+ * Also verifies that the auto-loop classifies "database disk image is
+ * malformed" as an infrastructure error to prevent wasting retries.
+ */
+
+import { describe, test, beforeEach, afterEach } from "node:test";
+import assert from "node:assert/strict";
+import {
+  existsSync,
+  mkdirSync,
+  mkdtempSync,
+  rmSync,
+  symlinkSync,
+  writeFileSync,
+} from "node:fs";
+import { join } from "node:path";
+import { tmpdir } from "node:os";
+
+import {
+  openDatabase,
+  closeDatabase,
+  reconcileWorktreeDb,
+  insertDecision,
+} from "../gsd-db.ts";
+import { isInfrastructureError } from "../auto/infra-errors.ts";
+
+// ─── Fix 1 & 2: reconcileWorktreeDb same-file guard ─────────────────
+
+describe("#2823: reconcileWorktreeDb same-file guard", () => {
+  let tmpDir: string;
+
+  beforeEach(() => {
+    tmpDir = mkdtempSync(join(tmpdir(), "gsd-2823-"));
+  });
+
+  afterEach(() => {
+    closeDatabase();
+    rmSync(tmpDir, { recursive: true, force: true });
+  });
+
+  test("returns zero result when both paths resolve to the same file", () => {
+    const mainGsd = join(tmpDir, "main", ".gsd");
+    mkdirSync(mainGsd, { recursive: true });
+    const mainDbPath = join(mainGsd, "gsd.db");
+
+    // Create a real DB at mainDbPath
+    openDatabase(mainDbPath);
+    insertDecision({
+      id: "D001",
+      when_context: "2026-01-01",
+      scope: "M001",
+      decision: "Test decision",
+      choice: "Test choice",
+      rationale: "Test rationale",
+      revisable: "yes",
+      made_by: "agent",
+      superseded_by: null,
+    });
+
+    // Create a worktree path that resolves to the same file via symlink
+    const wtGsd = join(tmpDir, "worktree", ".gsd");
+    mkdirSync(join(tmpDir, "worktree"), { recursive: true });
+    symlinkSync(mainGsd, wtGsd, "junction");
+    const worktreeDbPath = join(wtGsd, "gsd.db");
+
+    // Both paths exist and resolve to the same physical file
+    assert.ok(existsSync(mainDbPath), "main DB exists");
+    assert.ok(existsSync(worktreeDbPath), "worktree DB path exists (via symlink)");
+
+    // This should NOT attempt ATTACH — should return zero result
+    const result = reconcileWorktreeDb(mainDbPath, worktreeDbPath);
+
+    assert.equal(result.decisions, 0, "no decisions reconciled");
+    assert.equal(result.requirements, 0, "no requirements reconciled");
+    assert.equal(result.artifacts, 0, "no artifacts reconciled");
+    assert.equal(result.conflicts.length, 0, "no conflicts");
+  });
+
+  test("returns zero result when both paths are identical strings", () => {
+    const mainGsd = join(tmpDir, "project", ".gsd");
+    mkdirSync(mainGsd, { recursive: true });
+    const dbPath = join(mainGsd, "gsd.db");
+
+    openDatabase(dbPath);
+    insertDecision({
+      id: "D001",
+      when_context: "2026-01-01",
+      scope: "M001",
+      decision: "Test",
+      choice: "Test",
+      rationale: "Test",
+      revisable: "yes",
+      made_by: "agent",
+      superseded_by: null,
+    });
+
+    // Same exact path — should bail immediately
+    const result = reconcileWorktreeDb(dbPath, dbPath);
+
+    assert.equal(result.decisions, 0);
+    assert.equal(result.conflicts.length, 0);
+  });
+
+  test("still reconciles when paths are genuinely different files", () => {
+    // Main DB
+    const mainGsd = join(tmpDir, "main", ".gsd");
+    mkdirSync(mainGsd, { recursive: true });
+    const mainDbPath = join(mainGsd, "gsd.db");
+
+    openDatabase(mainDbPath);
+    insertDecision({
+      id: "D001",
+      when_context: "2026-01-01",
+      scope: "M001",
+      decision: "Main decision",
+      choice: "Main choice",
+      rationale: "Main rationale",
+      revisable: "yes",
+      made_by: "agent",
+      superseded_by: null,
+    });
+    closeDatabase();
+
+    // Create a separate worktree DB with different data
+    const wtGsd = join(tmpDir, "worktree", ".gsd");
+    mkdirSync(wtGsd, { recursive: true });
+    const worktreeDbPath = join(wtGsd, "gsd.db");
+
+    openDatabase(worktreeDbPath);
+    insertDecision({
+      id: "D002",
+      when_context: "2026-01-01",
+      scope: "M001",
+      decision: "WT decision",
+      choice: "WT choice",
+      rationale: "WT rationale",
+      revisable: "yes",
+      made_by: "agent",
+      superseded_by: null,
+    });
+    closeDatabase();
+
+    // Re-open main and reconcile — should work normally
+    openDatabase(mainDbPath);
+    const result = reconcileWorktreeDb(mainDbPath, worktreeDbPath);
+
+    assert.ok(
+      result.decisions > 0,
+      "should reconcile decisions from a genuinely different DB",
+    );
+  });
+});
+
+// ─── Fix 3: infrastructure error classification ─────────────────────
+
+describe("#2823: malformed DB classified as infrastructure error", () => {
+  test("database disk image is malformed is detected as infra error", () => {
+    const err = new Error("database disk image is malformed");
+    const code = isInfrastructureError(err);
+    assert.ok(code !== null, "should be classified as infrastructure error");
+    assert.equal(code, "SQLITE_CORRUPT");
+  });
+
+  test("other SQLite errors are not falsely classified", () => {
+    const err = new Error("SQLITE_BUSY: database is locked");
+    const code = isInfrastructureError(err);
+    assert.equal(code, null, "SQLITE_BUSY should not be infra error (it's transient)");
+  });
+});