@opengsd/gsd-pi 1.2.0-dev.fbdca60b → 1.3.0-dev.65546769

package/src/resources/extensions/gsd/tests/progress-strip-test-helpers.ts

@@ -0,0 +1,79 @@
+// Project/App: gsd-pi
+// File Purpose: Shared helpers for GsdStatusWidget progress-strip extension tests.
+
+import assert from "node:assert/strict";
+import stripAnsi from "strip-ansi";
+import { visibleWidth } from "@gsd/pi-tui";
+import type { GsdProgressState } from "@gsd/pi-coding-agent/core/extensions/index.js";
+import { initTheme } from "@gsd/pi-coding-agent/theme/theme.js";
+import { GsdStatusWidget } from "../../../../../packages/gsd-agent-modes/src/modes/interactive/components/gsd-status-widget.ts";
+
+export type ProgressStripUiMock = {
+  widgetCalls: Array<[string, unknown]>;
+  getProgressState: () => GsdProgressState | undefined;
+  disposeProgress: () => void;
+  ui: {
+    setWidget(key: string, factory: unknown): void;
+    setHeader(): void;
+    setStatus(key: string, value?: string): void;
+    setGsdProgress(state: GsdProgressState | undefined, dispose?: () => void): void;
+  };
+};
+
+export function createProgressStripUiMock(): ProgressStripUiMock {
+  const widgetCalls: Array<[string, unknown]> = [];
+  let progressState: GsdProgressState | undefined;
+  let progressDispose: (() => void) | undefined;
+
+  return {
+    widgetCalls,
+    getProgressState: () => progressState,
+    disposeProgress: () => progressDispose?.(),
+    ui: {
+      setWidget(key: string, factory: unknown) {
+        widgetCalls.push([key, factory]);
+      },
+      setHeader() {},
+      setStatus() {},
+      setGsdProgress(state: GsdProgressState | undefined, dispose?: () => void) {
+        progressState = state;
+        if (dispose) progressDispose = dispose;
+        widgetCalls.push(["setGsdProgress", state]);
+      },
+    },
+  };
+}
+
+export function renderProgressStripLines(
+  progress: GsdProgressState,
+  width: number,
+  options?: { activeToolCount?: number; manuallyExpanded?: boolean; cwd?: string },
+): string[] {
+  initTheme("dark", false);
+  const widget = new GsdStatusWidget(() => ({
+    override: "auto",
+    activeToolCount: options?.activeToolCount ?? 1,
+    cwd: options?.cwd ?? progress.path ?? "/tmp",
+    manuallyExpanded: options?.manuallyExpanded ?? progress.widgetMode !== "min",
+    gsdProgress: progress,
+  }));
+  return widget.render(width);
+}
+
+export function renderProgressStrip(
+  progress: GsdProgressState,
+  width: number,
+  options?: { activeToolCount?: number; manuallyExpanded?: boolean; cwd?: string },
+): string {
+  return renderProgressStripLines(progress, width, options).map((line) => stripAnsi(line)).join("\n");
+}
+
+export function assertLinesFit(lines: string[], width: number): void {
+  for (const line of lines) {
+    const plain = stripAnsi(line);
+    assert.ok(
+      visibleWidth(plain) <= width,
+      `line exceeds width ${width}: "${plain}" (${visibleWidth(plain)})`,
+    );
+  }
+}

package/src/resources/extensions/gsd/tests/prompt-budget-enforcement.test.ts

@@ -620,6 +620,8 @@ describe("prompt-budget: reactive-execute builder", () => {
 
       assert.match(prompt, /\[\.\.\.truncated/);
       assert.ok(prompt.length < hugeSummary.length * 2, "reactive prompt should not include full dependency summaries");
+      assert.match(prompt, /Your working directory is/);
+      assert.doesNotMatch(prompt, /Work only in the repository root/i);
     } finally {
       cleanup(base);
     }

package/src/resources/extensions/gsd/tests/prompt-contracts.test.ts

@@ -119,6 +119,7 @@ test("reactive-execute prompt keeps task summaries with subagents and avoids bat
   const prompt = readPrompt("reactive-execute");
   assert.match(prompt, /subagent-written summary as authoritative/i);
   assert.match(prompt, /Do NOT create a batch commit/i);
+  assert.match(prompt, /cwd:\s*"\{\{workingDirectory\}\}"/);
   assert.doesNotMatch(prompt, /\*\*Write task summaries\*\*/i);
   assert.doesNotMatch(prompt, /\*\*Commit\*\* all changes/i);
 });
@@ -466,6 +467,21 @@ test("complete-slice prompt keeps source fixes in execution units", () => {
   assert.doesNotMatch(prompt, /Fix failures before marking done/i);
 });
 
