@opengsd/gsd-pi 1.1.1-dev.a5a2de8 → 1.1.1-dev.b2556262

package/src/resources/extensions/gsd/tests/closeout-wizard.test.ts

@@ -8,6 +8,7 @@ import {
   buildCloseoutMenuActions,
   buildIdleMenuSummary,
   getPrimaryCloseoutRecommendation,
+  showMilestoneMergeCloseout,
 } from "../closeout-wizard.ts";
 import { buildGsdHomeModel } from "../gsd-command-home.ts";
 import type { GSDState } from "../types.ts";
@@ -119,3 +120,46 @@ test("/gsd home recommends merge milestone when closeout is pending", () => {
   assert.equal(merge?.recommended, true);
   assert.equal(merge?.enabled, true);
 });
+
+test("milestone merge closeout clears stale timer controls and installs the closeout outcome", () => {
+  const statuses: Array<[string, string | undefined]> = [];
+  const widgets: Array<[string, unknown]> = [];
+
+  showMilestoneMergeCloseout({
+    hasUI: true,
+    ui: {
+      setStatus: (key: string, value: string | undefined) => {
+        statuses.push([key, value]);
+      },
+      setWidget: (key: string, value: unknown) => {
+        widgets.push([key, value]);
+      },
+    },
+  } as any, {
+    milestoneId: "M004",
+    branch: "milestone/M004",
+    integrationBranch: "main",
+    files: ["src/app.ts"],
+    dirtyOverlap: [],
+  });
+
+  assert.deepEqual(statuses, [
+    ["gsd-auto", undefined],
+    ["gsd-step", undefined],
+  ]);
+  assert.ok(
+    widgets.some(([key, value]) => key === "gsd-progress" && value === undefined),
+    "stale progress/timer widget should be cleared",
+  );
+  const outcome = widgets.find(([key]) => key === "gsd-outcome")?.[1];
+  assert.equal(typeof outcome, "function");
+
+  const component = (outcome as any)(
+    { requestRender() {} },
+    { fg: (_color: string, text: string) => text, bold: (text: string) => text },
+  );
+  const rendered = component.render(100).join("\n");
+  assert.match(rendered, /Milestone M004 merged/);
+  assert.match(rendered, /Review the closeout/);
+  assert.doesNotMatch(rendered, /\/gsd auto/);
+});

package/src/resources/extensions/gsd/tests/commands-dispatcher-unmerged-milestone.test.ts

@@ -40,6 +40,7 @@ function makeMockCtx(base: string): {
   return {
     ctx: {
       cwd: base,
+      hasUI: true,
       ui: {
         notify: (message: string, kind: string) => {
           calls.push({ message, kind });
@@ -217,7 +218,7 @@ test("dispatcher recovers a completed unmerged milestone through complete-milest
   const base = makeTempRepo("gsd-dispatch-unmerged-");
   try {
     seedRegisteredCompletedWorktree(base);
-    const { ctx, calls } = makeMockCtx(base);
+    const { ctx, calls, widgets, statuses } = makeMockCtx(base);
     const { pi, messages } = makeMockPi();
 
     await handleGSDCommand("dispatch complete-milestone M008", ctx, pi);
@@ -231,6 +232,30 @@ test("dispatcher recovers a completed unmerged milestone through complete-milest
       calls.some((call) => call.message.includes("Milestone M008 merged to main")),
       "user sees merge recovery success",
     );
+    assert.ok(
+      calls.some((call) => call.message.includes("Closeout is complete")),
+      "merge recovery ends at a closeout-complete message",
+    );
+    assert.ok(
+      calls.every((call) => !call.message.includes("Run /gsd again when ready")),
+      "merge recovery must not send the user past the closeout endpoint",
+    );
+    assert.ok(
+      statuses.some(([key, value]) => key === "gsd-auto" && value === undefined),
+      "merge recovery clears stale auto status so the run timer stops",
+    );
+    assert.ok(
+      statuses.some(([key, value]) => key === "gsd-step" && value === undefined),
+      "merge recovery clears stale step status",
+    );
+    assert.ok(
+      widgets.some(([key, value]) => key === "gsd-progress" && value === undefined),
+      "merge recovery clears stale progress/timer controls",
+    );
+    assert.ok(
+      widgets.some(([key, value]) => key === "gsd-outcome" && typeof value === "function"),
+      "merge recovery installs a durable closeout outcome",
+    );
     assert.equal(readFileSync(join(base, "index.html"), "utf-8"), "<h1>M008</h1>\n");
     assert.equal(git(base, "branch", "--list", "milestone/M008"), "");
   } finally {

package/src/resources/extensions/gsd/tests/complete-slice-verification-gate.test.ts

