gsd-pi 2.80.0-dev.c5f2443b3 → 2.80.0-dev.d4fc28e6b

package/dist/resources/extensions/gsd/memory-store.js

@@ -14,6 +14,27 @@ const CATEGORY_PRIORITY = {
     environment: 4,
     preference: 5,
 };
+// ─── Scoring Helpers ─────────────────────────────────────────────────────────
+/**
+ * Time-decay factor for memory relevance scoring.
+ * Returns 1.0 for never-hit or recently-hit memories, decaying linearly to
+ * 0.7 for memories not accessed in 90+ days. Floor at 0.7 keeps old-but-valid
+ * knowledge from being fully suppressed.
+ *
+ * Defensive parsing: invalid timestamp strings (NaN from Date.parse) are
+ * treated as "no decay" rather than propagating NaN into score arithmetic.
+ * Future timestamps (clock skew, manual DB edits) clamp to daysAgo=0 so the
+ * factor stays in the documented [0.7, 1.0] contract.
+ */
+export function memoryDecayFactor(lastHitAt) {
+    if (!lastHitAt)
+        return 1.0;
+    const ts = Date.parse(lastHitAt);
+    if (!Number.isFinite(ts))
+        return 1.0;
+    const daysAgo = Math.max(0, (Date.now() - ts) / 86_400_000);
+    return Math.max(0.7, 1.0 - 0.3 * Math.min(1.0, daysAgo / 90));
+}
 // ─── Row Mapping ────────────────────────────────────────────────────────────
 function rowToMemory(row) {
     return {
@@ -31,6 +52,7 @@ function rowToMemory(row) {
         scope: row['scope'] ?? 'project',
         tags: parseTags(row['tags']),
         structured_fields: parseStructuredFields(row['structured_fields']),
+        last_hit_at: row['last_hit_at'] ?? null,
     };
 }
 function parseStructuredFields(raw) {
@@ -114,15 +136,37 @@ export function queryMemoriesRanked(opts) {
         ? semanticSearch(adapter, opts.queryVector, activeClause, 50)
         : [];
     if (keywordHits.length === 0 && semanticHits.length === 0 && !trimmedQuery) {
-        // No query at all — fall back to the existing ranked-by-score listing.
-        return getActiveMemoriesRanked(k).map((memory) => ({
-            memory,
-            score: memory.confidence * (1 + memory.hit_count * 0.1),
-            keywordRank: null,
-            semanticRank: null,
-            confidenceBoost: memory.confidence * (1 + memory.hit_count * 0.1),
-            reason: 'ranked',
-        })).filter((hit) => passesFilters(hit.memory, opts));
+        // No query at all — return top-k by decay-aware ranked score.
+        //
+        // Build the candidate pool from a direct SQL query that honors the
+        // request's activeClause (i.e. include_superseded). Using
+        // getActiveMemoriesRanked here would silently drop superseded rows even
+        // when the caller explicitly opted in, and would slice by raw score
+        // before decay/filters had a chance to reorder.
+        const candidatePool = Math.min(Math.max(k * 5, 50), 500);
+        const rows = adapter
+            .prepare(`SELECT * FROM memories ${activeClause}
+         ORDER BY (confidence * (1.0 + hit_count * 0.1)) DESC
+         LIMIT :limit`)
+            .all({ ':limit': candidatePool });
+        const ranked = [];
+        for (const row of rows) {
+            const memory = rowToMemory(row);
+            if (!passesFilters(memory, opts))
+                continue;
+            const decay = memoryDecayFactor(memory.last_hit_at);
+            const score = memory.confidence * (1 + memory.hit_count * 0.1) * decay;
+            ranked.push({
+                memory,
+                score,
+                keywordRank: null,
+                semanticRank: null,
+                confidenceBoost: score,
+                reason: 'ranked',
+            });
+        }
+        ranked.sort((a, b) => b.score - a.score);
+        return ranked.slice(0, k);
     }
     // 3) Reciprocal rank fusion — each hit contributes 1/(rrfK + rank).
     const fused = new Map();
@@ -155,7 +199,7 @@ export function queryMemoriesRanked(opts) {
     for (const entry of fused.values()) {
         if (!passesFilters(entry.memory, opts))
             continue;
-        const boost = entry.memory.confidence * (1 + entry.memory.hit_count * 0.1);
+        const boost = entry.memory.confidence * (1 + entry.memory.hit_count * 0.1) * memoryDecayFactor(entry.memory.last_hit_at);
         const reason = entry.kwRank != null && entry.semRank != null
             ? 'both'
             : entry.kwRank != null
@@ -194,6 +238,7 @@ function passesFilters(memory, filters) {
     }
     return true;
 }
+let ftsWarningEmitted = false;
 function keywordSearch(adapter, rawQuery, activeClause, limit) {
     const ftsAvailable = isFtsAvailable(adapter);
     if (ftsAvailable) {
@@ -215,14 +260,26 @@ function keywordSearch(adapter, rawQuery, activeClause, limit) {
             // fall through to LIKE
         }
     }
-    // LIKE fallback — scans the candidate pool.
+    // LIKE fallback — scans a capped candidate pool.
+    if (!ftsWarningEmitted) {
+        ftsWarningEmitted = true;
+        logWarning('memory-store', 'FTS5 unavailable — using LIKE fallback scan (consider enabling FTS5)');
+    }
     const terms = rawQuery
         .toLowerCase()
         .split(/[^a-z0-9_]+/)
         .filter((t) => t.length >= 2);
     if (terms.length === 0)
         return [];
-    const rows = adapter.prepare(`SELECT * FROM memories ${activeClause}`).all();
+    const preScanCap = Math.min(limit * 20, 2000);
+    // ORDER BY confidence-weighted hit_count DESC so the cap keeps the most
+    // valuable candidates instead of the oldest-by-rowid (which would silently
+    // exclude recently-stored memories on tables larger than preScanCap).
+    const rows = adapter
+        .prepare(`SELECT * FROM memories ${activeClause}
+       ORDER BY (confidence * (1.0 + hit_count * 0.1)) DESC
+       LIMIT :preScanCap`)
+        .all({ ':preScanCap': preScanCap });
     const scored = [];
     for (const row of rows) {
         const memory = rowToMemory(row);