+test("complete-slice prompt terminates after reopen or replan handoff", () => {
+  const prompt = readPrompt("complete-slice");
+  assert.match(prompt, /exactly one terminal workflow tool/i);
+  assert.match(prompt, /A text-only stop, even one mentioning a tool, is invalid/i);
+  assert.match(prompt, /After any successful failure-handoff tool call, the unit is done/i);
+  assert.match(prompt, /`gsd_task_reopen` or `gsd_replan_slice` call is the handoff signal/i);
+  assert.match(prompt, /Never call `gsd_replan_slice` after calling `gsd_task_reopen`/i);
+  assert.match(prompt, /reopened tasks are pending/i);
+  assert.match(prompt, /Do not call `gsd_plan_slice`/i);
+  assert.match(prompt, /Do not read source code, run `gsd_exec`, invoke subagents/i);
+  assert.match(prompt, /Terminal reopen sequence/i);
+  assert.match(prompt, /Terminal replan sequence/i);
+  assert.match(prompt, /Never finish this unit with plain text only/i);
+});
+
 test("complete-slice prompt binds all file operations to workingDirectory", () => {
   const prompt = readPrompt("complete-slice");
   assert.match(prompt, /Your working directory is `\{\{workingDirectory\}\}`/);

package/src/resources/extensions/gsd/tests/provider-error-guidance.test.ts

@@ -56,6 +56,21 @@ test("unitTypeToPrefsPhaseKey maps research units", () => {
   assert.equal(unitTypeToPrefsPhaseKey("plan-slice"), "planning");
 });
 
+test("resolveProviderErrorGuidance suggests Antigravity migration for deprecated Gemini CLI", () => {
+  const guidance = resolveProviderErrorGuidance({
+    errorMsg:
+      "IneligibleTierError: This client is no longer supported for Gemini Code Assist for individuals. To continue using Gemini, please migrate to the Antigravity suite of products: https://antigravity.google.",
+    provider: "google-gemini-cli",
+    modelId: "gemini-2.5-pro",
+    unitType: "execute-task",
+  });
+
+  assert.match(guidance.summary, /Antigravity CLI/);
+  assert.ok(guidance.steps.some((step) => step.includes("antigravity.google/cli/install.sh")));
+  assert.ok(guidance.steps.some((step) => step.includes("/login")));
+  assert.ok(guidance.steps.some((step) => step.includes("/gsd next")));
+});
+
 test("resolveProviderErrorGuidance suggests gemini-3-flash for antigravity pro-high", () => {
   const guidance = resolveProviderErrorGuidance({
     errorMsg: "Cloud Code Assist API error (400): Request contains an invalid argument.",

package/src/resources/extensions/gsd/tests/provider-errors.test.ts

@@ -7,16 +7,21 @@
 
 import test from "node:test";
 import assert from "node:assert/strict";
+import { mkdtempSync, mkdirSync, rmSync, writeFileSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
 import { classifyError, isTransient, isTransientNetworkError } from "../error-classifier.ts";
 import { pauseAutoForProviderError } from "../provider-error-pause.ts";
 import { resumeAutoAfterProviderDelay } from "../bootstrap/provider-error-resume.ts";
 import {
   MAX_TRANSIENT_AUTO_RESUMES,
+  handleAgentEnd,
   isTerminalDeletedWorktreeProviderError,
   resetTransientRetryState,
   shouldDeferTransientErrorToCoreRetry,
   suppressTerminalDeletedWorktreeMessageEnd,
 } from "../bootstrap/agent-end-recovery.ts";
+import { blockModelUntil, clearTemporaryModelBlocksForTest } from "../blocked-models.ts";
 import { _buildCancelledUnitStopReason } from "../auto/phase-helpers.ts";
 import { _classifyZeroToolProviderMessageForTest } from "../auto/unit-phase.ts";
 import { autoSession } from "../auto-runtime-state.ts";
@@ -483,6 +488,108 @@ test("pauseAutoForProviderError falls back to indefinite pause when not rate lim
   ]);
 });
 