@@ -155,6 +155,124 @@ describe('complete-slice verification gate (#3580)', () => {
     }
   });
 
+  // ── Browser/web UAT classification gate (M001/S03 regression) ──────────
+  const BROWSER_UAT_BODY = [
+    '## UAT Type',
+    '- UAT mode: artifact-driven',
+    '',
+    '## Smoke Test',
+    '1. Open the page in a browser and perform add/edit/complete/delete once.',
+  ].join('\n');
+
+  test('rejects an artifact-driven UAT that drives a browser (open the page in a browser)', async () => {
+    const result = await handleCompleteSlice(
+      makeParams({ uatContent: BROWSER_UAT_BODY }),
+      basePath,
+    );
+    assert.ok('error' in result, 'expected handler to reject a browser UAT mislabeled artifact-driven');
+    assert.match((result as { error: string }).error, /requires browser verification/i);
+  });
+
+  test('allows a runtime-executable UAT that runs a browser test command (playwright)', async () => {
+    // Bugbot regression: runtime-executable legitimately drives a browser via a
+    // command captured by gsd_uat_exec — it must not be pushed to gsd-browser.
+    const body = [
+      '## UAT Type',
+      '- UAT mode: runtime-executable',
+      '',
+      '## Test Cases',
+      '1. Run `npx playwright test` and confirm a passing exit code; capture a screenshot artifact.',
+      '2. Hit http://localhost:3000/health and assert a 200 response.',
+    ].join('\n');
+    const result = await handleCompleteSlice(
+      makeParams({ uatContent: body }),
+      basePath,
+    );
+    if ('error' in result) {
+      assert.doesNotMatch(
+        result.error,
+        /artifact-driven|browser-capable|browser verification/i,
+        `runtime-executable command UATs must not be gated, got: ${result.error}`,
+      );
+    }
+  });
+
+  test('allows an artifact-driven UAT that only disclaims browser coverage (no false positive)', async () => {
+    // S01-style: genuinely artifact-driven persistence scaffolding that merely
+    // mentions "cross-browser" / "browser-level" in a Not-Proven disclaimer.
+    const body = [
+      '## UAT Type',
+      '- UAT mode: artifact-driven',
+      '',
+      '## Not Proven By This UAT',
+      '- Interactive browser-level CRUD and real cross-browser localStorage behavior.',
+    ].join('\n');
+    const result = await handleCompleteSlice(
+      makeParams({ uatContent: body }),
+      basePath,
+    );
+    if ('error' in result) {
+      assert.doesNotMatch(
+        result.error,
+        /requires browser verification/i,
+        `disclaimer-only mention must not trip the browser gate, got: ${result.error}`,
+      );
+    }
+  });
+
+  test('allows an artifact-driven UAT whose "navigate" step targets a file, not a browser', async () => {
+    // Bugbot regression: a bare "navigate to <file/API>" must not trip the gate
+    // just because it contains the word "navigate".
+    const body = [
+      '## UAT Type',
+      '- UAT mode: artifact-driven',
+      '',
+      '## Test Cases',
+      '1. Navigate to the generated report file and confirm the schema section exists.',
+    ].join('\n');
+    const result = await handleCompleteSlice(
+      makeParams({ uatContent: body }),
+      basePath,
+    );
+    if ('error' in result) {
+      assert.doesNotMatch(
+        result.error,
+        /requires browser verification/i,
+        `non-web "navigate" must not trip the browser gate, got: ${result.error}`,
+      );
+    }
+  });
+
+  test('allows a browser UAT when it is declared browser-executable', async () => {
+    const body = BROWSER_UAT_BODY.replace('artifact-driven', 'browser-executable');
+    const result = await handleCompleteSlice(
+      makeParams({ uatContent: body }),
+      basePath,
+    );
+    if ('error' in result) {
+      assert.doesNotMatch(
+        result.error,
+        /requires browser verification/i,
+        `browser-executable UAT must pass the browser gate, got: ${result.error}`,
+      );
+    }
+  });
+
+  test('allows a browser UAT when it is declared mixed (mixed receives browser tools)', async () => {
+    const body = BROWSER_UAT_BODY.replace('artifact-driven', 'mixed (artifact-driven + browser)');
+    const result = await handleCompleteSlice(
+      makeParams({ uatContent: body }),
+      basePath,
+    );
+    if ('error' in result) {
+      assert.doesNotMatch(
+        result.error,
+        /requires browser verification/i,
+        `mixed UAT must pass the browser gate, got: ${result.error}`,
+      );
+    }
+  });
+
   test('backfills prior verification narrative when verification is omitted on re-completion', async () => {
     // Seed full_summary_md with a prior verification narrative (simulates a
     // previous completion where the verification text was recorded).

