gsd-pi 2.82.0-dev.ed17d078d → 3.0.0-dev.1b44e695b

package/dist/resources/extensions/gsd/prompts/forensics.md

@@ -50,11 +50,11 @@ GSD extension source: `{{gsdSourceDir}}`
 
 The journal is a structured event log for auto-mode iterations. Daily files contain JSONL:
 
-```
-{ ts: "ISO-8601", flowId: "UUID", seq: 0, eventType: "iteration-start", rule?: "rule-name", causedBy?: { flowId, seq }, data?: { unitId, status, ... } }
+```json
+{ ts: "ISO-8601", flowId: "UUID", seq: 0, eventType: "orchestrator-iteration-start", rule?: "rule-name", causedBy?: { flowId, seq }, data?: { unitId, status, ... } }
 ```
 
-Key events: `iteration-start/end`, `dispatch-match/stop`, `unit-start/end`, `terminal`, `guard-block`, `stuck-detected`, `milestone-transition`, worktree events. `flowId` groups one loop; `causedBy` links causal events; `seq` orders events. Trace stuck loops with `stuck-detected` -> `flowId`; guard blocks with `guard-block` and `data.reason`.
+Key orchestrator events: `orchestrator-iteration-start/end`, `orchestrator-dispatch-match/stop`, `orchestrator-guard-block`, `orchestrator-terminal`. Legacy loop and phase events (`iteration-start/end`, `dispatch-match/stop`, `unit-start/end`, `terminal`, `guard-block`, `stuck-detected`, `milestone-transition`) still appear for non-orchestrator paths, along with worktree events. `flowId` groups one loop; `causedBy` links causal events; `seq` orders events. Trace orchestrator stalls with `orchestrator-guard-block`/`orchestrator-dispatch-stop` and `data.reason`.
 
 ### Crash Lock Format (`auto.lock`)
 

package/dist/resources/extensions/gsd/prompts/guided-discuss-project.md

@@ -1,6 +1,6 @@
 **Working directory:** `{{workingDirectory}}`. All file reads, writes, and shell commands MUST operate relative to this directory. Do NOT `cd` elsewhere. For `.gsd` files, use absolute paths rooted at `{{workingDirectory}}`, not `Glob`.
 
-Discuss the **project** as a whole: vision, users, anti-goals, constraints, and rough milestone sequence. Ask only real gray areas, then write `.gsd/PROJECT.md` with the **Project** template below. If a `GSD Skill Preferences` block exists, use it; artifact rules still apply.
+Discuss the **project** as a whole: vision, users, anti-goals, constraints, and rough milestone sequence. Ask only real gray areas, then persist the final Project template through `gsd_summary_save` with `artifact_type: "PROJECT"`. The tool renders `.gsd/PROJECT.md`; do not write the projection directly. If a `GSD Skill Preferences` block exists, use it; artifact rules still apply.
 
 This runs once before milestone discussion. Later milestones, requirements, and roadmaps depend on it.
 
@@ -34,7 +34,7 @@ After the opening answer, classify project shape as **`simple`** or **`complex`*
 
 **Default to `complex` when uncertain.** The user can override the verdict in plain text; if they do, accept it and proceed.
 
-Persist the verdict to PROJECT.md -> `## Project Shape`; downstream `discuss-requirements`, `discuss-milestone`, and `discuss-slice` read it from there.
+Persist the verdict through `gsd_summary_save` with `artifact_type: "PROJECT"` into `## Project Shape`; downstream `discuss-requirements`, `discuss-milestone`, and `discuss-slice` read the rendered projection.
 
 ### Before deeper rounds
 
@@ -95,7 +95,7 @@ If they clarify, absorb the correction and re-verify.
 
 The depth verification is the only required confirmation gate. Do not add a second "ready to proceed?" gate after it.
 
-**CRITICAL — Confirmation gate:** Do not write final PROJECT.md until the user selects the "(Recommended)" option (structured path) or explicitly confirms (plain-text path). If the user declines, cancels, does not respond, or the tool fails, re-ask.
+**CRITICAL — Confirmation gate:** Do not persist final PROJECT content until the user selects the "(Recommended)" option (structured path) or explicitly confirms (plain-text path). If the user declines, cancels, does not respond, or the tool fails, re-ask.
 
 ---
 
@@ -104,7 +104,7 @@ The depth verification is the only required confirmation gate. Do not add a seco
 Once the user confirms depth:
 
 1. Use the **Project** output template (inlined above).
-2. Call `gsd_summary_save` with `artifact_type: "PROJECT"` and full project markdown as `content`; omit `milestone_id`. The tool writes `.gsd/PROJECT.md` and persists to DB. Preserve the user's terms and framing.
+2. Call `gsd_summary_save` with `artifact_type: "PROJECT"` and full project markdown as `content`; omit `milestone_id`. The tool persists the DB-backed PROJECT artifact and renders `.gsd/PROJECT.md`. Preserve the user's terms and framing.
 3. The `## Project Shape` section MUST contain `**Complexity:** simple` or `**Complexity:** complex` (matching the verdict you announced) plus a one-line `**Why:**` rationale. Downstream stages read this line.