package/dist/resources/extensions/gsd/migrate/command.js

@@ -15,6 +15,43 @@ import { fileURLToPath } from "node:url";
 import { showNextAction } from "../../shared/tui.js";
 import { validatePlanningDirectory, parsePlanningDirectory, transformToGSD, generatePreview, writeGSDDirectory, } from "./index.js";
 import { homedir } from "node:os";
+import { ensureDbOpen } from "../bootstrap/dynamic-tools.js";
+import { clearEngineHierarchy, transaction } from "../gsd-db.js";
+import { migrateFromMarkdown } from "../md-importer.js";
+import { invalidateStateCache } from "../state.js";
+function assertMigrationImportMatchesPreview(imported, preview) {
+    const mismatches = [];
+    if (imported.hierarchy.milestones !== preview.milestoneCount) {
+        mismatches.push(`milestones ${imported.hierarchy.milestones}/${preview.milestoneCount}`);
+    }
+    if (imported.hierarchy.slices !== preview.totalSlices) {
+        mismatches.push(`slices ${imported.hierarchy.slices}/${preview.totalSlices}`);
+    }
+    if (imported.hierarchy.tasks !== preview.totalTasks) {
+        mismatches.push(`tasks ${imported.hierarchy.tasks}/${preview.totalTasks}`);
+    }
+    if (imported.requirements !== preview.requirements.total) {
+        mismatches.push(`requirements ${imported.requirements}/${preview.requirements.total}`);
+    }
+    if (mismatches.length > 0) {
+        throw new Error(`migration DB import verification failed: ${mismatches.join(", ")}`);
+    }
+}
+export async function importWrittenMigrationToDb(basePath, preview) {
+    const opened = await ensureDbOpen(basePath);
+    if (!opened) {
+        throw new Error(`failed to open or create the GSD database at ${basePath}`);
+    }
+    const counts = transaction(() => {
+        clearEngineHierarchy();
+        const imported = migrateFromMarkdown(basePath);
+        if (preview)
+            assertMigrationImportMatchesPreview(imported, preview);
+        return imported;
+    });
+    invalidateStateCache();
+    return counts;
+}
 /** Format preview stats for embedding in the review prompt. */
 function formatPreviewStats(preview) {
     const lines = [
@@ -126,12 +163,14 @@ export async function handleMigrate(args, ctx, pi) {
     ctx.ui.notify("Writing .gsd directory…", "info");
     const result = await writeGSDDirectory(project, process.cwd());
     const gsdPath = gsdRoot(process.cwd());
-    ctx.ui.notify(`✓ Migration complete — ${result.paths.length} file(s) written to .gsd/`, "info");
+    const imported = await importWrittenMigrationToDb(process.cwd(), preview);
+    ctx.ui.notify(`✓ Migration complete — ${result.paths.length} file(s) written to .gsd/ and ${imported.hierarchy.milestones}M/${imported.hierarchy.slices}S/${imported.hierarchy.tasks}T imported to the database`, "info");
     // ── Post-write review offer ────────────────────────────────────────────────
     const reviewChoice = await showNextAction(ctx, {
         title: "Migration written",
         summary: [
             `${result.paths.length} files written to .gsd/`,
+            `${imported.hierarchy.milestones} milestone(s), ${imported.hierarchy.slices} slice(s), and ${imported.hierarchy.tasks} task(s) imported to gsd.db`,
             "",
             "The agent can now review the migrated output against GSD-2 standards —",
             "checking structure, content quality, deriveState() round-trip, and",