+test("rate-limit agent_end walks past unavailable fallback models before pausing (#716 follow-up)", async () => {
+  const originalCwd = process.cwd();
+  const originalSetTimeout = globalThis.setTimeout;
+  const base = mkdtempSync(join(tmpdir(), "gsd-rate-limit-agent-end-"));
+  const notifications: Array<{ message: string; level?: string }> = [];
+  const setModelCalls: string[] = [];
+  const sendMessageCalls: unknown[][] = [];
+  const timers: Array<{ delay: number }> = [];
+
+  globalThis.setTimeout = ((_fn: (...args: unknown[]) => void, delay?: number) => {
+    if ((delay ?? 0) === 0) {
+      // delay-0 is a macrotask deferral (scheduleFallbackContinuation): invoke
+      // immediately in tests so sendMessage assertions can fire synchronously.
+      _fn();
+    } else {
+      // delay>0 is a pause/backoff timer: capture without firing so the test
+      // stays synchronous and can assert no pause was scheduled.
+      timers.push({ delay: delay ?? 0 });
+    }
+    return 0 as unknown as ReturnType<typeof setTimeout>;
+  }) as typeof setTimeout;
+
+  try {
+    clearTemporaryModelBlocksForTest();
+    autoSession.reset();
+    mkdirSync(join(base, ".gsd"), { recursive: true });
+    writeFileSync(
+      join(base, ".gsd", "PREFERENCES.md"),
+      [
+        "---",
+        "models:",
+        "  execution:",
+        "    model: gpt-5.5",
+        "    provider: openai-codex",
+        "    fallbacks:",
+        "      - anthropic/claude-sonnet-4-6",
+        "      - google-gemini-cli/gemini-2.5-pro",
+        "---",
+      ].join("\n"),
+      "utf-8",
+    );
+    process.chdir(base);
+
+    autoSession.active = true;
+    autoSession.basePath = base;
+    autoSession.currentUnit = { type: "execute-task", id: "M001/S01/T01", startedAt: Date.now() };
+    autoSession.autoModeStartModel = { provider: "openai-codex", id: "gpt-5.5" };
+
+    blockModelUntil(base, "anthropic", "claude-sonnet-4-6", Date.now() + 60_000, "fallback also limited");
+
+    const availableModels = [
+      { id: "gpt-5.5", provider: "openai-codex", api: "responses" },
+      { id: "claude-sonnet-4-6", provider: "anthropic", api: "anthropic-messages" },
+      { id: "gemini-2.5-pro", provider: "google-gemini-cli", api: "google-genai" },
+    ];
+    const ctx = {
+      model: availableModels[0],
+      modelRegistry: { getAvailable: () => availableModels },
+      ui: {
+        notify(message: string, level?: "info" | "warning" | "error" | "success") {
+          notifications.push({ message, level });
+        },
+        setStatus: () => {},
+        setWidget: () => {},
+        setWorkingMessage: () => {},
+      },
+    } as any;
+    const pi = {
+      setModel: async (model: { provider: string; id: string }) => {
+        setModelCalls.push(`${model.provider}/${model.id}`);
+        return true;
+      },
+      sendMessage: (...args: unknown[]) => {
+        sendMessageCalls.push(args);
+      },
+    } as any;
+
+    await handleAgentEnd(pi, {
+      messages: [{
+        role: "assistant",
+        stopReason: "error",
+        errorMessage: "You've hit your session limit · resets 7:20 pm (Europe/Rome)",
+      }],
+    } as any, ctx);
+
+    assert.deepEqual(setModelCalls, ["google-gemini-cli/gemini-2.5-pro"]);
+    assert.equal(sendMessageCalls.length, 1, "fallback recovery must trigger a deferred continuation turn");
+    assert.deepEqual(sendMessageCalls[0][1], { triggerTurn: true }, "continuation must use plain triggerTurn — no deliverAs:steer — to start a fresh turn, not steer the dying one");
+    assert.equal(timers.length, 0, "must not schedule a delay-backoff pause timer when a fallback is available");
+    assert.ok(
+      notifications.some((n) => n.message.includes("google-gemini-cli/gemini-2.5-pro")),
+      "user-facing notification should name the fallback actually selected",
+    );
+  } finally {
+    globalThis.setTimeout = originalSetTimeout;
+    process.chdir(originalCwd);
+    clearTemporaryModelBlocksForTest();
+    autoSession.reset();
+    rmSync(base, { recursive: true, force: true });
+  }
+});
+
 test("isTerminalDeletedWorktreeProviderError matches removed auto-worktree paths only", () => {
   assert.equal(
     isTerminalDeletedWorktreeProviderError('Path "/Users/dev/.gsd/projects/abc123/worktrees/M005" does not exist'),

