@opengsd/gsd-pi 1.2.0-dev.4813ead6 → 1.2.0-dev.5457a158

package/dist/resources/extensions/gsd/state-transition-matrix.js

@@ -99,6 +99,44 @@ export const STATE_TRANSITION_MATRIX = [
 export function findTransition(from, event) {
     return STATE_TRANSITION_MATRIX.find((entry) => (entry.from === from || entry.from === "*") && entry.event === event);
 }
+/**
+ * Edge-keyed legality check for the Phase Transition Invariant (ADR-030).
+ * `advance()` derives the next Phase and asserts the (from → to) edge here.
+ *
+ * The matrix is an assertion, not a decision-maker — `deriveState` already
+ * chose the Phase. A self-edge is trivially legal (no transition to assert). An
+ * edge is legal when some matrix entry permits it, honoring the `*` wildcard
+ * rows (e.g. any → blocked via manual-block, any → executing via
+ * retryable-failure).
+ *
+ * Note: the matrix is currently a sparse hardening spec, not a complete
+ * legal-edge graph, so `advance()` consumes this in advisory mode (telemetry
+ * only). It must be expanded to cover every edge `deriveState` emits before
+ * enforcement flips on.
+ */
+export function isLegalEdge(from, to) {
+    if (from === to)
+        return true;
+    return STATE_TRANSITION_MATRIX.some((entry) => (entry.from === from || entry.from === "*") && entry.to === to);
+}
+/**
+ * Thrown when an illegal derived Phase edge survives reconciliation. Carries
+ * both endpoints so Recovery Classification can report them. Recognized by
+ * class in `classifyFailure` and mapped to the `illegal-transition` kind.
+ */
+export class IllegalPhaseTransitionError extends Error {
+    // Explicit fields, not constructor parameter properties — strip-types
+    // consumers (workspace-index subprocess, integration tests) reject the
+    // parameter-property syntax with ERR_UNSUPPORTED_TYPESCRIPT_SYNTAX.
+    from;
+    to;
+    constructor(from, to) {
+        super(`Illegal phase transition ${from} -> ${to} survived reconciliation`);
+        this.name = "IllegalPhaseTransitionError";
+        this.from = from;
+        this.to = to;
+    }
+}
 export function validateTransitionMatrix(requiredEvents) {
     const seen = new Set();
     const duplicateKeys = [];

package/dist/resources/extensions/gsd/state.js

@@ -22,26 +22,7 @@ import { isDbAvailable, getAllMilestones, getMilestone, getMilestoneSlices, getS
 import { wasWorkflowDatabaseOpenAttempted } from './db-workspace.js';
 import { formatCompletePhaseNextAction, countUnmappedActiveRequirements } from './requirements-backlog.js';
 import { classifyMilestoneReadiness, readinessNeedsDiscussion, } from './milestone-readiness.js';
-function formatNeedsAttentionBlocker(milestoneId) {
-    return [
-        `Milestone ${milestoneId} is blocked because milestone validation returned needs-attention.`,
-        `Fix options:`,
-        `1. Review the validation details: \`/gsd status\``,
-        `2. If you fixed the missing evidence or issue, re-run milestone validation: \`/gsd validate-milestone\``,
-        `3. If the finding is acceptable, override it: \`/gsd verdict pass --rationale "why this is okay"\``,
-        `4. If this should wait, defer it explicitly: \`/gsd park ${milestoneId}\``,
-        `After validation or override passes, run \`/gsd auto\` to complete and merge the milestone.`,
-    ].join("\n");
-}
-function formatNeedsRemediationBlocker(milestoneId) {
-    return [
-        `Milestone ${milestoneId} is blocked because milestone validation returned needs-remediation, but all slices are complete.`,
-        `Fix options:`,
-        `1. Run \`/gsd dispatch reassess\` to add remediation slices, then run \`/gsd auto\``,
-        `2. If the finding is acceptable, override it: \`/gsd verdict pass --rationale "why this is okay"\``,
-        `3. If this should wait, defer it explicitly: \`/gsd park ${milestoneId}\``,
-    ].join("\n");
-}
+import { needsAttentionBlockerGuidance as formatNeedsAttentionBlocker, needsRemediationBlockerGuidance as formatNeedsRemediationBlocker, } from './guidance.js';
 /**
  * A "ghost" milestone directory contains only META.json (and no substantive
  * files like CONTEXT, CONTEXT-DRAFT, ROADMAP, or SUMMARY).  These appear when