package/dist/resources/extensions/gsd/migration-auto-check.js

@@ -0,0 +1,87 @@
+import { existsSync, readdirSync, readFileSync } from "node:fs";
+import { ensureDbOpen } from "./bootstrap/dynamic-tools.js";
+import { clearEngineHierarchy, getAllMilestones, getMilestoneSlices, getSliceTasks, isDbAvailable, transaction, } from "./gsd-db.js";
+import { migrateHierarchyToDb } from "./md-importer.js";
+import { parsePlan, parseRoadmap } from "./parsers-legacy.js";
+import { milestonesDir, resolveMilestoneFile, resolveSliceFile, } from "./paths.js";
+import { invalidateStateCache } from "./state.js";
+function zeroCounts() {
+    return { milestones: 0, slices: 0, tasks: 0 };
+}
+function sameCounts(a, b) {
+    return a.milestones === b.milestones && a.slices === b.slices && a.tasks === b.tasks;
+}
+export function countMarkdownHierarchy(basePath) {
+    const root = milestonesDir(basePath);
+    if (!existsSync(root))
+        return zeroCounts();
+    const counts = zeroCounts();
+    for (const entry of readdirSync(root, { withFileTypes: true })) {
+        if (!entry.isDirectory() || !/^M\d+/.test(entry.name))
+            continue;
+        counts.milestones++;
+        const roadmapPath = resolveMilestoneFile(basePath, entry.name, "ROADMAP");
+        if (!roadmapPath || !existsSync(roadmapPath))
+            continue;
+        const roadmap = parseRoadmap(readFileSync(roadmapPath, "utf-8"));
+        counts.slices += roadmap.slices.length;
+        for (const slice of roadmap.slices) {
+            const planPath = resolveSliceFile(basePath, entry.name, slice.id, "PLAN");
+            if (!planPath || !existsSync(planPath))
+                continue;
+            const plan = parsePlan(readFileSync(planPath, "utf-8"));
+            counts.tasks += plan.tasks.length;
+        }
+    }
+    return counts;
+}
+export function countDbHierarchy() {
+    if (!isDbAvailable())
+        return zeroCounts();
+    const counts = zeroCounts();
+    const milestones = getAllMilestones();
+    counts.milestones = milestones.length;
+    for (const milestone of milestones) {
+        const slices = getMilestoneSlices(milestone.id);
+        counts.slices += slices.length;
+        for (const slice of slices) {
+            counts.tasks += getSliceTasks(milestone.id, slice.id).length;
+        }
+    }
+    return counts;
+}
+export async function autoImportMarkdownHierarchyIfDbMismatch(basePath) {
+    const markdown = countMarkdownHierarchy(basePath);
+    if (sameCounts(markdown, zeroCounts())) {
+        return {
+            action: "none",
+            reason: "no-markdown",
+            markdown,
+            beforeDb: zeroCounts(),
+            afterDb: zeroCounts(),
+        };
+    }
+    const opened = await ensureDbOpen(basePath);
+    if (!opened || !isDbAvailable()) {
+        throw new Error(`failed to open or create the GSD database at ${basePath}`);
+    }
+    const beforeDb = countDbHierarchy();
+    if (sameCounts(markdown, beforeDb)) {
+        return { action: "none", reason: "in-sync", markdown, beforeDb, afterDb: beforeDb };
+    }
+    const reason = sameCounts(beforeDb, zeroCounts()) ? "db-empty" : "count-mismatch";
+    const imported = transaction(() => {
+        clearEngineHierarchy();
+        return migrateHierarchyToDb(basePath);
+    });
+    invalidateStateCache();
+    const afterDb = {
+        milestones: imported.milestones,
+        slices: imported.slices,
+        tasks: imported.tasks,
+    };
+    if (!sameCounts(markdown, afterDb)) {
+        throw new Error(`migration auto-import verification failed: markdown ${markdown.milestones}M/${markdown.slices}S/${markdown.tasks}T, db ${afterDb.milestones}M/${afterDb.slices}S/${afterDb.tasks}T`);
+    }
+    return { action: "imported", reason, markdown, beforeDb, afterDb };
+}