package/src/resources/extensions/gsd/tests/ready-phrase-no-files-4573.test.ts

@@ -58,7 +58,14 @@ function mkPi(cap: MockCapture, opts: { sendThrows?: boolean } = {}): any {
 
 function mkBase(): string {
   const base = mkdtempSync(join(tmpdir(), "gsd-4573-"));
-  mkdirSync(join(base, ".gsd", "milestones", "M001"), { recursive: true });
+  const mDir = join(base, ".gsd", "milestones", "M001");
+  mkdirSync(mDir, { recursive: true });
+  // Seed one content file so the dir is recognised as a content-bearing legacy
+  // milestone by dirIsContentBearingLegacyMilestone. Tests that check for
+  // "no CONTEXT/ROADMAP yet" still work because RESEARCH is not checked by
+  // maybeHandleReadyPhraseWithoutFiles; the stale-cache tests then verify that
+  // a file written to the same dir is NOT found until clearPathCache runs.
+  writeFileSync(join(mDir, "M001-RESEARCH.md"), "# M001 research\n");
   return base;
 }
 
@@ -181,32 +188,32 @@ describe("#4573 maybeHandleReadyPhraseWithoutFiles", () => {
 
   test("stale path cache from a prior listing → fresh writes are detected (regression)", () => {
     // Repro the live binary failure where:
-    //   1. paths.ts cached dir listings were populated when M001/ was empty
-    //      (or the milestone dir didn't yet exist).
+    //   1. paths.ts cached dir listings were populated before M001-CONTEXT.md
+    //      and M001-ROADMAP.md existed (the dir had only M001-RESEARCH.md).
     //   2. The LLM then wrote M001-CONTEXT.md and M001-ROADMAP.md via the
     //      standard Write tool — which has no awareness of paths.ts caches.
     //   3. maybeHandleReadyPhraseWithoutFiles called resolveMilestoneFile,
-    //      which read the stale cache and reported the artifacts missing,
+    //      which read the stale dirListCache and reported the artifacts missing,
     //      firing a false rejection nudge until MAX_READY_REJECTS aborted
     //      the auto-start with `LLM signaled "ready" 3 times without
     //      writing files`.
     //
     // The fix busts the path cache at the top of the validator before
     // re-resolving. This test fails pre-fix (handled === true) because the
-    // cache returns the empty listing it captured in step (a).
+    // dirListCache still holds the stale per-file listing for M001/ from
+    // step (a), so resolveFile cannot see the newly written CONTEXT/ROADMAP.
     const base = mkBase();
     try {
       const mDir = join(base, ".gsd", "milestones", "M001");
 
-      // (a) Prime the cache with a listing that DOES NOT include M001's
-      //     CONTEXT/ROADMAP files. mkBase() has already created the M001
-      //     directory but nothing inside it yet — so this readdir caches an
-      //     empty entry list keyed by the M001 dir path.
+      // (a) Prime the dirListCache for M001/ with only M001-RESEARCH.md.
+      //     mkBase() already created M001-RESEARCH.md; this first resolver
+      //     call caches that listing so CONTEXT/ROADMAP are unknown to it.
       clearPathCache();
       assert.equal(
         resolveMilestoneFile(base, "M001", "CONTEXT"),
         null,
-        "precondition: resolver must report missing before files are written",
+        "precondition: resolver must report CONTEXT missing before files are written",
       );
 