package/dist/resources/extensions/gsd/status-guards.js

@@ -1,16 +1,64 @@
 /**
- * Status predicates for GSD state-machine guards.
+ * Status predicates and the canonical status vocabulary for GSD state-machine
+ * guards (ADR-030).
  *
- * The DB stores status as free-form strings. Three values indicate
- * "closed": "complete" (canonical), "done" (legacy / alias),
- * "closed" (legacy/imported), and
- * "skipped" (user-directed skip via rethink or backtrack).
- * Every inline `status === "complete" || status === "done"` should
- * use isClosedStatus() instead.
+ * The DB column is free-form `string` so legacy/imported rows still load. Three
+ * raw values besides canonical "complete"/"skipped" indicate "closed": "done"
+ * (legacy alias), "closed" (legacy/imported), and "skipped" (user-directed skip
+ * via rethink or backtrack). `RAW_CLOSED_STATUSES` is the single source for both
+ * `isClosedStatus()` and the SQL terminal-status fragment
+ * (`db/sql-constants.ts` derives `TERMINAL_STATUS_SQL` from it), replacing the
+ * prior independent definitions.
+ *
+ * `toStatus()` is the single seam where a free-form string becomes the canonical
+ * `Status` vocabulary; the Status Transition Core writes canonical, so the store
+ * converges over time without a forced migration.
+ */
+/**
+ * Canonical, normalized entity-status vocabulary across milestones, slices, and
+ * tasks — the single source for both the `Status` type and the runtime
+ * membership set. The in-memory domain speaks `Status`; the DB column stays
+ * free-form.
+ */
+export const CANONICAL_STATUSES = [
+    "pending", "queued", "active", "parked", "in_progress", "blocked", "complete", "skipped", "deferred",
+];
+const CANONICAL_STATUS_SET = new Set(CANONICAL_STATUSES);
+/**
+ * Raw status values that mean a unit is closed — the single source of truth.
+ * Includes legacy/imported aliases ("done", "closed") alongside canonical
+ * "complete"/"skipped" because the DB column is free-form and older rows /
+ * imports still carry them. Order matters: `TERMINAL_STATUS_SQL` is derived
+ * from this array verbatim.
+ */
+export const RAW_CLOSED_STATUSES = ["complete", "done", "skipped", "closed"];
+const RAW_CLOSED_SET = new Set(RAW_CLOSED_STATUSES);
+/** Free-form aliases mapped to their canonical Status on read. */
+const ALIAS_TO_CANONICAL = {
+    done: "complete",
+    closed: "complete",
+    planned: "pending",
+    "in-progress": "in_progress",
+};
+/**
+ * Normalize a free-form DB status string into the canonical `Status`
+ * vocabulary. Maps known aliases (done/closed → complete, planned → pending,
+ * in-progress → in_progress). An unrecognized/legacy value is **quarantined** —
+ * preserved verbatim rather than silently remapped to a wrong canonical state —
+ * so reads never fail and reconciliation/telemetry can surface it.
  */
+export function toStatus(raw) {
+    const value = raw.trim();
+    if (CANONICAL_STATUS_SET.has(value))
+        return value;
+    const alias = ALIAS_TO_CANONICAL[value];
+    if (alias)
+        return alias;
+    return value;
+}
 /** Returns true when a milestone, slice, or task status indicates closure. */
 export function isClosedStatus(status) {
-    return status === "complete" || status === "done" || status === "skipped" || status === "closed";
+    return RAW_CLOSED_SET.has(status);
 }
 /** Returns true when a slice status indicates it was deferred by a decision. */
 export function isDeferredStatus(status) {