package/dist/resources/extensions/gsd/native-git-bridge.js

@@ -5,7 +5,7 @@
 // Both READ and WRITE operations are native — push operations remain as
 // execSync calls because git2 credential handling is too complex.
 import { execFileSync } from "node:child_process";
-import { existsSync, readFileSync, writeFileSync } from "node:fs";
+import { existsSync, readFileSync, rmSync, writeFileSync } from "node:fs";
 import { join } from "node:path";
 import { GSDError, GSD_GIT_ERROR } from "./errors.js";
 import { GIT_NO_PROMPT_ENV } from "./git-constants.js";
@@ -1007,6 +1007,24 @@ export function nativeRmForce(basePath, paths) {
         gitFileExec(basePath, ["rm", "--force", "--", path], true);
     }
 }
+function runGitWorktreeAdd(basePath, wtPath, branch, createBranch, startPoint) {
+    if (createBranch) {
+        const branchRef = gitExec(basePath, ["show-ref", "--verify", `refs/heads/${branch}`], true);
+        if (branchRef) {
+            gitExec(basePath, ["worktree", "add", wtPath, branch]);
+            return;
+        }
+        gitExec(basePath, ["worktree", "add", "-b", branch, wtPath, startPoint ?? "HEAD"]);
+    }
+    else {
+        gitExec(basePath, ["worktree", "add", wtPath, branch]);
+    }
+}
+export function assertWorktreeMaterialized(wtPath) {
+    if (existsSync(join(wtPath, ".git")))
+        return;
+    throw new GSDError(GSD_GIT_ERROR, `git worktree add did not materialize a valid worktree at ${wtPath}: missing .git file`);
+}
 /**
  * Add a new git worktree.
  * Native: libgit2 worktree API.
@@ -1016,14 +1034,20 @@ export function nativeWorktreeAdd(basePath, wtPath, branch, createBranch, startP
     const native = loadNative();
     if (native) {
         native.gitWorktreeAdd(basePath, wtPath, branch, createBranch, startPoint);
-        return;
-    }
-    if (createBranch) {
-        gitExec(basePath, ["worktree", "add", "-b", branch, wtPath, startPoint ?? "HEAD"]);
-    }
-    else {
-        gitExec(basePath, ["worktree", "add", wtPath, branch]);
+        try {
+            assertWorktreeMaterialized(wtPath);
+            return;
+        }
+        catch {
+            rmSync(wtPath, { recursive: true, force: true });
+            gitExec(basePath, ["worktree", "prune"], true);
+            runGitWorktreeAdd(basePath, wtPath, branch, createBranch, startPoint);
+            assertWorktreeMaterialized(wtPath);
+            return;
+        }
     }
+    runGitWorktreeAdd(basePath, wtPath, branch, createBranch, startPoint);
+    assertWorktreeMaterialized(wtPath);
 }
 /**
  * Remove a git worktree.