package/src/resources/extensions/gsd/tests/content-validator.test.ts

@@ -0,0 +1,74 @@
+import test from "node:test";
+import assert from "node:assert/strict";
+import { mkdtempSync, mkdirSync, rmSync, writeFileSync } from "node:fs";
+import { join } from "node:path";
+import { tmpdir } from "node:os";
+
+import { validateContent } from "../safety/content-validator.ts";
+
+function makeTempFile(content: string): { base: string; path: string } {
+  const base = mkdtempSync(join(tmpdir(), "gsd-content-validator-"));
+  mkdirSync(base, { recursive: true });
+  const path = join(base, "artifact.md");
+  writeFileSync(path, content, "utf-8");
+  return { base, path };
+}
+
+test("validateContent marks empty milestone roadmaps as blocking", () => {
+  const { base, path } = makeTempFile([
+    "# M004: Empty roadmap",
+    "",
+    "## Slices",
+    "",
+    "_TBD_",
+    "",
+  ].join("\n"));
+
+  try {
+    const violations = validateContent("plan-milestone", path);
+    assert.deepEqual(violations, [{
+      severity: "error",
+      reason: "Milestone roadmap has 0 slice(s) — expected at least 1",
+    }]);
+  } finally {
+    rmSync(base, { recursive: true, force: true });
+  }
+});
+
+test("validateContent accepts checkbox milestone roadmap slices", () => {
+  const { base, path } = makeTempFile([
+    "# M004: Roadmap",
+    "",
+    "## Slices",
+    "",
+    "- [ ] **S01: Browser due dates** `risk:low` `depends:[]`",
+    "  > After this: due dates are visible.",
+    "",
+  ].join("\n"));
+
+  try {
+    const violations = validateContent("plan-milestone", path);
+    assert.deepEqual(violations, []);
+  } finally {
+    rmSync(base, { recursive: true, force: true });
+  }
+});
+
+test("validateContent marks empty slice plans as blocking", () => {
+  const { base, path } = makeTempFile([
+    "# S01: Empty slice",
+    "",
+    "## Tasks",
+    "",
+    "_TBD_",
+    "",
+  ].join("\n"));
+
+  try {
+    const violations = validateContent("plan-slice", path);
+    assert.equal(violations[0]?.severity, "error");
+    assert.equal(violations[0]?.reason, "Slice plan has 0 task(s) — expected at least 1");
+  } finally {
+    rmSync(base, { recursive: true, force: true });
+  }
+});

package/src/resources/extensions/gsd/tests/context-masker.test.ts

@@ -1,7 +1,12 @@
 import test from "node:test";
 import assert from "node:assert/strict";
 
-import { createObservationMask } from "../context-masker.js";
+import {
+  createObservationMask,
+  createResponsesInputObservationMask,
+  truncateContextResultMessages,
+  truncateResponsesInputResultItems,
+} from "../context-masker.js";
 
