refactor: hard-fork GSD -> MSD (Make Software Done)

Mechanical rename produced by scripts/msd-rename.cjs: gsd/Gsd/GSD -> msd/Msd/MSD
across contents and paths, upstream package/repo coordinates -> @golem15/msd-core
and golem15com/msd-core. Deep links into upstream history, sibling upstream
packages, the GSD-2 import feature, CHANGELOG.md and .changeset/ are kept as-is.

Hand edits on top: MSD block-letter banner and logos, LICENSE copyright line,
package/plugin identity, regenerated lockfile, install-tree fixtures, derived
registries and benchmark baseline; migration checksum baseline re-locked
(MSD keeps its own install state, so no install had applied the old sums);
sort-order and regex-escaped expectations in tests adjusted.

scripts/lib/alias-drift-families.cjs

@@ -14,7 +14,7 @@
 
 /**
  * Alias families the drift check validates. `router` is the module basename,
- * shared by the `src/<router>.cts` source and the `gsd-core/bin/lib/<router>.cjs`
+ * shared by the `src/<router>.cts` source and the `msd-core/bin/lib/<router>.cjs`
  * artifact it compiles to.
  */
 const FAMILIES = Object.freeze([
@@ -34,7 +34,7 @@ const ALIAS_TABLE = 'command-aliases';
 /**
  * Repo-relative TRACKED sources whose edit should re-run the drift check.
  *
- * Deliberately the `src/*.cts` sources, never the `gsd-core/bin/lib/*.cjs`
+ * Deliberately the `src/*.cts` sources, never the `msd-core/bin/lib/*.cjs`
  * build outputs they compile to: those are gitignored, so
  * `git diff --cached --name-only` can never list them and a pre-commit guard
  * keyed on them can never fire (#2725).

scripts/lib/cli-exit.cjs

@@ -5,7 +5,7 @@
 //
 // Why this copy exists: scripts/ runs straight from the repo checkout and must
 // work on an unbuilt clone — 64+ scripts require this file, including
-// check-env.cjs, which runs before any build. gsd-core/bin/lib/cli-exit.cjs is
+// check-env.cjs, which runs before any build. msd-core/bin/lib/cli-exit.cjs is
 // gitignored tsc output and doubles as the build sentinel, so it cannot be
 // required from here. Hence one source, two emitted locations.
 