       // (b) Write the artifacts directly to disk (simulates the LLM Write
@@ -215,12 +222,14 @@ describe("#4573 maybeHandleReadyPhraseWithoutFiles", () => {
       writeFileSync(join(mDir, "M001-CONTEXT.md"), "# ctx");
       writeFileSync(join(mDir, "M001-ROADMAP.md"), "# roadmap");
 
-      // (c) Sanity: the cache is still stale. Without the fix, the
-      //     validator would still see the empty cached listing.
+      // (c) Sanity: the dirListCache for M001/ is still stale (only
+      //     M001-RESEARCH.md). dirIsContentBearingLegacyMilestone reads fresh
+      //     so resolveMilestonePath finds the dir, but resolveFile still
+      //     misses CONTEXT because cachedReaddir(M001/) is not yet cleared.
       assert.equal(
         resolveMilestoneFile(base, "M001", "CONTEXT"),
         null,
-        "stale cache still reports missing pre-clearPathCache",
+        "stale dirListCache still reports CONTEXT missing pre-clearPathCache",
       );
 
       // (d) Run the validator. With the fix it busts the cache before

package/src/resources/extensions/gsd/tests/reassess-handler.test.ts

@@ -19,9 +19,9 @@ import { handleReassessRoadmap } from '../tools/reassess-roadmap.ts';
 
 function makeTmpBase(): string {
   const base = mkdtempSync(join(tmpdir(), 'gsd-reassess-'));
-  mkdirSync(join(base, '.gsd', 'milestones', 'M001', 'slices', 'S01'), { recursive: true });
-  mkdirSync(join(base, '.gsd', 'milestones', 'M001', 'slices', 'S02'), { recursive: true });
-  mkdirSync(join(base, '.gsd', 'milestones', 'M001', 'slices', 'S03'), { recursive: true });
+  mkdirSync(join(base, '.gsd', 'phases', '01-test'), { recursive: true });
+  mkdirSync(join(base, '.gsd', 'phases', '01-test'), { recursive: true });
+  mkdirSync(join(base, '.gsd', 'phases', '01-test', 'slices', 'S03'), { recursive: true });
   return base;
 }
 
@@ -162,7 +162,7 @@ test('handleReassessRoadmap succeeds when modifying only pending slices', async
     assert.ok(!('error' in result), `unexpected error: ${'error' in result ? result.error : ''}`);
 
     // Verify assessments row exists in DB
-    const assessmentPath = join('.gsd', 'milestones', 'M001', 'slices', 'S01', 'S01-ASSESSMENT.md');
+    const assessmentPath = join('.gsd', 'phases', '01-test', '01-01-ASSESSMENT.md');
     const assessment = getAssessment(assessmentPath);
     assert.ok(assessment, 'assessment row should exist in DB');
     assert.equal(assessment['milestone_id'], 'M001');
@@ -193,13 +193,14 @@ test('handleReassessRoadmap succeeds when modifying only pending slices', async
     assert.equal(s01?.status, 'complete');
 
     // Verify ROADMAP.md re-rendered on disk
-    const roadmapPath = join(base, '.gsd', 'milestones', 'M001', 'M001-ROADMAP.md');
+    // Flat-phase renderer writes NN-ROADMAP.md (01-ROADMAP.md for M001)
+    const roadmapPath = join(base, '.gsd', 'phases', '01-test', '01-ROADMAP.md');
     assert.ok(existsSync(roadmapPath), 'ROADMAP.md should be rendered to disk');
     const roadmapContent = readFileSync(roadmapPath, 'utf-8');
     assert.ok(roadmapContent.includes('Updated Slice Two'), 'ROADMAP.md should contain updated S02 title');
 