 // These helpers produce messages in the pi-ai LLM payload format
 // (post-convertToLlm, pre-provider), which is what before_provider_request sees.
@@ -120,3 +125,53 @@ test("masks toolResult by role, not by type field", () => {
   const result = mask(messages as any);
   assert.equal((result[1].content as any)[0].text, MASK_TEXT);
 });
+
+test("truncates recent bash result user messages", () => {
+  const messages = [
+    userMsg("turn 1"),
+    bashResult("a".repeat(50)),
+    assistantMsg("response 1"),
+  ];
+  const result = truncateContextResultMessages(messages as any, 10);
+  const text = (result[1].content as any)[0].text;
+  assert.ok(text.length < (messages[1].content as any)[0].text.length);
+  assert.match(text, /…\[truncated\]/);
+});
+
+test("masks Responses API function outputs older than keepRecentTurns", () => {
+  const mask = createResponsesInputObservationMask(1);
+  const items = [
+    { role: "user", content: [{ type: "input_text", text: "turn 1" }] },
+    { type: "function_call_output", call_id: "call_1", output: "old output" },
+    { type: "message", role: "assistant", content: [{ type: "output_text", text: "response 1" }] },
+    { role: "user", content: [{ type: "input_text", text: "turn 2" }] },
+  ];
+  const result = mask(items as any);
+  assert.equal(result[1].output, MASK_TEXT);
+});
+
+test("masks Responses API bash result user items older than keepRecentTurns", () => {
+  const mask = createResponsesInputObservationMask(1);
+  const items = [
+    { role: "user", content: [{ type: "input_text", text: "turn 1" }] },
+    { role: "user", content: [{ type: "input_text", text: "Ran `npm test`\n```\nold output\n```" }] },
+    { type: "message", role: "assistant", content: [{ type: "output_text", text: "response 1" }] },
+    { role: "user", content: [{ type: "input_text", text: "turn 2" }] },
+  ];
+  const result = mask(items as any);
+  assert.equal((result[1].content as any)[0].text, MASK_TEXT);
+});
+
+test("truncates Responses API function outputs and recent bash result items", () => {
+  const items = [
+    { role: "user", content: [{ type: "input_text", text: "turn 1" }] },
+    { type: "function_call_output", call_id: "call_1", output: "b".repeat(50) },
+    { role: "user", content: [{ type: "input_text", text: "Ran `npm test`\n```\n" + "c".repeat(50) + "\n```" }] },
+  ];
+  const result = truncateResponsesInputResultItems(items as any, 12);
+
+  assert.match(result[1].output as string, /…\[truncated\]/);
+  assert.match((result[2].content as any)[0].text, /…\[truncated\]/);
+  assert.ok((result[1].output as string).length < (items[1].output as string).length);
+  assert.ok((result[2].content as any)[0].text.length < (items[2].content as any)[0].text.length);
+});

package/src/resources/extensions/gsd/tests/custom-engine-loop-integration.test.ts

@@ -8,7 +8,7 @@
 
 import { describe, it, afterEach } from "node:test";
 import assert from "node:assert/strict";
-import { mkdtempSync, rmSync, existsSync } from "node:fs";
+import { existsSync, mkdtempSync, rmSync, writeFileSync } from "node:fs";
 import { join } from "node:path";
 import { tmpdir } from "node:os";
 
@@ -18,7 +18,7 @@ import type { LoopDeps } from "../auto/loop-deps.js";
 import { WorktreeStateProjection } from "../worktree-state-projection.js";
 import type { SessionLockStatus } from "../session-lock.js";
 import { writeGraph, readGraph, type WorkflowGraph, type GraphStep } from "../graph.ts";
-import { writeFileSync } from "node:fs";
+import { SourceObservationStore } from "../source-observations.js";
 import { stringify } from "yaml";
 