 4. The `## Capability Contract` section MUST reference `.gsd/REQUIREMENTS.md` — that file does not yet exist; the next stage (`discuss-requirements`) will produce it.
 5. The `## Milestone Sequence` MUST list at least M001 with title and one-liner. Subsequent milestones may be listed as known intents; they will be elaborated in their own discuss-milestone stages.

package/dist/resources/extensions/gsd/prompts/guided-discuss-requirements.md

@@ -1,6 +1,6 @@
 **Working directory:** `{{workingDirectory}}`. All file reads, writes, and shell commands MUST operate relative to this directory. Do NOT `cd` elsewhere. For `.gsd` files, use absolute paths rooted at `{{workingDirectory}}`, not `Glob`.
 
-Discuss **project-level requirements**. Read `.gsd/PROJECT.md` first; it is authoritative for vision, core value, anti-goals, and milestone sequence. Requirements must trace to it. Ask capability gray areas, then write `.gsd/REQUIREMENTS.md` using v2 `R###` format and the **Requirements** template.
+Discuss **project-level requirements**. Read `.gsd/PROJECT.md` first; it is the rendered project artifact for vision, core value, anti-goals, and milestone sequence. Requirements must trace to it. Ask capability gray areas, then persist requirements with `gsd_requirement_save` and render `.gsd/REQUIREMENTS.md` through `gsd_summary_save` using v2 `R###` format and the **Requirements** template.
 
 This runs once after `discuss-project` and before milestone work, creating the capability contract for milestones, slices, and verification.
 
@@ -25,7 +25,7 @@ Before your first action, print this banner verbatim in chat:
 3. If `.gsd/REQUIREMENTS.md` exists, read it as the working set.
 
 **Shape-dependent cadence:**
-- **`simple`**: one fast pass. Extract from PROJECT.md, ask 1-2 plain-text clarifiers only when class/status is ambiguous, then write REQUIREMENTS.md.
+- **`simple`**: one fast pass. Extract from PROJECT.md, ask 1-2 plain-text clarifiers only when class/status is ambiguous, then persist requirements through the DB-backed tools.
 - **`complex`**: multi-round questioning with structured 3-4-option questions where alternatives matter.
 
 ---
@@ -81,7 +81,7 @@ Before the wrap-up gate, verify: every milestone has an Active requirement; Core
 
 If they adjust, absorb and re-verify.
 
-**CRITICAL — Confirmation gate:** Do not write final REQUIREMENTS.md until explicit confirmation. Never rationalize past it.
+**CRITICAL — Confirmation gate:** Do not persist final REQUIREMENTS content until explicit confirmation. Never rationalize past it.
 
 ---
 

package/dist/resources/extensions/gsd/prompts/plan-slice.md

@@ -26,7 +26,7 @@ Before planning, validate roadmap assumptions against code and dependency summar
 
 {{sourceFilePaths}}
 
-If slice research is inlined, trust it. Explore enough code to confirm paths, boundaries, and verification. Executors later get only task plans, slice excerpt, and prior summaries, so put required paths, steps, inputs, and outputs in task plans.
+If slice research is inlined, trust its architectural findings, but verify every concrete file path you place in task `inputs` or `expectedOutput` against the current tree or prior/same-task outputs. Explore enough code to confirm paths, boundaries, and verification. Executors later get only task plans, slice excerpt, and prior summaries, so put required paths, steps, inputs, and outputs in task plans.
 
 {{executorContextConstraints}}
 
@@ -39,10 +39,10 @@ If slice research is inlined, trust it. Explore enough code to confirm paths, bo
 5. Define slice verification before tasks. Non-trivial slices need real tests or executable assertions; boundary contracts need contract-exercising checks. Tests must not read .gitignore/gitignored paths such as `.gsd/`, `.planning/`, or `.audits/`.
 6. Include Threat Surface (Q3), Requirement Impact (Q4), proof level, observability, integration closure, Failure Modes (Q5), Load Profile (Q6), and Negative Tests (Q7) only where applicable.
 7. Right-size tasks. Simple slices can be one task; split only when context, ownership, or verification boundaries justify it.
-8. Each task needs a concrete title, Why / Files / Do / Verify / Done when, plus task-plan description, steps, must-haves, verification, inputs, and expected output. Inputs and Expected Output must include concrete backtick-wrapped paths. Use paths relative to `{{workingDirectory}}`; do not put absolute paths to the original checkout or any directory outside `{{workingDirectory}}` in `files`, `inputs`, `expectedOutput`, or verification commands. **`expected_output` must only list files the task actually creates or overwrites on disk.** Do NOT include files the task merely reads, verifies, or tests — those belong only in `inputs`. If a task is a pure verification or test task that produces no new files, its `expected_output` may be empty or limited to test-result artifacts (e.g. a log or assertion output). A file that does not yet exist on disk and is needed as an `input` must be produced by an earlier task's `expected_output` — if no prior task creates it, add a task before this one that does.