package/dist/resources/extensions/gsd/orphan-stash-audit.js

@@ -0,0 +1,101 @@
+// GSD-2 + src/resources/extensions/gsd/orphan-stash-audit.ts
+// Startup sweep for orphaned gsd-preflight-stash entries left behind by
+// interrupted milestone merges (#5538-followup).
+import { execFileSync } from "node:child_process";
+import { GIT_NO_PROMPT_ENV } from "./git-constants.js";
+/**
+ * Recognize the "already restored" failure mode of `git stash apply`.
+ *
+ * When a preflight stash captured untracked files via `--include-untracked`
+ * and those files are now present in the working tree (e.g. a prior audit
+ * run already applied this stash), `git stash apply` aborts with
+ * `<path> already exists, no checkout` and exits non-zero. That is the
+ * idempotent steady state for this audit, not a recovery failure — treat
+ * it as a no-op so repeated GSD startups stop spamming the user with
+ * warnings about stashes that have already been restored (#5538-followup
+ * peer-review feedback).
+ */
+function _isAlreadyRestoredApplyError(err) {
+    if (!err || typeof err !== "object")
+        return false;
+    const stderr = err.stderr;
+    const stderrText = typeof stderr === "string" ? stderr : stderr instanceof Uint8Array ? Buffer.from(stderr).toString("utf-8") : "";
+    if (stderrText && /already exists, no checkout/i.test(stderrText))
+        return true;
+    const message = err instanceof Error ? err.message : String(err);
+    return /already exists, no checkout/i.test(message);
+}
+export { _isAlreadyRestoredApplyError };
+/**
+ * Audit `git stash list` for orphaned `gsd-preflight-stash:M00x:*` entries.
+ *
+ * The matching merge code in `phases.ts` previously skipped the postflight
+ * pop whenever `mergeAndExit` threw, leaking the user's pre-merge working
+ * tree into the stash list. For every preflight-stash entry whose milestone
+ * is now complete (per the supplied callback), `git stash apply` is invoked —
+ * NOT `pop`. The stash entry stays in the list so the user retains a backup
+ * if the apply produces unexpected merge results. Idempotent across repeated
+ * startup runs.
+ *
+ * Failures are best-effort: a list error (no repo, git unavailable) returns
+ * an empty result. An apply error becomes a warning the user sees alongside
+ * the existing orphan-branch audit messages — startup continues.
+ */
+export function auditOrphanedPreflightStashes(basePath, isMilestoneComplete) {
+    const result = { applied: [], warnings: [] };
+    let listOutput;
+    try {
+        listOutput = execFileSync("git", ["stash", "list", "--format=%gd%x00%s"], {
+            cwd: basePath,
+            stdio: ["ignore", "pipe", "pipe"],
+            encoding: "utf-8",
+            env: GIT_NO_PROMPT_ENV,
+        });
+    }
+    catch {
+        return result;
+    }
+    const MARKER_RE = /\bgsd-preflight-stash:([A-Za-z0-9_-]+):/;
+    for (const line of listOutput.split("\n")) {
+        const sep = line.indexOf("\x00");
+        if (sep < 0)
+            continue;
+        const ref = line.slice(0, sep);
+        const subject = line.slice(sep + 1);
+        if (!ref || !subject)
+            continue;
+        const match = MARKER_RE.exec(subject);
+        if (!match)
+            continue;
+        const milestoneId = match[1];
+        let complete = false;
+        try {
+            complete = isMilestoneComplete(milestoneId);
+        }
+        catch (err) {
+            result.warnings.push(`Could not determine completion status for ${milestoneId} during preflight-stash audit: ${err instanceof Error ? err.message : String(err)}.`);
+            continue;
+        }
+        if (!complete)
+            continue;
+        try {
+            execFileSync("git", ["stash", "apply", "--quiet", ref], {
+                cwd: basePath,
+                stdio: ["ignore", "pipe", "pipe"],
+                encoding: "utf-8",
+                env: GIT_NO_PROMPT_ENV,
+            });
+            result.applied.push({ milestoneId, stashRef: ref });
+        }
+        catch (err) {
+            // Idempotent steady state: stash was already applied in a prior audit
+            // run; the files exist and `git stash apply` refuses to overwrite.
+            // Skip silently so repeat runs are no-ops.
+            if (_isAlreadyRestoredApplyError(err))
+                continue;
+            result.warnings.push(`Could not apply orphaned preflight stash ${ref} (milestone ${milestoneId}): ${err instanceof Error ? err.message : String(err)}. ` +
+                `Run \`git stash apply ${ref}\` manually to restore your pre-merge changes.`);
+        }
+    }
+    return result;
+}