@@ -18,7 +18,7 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
  * json-error-mode and contract-version cells.
  *
  * Must import nothing but `node:fs` and `./exit-code-registry.cjs` — this
- * source is emitted to TWO locations, gsd-core/bin/lib/cli-exit.cjs (tsc
+ * source is emitted to TWO locations, msd-core/bin/lib/cli-exit.cjs (tsc
  * build output) and scripts/lib/cli-exit.cjs (a generated, committed
  * artifact regenerated by scripts/gen-scripts-cli-exit.cjs), and the latter
  * must load on an unbuilt clone before anything under ./lib exists. The
@@ -48,19 +48,19 @@ const exitCodeFor = (name) => exitCodeRegistryModule.exitCodeFor(name);
 const EXIT_ENVELOPE_REASON = 'sdk_fail_fast';
 /**
  * Process-level flag: when true, error paths emit structured JSON to stderr
- * instead of plain text. Set by gsd-tools.cjs when the CLI is invoked with
+ * instead of plain text. Set by msd-tools.cjs when the CLI is invoked with
  * `--json-errors`; re-exported by io.cts, which is where most callers reach it.
  *
  * Held in a Symbol-keyed cell on globalThis rather than in module scope, and
  * that is load-bearing: this module is emitted to TWO locations
- * (gsd-core/bin/lib/cli-exit.cjs and the generated scripts/lib/cli-exit.cjs),
+ * (msd-core/bin/lib/cli-exit.cjs and the generated scripts/lib/cli-exit.cjs),
  * so a process that loads both would get two independent module instances. A
  * module-level `let` would give them two independent flags — one copy could
  * think json mode is on while the other thought it was off, which is exactly
  * the divergence class ADR-3889 exists to remove. One cell, keyed by a
  * registry Symbol, makes that unrepresentable.
  */
-const JSON_ERROR_MODE_KEY = Symbol.for('gsd.exit.jsonErrorMode');
+const JSON_ERROR_MODE_KEY = Symbol.for('msd.exit.jsonErrorMode');
 function setJsonErrorMode(v) {
     globalThis[JSON_ERROR_MODE_KEY] = !!v;
 }
@@ -80,7 +80,7 @@ const HOOK_DENY_CODE = exitCodeFor(HOOK_DENY_NAME);
  * `resolveContractVersion` is the only writer; `terminateNow`/`runMain`
  * read it internally when projecting a declared outcome.
  */
-const CONTRACT_VERSION_KEY = Symbol.for('gsd.exit.contractVersion');
+const CONTRACT_VERSION_KEY = Symbol.for('msd.exit.contractVersion');
 function setContractVersion(v) {
     globalThis[CONTRACT_VERSION_KEY] = v;
 }
@@ -88,12 +88,12 @@ function setContractVersion(v) {
  * Resolve the active exit-contract version, wiring the ambient process to the
  * two terminators (ADR-3889 §4/§3). Mirrors how JSON_ERROR_MODE_KEY already
  * works: a process-global cell means no entrypoint needs per-call wiring, so
- * a `scripts/` tool or a hook gets the same behaviour as `gsd-tools` without
- * this module touching either (P8 owns `gsd-tools`; P7 owns hooks).
+ * a `scripts/` tool or a hook gets the same behaviour as `msd-tools` without
+ * this module touching either (P8 owns `msd-tools`; P7 owns hooks).
  *
  * Precedence: if the cell already holds an explicit version, that wins —
  * this is what lets `setContractVersion` override the ambient process (a
- * later `GSD_EXIT_CONTRACT=v2` in the same process must NOT unseat an
+ * later `MSD_EXIT_CONTRACT=v2` in the same process must NOT unseat an
  * explicit `setContractVersion('v1')` call). Otherwise resolve from argv/env
  * via `resolveContractVersion`, which itself persists the result into the
  * cell — so this is a one-time resolution per process; every later read is
@@ -176,7 +176,7 @@ function projectOutcome(outcome, version) {
  * `main()` returning void would inherit a stale DEGRADED from an unrelated,
  * earlier call — this is the leak #3912 review found and fixed.
  */
-const PENDING_OUTCOME_KEY = Symbol.for('gsd.exit.pendingOutcome');
+const PENDING_OUTCOME_KEY = Symbol.for('msd.exit.pendingOutcome');
 function setPendingOutcome(v) {
     globalThis[PENDING_OUTCOME_KEY] = v;
 }
@@ -200,10 +200,10 @@ function findExitContractFlag(argv) {
  * against it without re-parsing argv/env itself.
  *
  * Precedence: an explicit `--exit-contract=<v>` flag BEATS
- * `GSD_EXIT_CONTRACT`, in both directions (flag=v1 + env=v2 -> v1; flag=v2 +
+ * `MSD_EXIT_CONTRACT`, in both directions (flag=v1 + env=v2 -> v1; flag=v2 +
  * env=v1 -> v2). Neither present -> 'v1' (the documented default). An empty
  * env var reads as UNSET, not as an explicit empty selection — a shell that
- * exports `GSD_EXIT_CONTRACT=` with nothing after the `=` must not silently
+ * exports `MSD_EXIT_CONTRACT=` with nothing after the `=` must not silently
  * select a version.
  *
  * Casing is decided, not accidental: only the exact lowercase tokens `v1`/
@@ -218,7 +218,7 @@ function resolveContractVersion(opts = {}) {
     const argv = opts.argv ?? process.argv;
     const env = opts.env ?? process.env;
     const flagValue = findExitContractFlag(argv);
-    const rawEnvValue = env.GSD_EXIT_CONTRACT;
+    const rawEnvValue = env.MSD_EXIT_CONTRACT;
     const envValue = rawEnvValue === undefined || rawEnvValue === '' ? undefined : rawEnvValue;
     const selected = flagValue !== undefined ? flagValue : envValue;
     let resolved;
@@ -404,7 +404,7 @@ function runMain(main) {
  *   fd 2 gets the SAME serialized `payload` fd 1 got — unchanged behavior.
  *   When provided, fd 2 gets THIS instead: a string is written raw
  *   (verbatim, not JSON-stringified), anything else is JSON-stringified
- *   like `payload`. This exists because `hooks/gsd-write-guard.js`'s
+ *   like `payload`. This exists because `hooks/msd-write-guard.js`'s
  *   emitBlock does NOT write the same bytes to both streams today — it
  *   writes the full JSON `output` to stdout but only the plain-text
  *   `output.reason` STRING to stderr, because Kimi's native hook bus reads
@@ -454,7 +454,7 @@ function terminateNow(outcome, payload, stderrPayload) {
             throw new Error(`terminateNow: exit code ${HOOK_DENY_CODE} is reserved to the ${HOOK_DENY_NAME} outcome; `
                 + `got outcome ${JSON.stringify(outcome)}`);
         }
-        // m2 (round 5, hooks/gsd-write-guard.js:159-175): emission must itself be
+        // m2 (round 5, hooks/msd-write-guard.js:159-175): emission must itself be
         // exception-safe. A failed write (EPIPE, a full pipe buffer, a throwing
         // fs.writeSync in a test) must NOT change the exit code — if it propagated
         // out of this function, a caller whose payload could not be delivered
@@ -519,7 +519,7 @@ function terminateNow(outcome, payload, stderrPayload) {
         process.exit(projected);
     }
     catch (err) {
-        // Anything above threw: an unrecognized --exit-contract/GSD_EXIT_CONTRACT
+        // Anything above threw: an unrecognized --exit-contract/MSD_EXIT_CONTRACT
         // value, a non-string/empty/unregistered `outcome`, or the HOOK_DENY
         // collision guard. Diagnose on stderr — swallowing this silently would
         // make a typo'd outcome name or a bad contract-version env var