package/dist/resources/extensions/gsd/stop-notice.js

@@ -0,0 +1,57 @@
+// Project/App: gsd-pi
+// File Purpose: Stop Notice module — single owner of the auto/step-mode
+// stop/pause notice vocabulary. Both sides of the wire live here: the
+// formatters that produce the canonical prefixes (used by stopAuto/pauseAuto)
+// and the classifiers that recognize them (used by the headless host to pick
+// exit codes). Wording changes in this file keep emitter and detector in
+// lockstep; round-trip tests enforce it.
+/** A reason string of the form "Blocked: …" marks a blocked stop. */
+export function isBlockedStopReason(reason) {
+    return /^Blocked:\s*/i.test(reason ?? "");
+}
+/** Strip the "Blocked: " marker for display. */
+export function stopNoticeDisplayReason(reason) {
+    return (reason ?? "").replace(/^Blocked:\s*/i, "").trim();
+}
+export function stopNoticeKind(reason) {
+    return isBlockedStopReason(reason) ? "blocked" : "stopped";
+}
+/** Canonical stop-notice prefix: "Auto-mode blocked — reason" / "Auto-mode stopped". */
+export function formatStopNoticePrefix(reason) {
+    const displayReason = stopNoticeDisplayReason(reason);
+    const prefix = stopNoticeKind(reason) === "blocked" ? "Auto-mode blocked" : "Auto-mode stopped";
+    return displayReason ? `${prefix} — ${displayReason}` : prefix;
+}
+// ─── Classification (headless host side) ────────────────────────────────
+// The canonical lowercase prefixes the headless event loop recognizes in
+// notify messages. Emitters above and ad-hoc emitters elsewhere must start
+// their terminal notices with one of these.
+export const PAUSED_NOTICE_PREFIXES = ["auto-mode paused", "step-mode paused"];
+export const TERMINAL_NOTICE_PREFIXES = [
+    "auto-mode stopped",
+    "step-mode stopped",
+    "auto-mode complete",
+    "no active milestone",
+    "auto-mode idle",
+];
+/** Manual-resolution notices emitted before auto-mode can formally pause/stop. */
+export function isManualResolutionNotice(message) {
+    return (message.includes("resolve manually and re-run /gsd auto") ||
+        message.includes("resolve conflicts manually and run /gsd auto to resume") ||
+        message.includes("resolve and run /gsd auto to resume"));
+}
+export function isPauseNotice(message) {
+    return PAUSED_NOTICE_PREFIXES.some((prefix) => message.startsWith(prefix));
+}
+export function isTerminalNotice(message) {
+    return TERMINAL_NOTICE_PREFIXES.some((prefix) => message.startsWith(prefix));
+}
+/** Pauses that do not require operator intervention in headless mode. */
+export function isNonBlockingPauseNotice(message) {
+    return message.includes("idempotent advance: unit already active");
+}
+export function isBlockedNoticeMessage(message) {
+    return (message.includes("blocked:") ||
+        (isPauseNotice(message) && !isNonBlockingPauseNotice(message)) ||
+        isManualResolutionNotice(message));
+}

package/dist/resources/extensions/gsd/tool-surface-readiness.js

@@ -0,0 +1,56 @@
+// Project/App: gsd-pi
+// File Purpose: Tool Contract module's runtime face — verify the live SDK tool surface covers a Unit's required workflow tools.
+import { mcpToolMatchesBaseName } from "./mcp-tool-name.js";
+import { getRequiredWorkflowToolsForUnit } from "./unit-tool-contracts.js";
+import { isWorkflowToolSurfaceName } from "./workflow-tool-surface.js";
+/**
+ * Stable phrase recognized as transient by auto-tool-tracking's
+ * isToolUnavailableError and error-classifier's transient buckets,
+ * which build their matchers from this constant.
+ */
+export const TOOL_SURFACE_NOT_READY = "workflow tool surface not ready";
+/** MCP server statuses that will not self-heal within the session. */
+const TERMINAL_MCP_SERVER_STATUSES = new Set(["failed", "needs-auth", "disabled"]);
+/**
+ * Verify the live tool surface observed at SDK session init covers the Unit's
+ * required workflow tools. Complements the static pre-dispatch gate
+ * (getWorkflowTransportSupportError), which only proves the MCP launch config
+ * is discoverable — the workflow server connects asynchronously after session
+ * start, so the static gate cannot see whether the tools actually registered.
+ *
+ * Returns a transient, recovery-classifiable error (kind tool-unavailable →
+ * retry) when the workflow server failed or has not yet registered a required
+ * tool, so dispatch aborts before the first model turn instead of letting the
+ * Unit improvise around "No such tool available". Returns null when no
+ * workflow server is part of this session (native tool path), when the Unit
+ * requires no workflow tools, or when the surface is ready.
+ */
+export function getToolSurfaceReadinessError(input) {
+    const { unitType, workflowServerName, observation } = input;
+    if (!unitType || !workflowServerName)
+        return null;
+    const required = getRequiredWorkflowToolsForUnit(unitType).filter(isWorkflowToolSurfaceName);
+    if (required.length === 0)
+        return null;
+    const server = observation.mcpServers.find((entry) => entry.name === workflowServerName);
+    if (!server) {
+        return `${TOOL_SURFACE_NOT_READY} for ${unitType}: MCP server "${workflowServerName}" is absent from the init surface (not yet connected): ${required.join(", ")}`;
+    }
+    // The SDK does not wait for MCP servers before init — a still-connecting
+    // server reports "pending" there routinely, then registers within seconds,
+    // usually well before the Unit's first workflow tool call. Aborting on
+    // "pending" would fail the common healthy session, so it passes through;
+    // a genuine miss after pass-through still surfaces in-session as
+    // "No such tool available" and classifies tool-unavailable → bounded retry.
+    // Only statuses that cannot self-heal abort here.
+    if (server.status !== "connected" && !TERMINAL_MCP_SERVER_STATUSES.has(server.status)) {
+        return null;
+    }
+    const missing = required.filter((tool) => !observation.tools.some((name) => name === tool || mcpToolMatchesBaseName(name, tool)));
+    if (missing.length === 0)
+        return null;
+    const serverDetail = server.status === "connected"
+        ? `MCP server "${workflowServerName}" is connected but has not registered`
+        : `MCP server "${workflowServerName}" status is "${server.status}" and it has not registered`;
+    return `${TOOL_SURFACE_NOT_READY} for ${unitType}: ${serverDetail}: ${missing.join(", ")}`;
+}