 // ─── Helpers ─────────────────────────────────────────────────────────────
@@ -115,6 +115,7 @@ function makeLoopSession(overrides?: Record<string, unknown>) {
     currentMilestoneId: null,
     currentUnit: null,
     currentUnitRouting: null,
+    sourceObservations: new SourceObservationStore(),
     completedUnits: [],
     resourceVersionOnStart: null,
     lastPromptCharCount: undefined,
@@ -129,6 +130,7 @@ function makeLoopSession(overrides?: Record<string, unknown>) {
     unitLifetimeDispatches: new Map<string, number>(),
     unitRecoveryCount: new Map<string, number>(),
     verificationRetryCount: new Map<string, number>(),
+    zeroToolRetryCount: new Map<string, number>(),
     gitService: null,
     autoStartTime: Date.now(),
     activeEngineId: null,
@@ -138,6 +140,19 @@ function makeLoopSession(overrides?: Record<string, unknown>) {
       newSession: () => Promise.resolve({ cancelled: false }),
       getContextUsage: () => ({ percent: 10, tokens: 1000, limit: 10000 }),
     },
+    setCurrentUnit(this: any, unit: any) {
+      this.currentUnit = unit;
+      this.sourceObservations.beginUnit({
+        unitType: unit.type,
+        unitId: unit.id,
+        startedAt: unit.startedAt,
+        basePath: unit.workspaceRoot ?? this.basePath,
+      });
+    },
+    clearCurrentUnit(this: any) {
+      this.currentUnit = null;
+      this.sourceObservations.clear();
+    },
     clearTimers: () => {},
     lockBasePath: "/tmp/project",
     ...overrides,

package/src/resources/extensions/gsd/tests/dispatch-rule-coverage.test.ts

@@ -216,6 +216,30 @@ test("dispatch-rule-coverage: planning with active slice and skip_research → p
   );
 });
 
+test("dispatch-rule-coverage: planning boundary without planner handoff → research-slice", async (t) => {
+  const tmp = mkdtempSync(join(tmpdir(), "gsd-disp-cov-planning-"));
+  t.after(() => rmSync(tmp, { recursive: true, force: true }));
+
+  writeMilestoneFile(tmp, "M001", "CONTEXT", "# Context\n");
+  writeMilestoneFile(tmp, "M001", "ROADMAP", "# Roadmap\n");
+
+  const state = makeState({
+    phase: "planning",
+    activeSlice: { id: "S01", title: "First Slice" },
+    nextAction: "Plan slice S01 (First Slice).",
+  });
+  const match = await findFirstMatch(makeCtx(tmp, state));
+  assertMatch(
+    match,
+    {
+      ruleName: "planning (no research, not S01) → research-slice",
+      action: "dispatch",
+      unitType: "research-slice",
+    },
+    "planning boundary without planner handoff",
+  );
+});
+
 test("dispatch-rule-coverage: executing with task plan present → execute-task", async (t) => {
   const tmp = mkdtempSync(join(tmpdir(), "gsd-disp-cov-exec-"));
   t.after(() => rmSync(tmp, { recursive: true, force: true }));

package/src/resources/extensions/gsd/tests/doctor-scope-db-unavailable.test.ts

@@ -109,22 +109,12 @@ test("checkEngineHealth treats explicit reopen as authoritative when dispatch ti
       worker_id, host, pid, started_at, version, last_heartbeat_at, status, project_root_realpath
     ) VALUES (?, ?, ?, ?, ?, ?, ?, ?)`,
   ).run("worker-1", "localhost", 1, "2026-01-01T00:00:00.000Z", "test", "2026-01-01T00:00:00.000Z", "stopped", base);
-  db.exec("PRAGMA writable_schema = ON");
   db.prepare(
-    `UPDATE sqlite_schema
-     SET sql = replace(sql, 'started_at TEXT NOT NULL', 'started_at TEXT')
-     WHERE type = 'table' AND name = 'unit_dispatches'`,
-  ).run();
-  db.exec("PRAGMA writable_schema = OFF");
-  closeDatabase();
-  openDatabase(join(gsdDir, "gsd.db"));
-  const reopenedDb = _getAdapter()!;
-  reopenedDb.prepare(
     `INSERT INTO unit_dispatches (
       trace_id, worker_id, milestone_lease_token, milestone_id,
       unit_type, unit_id, status, attempt_n, started_at, ended_at
     ) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`,
-  ).run("trace-1", "worker-1", 1, "M001", "complete-milestone", "M001", "completed", 1, null, null);
+  ).run("trace-1", "worker-1", 1, "M001", "complete-milestone", "M001", "completed", 1, "", "");
   appendEvent(base, {
     cmd: "reopen-milestone",
     params: { milestoneId: "M001" },