package/dist/resources/extensions/gsd/parallel-orchestrator.js

@@ -12,7 +12,7 @@ import { join, dirname } from "node:path";
 import { fileURLToPath } from "node:url";
 import { gsdRoot } from "./paths.js";
 import { createWorktree, worktreePath } from "./worktree-manager.js";
-import { autoWorktreeBranch, runWorktreePostCreateHook, syncGsdStateToWorktree } from "./auto-worktree.js";
+import { autoWorktreeBranch, fastForwardReusedMilestoneBranchIfSafe, runWorktreePostCreateHook, syncGsdStateToWorktree } from "./auto-worktree.js";
 import { nativeBranchExists } from "./native-git-bridge.js";
 import { readIntegrationBranch } from "./git-service.js";
 import { resolveParallelConfig } from "./preferences.js";
@@ -368,7 +368,7 @@ export async function startParallel(basePath, milestoneIds, prefs) {
             // Create the worktree (without chdir — coordinator stays in project root)
             let wtPath;
             try {
-                wtPath = createMilestoneWorktree(basePath, mid);
+                wtPath = _createMilestoneWorktree(basePath, mid);
             }
             catch (e) {
                 logWarning("parallel", `createMilestoneWorktree fallback for ${mid}: ${e.message}`);
@@ -421,12 +421,22 @@ export async function startParallel(basePath, milestoneIds, prefs) {
 /**
  * Create a git worktree for a milestone without changing the coordinator's cwd.
  * Uses milestone/<MID> branch naming (same as auto-worktree.ts).
+ *
+ * Exported with the `_` prefix purely for tests — production callers stay on
+ * the closure-private name `createMilestoneWorktree` below.
  */
-function createMilestoneWorktree(basePath, milestoneId) {
+export function _createMilestoneWorktree(basePath, milestoneId) {
     const branch = autoWorktreeBranch(milestoneId);
     const branchExists = nativeBranchExists(basePath, branch);
     let info;
     if (branchExists) {
+        // #5549 post-merge audit (R3): match the fast-forward behavior added to
+        // `createAutoWorktree` in commit 8996cb68e. When a worker reuses an
+        // existing milestone branch, fast-forward it onto the integration branch
+        // when safe so per-worker worktrees don't fork from a stale base after a
+        // sibling milestone has merged. Same `nativeIsAncestor` + worktree-list
+        // safety guards apply.
+        fastForwardReusedMilestoneBranchIfSafe(basePath, milestoneId, branch);
         info = createWorktree(basePath, milestoneId, { branch, reuseExistingBranch: true });
     }
     else {

package/dist/resources/extensions/gsd/planning-path-scope.js

@@ -0,0 +1,26 @@
+import { isAbsolute, relative, resolve } from "node:path";
+import { normalizePlannedFileReference } from "./files.js";
+function isInsideBase(basePath, candidate) {
+    const base = resolve(basePath);
+    const abs = resolve(candidate);
+    const rel = relative(base, abs);
+    return rel === "" || (!!rel && !rel.startsWith("..") && !isAbsolute(rel));
+}
+/**
+ * Planning IO fields are execution contracts. Absolute paths are only safe when
+ * they stay inside the active working directory; in worktree mode, an absolute
+ * path to the original checkout makes executors edit the wrong tree.
+ */
+export function validatePlanningPathScope(basePath, fields) {
+    for (const { field, values } of fields) {
+        for (const raw of values) {
+            const candidate = normalizePlannedFileReference(raw);
+            if (!isAbsolute(candidate))
+                continue;
+            if (isInsideBase(basePath, candidate))
+                continue;
+            return `${field} contains absolute path outside working directory: ${candidate}. Use a path relative to ${basePath}.`;
+        }
+    }
+    return null;
+}