package/dist/resources/extensions/gsd/tools/complete-slice.js

@@ -11,8 +11,7 @@
  */
 import { existsSync, readFileSync } from "node:fs";
 import { join } from "node:path";
-import { isClosedStatus } from "../status-guards.js";
-import { transaction, insertMilestone, insertSlice, getSlice, getSliceTasks, getMilestone, updateSliceStatus, setSliceSummaryMd, saveGateResult, getPendingGatesForTurn, getMilestoneSlices, updateMilestoneStatus, } from "../gsd-db.js";
+import { completeSliceCascade, setSliceSummaryMd, saveGateResult, getPendingGatesForTurn, } from "../gsd-db.js";
 import { getGatesForTurn } from "../gate-registry.js";
 import { gsdProjectionRoot, clearPathCache, resolveMilestoneFile } from "../paths.js";
 import { resolveCanonicalMilestoneRoot } from "../worktree-manager.js";
@@ -295,52 +294,34 @@ export async function handleCompleteSlice(params, basePath) {
             error: `UAT requires browser verification (opening a page in a browser, navigating to a page or localhost, screenshots) but declares "UAT mode: artifact-driven", which only runs static/file checks and would defer the browser work to a human. Use a mode that actually verifies the UI: "browser-executable" (interactive browser tools), "runtime-executable" (a browser test command such as playwright), or a browser-inclusive "mixed"/"live-runtime". Re-author the UAT Type section and complete the slice again.`,
         };
     }
-    // ── Guards + DB writes inside a single transaction (prevents TOCTOU) ───
+    // ── Atomic completion cascade (guards + writes in one transaction) ───────
     const completedAt = new Date().toISOString();
     let guardError = null;
     let existingSummaryMd = "";
     let duplicateComplete = false;
-    transaction(() => {
-        // State machine preconditions (inside txn for atomicity).
-        // Milestone/slice not existing is OK — insertMilestone/insertSlice below will auto-create.
-        // Only block if they exist and are closed.
-        const milestone = getMilestone(params.milestoneId);
-        if (milestone && isClosedStatus(milestone.status)) {
-            guardError = `cannot complete slice in a closed milestone: ${params.milestoneId} (status: ${milestone.status})`;
-            return;
-        }
-        const slice = getSlice(params.milestoneId, params.sliceId);
-        existingSummaryMd = slice?.full_summary_md?.trim() ?? "";
-        if (slice && isClosedStatus(slice.status)) {
-            duplicateComplete = true;
-            return;
-        }
-        // Verify all tasks are complete
-        const tasks = getSliceTasks(params.milestoneId, params.sliceId);
-        if (tasks.length === 0) {
-            guardError = `no tasks found for slice ${params.sliceId} in milestone ${params.milestoneId}`;
-            return;
-        }
-        const incompleteTasks = tasks.filter(t => !isClosedStatus(t.status));
-        if (incompleteTasks.length > 0) {
-            const incompleteIds = incompleteTasks.map(t => `${t.id} (status: ${t.status})`).join(", ");
-            guardError = `incomplete tasks: ${incompleteIds}`;
-            return;
-        }
-        // All guards passed — perform writes. Preserve existing planning metadata:
-        // completion should not overwrite title/risk/depends/demo/sequence.
-        insertMilestone({ id: params.milestoneId, title: params.milestoneId });
-        if (!slice) {
-            insertSlice({ id: params.sliceId, milestoneId: params.milestoneId, title: params.sliceTitle || params.sliceId });
-        }
-        updateSliceStatus(params.milestoneId, params.sliceId, "complete", completedAt);
-        const updatedSlices = getMilestoneSlices(params.milestoneId);
-        if (milestone?.status === "planned" &&
-            updatedSlices.length > 0 &&
-            updatedSlices.every((s) => isClosedStatus(s.status))) {
-            updateMilestoneStatus(params.milestoneId, "active");
-        }
+    const outcome = completeSliceCascade(params.milestoneId, params.sliceId, {
+        sliceTitle: params.sliceTitle,
+        completedAt,
     });
+    if (outcome.ok) {
+        existingSummaryMd = outcome.existingSummaryMd;
+        duplicateComplete = outcome.duplicate;
+    }
+    else {
+        switch (outcome.reason) {
+            case "milestone-closed":
+                guardError = `cannot complete slice in a closed milestone: ${params.milestoneId} (status: ${outcome.status})`;
+                break;
+            case "no-tasks":
+                guardError = `no tasks found for slice ${params.sliceId} in milestone ${params.milestoneId}`;
+                break;
+            case "incomplete-tasks": {
+                const incompleteIds = outcome.incomplete.map((t) => `${t.id} (status: ${t.status})`).join(", ");
+                guardError = `incomplete tasks: ${incompleteIds}`;
+                break;
+            }
+        }
+    }
     if (duplicateComplete) {
         const staleSummaryPath = sliceSummaryPath(artifactBasePath, params.milestoneId, params.sliceId);
         const duplicateIsStale = isStaleWrite("complete-slice");