-9. Persist with `gsd_plan_slice` using goal, successCriteria, optional proofLevel/integrationClosure/observabilityImpact, and tasks. `gsd_plan_slice` handles task persistence transactionally and renders `{{outputPath}}` plus task plans; do not call `gsd_plan_task`. The DB-backed tool is the canonical write path. Do **not** rely on direct `PLAN.md` writes as the source of truth.
+8. Each task needs the exact `gsd_plan_slice.tasks[]` shape: `taskId`, `title`, `description`, `estimate`, `files`, `verify`, `inputs`, `expectedOutput`, and optional `observabilityImpact`. `description` should contain the Why / Do / Done-when narrative. `files`, `inputs`, and `expectedOutput` must be JSON arrays of strings, even when there is only one path (for example, `"inputs": ["src/index.ts"]`, never `"inputs": "src/index.ts"`). Use paths relative to `{{workingDirectory}}`; do not put absolute paths to the original checkout or any directory outside `{{workingDirectory}}` in `files`, `inputs`, `expectedOutput`, or verification commands. **`expectedOutput` must only list files the task actually creates or overwrites on disk.** Do NOT include files the task merely reads, verifies, or tests — those belong only in `inputs`. If a task is a pure verification or test task that produces no new files, `expectedOutput` may be `[]` or limited to test-result artifacts (e.g. a log or assertion output). A file that does not yet exist on disk and is needed as an `input` must be produced by an earlier task's `expectedOutput` — if no prior task creates it, add a task before this one that does.
+9. Persist with `gsd_plan_slice` using `milestoneId`, `sliceId`, `goal`, optional `successCriteria`/`proofLevel`/`integrationClosure`/`observabilityImpact`, and `tasks`. `gsd_plan_slice` handles task persistence transactionally and renders `{{outputPath}}` plus task plans; do not call `gsd_plan_task`. The DB-backed tool is the canonical write path. Do **not** rely on direct `PLAN.md` writes as the source of truth.
 10. Self-audit before finishing: goal/demo closure, requirement coverage, locked decisions, concrete paths, dependency order, wiring, scope size, proof truthfulness, feature completeness, and quality gates. Quality gates: non-trivial slices/tasks include specific Q3-Q7 coverage where applicable.
-11. If planning creates structural decisions, append them to `.gsd/DECISIONS.md`.
+11. If planning creates structural decisions, call `gsd_decision_save` for each; the tool persists the decision and regenerates `.gsd/DECISIONS.md`.
 12. {{commitInstruction}}
 
 The slice directory already exists. Do not mkdir.

package/dist/resources/extensions/gsd/prompts/queue.md

@@ -114,10 +114,10 @@ Once the user is satisfied, in one pass for **each** new milestone:
 
 After all milestone directories and context files are written:
 
-3. Update `.gsd/PROJECT.md` by adding new milestones to the Milestone Sequence. Keep existing entries exactly as-is; only add new lines.
-4. If `.gsd/REQUIREMENTS.md` exists and the queued work introduces new in-scope capabilities or promotes Deferred items, update it.
-5. If discussion produced decisions relevant to existing work, append to `.gsd/DECISIONS.md`.
-6. Append to `.gsd/QUEUE.md`.
+3. Refresh project state through `gsd_summary_save` with `artifact_type: "PROJECT"` and full PROJECT content that includes the new milestones in the Milestone Sequence; omit `milestone_id`.
+4. If the queued work introduces new in-scope capabilities or promotes Deferred items, persist those changes with `gsd_requirement_save` or `gsd_requirement_update`, then call `gsd_summary_save` with `artifact_type: "REQUIREMENTS"` so `.gsd/REQUIREMENTS.md` renders from DB rows.
+5. If discussion produced decisions relevant to existing work, call `gsd_decision_save` for each decision; the tool regenerates `.gsd/DECISIONS.md`.
+6. If `.gsd/QUEUE.md` is maintained, update it only as an audit projection of queued intent. Runtime queue state must come from the DB-backed milestone/context tool calls above.
 7. {{commitInstruction}}
 
 **Do NOT write roadmaps for queued milestones.**

package/dist/resources/extensions/gsd/prompts/reactive-execute.md

@@ -8,7 +8,7 @@
 
 You are executing **multiple tasks in parallel** for this slice. The task graph below shows which tasks are ready for simultaneous execution based on their input/output dependencies.
 
-**Critical rule:** Use the `subagent` tool in **parallel mode** to dispatch all ready tasks simultaneously. Each subagent gets a full `execute-task` prompt and is responsible for its own implementation, verification, task summary, and completion tool calls. The parent batch agent orchestrates, verifies, and records failures only when a dispatched task failed before it could leave its own summary behind.
+**Critical rule:** Use the `subagent` tool in **parallel mode** to dispatch all ready tasks simultaneously. Each subagent gets a task-specific execution packet (task plan + dependency carry-forward + completion contract) and is responsible for its own implementation, verification, task summary, and completion tool calls. The parent batch agent orchestrates, verifies, and records failures only when a dispatched task failed before it could leave its own summary behind.
 
 ## Task Dependency Graph
 

package/dist/resources/extensions/gsd/prompts/refine-slice.md

@@ -64,10 +64,10 @@ Then:
 2. {{skillActivation}} Record the installed skills you expect executors to use in each task plan's `skills_used` frontmatter.