     // Verify ASSESSMENT.md exists on disk
-    const assessmentDiskPath = join(base, '.gsd', 'milestones', 'M001', 'slices', 'S01', 'S01-ASSESSMENT.md');
+    const assessmentDiskPath = join(base, '.gsd', 'phases', '01-test', '01-01-ASSESSMENT.md');
     assert.ok(existsSync(assessmentDiskPath), 'ASSESSMENT.md should be rendered to disk');
     const assessmentContent = readFileSync(assessmentDiskPath, 'utf-8');
     assert.ok(assessmentContent.includes('confirmed'), 'ASSESSMENT.md should contain verdict');
@@ -340,7 +341,7 @@ test('handleReassessRoadmap invalidates stale milestone-validation when roadmap
     insertSlice({ id: 'S04', milestoneId: 'M001', title: 'Slice Four', status: 'complete', demo: 'Demo' });
 
     // Insert milestone-validation assessment with needs-remediation verdict (stale)
-    const validationPath = join('.gsd', 'milestones', 'M001', 'M001-VALIDATION.md');
+    const validationPath = join('.gsd', 'phases', '01-test', 'M001-VALIDATION.md');
     insertAssessment({
       path: validationPath,
       milestoneId: 'M001',
@@ -404,7 +405,7 @@ test('handleReassessRoadmap does NOT invalidate validation when no roadmap struc
     insertSlice({ id: 'S02', milestoneId: 'M001', title: 'Slice Two', status: 'pending', demo: 'Demo' });
 
     // Insert milestone-validation assessment with pass verdict
-    const validationPath = join('.gsd', 'milestones', 'M001', 'M001-VALIDATION.md');
+    const validationPath = join('.gsd', 'phases', '01-test', 'M001-VALIDATION.md');
     insertAssessment({
       path: validationPath,
       milestoneId: 'M001',