package/dist/resources/extensions/gsd/pr-evidence.js

@@ -8,8 +8,53 @@ const CHANGE_TYPE_LABELS = {
     docs: "Documentation only",
     chore: "Build, CI, or tooling changes",
 };
+// Per-item cap for user-supplied content. 2 KB gives slice titles plus
+// descriptions room while still bounding malicious DoS-via-PR-body input.
+const USER_CONTENT_CAP_BYTES = 2048;
+const TRUNCATION_SUFFIX = " … [truncated]";
+// Strips HTML comments, fake commit trailers (Co-Authored-By, Signed-off-by —
+// case-insensitive on the trailer name), and caps total length. Designed to
+// be a no-op for well-formed input; golden fixtures must remain byte-stable.
+// Trailer lines are removed (not rejected) so that a single bad line in an
+// otherwise legitimate description does not block the entire PR.
+function sanitizeUserContent(s) {
+    if (!s)
+        return s;
+    // Strip HTML comments greedily across newlines.
+    let out = s.replace(/<!--[\s\S]*?-->/g, "");
+    // Drop lines that look like commit trailers we do not want forged.
+    out = out
+        .split("\n")
+        .filter((line) => !/^\s*(co-authored-by|signed-off-by)\s*:/i.test(line))
+        .join("\n");
+    if (Buffer.byteLength(out, "utf8") > USER_CONTENT_CAP_BYTES) {
+        const budget = USER_CONTENT_CAP_BYTES - Buffer.byteLength(TRUNCATION_SUFFIX, "utf8");
+        // Truncate by code units to stay safely under the byte budget for ASCII;
+        // for multibyte content we conservatively walk back until under budget.
+        let sliced = out.slice(0, Math.max(0, budget));
+        while (Buffer.byteLength(sliced, "utf8") > budget && sliced.length > 0) {
+            sliced = sliced.slice(0, -1);
+        }
+        out = sliced + TRUNCATION_SUFFIX;
+    }
+    return out;
+}
+// Strips HTML comments and fake trailers without applying the length cap.
+// Used for short fields like linkedIssue where truncation would be confusing.
+function sanitizeIssueRef(s) {
+    if (!s)
+        return s;
+    let out = s.replace(/<!--[\s\S]*?-->/g, "");
+    out = out
+        .split("\n")
+        .filter((line) => !/^\s*(co-authored-by|signed-off-by)\s*:/i.test(line))
+        .join("\n");
+    return out;
+}
 function normalizeList(values) {
-    return (values ?? []).map((value) => value.trim()).filter(Boolean);
+    return (values ?? [])
+        .map((value) => sanitizeUserContent(value).trim())
+        .filter(Boolean);
 }
 function changeTypeChecklist(selected) {
     return Object.keys(CHANGE_TYPE_LABELS).map((type) => {
@@ -28,13 +73,17 @@ export function buildPrEvidence(input) {
     const subjectTitle = input.milestoneTitle?.trim() || subjectId;
     const changeType = input.changeType ?? "feat";
     const summaries = normalizeList(input.summaries);
+    const blockers = normalizeList(input.blockers);
     const roadmapItems = normalizeList(input.roadmapItems);
     const metrics = normalizeList(input.metrics);
     const testsRun = normalizeList(input.testsRun);
     const rollbackNotes = normalizeList(input.rollbackNotes);
-    const linkedIssue = input.linkedIssue?.trim() || "Not specified. Add an issue link before marking this PR ready if CONTRIBUTING.md requires one.";
-    const why = input.why?.trim() || `${capitalize(subjectKind)} work is complete and ready for review.`;
-    const how = input.how?.trim() || "Generated from GSD evidence and local workflow artifacts.";
+    // linkedIssue is sanitized but not length-capped: legitimate issue refs
+    // are short by nature, and truncating "Closes #123" would be unhelpful.
+    const linkedIssueRaw = input.linkedIssue ? sanitizeIssueRef(input.linkedIssue).trim() : "";
+    const linkedIssue = linkedIssueRaw || "Not specified. Add an issue link before marking this PR ready if CONTRIBUTING.md requires one.";
+    const why = (input.why ? sanitizeUserContent(input.why).trim() : "") || `${capitalize(subjectKind)} work is complete and ready for review.`;
+    const how = (input.how ? sanitizeUserContent(input.how).trim() : "") || "Generated from GSD evidence and local workflow artifacts.";
     const title = `${changeType}: ${subjectTitle}`;
     const sections = [
         "## TL;DR",
@@ -46,19 +95,11 @@ export function buildPrEvidence(input) {
         "## What",
         "",
         summaries.length > 0 ? summaries.join("\n\n") : `${capitalize(subjectKind)} ${subjectId} completed.`,
-        "",
-        "## Why",
-        "",
-        why,
-        "",
-        "## How",
-        "",
-        how,
-        "",
-        "## Linked Issue",
-        "",
-        linkedIssue,
     ];
+    if (blockers.length > 0) {
+        sections.push("", "## Blockers", "", blockers.map((blocker) => `- ${blocker}`).join("\n"));
+    }
+    sections.push("", "## Why", "", why, "", "## How", "", how, "", "## Linked Issue", "", linkedIssue);
     if (roadmapItems.length > 0) {
         sections.push("", "## Roadmap", "", roadmapItems.join("\n"));
     }