 3. Define slice-level verification: the objective stopping condition. Plan real test files with real assertions; for simple slices, executable commands are fine.
 4. For non-trivial slices, plan observability / proof level / integration closure, threat surface, and requirement impact. Omit entirely for simple slices.
-5. Decompose the slice into tasks that fit one context window each. Every task must have Why / Files / Do / Verify / Done-when, plus a task plan with description, steps, must-haves, verification, inputs (backtick-wrapped paths), and expected output (backtick-wrapped paths).
+5. Decompose the slice into tasks that fit one context window each. Every task passed to `gsd_plan_slice` must use the exact keys `taskId`, `title`, `description`, `estimate`, `files`, `verify`, `inputs`, `expectedOutput`, and optional `observabilityImpact`. Put Why / Do / Done-when detail in `description`. `files`, `inputs`, and `expectedOutput` must be JSON arrays of strings, even for one path (for example, `"expectedOutput": ["src/index.ts"]`, never `"expectedOutput": "src/index.ts"`).
 6. **Persist planning state through `gsd_plan_slice`.** Call it with the full payload. The tool writes to the DB and renders `{{outputPath}}` and `{{slicePath}}/tasks/T##-PLAN.md` automatically. Do NOT rely on direct `PLAN.md` writes.
 7. **Self-audit the plan.** If every task were completed exactly as written, the slice goal/demo should be true. Every must-have maps to a task. Inputs and Expected Output are backtick-wrapped file paths.
-8. If refinement produced structural decisions that diverge from the sketch, append them to `.gsd/DECISIONS.md`.
+8. If refinement produced structural decisions that diverge from the sketch, call `gsd_decision_save` for each; the tool persists the decision and regenerates `.gsd/DECISIONS.md`.
 9. {{commitInstruction}}
 
 The slice directory and tasks/ subdirectory already exist. Do NOT mkdir.

package/dist/resources/extensions/gsd/prompts/rewrite-docs.md

@@ -23,7 +23,7 @@ An override was issued by the user that changes a fundamental decision or approa
    - For DECISIONS.md: append a new decision entry documenting the override and why. Do NOT delete prior decisions — mark them as superseded with a note.
    - For slice plans (S##-PLAN.md): update Goal, Demo, and Verification sections if affected. Update Files Likely Touched if the override changes scope. Do NOT modify completed task entries.
    - For REQUIREMENTS.md: update requirement descriptions if the override changes what "done" means, but do not remove requirements.
-   - For PROJECT.md: update if the override changes project-level facts.
+   - For PROJECT.md: do not edit the projection directly. If the override changes project-level facts, persist the revised Project content through `gsd_summary_save` with `artifact_type: "PROJECT"` so the DB remains authoritative.
    - Milestone context files are reference only — do not modify them.
 4. Mark all active overrides as resolved: change `**Scope:** active` to `**Scope:** resolved` in `{{overridesPath}}`
 5. Do not commit manually — the system auto-commits your changes after this unit completes.

package/dist/resources/extensions/gsd/queue-reorder-ui.js

@@ -24,6 +24,7 @@ export async function showQueueReorder(ctx, completed, pending) {
         const items = [...pending];
         let cursor = 0;
         let grabbed = false;
+        let scrollOffset = 0;
         let cachedLines;
         let validation;
         // Mutable deps map — tracks removals during this session
@@ -128,9 +129,11 @@ export async function showQueueReorder(ctx, completed, pending) {
                 return cachedLines;
             const ui = makeUI(theme, width);
             const lines = [];
+            const queueRows = [];
             const push = (...rows) => { for (const r of rows)
                 lines.push(...r); };
             const add = (s) => truncateToWidth(s, width);
+            let cursorQueueRow = 0;
             const headerText = grabbed ? "  Queue Reorder — Moving Item" : "  Queue Reorder";
             push(ui.bar(), ui.blank(), ui.header(headerText), ui.blank());
             // Completed milestones (dimmed)
@@ -153,13 +156,15 @@ export async function showQueueReorder(ctx, completed, pending) {
                 const num = i + 1;
                 const label = item.title && item.title !== item.id ? `${item.id}  ${item.title}` : item.id;
                 if (isCursor && grabbed) {
-                    lines.push(add(`  ${theme.fg("warning", `▸▸ ${num}. ${label}`)}`));
+                    cursorQueueRow = queueRows.length;
+                    queueRows.push(add(`  ${theme.fg("warning", `▸▸ ${num}. ${label}`)}`));
                 }
                 else if (isCursor) {
-                    lines.push(add(`  ${theme.fg("accent", `${GLYPH.cursor} ${num}. ${label}`)}`));
+                    cursorQueueRow = queueRows.length;
+                    queueRows.push(add(`  ${theme.fg("accent", `${GLYPH.cursor} ${num}. ${label}`)}`));
                 }
                 else {
-                    lines.push(add(`    ${theme.fg("text", `${num}. ${label}`)}`));
+                    queueRows.push(add(`    ${theme.fg("text", `${num}. ${label}`)}`));
                 }
                 // depends_on annotations