package/dist/resources/extensions/gsd/tools/exec-tool.js

@@ -4,6 +4,7 @@ import { EXEC_DEFAULTS, runExecSandbox, } from "../exec-sandbox.js";
 import { realpathSync } from "node:fs";
 import path from "node:path";
 import { isContextModeEnabled } from "../preferences-types.js";
+import { projectRootFromWorktreePath } from "../worktree-root.js";
 import { contextModeDisabledResult } from "./context-mode-tool-result.js";
 const UAT_EXEC_INTENTS = [
     "uat-artifact-check",
@@ -141,14 +142,10 @@ function normalizeScanPath(value) {
 }
 function parseWorktreeBase(baseDir) {
     const normalizedBase = normalizeScanPath(baseDir);
-    const marker = "/.gsd/worktrees/";
-    const markerIndex = normalizedBase.indexOf(marker);
-    if (markerIndex <= 0)
+    const originalRoot = projectRootFromWorktreePath(normalizedBase);
+    if (!originalRoot)
         return null;
-    return {
-        originalRoot: normalizedBase.slice(0, markerIndex),
-        worktreeRoot: normalizedBase,
-    };
+    return { originalRoot, worktreeRoot: normalizedBase };
 }
 function pathInside(parent, target) {
     const parentWithSep = parent.endsWith("/") ? parent : `${parent}/`;
@@ -234,7 +231,7 @@ function scriptReferencesOriginalRootFromWorktree(script, baseDir) {
         return false;
     const normalizedScript = script.replace(/\\/g, "/");
     return comparablePathVariants(parsed.originalRoot).some((originalRoot) => {
-        const originalRootPattern = new RegExp(`${escapeRegExp(originalRoot)}(?=$|[\\s'"\\\`;)&|<>]|/(?!\\.gsd/worktrees(?:/|$)))`);
+        const originalRootPattern = new RegExp(`${escapeRegExp(originalRoot)}(?=$|[\\s'"\\\`;)&|<>]|/(?!\\.gsd(?:-worktrees|/worktrees)(?:/|$)))`);
         return originalRootPattern.test(normalizedScript);
     });
 }