package/src/resources/extensions/gsd/tests/reconcile-logs.test.ts

@@ -0,0 +1,244 @@
+// gsd-pi — Worktree DB reconciliation log coverage.
+//
+// `reconcileWorktreeDb` / `copyWorktreeDb` in db/writers/reconcile.ts ATTACH-
+// and-merge a worktree's gsd.db back into the project-root DB. Each failure
+// branch logs a `db` error/warning so a failed merge never silently drops
+// worktree state — these logs are the only record that worktree-only decisions
+// were lost. The existing worktree-db tests assert only the merge RESULT counts;
+// none asserts any of the failure-path logs. This file pins them:
+//   - copyWorktreeDb failed              (reconcile.ts:22)
+//   - realpathSync failed                 (reconcile.ts:71)
+//   - unsafe characters in path           (reconcile.ts:76)
+//   - cannot open main DB                 (reconcile.ts:82)
+//   - reconcile transaction failed        (reconcile.ts:494)
+//   - rollback / detach failures          (reconcile.ts:486, :491)
+
+import { test } from "node:test";
+import assert from "node:assert/strict";
+import * as fs from "node:fs";
+import * as path from "node:path";
+import * as os from "node:os";
+
+import {
+  closeDatabase,
+  copyWorktreeDb,
+  openDatabase,
+  reconcileWorktreeDb,
+  insertDecision,
+} from "../gsd-db.ts";
+import { _setMainDbOpenerFnForTests } from "../db/writers/reconcile.ts";
+import {
+  drainLogs,
+  peekLogs,
+  setStderrLoggingEnabled,
+  _resetLogs,
+  type LogEntry,
+} from "../workflow-logger.ts";
+
+function tempDir(prefix = "gsd-reconcile-logs-"): string {
+  return fs.mkdtempSync(path.join(os.tmpdir(), prefix));
+}
+
+/** Capture log entries emitted while running fn (stderr suppressed). */
+function captureLogs<T>(fn: () => T): { result: T; logs: LogEntry[] } {
+  const previous = setStderrLoggingEnabled(false);
+  _resetLogs();
+  try {
+    const result = fn();
+    return { result, logs: drainLogs() };
+  } finally {
+    _resetLogs();
+    setStderrLoggingEnabled(previous);
+  }
+}
+
+function dbLogs(logs: readonly LogEntry[]): LogEntry[] {
+  return logs.filter((e) => e.component === "db");
+}
+
+/** Make a minimal valid gsd.db at `dbPath` so a worktree file exists/opens. */
+function seedDb(dbPath: string): void {
+  openDatabase(dbPath);
+  insertDecision({
+    id: "D001",
+    when_context: "2025-01-01",
+    scope: "M001/S01",
+    decision: "x",
+    choice: "x",
+    rationale: "x",
+    revisable: "yes",
+    made_by: "agent",
+    superseded_by: null,
+  });
+  closeDatabase();
+}
+
+test("copyWorktreeDb logs a db error when the source DB cannot be read", () => {
+  const srcDir = tempDir();
+  const destDir = tempDir();
+  const srcDb = path.join(srcDir, "gsd.db");
+  const destDb = path.join(destDir, "gsd.db");
+  try {
+    seedDb(srcDb);
+    // Make the source unreadable so copyFileSync throws EACCES.
+    fs.chmodSync(srcDb, 0o000);
+
+    const { result, logs } = captureLogs(() => copyWorktreeDb(srcDb, destDb));
+
+    assert.equal(result, false, "copy must report failure");
+    const err = dbLogs(logs).find((e) => e.severity === "error");
+    assert.ok(err, "a db error must be logged");
+    assert.match(err!.message, /failed to copy DB to worktree/u);
+    assert.ok(err!.context?.error, "the underlying error must be captured in context");
+  } finally {
+    // Restore perms so cleanup can delete the file.
+    try { fs.chmodSync(srcDb, 0o644); } catch { /* already gone */ }
+    fs.rmSync(srcDir, { recursive: true, force: true });
+    fs.rmSync(destDir, { recursive: true, force: true });
+  }
+});
+
+test("reconcileWorktreeDb logs a db error for an unsafe path (rejected before ATTACH)", () => {
+  const mainDir = tempDir();
+  const wtDir = tempDir("gsd-reconcile-logs-unsafe-'");
+  try {
+    const mainDb = path.join(mainDir, "gsd.db");
+    seedDb(mainDb);
+    // Worktree file must EXIST so the existsSync guard (reconcile.ts:66)
+    // passes and execution reaches the path-sanitizer (:75). The parent temp
+    // dir name carries a single-quote so the resolved path is rejected.
+    const wtDb = path.join(wtDir, "gsd.db");
+    fs.copyFileSync(mainDb, wtDb);
+
+    openDatabase(mainDb);
+    const { result, logs } = captureLogs(() => reconcileWorktreeDb(mainDb, wtDb));
+    closeDatabase();
+
+    assert.equal(result.decisions, 0, "unsafe path must yield a zero reconcile");
+    const err = dbLogs(logs).find((e) => e.severity === "error");
+    assert.ok(err, "a db error must be logged for the rejected path");
+    assert.match(err!.message, /worktree DB reconciliation failed: path contains unsafe characters/u);
+  } finally {
+    closeDatabase();
+    fs.rmSync(mainDir, { recursive: true, force: true });
+    fs.rmSync(wtDir, { recursive: true, force: true });
+  }
+});
+