                 const deps = liveDeps.get(item.id) ?? [];
@@ -168,34 +173,35 @@ export async function showQueueReorder(ctx, completed, pending) {
                         continue;
                     const pairKey = `${item.id}:${dep}`;
                     if (violatedPairs.has(pairKey)) {
-                        lines.push(add(`       ${theme.fg("warning", `${GLYPH.statusWarning} depends_on: ${dep} — auto-removed on confirm`)}`));
+                        queueRows.push(add(`       ${theme.fg("warning", `${GLYPH.statusWarning} depends_on: ${dep} — auto-removed on confirm`)}`));
                     }
                     else if (redundantPairs.has(pairKey)) {
-                        lines.push(add(`       ${theme.fg("dim", `↳ depends_on: ${dep} (redundant)`)}`));
+                        queueRows.push(add(`       ${theme.fg("dim", `↳ depends_on: ${dep} (redundant)`)}`));
                     }
                     else {
-                        lines.push(add(`       ${theme.fg("dim", `↳ depends_on: ${dep}`)}`));
+                        queueRows.push(add(`       ${theme.fg("dim", `↳ depends_on: ${dep}`)}`));
                     }
                 }
                 // Missing deps
                 for (const v of validation.violations.filter(v => v.milestone === item.id && v.type === 'missing_dep')) {
-                    lines.push(add(`       ${theme.fg("error", `${GLYPH.statusWarning} depends_on: ${v.dependsOn} (does not exist)`)}`));
+                    queueRows.push(add(`       ${theme.fg("error", `${GLYPH.statusWarning} depends_on: ${v.dependsOn} (does not exist)`)}`));
                 }
             }
             // Removed deps feedback
+            const trailingLines = [];
             if (removedDeps.length > 0) {
-                push(ui.blank());
+                trailingLines.push(...ui.blank());
                 for (const r of removedDeps) {
-                    lines.push(add(`  ${theme.fg("success", `${GLYPH.statusDone} Removed: ${r.milestone} depends_on ${r.dep}`)}`));
+                    trailingLines.push(add(`  ${theme.fg("success", `${GLYPH.statusDone} Removed: ${r.milestone} depends_on ${r.dep}`)}`));
                 }
             }
             // Circular warning
             const circ = validation.violations.find(v => v.type === 'circular');
             if (circ) {
-                push(ui.blank());
-                lines.push(add(`  ${theme.fg("error", `${GLYPH.statusWarning} ${circ.message}`)}`));
+                trailingLines.push(...ui.blank());
+                trailingLines.push(add(`  ${theme.fg("error", `${GLYPH.statusWarning} ${circ.message}`)}`));
             }
-            push(ui.blank());
+            trailingLines.push(...ui.blank());
             // Hints — context-sensitive based on grab state
             const hints = [];
             if (grabbed) {
@@ -215,7 +221,18 @@ export async function showQueueReorder(ctx, completed, pending) {
                 hints.push("enter ok");
             }
             hints.push("esc");
-            push(ui.hints(hints), ui.bar());
+            trailingLines.push(...ui.hints(hints), ...ui.bar());
+            const maxOverlayRows = Math.max(10, process.stdout.rows ? Math.floor(process.stdout.rows * 0.8) : 24);
+            const availableQueueRows = Math.max(1, maxOverlayRows - lines.length - trailingLines.length);
+            const maxScroll = Math.max(0, queueRows.length - availableQueueRows);
+            if (cursorQueueRow < scrollOffset) {
+                scrollOffset = cursorQueueRow;
+            }
+            else if (cursorQueueRow >= scrollOffset + availableQueueRows) {
+                scrollOffset = cursorQueueRow - availableQueueRows + 1;
+            }
+            scrollOffset = Math.min(Math.max(scrollOffset, 0), maxScroll);
+            lines.push(...queueRows.slice(scrollOffset, scrollOffset + availableQueueRows), ...trailingLines);
             cachedLines = lines;
             return lines;
         }

package/dist/resources/extensions/gsd/repo-identity.js

@@ -405,19 +405,32 @@ function hasProjectState(externalPath) {
  * Returns the resolved external path (may differ from the computed identity).
  */
 function resolveExternalPathWithRecovery(projectPath) {
-    const computedPath = externalGsdRoot(projectPath);
+    const base = process.env.GSD_STATE_DIR || gsdHome();
     const computedId = repoIdentity(projectPath);
+    const computedPath = join(base, "projects", computedId);
+    const computedHasState = hasProjectState(computedPath);
+    const markerId = readGsdIdMarker(projectPath);
+    const markerPath = markerId ? join(base, "projects", markerId) : null;
+    const markerHasState = markerPath ? hasProjectState(markerPath) : false;
+    // Split-brain guard: when marker and computed identities disagree and both
+    // directories contain state, prefer the marker-backed directory. This keeps
+    // all writers anchored to a single canonical project identity even if a
+    // transient identity computation produced a stale computed hash.
+    if (markerId
+        && markerPath
+        && markerId !== computedId
+        && markerHasState
+        && computedHasState) {
+        return { path: markerPath, identity: markerId };
+    }
     // Check if computed path already has state — fast path, no recovery needed.