package/dist/resources/extensions/gsd/tools/plan-slice.js

@@ -12,7 +12,8 @@ import { writeManifest } from "../workflow-manifest.js";
 import { appendEvent } from "../workflow-events.js";
 import { logWarning } from "../workflow-logger.js";
 import { validatePathOnlyPlanningFields, validatePlanningPathScope } from "../planning-path-scope.js";
-import { checkFilePathConsistency, checkTaskOrdering } from "../pre-execution-checks.js";
+import { runTaskPathChecks } from "../pre-execution-checks.js";
+import { resolveWorktreeProjectRoot } from "../worktree-root.js";
 import { buildTaskFileName, gsdProjectionRoot } from "../paths.js";
 import { loadEffectiveGSDPreferences } from "../preferences.js";
 import { createRepositoryRegistryFromPreferences, defaultRepositoryTargets } from "../repository-registry.js";
@@ -193,11 +194,16 @@ function validateTaskPathsBeforePersist(params, basePath, defaultTargets, allowe
     const additionalRoots = allowedRoots
         .map((root) => resolve(root))
         .filter((root) => root !== baseRoot);
-    const context = additionalRoots.length > 0 ? { additionalRoots } : undefined;
-    const checks = [
-        ...checkFilePathConsistency(taskRows, basePath, context),
-        ...checkTaskOrdering(taskRows, basePath, context),
-    ];
+    const resolvedCanonicalRoot = resolve(resolveWorktreeProjectRoot(basePath));
+    const canonicalProjectRoot = resolvedCanonicalRoot !== baseRoot ? resolvedCanonicalRoot : undefined;
+    const hasContext = additionalRoots.length > 0 || canonicalProjectRoot !== undefined;
+    const context = hasContext
+        ? {
+            ...(additionalRoots.length > 0 ? { additionalRoots } : {}),
+            ...(canonicalProjectRoot !== undefined ? { canonicalProjectRoot } : {}),
+        }
+        : undefined;
+    const checks = runTaskPathChecks(taskRows, basePath, context);
     const blocking = checks.filter((check) => !check.passed && check.blocking);
     if (blocking.length === 0)
         return null;

package/dist/resources/extensions/gsd/tools/reopen-milestone.js

@@ -7,9 +7,8 @@
  * artifacts so the DB-filesystem reconciler does not auto-correct
  * entities back to "complete".
  */
-import { getMilestone, getMilestoneSlices, getSliceTasks, reopenMilestoneStatus, updateSliceStatus, updateTaskStatus, transaction, } from "../gsd-db.js";
+import { getMilestoneSlices, getSliceTasks, reopenMilestoneCascade, } from "../gsd-db.js";
 import { invalidateStateCache } from "../state.js";
-import { isClosedStatus } from "../status-guards.js";
 import { renderAllProjections } from "../workflow-projections.js";
 import { writeManifest } from "../workflow-manifest.js";
 import { appendEvent } from "../workflow-events.js";
@@ -23,35 +22,18 @@ export async function handleReopenMilestone(params, basePath) {
     if (!params.milestoneId || typeof params.milestoneId !== "string" || params.milestoneId.trim() === "") {
         return { error: "milestoneId is required and must be a non-empty string" };
     }
-    // ── Guards + DB writes inside a single transaction (prevents TOCTOU) ───
-    let guardError = null;
-    let slicesResetCount = 0;
-    let tasksResetCount = 0;
-    transaction(() => {
-        const milestone = getMilestone(params.milestoneId);
-        if (!milestone) {
-            guardError = `milestone not found: ${params.milestoneId}`;
-            return;
+    // ── Atomic reopen cascade (guards + writes in one transaction) ───────────
+    const outcome = reopenMilestoneCascade(params.milestoneId);
+    if (!outcome.ok) {
+        switch (outcome.reason) {
+            case "milestone-not-found":
+                return { error: `milestone not found: ${params.milestoneId}` };
+            case "milestone-not-closed":
+                return { error: `milestone ${params.milestoneId} is not closed (status: ${outcome.status}) — nothing to reopen` };
         }
-        if (!isClosedStatus(milestone.status)) {
-            guardError = `milestone ${params.milestoneId} is not closed (status: ${milestone.status}) — nothing to reopen`;
-            return;
-        }
-        reopenMilestoneStatus(params.milestoneId);
-        const slices = getMilestoneSlices(params.milestoneId);
-        slicesResetCount = slices.length;
-        for (const slice of slices) {
-            updateSliceStatus(params.milestoneId, slice.id, "in_progress");
-            const tasks = getSliceTasks(params.milestoneId, slice.id);
-            tasksResetCount += tasks.length;
-            for (const task of tasks) {
-                updateTaskStatus(params.milestoneId, slice.id, task.id, "pending");
-            }
-        }
-    });
-    if (guardError) {
-        return { error: guardError };
     }
+    const slicesResetCount = outcome.slicesReset;
+    const tasksResetCount = outcome.tasksReset;
     // ── Invalidate caches ────────────────────────────────────────────────────
     invalidateStateCache();
     // ── Clean up stale filesystem artifacts (M12 fix) ────────────────────────