scripts/lib/drift-scan.cjs

@@ -10,7 +10,7 @@
  * root-confinement / literal-tokenizer / sanitizer implementation instead of
  * each copying it verbatim — the exact generative-fix-divergence class this
  * epic exists to remove, now applied to the guards themselves (see
- * `.gsd/phase/refactor-3184-milestone-window-single-owner/40-design.md`,
+ * `.msd/phase/refactor-3184-milestone-window-single-owner/40-design.md`,
  * "Rejected: let the new drift guard copy Phase 1's tree-walk /
  * root-confinement / sanitizer").
  *

scripts/lib/exit-code-registry.cjs

@@ -1,9 +1,9 @@
 'use strict';
 
 // GENERATED FILE — DO NOT EDIT BY HAND.
-// Source of truth: gsd-core/bin/shared/exit-codes.json. Regenerate with:
+// Source of truth: msd-core/bin/shared/exit-codes.json. Regenerate with:
 //   node scripts/gen-exit-code-registry.cjs --write
-// This exact content is emitted to THREE locations — gsd-core/bin/lib/exit-code-registry.cjs,
+// This exact content is emitted to THREE locations — msd-core/bin/lib/exit-code-registry.cjs,
 // scripts/lib/exit-code-registry.cjs, and hooks/lib/exit-code-registry.js (the latter two
 // committed so scripts/ and hooks/ consumers work on an unbuilt clone) — all byte-compared by
 // `npm run lint:generated-sync` (#3905 ADR-3889 Phase 1; #3906 Phase 2 added the second copy;
@@ -52,7 +52,7 @@ const EXIT_CODES = Object.freeze([
     code: 80,
     name: "DEGRADED",
     meaning: "Ran to completion and is reporting a condition through its result payload rather than as a process failure",
-    owner: "gsd-tools",
+    owner: "msd-tools",
     authorizedBy: "ADR-3889 + ADR-2980",
   })
 ]);