-    if (hasProjectState(computedPath)) {
-        return computedPath;
+    if (computedHasState) {
+        return { path: computedPath, identity: computedId };
     }
     // Check for .gsd-id marker from a previous location.
-    const markerId = readGsdIdMarker(projectPath);
-    if (markerId && markerId !== computedId) {
+    if (markerId && markerPath && markerId !== computedId) {
         // The marker points to a different identity — the repo was likely moved.
-        const base = process.env.GSD_STATE_DIR || gsdHome();
-        const markerPath = join(base, "projects", markerId);
-        if (hasProjectState(markerPath)) {
+        if (markerHasState) {
             // Recover: use the old state directory and update the marker to the new identity.
             // Move the state from the old hash dir to the new one so future lookups work
             // without the marker.
@@ -446,11 +459,11 @@ function resolveExternalPathWithRecovery(projectPath) {
             }
             catch {
                 // If migration fails, just point at the old directory.
-                return markerPath;
+                return { path: markerPath, identity: markerId };
             }
         }
     }
-    return computedPath;
+    return { path: computedPath, identity: computedId };
 }
 // ─── Symlink Management ─────────────────────────────────────────────────────
 /**
@@ -467,17 +480,18 @@ function resolveExternalPathWithRecovery(projectPath) {
  * Returns the resolved external path.
  */
 export function ensureGsdSymlink(projectPath) {
-    const result = ensureGsdSymlinkCore(projectPath);
+    const { path: result, identity } = ensureGsdSymlinkCore(projectPath);
     // Write .gsd-id marker so future relocations can recover this state (#2750).
     // Only write for the project root (not subdirectories or worktrees that
     // delegate to a parent .gsd).
     if (!isInsideWorktree(projectPath)) {
-        writeGsdIdMarker(projectPath, repoIdentity(projectPath));
+        writeGsdIdMarker(projectPath, identity);
     }
     return result;
 }
 function ensureGsdSymlinkCore(projectPath) {
-    const externalPath = resolveExternalPathWithRecovery(projectPath);
+    const resolved = resolveExternalPathWithRecovery(projectPath);
+    const externalPath = resolved.path;
     const localGsd = join(projectPath, ".gsd");
     const inWorktree = isInsideWorktree(projectPath);
     // Guard: Never create a symlink at ~/.gsd — that's the user-level GSD home,
@@ -498,7 +512,7 @@ function ensureGsdSymlinkCore(projectPath) {
     const localGsdNormalized = normalizeForGuard(localGsd);
     const gsdHomeNorm = normalizeForGuard(gsdHome());
     if (localGsdNormalized === gsdHomeNorm) {
-        return localGsd;
+        return { path: localGsd, identity: resolved.identity };
     }
     // Guard: If projectPath is a plain subdirectory (not a worktree) of a git
     // repo that already has a .gsd at the git root, do not create a duplicate
@@ -516,7 +530,10 @@ function ensureGsdSymlinkCore(projectPath) {
                     try {
                         const rootStat = lstatSync(rootGsd);
                         if (rootStat.isSymbolicLink() || rootStat.isDirectory()) {
-                            return rootStat.isSymbolicLink() ? realpathSync(rootGsd) : rootGsd;
+                            return {
+                                path: rootStat.isSymbolicLink() ? realpathSync(rootGsd) : rootGsd,
+                                identity: resolved.identity,
+                            };
                         }
                     }
                     catch {
@@ -544,7 +561,7 @@ function ensureGsdSymlinkCore(projectPath) {
         }
         catch { /* already gone */ }
         symlinkSync(externalPath, localGsd, "junction");
-        return externalPath;
+        return resolved;
     };
     // Check for dangling symlinks (e.g. after relocation recovery removed the old
     // state dir). existsSync follows symlinks, so it returns false for dangling ones.
@@ -567,7 +584,7 @@ function ensureGsdSymlinkCore(projectPath) {
         }
         catch { /* nothing to remove */ }
         symlinkSync(externalPath, localGsd, "junction");
-        return externalPath;
+        return resolved;
     }
     try {
         const stat = lstatSync(localGsd);
@@ -575,7 +592,7 @@ function ensureGsdSymlinkCore(projectPath) {
             // Already a symlink — verify it points to the right place
             const target = realpathSync(localGsd);
             if (target === externalPath) {
-                return externalPath; // correct symlink, no-op
+                return resolved; // correct symlink, no-op
             }
             // In a worktree, mismatched symlinks are always stale. Heal them so
             // the worktree points at the same external state dir as the main repo.
@@ -610,24 +627,24 @@ function ensureGsdSymlinkCore(projectPath) {
                 }
                 catch {
                     // Migration failed — preserve old symlink
-                    return target;
+                    return { path: target, identity: resolved.identity };
                 }
             }
             // Outside worktrees, preserve custom overrides or legacy symlinks.
-            return target;
+            return { path: target, identity: resolved.identity };
         }
         if (stat.isDirectory()) {
             // Real directory in the main repo — migration will handle this later.
             // In worktrees, keep the directory in place and let syncGsdStateToWorktree
             // refresh its contents. Replacing a git-tracked .gsd directory with a
             // symlink makes git think tracked planning files were deleted.