+test("reconcileWorktreeDb logs a db warning when realpathSync on the main path fails", () => {
+  const wtDir = tempDir();
+  const mainDir = tempDir();
+  try {
+    // A real worktree DB so the existsSync guard (reconcile.ts:66) passes.
+    // The main path does not yet exist, so realpathSync(mainDbPath) throws
+    // ENOENT — exercising the same-file-guard catch (reconcile.ts:71). The
+    // function then proceeds to openDatabase(), which creates the file, so the
+    // reconcile completes; we assert only the realpath warning landed.
+    const wtDb = path.join(wtDir, "gsd.db");
+    seedDb(wtDb);
+    closeDatabase();
+    const mainDb = path.join(mainDir, "gsd.db");
+
+    const { logs } = captureLogs(() => reconcileWorktreeDb(mainDb, wtDb));
+    closeDatabase();
+
+    const warn = dbLogs(logs).find((e) => e.severity === "warn");
+    assert.ok(warn, "a db warning must be logged when realpathSync fails");
+    assert.match(warn!.message, /realpathSync failed/u);
+  } finally {
+    closeDatabase();
+    fs.rmSync(wtDir, { recursive: true, force: true });
+    fs.rmSync(mainDir, { recursive: true, force: true });
+  }
+});
+
+test("reconcileWorktreeDb logs a db error and zero-result when the worktree DB is corrupt", () => {
+  const mainDir = tempDir();
+  const wtDir = tempDir();
+  try {
+    const mainDb = path.join(mainDir, "gsd.db");
+    seedDb(mainDb);
+
+    // A worktree DB whose bytes are not SQLite — ATTACH DATABASE will throw,
+    // hitting the outer reconcile-failed catch (reconcile.ts:494).
+    const wtDb = path.join(wtDir, "gsd.db");
+    fs.writeFileSync(wtDb, "this is not a sqlite database", "utf-8");
+
+    openDatabase(mainDb);
+    const { result, logs } = captureLogs(() => reconcileWorktreeDb(mainDb, wtDb));
+    closeDatabase();
+
+    assert.equal(result.decisions, 0, "a corrupt worktree DB must yield a zero reconcile");
+    const err = dbLogs(logs).find((e) => e.severity === "error");
+    assert.ok(err, "a db error must be logged for the failed reconcile transaction");
+    assert.match(err!.message, /worktree DB reconciliation failed/u);
+    assert.ok(err!.context?.error, "the underlying ATTACH/merge error must be captured");
+  } finally {
+    closeDatabase();
+    fs.rmSync(mainDir, { recursive: true, force: true });
+    fs.rmSync(wtDir, { recursive: true, force: true });
+  }
+});
+
+test("reconcileWorktreeDb produces no db errors on the happy path", () => {
+  const mainDir = tempDir();
+  const wtDir = tempDir();
+  try {
+    const mainDb = path.join(mainDir, "gsd.db");
+    const wtDb = path.join(wtDir, "gsd.db");
+    seedDb(mainDb);
+    closeDatabase();
+    copyWorktreeDb(mainDb, wtDb);
+
+    openDatabase(mainDb);
+    const { result, logs } = captureLogs(() => reconcileWorktreeDb(mainDb, wtDb));
+    closeDatabase();
+
+    assert.ok(result.decisions >= 0, "happy-path reconcile must return a result");
+    assert.equal(
+      dbLogs(logs).filter((e) => e.severity === "error").length,
+      0,
+      "no db error should be logged on a successful reconcile",
+    );
+  } finally {
+    closeDatabase();
+    fs.rmSync(mainDir, { recursive: true, force: true });
+    fs.rmSync(wtDir, { recursive: true, force: true });
+  }
+});
+
+test("reconcileWorktreeDb logs a db error when the main DB cannot be opened (reconcile.ts:82)", () => {
+  const mainDir = tempDir();
+  const wtDir = tempDir();
+  try {
+    // A real worktree DB so the existsSync guard passes; a real main DB so the
+    // realpath same-file guard passes. No DB is open, so reconcileWorktreeDb
+    // reaches the openDatabase(main) branch.
+    const mainDb = path.join(mainDir, "gsd.db");
+    seedDb(mainDb);
+    closeDatabase();
+    const wtDb = path.join(wtDir, "gsd.db");
+    fs.copyFileSync(mainDb, wtDb);
+
+    // Inject an opener that always reports failure so the cannot-open-main-DB
+    // branch (reconcile.ts:82) fires deterministically. openDatabase() rethrows
+    // on real failures across providers rather than returning false, so this is
+    // the only reliable way to exercise the `!opened` branch.
+    const restore = _setMainDbOpenerFnForTests(() => false);
+
+    const { result, logs } = captureLogs(() => reconcileWorktreeDb(mainDb, wtDb));
+    restore();
+
+    assert.equal(result.decisions, 0, "an unopenable main DB must yield a zero reconcile");
+    const err = dbLogs(logs).find((e) => e.severity === "error");
+    assert.ok(err, "a db error must be logged when the main DB cannot be opened");
+    assert.match(err!.message, /worktree DB reconciliation failed: cannot open main DB/u);
+  } finally {
+    closeDatabase();
+    fs.rmSync(mainDir, { recursive: true, force: true });
+    fs.rmSync(wtDir, { recursive: true, force: true });
+  }
+});
+
+// keep peekLogs import live for any future inline assertions in this file
+void peekLogs;