scripts/lib/macos-conformance-tier.generated.cjs

@@ -81,13 +81,6 @@ module.exports = {
   "tests/git-base-branch.test.cjs",
   "tests/graphify-query.test.cjs",
   "tests/graphify-visualization.test.cjs",
-  "tests/gsd-secret-read-guard.test.cjs",
-  "tests/gsd-settings-advanced.test.cjs",
-  "tests/gsd-statusline.test.cjs",
-  "tests/gsd-tools-path-refs.test.cjs",
-  "tests/gsd-validate-commit-crash-policy.test.cjs",
-  "tests/gsd-validate-commit-sigpipe.test.cjs",
-  "tests/gsd-write-guard.test.cjs",
   "tests/health-diagnostic-rules/worktree-health.test.cjs",
   "tests/health-diagnostic.test.cjs",
   "tests/helpers-cleanup.test.cjs",
@@ -107,7 +100,7 @@ module.exports = {
   "tests/installer-migration-config-root-marker.test.cjs",
   "tests/installer-migration-pi-retire-hooks-dir.test.cjs",
   "tests/installer-migration-prune-stale-pristine.test.cjs",
-  "tests/installer-migration-rename-gsd-core.test.cjs",
+  "tests/installer-migration-rename-msd-core.test.cjs",
   "tests/installer-migrations.test.cjs",
   "tests/intel.test.cjs",
   "tests/inventory-nested-families.test.cjs",
@@ -124,6 +117,13 @@ module.exports = {
   "tests/milestone-window-single-owner.test.cjs",
   "tests/model-catalog.unit.test.cjs",
   "tests/model-resolver.test.cjs",
+  "tests/msd-secret-read-guard.test.cjs",
+  "tests/msd-settings-advanced.test.cjs",
+  "tests/msd-statusline.test.cjs",
+  "tests/msd-tools-path-refs.test.cjs",
+  "tests/msd-validate-commit-crash-policy.test.cjs",
+  "tests/msd-validate-commit-sigpipe.test.cjs",
+  "tests/msd-write-guard.test.cjs",
   "tests/no-exact-case-env-access.rule.test.cjs",
   "tests/no-pending-3212-markers.test.cjs",
   "tests/no-phantom-issue-refs.test.cjs",

scripts/lib/ndjson-reporter.cjs

@@ -9,7 +9,7 @@
 // per-chunk timeout kills the child. This reporter runs ALONGSIDE the normal
 // human reporter (a second `--test-reporter` on the same invocation, per
 // Node's documented multi-reporter pairing) and appends one JSON object per
-// line to a path supplied via the GSD_RUN_TESTS_EVENTS_FILE env var. On a
+// line to a path supplied via the MSD_RUN_TESTS_EVENTS_FILE env var. On a
 // timeout, run-tests.cjs reads that file back to name the file(s) still
 // in flight (a `test:dequeue` with no matching `test:pass`/`test:fail`).
 //
@@ -29,7 +29,7 @@
 // sink. Node still requires a `--test-reporter-destination` to pair with
 // this `--test-reporter` (see run-tests.cjs's reporterArgsFor), but that
 // destination is a throwaway sink that stays empty by design — the durable
-// path is GSD_RUN_TESTS_EVENTS_FILE, not the destination Node manages.
+// path is MSD_RUN_TESTS_EVENTS_FILE, not the destination Node manages.
 //
 // Contract targeted: Node's "Custom reporters" contract
 // (https://nodejs.org/api/test.html#custom-reporters) — a reporter module's
@@ -66,7 +66,7 @@
 // interleave a partial write with the kill) never leaves more than one
 // dangling unparsable trailing line.
 module.exports = async function ndjsonEventReporter(source) {
-  const eventsPath = process.env.GSD_RUN_TESTS_EVENTS_FILE;
+  const eventsPath = process.env.MSD_RUN_TESTS_EVENTS_FILE;
   // #3889: an init marker, written as this reporter's FIRST action — before
   // the `for await` loop even begins consuming the event stream — so the
   // events file's mere existence (and its exact contents) can distinguish