-            return localGsd;
+            return { path: localGsd, identity: resolved.identity };
         }
     }
     catch {
         // lstat failed — path exists but we can't stat it
     }
-    return localGsd;
+    return { path: localGsd, identity: resolved.identity };
 }
 // ─── Worktree Detection ─────────────────────────────────────────────────────
 /**

package/dist/resources/extensions/gsd/repository-registry.js

@@ -0,0 +1,44 @@
+// GSD-2 + Repository registry seam for parent workspace multi-repo resolution.
+import { isAbsolute, relative, resolve } from "node:path";
+import { resolveGsdPathContract } from "./paths.js";
+function assertInsideProjectRoot(projectRoot, candidateRoot, repoId) {
+    const rel = relative(projectRoot, candidateRoot);
+    if (rel === "")
+        return;
+    if (rel.startsWith("..") || isAbsolute(rel)) {
+        throw new Error(`workspace.repositories.${repoId}.path resolves outside project root: ${candidateRoot}`);
+    }
+}
+function resolveRepositoryRoot(projectRoot, repoId, repo) {
+    const root = resolve(projectRoot, repo.path);
+    assertInsideProjectRoot(projectRoot, root, repoId);
+    return {
+        id: repoId,
+        root,
+        role: repo.role,
+        verification: repo.verification,
+        commitPolicy: repo.commit_policy,
+    };
+}
+export function createRepositoryRegistry(basePath, workspacePrefs) {
+    const contract = resolveGsdPathContract(basePath);
+    const projectRoot = contract.projectRoot;
+    const mode = workspacePrefs?.mode ?? "project";
+    const repoMap = new Map();
+    // Backward-compatible default for single-repo projects.
+    // Explicit workspacePrefs?.repositories entries can override "project"
+    // via resolveRepositoryRoot to customize role/verification/commit policy.
+    repoMap.set("project", { id: "project", root: projectRoot });
+    for (const [repoId, repoConfig] of Object.entries(workspacePrefs?.repositories ?? {})) {
+        repoMap.set(repoId, resolveRepositoryRoot(projectRoot, repoId, repoConfig));
+    }
+    return {
+        projectRoot,
+        mode,
+        repositories: Array.from(repoMap.values()),
+        byId: repoMap,
+    };
+}
+export function createRepositoryRegistryFromPreferences(basePath, preferences) {
+    return createRepositoryRegistry(basePath, preferences?.workspace);
+}

package/dist/resources/extensions/gsd/safety/evidence-collector.js

@@ -17,6 +17,8 @@ import { randomBytes } from "node:crypto";
 const EXECUTION_TOOL_NAMES = new Set([
     "bash",
     "Bash",
+    "PowerShell",
+    "async_bash",
     "gsd_exec",
     "gsd_exec_search",
     "mcp__gsd-workflow__gsd_exec",

package/dist/resources/extensions/gsd/safety/evidence-cross-ref.js

@@ -15,7 +15,7 @@
 export function crossReferenceEvidence(claimedEvidence, actualEvidence) {
     const bashCalls = actualEvidence.filter((e) => e.kind === "bash");
     const mismatches = [];
-    for (const claimed of claimedEvidence) {
+    for (const claimed of latestClaimBatch(claimedEvidence)) {
         // Skip coerced entries — they're already flagged with exitCode: -1
         // and verdict: "unknown (coerced from string)" by db-tools.ts
         if (claimed.verdict?.includes("coerced from string"))
@@ -25,9 +25,11 @@ export function crossReferenceEvidence(claimedEvidence, actualEvidence) {
         // Skip entries with empty or generic commands
         if (!claimed.command || claimed.command.length < 3)
             continue;
-        // Find matching bash call by command substring match
-        const match = findBestMatch(claimed.command, bashCalls);
-        if (!match) {
+        // Find matching bash calls by command similarity. A command may be retried
+        // after a failed first run; the newest matching execution is the one that
+        // supports or rejects a claimed pass.
+        const matches = findMatches(claimed.command, bashCalls);
+        if (matches.length === 0) {
             mismatches.push({
                 severity: "warning",
                 claimed,
@@ -37,6 +39,7 @@ export function crossReferenceEvidence(claimedEvidence, actualEvidence) {
             continue;
         }
         // Exit code mismatch: LLM claims success but actual command failed
+        const match = latestMatch(matches);
         if (claimed.exitCode === 0 && match.exitCode !== 0) {
             mismatches.push({
                 severity: "error",
@@ -50,34 +53,55 @@ export function crossReferenceEvidence(claimedEvidence, actualEvidence) {
 }
 // ─── Internals ──────────────────────────────────────────────────────────────
 /**
- * Find the best matching bash evidence entry for a claimed command.
+ * Verification evidence rows are append-only across retries, but a task
+ * completion inserts one batch at a single created_at timestamp. When that
+ * timestamp is present, safety should judge the newest completion claim only.