package/src/resources/extensions/gsd/tests/gate-dispatch.test.ts

@@ -19,10 +19,12 @@ import {
   saveGateResult,
   markAllGatesOmitted,
   getPendingSliceGateCount,
+  getGateResults,
 } from "../gsd-db.ts";
 import { deriveState, invalidateStateCache } from "../state.ts";
 import { renderPlanFromDb } from "../markdown-renderer.ts";
 import { invalidateAllCaches } from "../cache.ts";
+import { DISPATCH_RULES } from "../auto-dispatch.ts";
 
 function setupTestProject(): { tmpDir: string; dbPath: string } {
   const tmpDir = mkdtempSync(join(tmpdir(), "gate-dispatch-"));
@@ -213,4 +215,66 @@ describe("evaluating-gates phase", () => {
       `pending Q8 must not stall evaluating-gates — got phase=${state.phase}`,
     );
   });
+
+  test("gate-evaluate dispatch id includes only gate-evaluate-owned gates", async () => {
+    planSlice(tmpDir);
+    await renderPlanFromDb(tmpDir, "M001", "S01");
+
+    insertGateRow({ milestoneId: "M001", sliceId: "S01", gateId: "Q3", scope: "slice" });
+    insertGateRow({ milestoneId: "M001", sliceId: "S01", gateId: "Q4", scope: "slice" });
+    insertGateRow({ milestoneId: "M001", sliceId: "S01", gateId: "Q8", scope: "slice" });
+
+    invalidateStateCache();
+    const state = await deriveState(tmpDir);
+    assert.equal(state.phase, "evaluating-gates");
+
+    const rule = DISPATCH_RULES.find((candidate) => candidate.name === "evaluating-gates → gate-evaluate");
+    assert.ok(rule, "gate-evaluate dispatch rule must exist");
+
+    const result = await rule.match({
+      basePath: tmpDir,
+      mid: "M001",
+      midTitle: "Test Milestone",
+      state,
+      prefs: { gate_evaluation: { enabled: true } },
+    });
+
+    assert.ok(result);
+    assert.equal(result.action, "dispatch");
+    if (result.action !== "dispatch") throw new Error("expected gate-evaluate dispatch");
+    assert.equal(result.unitId, "M001/S01/gates+Q3,Q4");
+    assert.doesNotMatch(result.prompt, /\*\*Q8\*\*/);
+  });
+
+  test("disabled gate evaluation only omits gate-evaluate-owned gates", async () => {
+    planSlice(tmpDir);
+    await renderPlanFromDb(tmpDir, "M001", "S01");
+
+    insertGateRow({ milestoneId: "M001", sliceId: "S01", gateId: "Q3", scope: "slice" });
+    insertGateRow({ milestoneId: "M001", sliceId: "S01", gateId: "Q4", scope: "slice" });
+    insertGateRow({ milestoneId: "M001", sliceId: "S01", gateId: "Q8", scope: "slice" });
+    insertGateRow({ milestoneId: "M001", sliceId: "S01", gateId: "Q5", scope: "task", taskId: "T01" });
+
+    invalidateStateCache();
+    const state = await deriveState(tmpDir);
+    assert.equal(state.phase, "evaluating-gates");
+
+    const rule = DISPATCH_RULES.find((candidate) => candidate.name === "evaluating-gates → gate-evaluate");
+    assert.ok(rule, "gate-evaluate dispatch rule must exist");
+
+    const result = await rule.match({
+      basePath: tmpDir,
+      mid: "M001",
+      midTitle: "Test Milestone",
+      state,
+      prefs: { gate_evaluation: { enabled: false } },
+    });
+
+    assert.equal(result?.action, "skip");
+    const byId = new Map(getGateResults("M001", "S01").map((gate) => [gate.gate_id, gate]));
+    assert.equal(byId.get("Q3")?.verdict, "omitted");
+    assert.equal(byId.get("Q4")?.verdict, "omitted");
+    assert.equal(byId.get("Q8")?.status, "pending");
+    assert.equal(byId.get("Q5")?.status, "pending");
+  });
 });

package/src/resources/extensions/gsd/tests/gate-storage.test.ts

@@ -83,6 +83,21 @@ describe("quality_gates CRUD", () => {
     assert.ok(results[0].evaluated_at);
   });
 