package/dist/resources/extensions/gsd/pre-execution-checks.js

@@ -328,6 +328,8 @@ function shouldValidateInputAsPath(raw) {
     const trimmed = raw.trim();
     if (!trimmed)
         return false;
+    if (isRuntimeOnlyInput(trimmed))
+        return false;
     const candidate = extractPathFromAnnotation(trimmed);
     if (!candidate)
         return false;
@@ -349,6 +351,9 @@ function shouldValidateInputAsPath(raw) {
         /[\\/]/.test(candidate) ||
         /[*?[\]{}]/.test(candidate));
 }
+function isRuntimeOnlyInput(raw) {
+    return /\(\s*runtime\s*\)/i.test(raw);
+}
 function containsGlobPattern(candidate) {
     return ["*", "?", "[", "]", "{", "}"].some((char) => candidate.includes(char));
 }
@@ -386,6 +391,15 @@ function getExpectedOutputsUpTo(tasks, taskIndex) {
  */
 export function checkFilePathConsistency(tasks, basePath) {
     const results = [];
+    // Build a set of all files created by any task at any position (normalized).
+    // Used to suppress consistency errors for files that will be caught with a
+    // more precise message by checkTaskOrdering (sequence violation).
+    const allTaskOutputs = new Set();
+    for (const t of tasks) {
+        for (const f of t.expected_output) {
+            allTaskOutputs.add(normalizeFilePath(f));
+        }
+    }
     for (let i = 0; i < tasks.length; i++) {
         const task = tasks[i];
         const priorOutputs = getExpectedOutputsUpTo(tasks, i);
@@ -416,6 +430,12 @@ export function checkFilePathConsistency(tasks, basePath) {
                         anyOutputUnderDirectory(normalizedFile, ownOutputs);
             }
             if (!existsOnDisk && !inPriorOutputs && !inOwnOutputs && !directorySatisfied) {
+                // If a later task claims to create this file, the ordering check will
+                // fire a more precise "sequence violation" error for the same file.
+                // Suppress the consistency error here to avoid duplicate noise.
+                if (allTaskOutputs.has(normalizedFile) && !ownOutputs.has(normalizedFile)) {
+                    continue;
+                }
                 results.push({
                     category: "file",
                     target: file,
@@ -461,6 +481,8 @@ export function checkTaskOrdering(tasks, basePath) {
         const task = tasks[i];
         const filesToCheck = [...task.inputs];
         for (const file of filesToCheck) {
+            if (isRuntimeOnlyInput(file))
+                continue;
             if (!shouldValidateInputAsPath(file))
                 continue;
             const normalizedFile = normalizeFilePath(file);