scripts/lib/npm-version-check-diagnosis.cjs

@@ -17,7 +17,7 @@
  * src/shell-command-projection.cts) computes it: `error.code ===
  * 'ETIMEDOUT'`, which Node's spawnSync guarantees when its own `timeout`
  * option fires. NOT imported directly here -- check-env.cjs deliberately
- * cannot depend on that seam's compiled output (gsd-core/bin/lib/*.cjs), a
+ * cannot depend on that seam's compiled output (msd-core/bin/lib/*.cjs), a
  * tsc build artifact that does not exist yet when check-env.cjs runs as its
  * own standalone pre-`npm ci` CI step (confirmed live: an earlier version
  * of this fix routed through execNpm directly and crashed every real CI

scripts/lib/platform-conformance-tier.generated.cjs

@@ -103,14 +103,6 @@ module.exports = {
   "tests/graphify-graph-path.test.cjs",
   "tests/graphify-visualization.test.cjs",
   "tests/graphify.test.cjs",
-  "tests/gsd-agent-isolation-guard.test.cjs",
-  "tests/gsd-check-update-worker-atomic-cache.test.cjs",
-  "tests/gsd-check-update-worker-platform-gate.test.cjs",
-  "tests/gsd-mcp-server-bin.test.cjs",
-  "tests/gsd-statusline.test.cjs",
-  "tests/gsd-validate-commit-crash-policy.test.cjs",
-  "tests/gsd-validate-commit-sigpipe.test.cjs",
-  "tests/gsd-write-guard.test.cjs",
   "tests/health-diagnostic-rules/config-validation.test.cjs",
   "tests/health-diagnostic-rules/worktree-health.test.cjs",
   "tests/health-diagnostic.test.cjs",
@@ -134,7 +126,7 @@ module.exports = {
   "tests/installer-migration-config-root-marker.test.cjs",
   "tests/installer-migration-pi-retire-hooks-dir.test.cjs",
   "tests/installer-migration-prune-stale-pristine.test.cjs",
-  "tests/installer-migration-rename-gsd-core.test.cjs",
+  "tests/installer-migration-rename-msd-core.test.cjs",
   "tests/installer-migrations.test.cjs",
   "tests/intel.test.cjs",
   "tests/inventory-nested-families.test.cjs",
@@ -156,6 +148,14 @@ module.exports = {
   "tests/milestone-archive.test.cjs",
   "tests/milestone-window-single-owner.test.cjs",
   "tests/model-resolver.test.cjs",
+  "tests/msd-agent-isolation-guard.test.cjs",
+  "tests/msd-check-update-worker-atomic-cache.test.cjs",
+  "tests/msd-check-update-worker-platform-gate.test.cjs",
+  "tests/msd-mcp-server-bin.test.cjs",
+  "tests/msd-statusline.test.cjs",
+  "tests/msd-validate-commit-crash-policy.test.cjs",
+  "tests/msd-validate-commit-sigpipe.test.cjs",
+  "tests/msd-write-guard.test.cjs",
   "tests/mutation-workflow-base-ref.test.cjs",
   "tests/new-milestone-clear-phases.test.cjs",
   "tests/no-bare-npm-exec.rule.test.cjs",

scripts/lib/shellcheck-fetch.cjs

@@ -89,7 +89,7 @@ function httpsGetFollowingRedirects(url, redirectsLeft = MAX_REDIRECTS, requestF
   return new Promise((resolve, reject) => {
     const req = requestFn(
       url,
-      { headers: { 'User-Agent': 'gsd-core-shellcheck-fetch' }, timeout: DOWNLOAD_TIMEOUT_MS },
+      { headers: { 'User-Agent': 'msd-core-shellcheck-fetch' }, timeout: DOWNLOAD_TIMEOUT_MS },
       (res) => {
         const status = res.statusCode || 0;
         if (status >= 300 && status < 400 && res.headers.location) {