+  test("saveGateResult throws when the gate row does not exist", () => {
+    assert.throws(
+      () => saveGateResult({
+        milestoneId: "M001",
+        sliceId: "S01",
+        gateId: "Q3",
+        verdict: "pass",
+        rationale: "No row exists.",
+        findings: "",
+      }),
+      /quality gate row not found/,
+    );
+    assert.equal(getGateResults("M001", "S01").length, 0);
+  });
+
   test("getPendingGates filters by scope", () => {
     insertGateRow({ milestoneId: "M001", sliceId: "S01", gateId: "Q3", scope: "slice" });
     insertGateRow({ milestoneId: "M001", sliceId: "S01", gateId: "Q5", scope: "task", taskId: "T01" });

package/src/resources/extensions/gsd/tests/gsd-recover.test.ts

@@ -502,7 +502,9 @@ describe('gsd-recover', async () => {
       insertMilestone({ id: 'M999', title: 'Existing DB State', status: 'active' });
 
       const { ctx, notes } = makeCtx();
-      await handleRecover(ctx, base, '--confirm');
+      // M999 is in the DB but not in the markdown, so recover would delete it:
+      // a data-loss recover now requires explicit --allow-data-loss.
+      await handleRecover(ctx, base, '--confirm --allow-data-loss');
 
       assert.equal(getMilestone('M999'), null, 'confirmed recover clears old hierarchy rows');
       assert.ok(getMilestone('M001'), 'confirmed recover imports markdown hierarchy');
@@ -512,4 +514,63 @@ describe('gsd-recover', async () => {
       cleanup(base);
     }
   });
+
+  test('handleRecover refuses to delete DB rows markdown lacks without --allow-data-loss', async () => {
+    const base = createFixtureBase();
+    try {
+      writeFile(base, 'milestones/M001/M001-ROADMAP.md', ROADMAP_M001);
+      openDatabase(':memory:');
+      insertMilestone({ id: 'M999', title: 'Existing DB State', status: 'active' });
+
+      const { ctx, notes } = makeCtx();
+      await handleRecover(ctx, base, '--confirm');
+
+      // --confirm alone must NOT clear authoritative DB rows the markdown lacks.
+      assert.ok(getMilestone('M999'), 'data-loss recover is refused, DB row preserved');
+      assert.equal(getMilestone('M001'), null, 'markdown not imported on refusal');
+      assert.equal(notes.at(-1)?.kind, 'error');
+    } finally {
+      closeDatabase();
+      cleanup(base);
+    }
+  });
+
+  test('handleRecover interactive data-loss requires a second explicit acknowledgement', async () => {
+    const base = createFixtureBase();
+    try {
+      writeFile(base, 'milestones/M001/M001-ROADMAP.md', ROADMAP_M001);
+      openDatabase(':memory:');
+      insertMilestone({ id: 'M999', title: 'Existing DB State', status: 'active' });
+
+      // First confirm (proceed?) = yes; second confirm (delete rows?) = no.
+      let call = 0;
+      const { ctx, notes } = makeCtx(async () => { call += 1; return call === 1; });
+      await handleRecover(ctx, base, '');
+
+      assert.ok(getMilestone('M999'), 'declining the data-loss ack preserves DB rows');
+      assert.equal(getMilestone('M001'), null, 'markdown not imported when data-loss ack declined');
+      assert.match(notes.at(-1)?.message ?? '', /cancelled/);
+    } finally {
+      closeDatabase();
+      cleanup(base);
+    }
+  });
+
+  test('handleRecover interactive proceeds when the data-loss deletion is acknowledged', async () => {
+    const base = createFixtureBase();
+    try {
+      writeFile(base, 'milestones/M001/M001-ROADMAP.md', ROADMAP_M001);
+      openDatabase(':memory:');
+      insertMilestone({ id: 'M999', title: 'Existing DB State', status: 'active' });
+
+      const { ctx } = makeCtx(async () => true); // both confirms accepted
+      await handleRecover(ctx, base, '');
+
+      assert.equal(getMilestone('M999'), null, 'acknowledged data-loss recover clears old rows');
+      assert.ok(getMilestone('M001'), 'acknowledged data-loss recover imports markdown');
+    } finally {
+      closeDatabase();
+      cleanup(base);
+    }
+  });
 });