+ */
+function latestClaimBatch(claimedEvidence) {
+    const dated = claimedEvidence
+        .map((claim) => ({
+        claim,
+        time: typeof claim.createdAt === "string" ? Date.parse(claim.createdAt) : Number.NaN,
+    }))
+        .filter((entry) => Number.isFinite(entry.time));
+    if (dated.length === 0)
+        return claimedEvidence;
+    const latestTime = Math.max(...dated.map((entry) => entry.time));
+    return claimedEvidence.filter((claim) => (typeof claim.createdAt === "string" && Date.parse(claim.createdAt) === latestTime));
+}
+/**
+ * Find bash evidence entries matching a claimed command.
  * Uses substring matching — the claimed command may be a shortened version
  * of the actual command, or vice versa.
  */
-function findBestMatch(claimedCommand, bashCalls) {
+function findMatches(claimedCommand, bashCalls) {
     const normalized = claimedCommand.trim();
-    // Exact match first
-    const exact = bashCalls.find(b => b.command.trim() === normalized);
-    if (exact)
+    // Exact matches first
+    const exact = bashCalls.filter(b => b.command.trim() === normalized);
+    if (exact.length > 0)
         return exact;
     // Substring match: claimed is contained in actual or actual in claimed
-    const substring = bashCalls.find(b => b.command.includes(normalized) || normalized.includes(b.command));
-    if (substring)
+    const substring = bashCalls.filter(b => b.command.includes(normalized) || normalized.includes(b.command));
+    if (substring.length > 0)
         return substring;
     // Token match: split on whitespace and check significant overlap
     const claimedTokens = normalized.split(/\s+/).filter(t => t.length > 2);
     if (claimedTokens.length === 0)
-        return null;
-    let bestMatch = null;
-    let bestScore = 0;
+        return [];
+    const scoredMatches = [];
     for (const call of bashCalls) {
         const callTokens = new Set(call.command.split(/\s+/));
         const matchCount = claimedTokens.filter(t => callTokens.has(t)).length;
         const score = matchCount / claimedTokens.length;
-        if (score > bestScore && score >= 0.5) {
-            bestScore = score;
-            bestMatch = call;
+        if (score >= 0.5) {
+            scoredMatches.push({ call, score });
         }
     }
-    return bestMatch;
+    const bestScore = Math.max(0, ...scoredMatches.map((match) => match.score));
+    return scoredMatches
+        .filter((match) => match.score === bestScore)
+        .map((match) => match.call);
+}
+function latestMatch(matches) {
+    return matches.reduce((latest, match) => (match.timestamp > latest.timestamp ? match : latest));
 }

package/dist/resources/extensions/gsd/session-lock.js

@@ -18,8 +18,9 @@
 import { createRequire } from "node:module";
 import { existsSync, readFileSync, readdirSync, mkdirSync, unlinkSync, rmSync, statSync } from "node:fs";
 import { join, dirname } from "node:path";
-import { gsdRoot } from "./paths.js";
+import { gsdRoot, normalizeRealPath } from "./paths.js";
 import { atomicWriteSync } from "./atomic-write.js";
+import { markWorkerStoppingByPid } from "./db/auto-workers.js";
 const _require = createRequire(import.meta.url);
 // ─── Module State ───────────────────────────────────────────────────────────
 /** Release function from proper-lockfile — calling it releases the OS lock. */
@@ -225,6 +226,12 @@ export function acquireSessionLock(basePath) {
     mkdirSync(dirname(lp), { recursive: true });
     // Clean up numbered lock file variants from cloud sync conflicts (#1315)
     cleanupStrayLockFiles(basePath);
+    // If lock metadata points to a dead PID, mark that worker row stopping so
+    // crash diagnostics do not keep surfacing it as active.
+    const existingPreflight = readExistingLockData(lp);
+    if (existingPreflight?.pid && !isPidAlive(existingPreflight.pid)) {
+        markWorkerStoppingByPid(normalizeRealPath(basePath), existingPreflight.pid);
+    }
     // Write our lock data first (the content is informational; the OS lock is the real guard)
     const lockData = {
         pid: process.pid,
@@ -250,7 +257,10 @@ export function acquireSessionLock(basePath) {
     const lockDir = lockTarget + ".lock";
     if (existsSync(lockDir)) {
         const existingData = readExistingLockData(lp);
-        const isOrphan = !existingData || (existingData.pid && !isPidAlive(existingData.pid));
+        const deadPid = existingData?.pid && !isPidAlive(existingData.pid) ? existingData.pid : null;
+        if (deadPid)
+            markWorkerStoppingByPid(normalizeRealPath(basePath), deadPid);
+        const isOrphan = !existingData || !!deadPid;
         if (isOrphan) {
             try {
                 rmSync(lockDir, { recursive: true, force: true });
@@ -288,6 +298,9 @@ export function acquireSessionLock(basePath) {
         // Check: if auto.lock is gone and no process is alive, the lock dir is stale.
         const existingData = readExistingLockData(lp);
         const existingPid = existingData?.pid;
+        if (existingPid && !isPidAlive(existingPid)) {
+            markWorkerStoppingByPid(normalizeRealPath(basePath), existingPid);
+        }
         // If no lock file or no alive process, try to clean up and re-acquire (#1245)
         if (!existingData || (existingPid && !isPidAlive(existingPid))) {
             try {