package/dist/resources/extensions/gsd/tools/reopen-slice.js

@@ -9,9 +9,8 @@
  */
 // GSD — reopen-slice tool handler
 // Copyright (c) 2026 Jeremy McSpadden <jeremy@fluxlabs.net>
-import { getMilestone, getSlice, getSliceTasks, updateSliceStatus, updateTaskStatus, transaction, } from "../gsd-db.js";
+import { getSliceTasks, reopenSliceCascade, } from "../gsd-db.js";
 import { invalidateStateCache } from "../state.js";
-import { isClosedStatus } from "../status-guards.js";
 import { renderAllProjections } from "../workflow-projections.js";
 import { writeManifest } from "../workflow-manifest.js";
 import { appendEvent } from "../workflow-events.js";
@@ -27,39 +26,21 @@ export async function handleReopenSlice(params, basePath) {
     if (!params.milestoneId || typeof params.milestoneId !== "string" || params.milestoneId.trim() === "") {
         return { error: "milestoneId is required and must be a non-empty string" };
     }
-    // ── Guards + DB writes inside a single transaction (prevents TOCTOU) ───
-    let guardError = null;
-    let tasksResetCount = 0;
-    transaction(() => {
-        const milestone = getMilestone(params.milestoneId);
-        if (!milestone) {
-            guardError = `milestone not found: ${params.milestoneId}`;
-            return;
+    // ── Atomic reopen cascade (guards + writes in one transaction) ───────────
+    const outcome = reopenSliceCascade(params.milestoneId, params.sliceId);
+    if (!outcome.ok) {
+        switch (outcome.reason) {
+            case "milestone-not-found":
+                return { error: `milestone not found: ${params.milestoneId}` };
+            case "milestone-closed":
+                return { error: `cannot reopen slice in a closed milestone: ${params.milestoneId} (status: ${outcome.status})` };
+            case "slice-not-found":
+                return { error: `slice not found: ${params.milestoneId}/${params.sliceId}` };
+            case "slice-not-complete":
+                return { error: `slice ${params.sliceId} is not complete (status: ${outcome.status}) — nothing to reopen` };
         }
-        if (isClosedStatus(milestone.status)) {
-            guardError = `cannot reopen slice in a closed milestone: ${params.milestoneId} (status: ${milestone.status})`;
-            return;
-        }
-        const slice = getSlice(params.milestoneId, params.sliceId);
-        if (!slice) {
-            guardError = `slice not found: ${params.milestoneId}/${params.sliceId}`;
-            return;
-        }
-        if (!isClosedStatus(slice.status)) {
-            guardError = `slice ${params.sliceId} is not complete (status: ${slice.status}) — nothing to reopen`;
-            return;
-        }
-        // Fetch tasks inside txn so the list is consistent with the slice status check
-        const tasks = getSliceTasks(params.milestoneId, params.sliceId);
-        tasksResetCount = tasks.length;
-        updateSliceStatus(params.milestoneId, params.sliceId, "in_progress");
-        for (const task of tasks) {
-            updateTaskStatus(params.milestoneId, params.sliceId, task.id, "pending");
-        }
-    });
-    if (guardError) {
-        return { error: guardError };
     }
+    const tasksResetCount = outcome.tasksReset;
     // ── Invalidate caches ────────────────────────────────────────────────────
     invalidateStateCache();
     // ── Clean up stale filesystem artifacts (M12 fix) ────────────────────────

package/dist/resources/extensions/gsd/tools/skip-slice.js

@@ -9,8 +9,7 @@
  * This function performs DB writes only. The MCP wrapper in
  * bootstrap/db-tools.ts handles state-cache invalidation and STATE.md rebuild.
  */
-import { getSlice, getSliceTasks, isDbAvailable, transaction, updateSliceStatus, updateTaskStatus, } from "../gsd-db.js";
-import { isClosedStatus } from "../status-guards.js";
+import { isDbAvailable, skipSliceCascade, } from "../gsd-db.js";
 /**
  * Mark a slice as "skipped" and cascade the skip to every non-closed task in
  * that slice. Runs as a single transaction so slice status and task statuses
@@ -39,40 +38,23 @@ export function handleSkipSlice(params) {
     if (!isDbAvailable()) {
         throw new Error("handleSkipSlice: GSD database is not available");
     }
-    // ── Guards + DB writes inside a single transaction (prevents TOCTOU) ────
-    let guardError = null;
-    let guardCode = null;
-    let wasAlreadySkipped = false;
-    let tasksSkipped = 0;
-    transaction(() => {
-        const slice = getSlice(params.milestoneId, params.sliceId);
-        if (!slice) {
-            guardError = `Slice ${params.sliceId} not found in milestone ${params.milestoneId}`;
-            guardCode = "slice_not_found";
-            return;
+    // ── Atomic skip cascade (guards + writes in one transaction) ────────────
+    const outcome = skipSliceCascade(params.milestoneId, params.sliceId);
+    if (!outcome.ok) {
+        switch (outcome.reason) {
+            case "slice-not-found":
+                return {
+                    ...base,
+                    error: `Slice ${params.sliceId} not found in milestone ${params.milestoneId}`,
+                    errorCode: "slice_not_found",
+                };
+            case "slice-already-complete":
+                return {
+                    ...base,
+                    error: `Slice ${params.sliceId} is already complete — cannot skip.`,
+                    errorCode: "already_complete",
+                };
         }
-        if (slice.status === "complete" || slice.status === "done") {
-            guardError = `Slice ${params.sliceId} is already complete — cannot skip.`;
-            guardCode = "already_complete";
-            return;
-        }
-        wasAlreadySkipped = slice.status === "skipped";
-        if (!wasAlreadySkipped) {
-            updateSliceStatus(params.milestoneId, params.sliceId, "skipped");
-        }
-        // Cascade: mark every non-closed task as skipped so milestone completion
-        // doesn't trip the deep-task guard (#4375). Closed tasks (complete/done/
-        // skipped) are left untouched — we never downgrade.
-        const tasks = getSliceTasks(params.milestoneId, params.sliceId);
-        for (const task of tasks) {
-            if (!isClosedStatus(task.status)) {
-                updateTaskStatus(params.milestoneId, params.sliceId, task.id, "skipped");
-                tasksSkipped++;
-            }
-        }
-    });
-    if (guardError) {
-        return { ...base, error: guardError, errorCode: guardCode ?? undefined };
     }
-    return { ...base, tasksSkipped, wasAlreadySkipped };
+    return { ...base, tasksSkipped: outcome.tasksSkipped, wasAlreadySkipped: outcome.wasAlreadySkipped };
 }

package/dist/resources/extensions/gsd/undo.js

@@ -11,7 +11,7 @@ import { deriveState } from "./state.js";
 import { invalidateAllCaches } from "./cache.js";
 import { gsdRoot, resolveTasksDir, resolveSlicePath, resolveTaskFile, buildTaskFileName, buildSliceFileName } from "./paths.js";
 import { sendDesktopNotification } from "./notifications.js";
-import { getTask, getSlice, getSliceTasks, updateTaskStatus, updateSliceStatus } from "./gsd-db.js";
+import { getTask, getSlice, getSliceTasks, updateTaskStatus, resetSliceCascade } from "./gsd-db.js";
 import { renderPlanCheckboxes, renderRoadmapCheckboxes } from "./markdown-renderer.js";
 /**
  * Undo the last completed unit: revert git commits,
@@ -275,20 +275,21 @@ export async function handleResetSlice(args, ctx, _pi, basePath) {
             `Run /gsd reset-slice ${rawId} --force to confirm.`, "warning");
         return;
     }
-    // Reset all tasks
-    let tasksReset = 0;
+    // Reset all task statuses to "pending" and the slice to "active" in one
+    // atomic commit (DB is source of truth). Previously a per-task updateTaskStatus
+    // loop + a separate updateSliceStatus, which could leave a partial reset if
+    // interrupted mid-loop.
+    resetSliceCascade(mid, sid);
+    // Delete task summary files — projection cleanup, separate from the DB reset.
+    const tasksReset = tasks.length;
     let summariesDeleted = 0;
     for (const t of tasks) {
-        updateTaskStatus(mid, sid, t.id, "pending");
-        tasksReset++;
         const summaryPath = resolveTaskFile(basePath, mid, sid, t.id, "SUMMARY");
         if (summaryPath && existsSync(summaryPath)) {
             unlinkSync(summaryPath);
             summariesDeleted++;
         }
     }
-    // Reset slice status
-    updateSliceStatus(mid, sid, "active");
     // Delete slice summary and UAT files
     let sliceFilesDeleted = 0;
     const slicePath = resolveSlicePath(basePath, mid, sid);