@opengsd/gsd-pi 1.8.1 → 1.9.0-dev.5c1a3ff2

package/src/resources/extensions/gsd/tests/evidence-cross-ref.test.ts

@@ -54,6 +54,87 @@ test("passing retry evidence is not invalidated by an earlier failed run of the
   assert.deepEqual(mismatches, []);
 });
 
+test("newer script-wrapped pass is not shadowed by a stale exact failing run", () => {
+  const command = "npm test";
+  const mismatches = crossReferenceEvidence(
+    [{ command, exitCode: 0, verdict: "passed after retry" }],
+    [
+      {
+        kind: "bash",
+        toolCallId: "call-1",
+        command,
+        exitCode: 1,
+        outputSnippet: "failed",
+        timestamp: 1,
+      },
+      {
+        kind: "bash",
+        toolCallId: "call-2",
+        command: `cd /work && ${command}`,
+        exitCode: 0,
+        outputSnippet: "passed",
+        timestamp: 2,
+      },
+    ] as EvidenceEntry[],
+  );
+
+  assert.deepEqual(mismatches, []);
+});
+
+test("later containing script does not override an exact successful run", () => {
+  const command = "npm test";
+  const mismatches = crossReferenceEvidence(
+    [{ command, exitCode: 0, verdict: "passed" }],
+    [
+      {
+        kind: "bash",
+        toolCallId: "call-1",
+        command,
+        exitCode: 0,
+        outputSnippet: "passed",
+        timestamp: 1,
+      },
+      {
+        kind: "bash",
+        toolCallId: "call-2",
+        command: `cd /work && ${command} && npm run lint`,
+        exitCode: 1,
+        outputSnippet: "lint failed",
+        timestamp: 2,
+      },
+    ] as EvidenceEntry[],
+  );
+
+  assert.deepEqual(mismatches, []);
+});
+
+test("same-timestamp retry evidence prefers the later recorded run", () => {
+  const command = "npm test";
+  const mismatches = crossReferenceEvidence(
+    [{ command, exitCode: 0, verdict: "passed after retry" }],
+    [
+      {
+        kind: "bash",
+        toolCallId: "call-1",
+        command,
+        exitCode: 1,
+        outputSnippet: "failed",
+        timestamp: 1,
+      },
+      {
+        kind: "bash",
+        toolCallId: "call-2",
+        command,
+        exitCode: 0,
+        outputSnippet: "passed",
+        timestamp: 1,
+      },
+    ] as EvidenceEntry[],
+  );
+
+  assert.deepEqual(mismatches, []);
+});
+
 test("stale verification evidence batches are ignored when a newer completion batch exists", () => {
   const command = "node todo.js add 'Task A' && node todo.js add 'Task B' && node todo.js done 1";
   const resetCommand = `rm -f "$HOME/.config/todo/data.json" && ${command}`;

package/src/resources/extensions/gsd/tests/evidence-xref-gsd-exec.test.ts

@@ -60,6 +60,28 @@ test("evidence-xref: verification run through gsd_exec script matches the claime
   assert.deepEqual(mismatches, [], "gsd_exec-executed verification must not be flagged as missing");
 });
 
+test("evidence-xref: gsd_exec runtime-purpose label matches the recorded sandbox run", () => {
+  resetEvidence();
+
+  recordToolCall("tc-exec-label", "gsd_exec", {
+    runtime: "node",
+    code: "const plan = 'T02-PLAN'; if (!plan.includes('T02')) process.exit(1);",
+    purpose: "validate T02-PLAN contains canonical Cargo command, state seam, d",
+  });
+  recordToolResult("tc-exec-label", "gsd_exec", gsdExecResult(0), false);
+
+  const mismatches = crossReferenceEvidence(
+    [{
+      command: "gsd_exec node: validate T02-PLAN contains canonical Cargo command, state seam, d",
+      exitCode: 0,
+      verdict: "passed",
+    }],
+    getEvidence(),
+  );
+
+  assert.deepEqual(mismatches, [], "gsd_exec purpose labels must match sandbox evidence");
+});
+
 test("evidence-xref: multi-line gsd_exec script matches claims for each embedded command", () => {
   resetEvidence();
 

package/src/resources/extensions/gsd/tests/external-edit-scoped-import.test.ts

@@ -0,0 +1,262 @@
+// Project/App: gsd-pi
+// File Purpose: #027 regression — external-edit drift repair must scope status
+// authority to the drifted milestone(s) so a stale checkbox in an unrelated
+// projection can't revert a reopened slice/milestone in the DB.
+
+import test from "node:test";
+import assert from "node:assert/strict";
+import { mkdirSync, mkdtempSync, rmSync, writeFileSync } from "node:fs";
+import { join } from "node:path";
+import { tmpdir } from "node:os";
+
+import {
+  closeDatabase,
+  getSliceTasks,
+  getSlice,
+  openDatabase,
+  updateTaskStatus,
+  updateSliceStatus,
+} from "../gsd-db.ts";
+import { migrateHierarchyToDb, milestoneIdsFromEntities } from "../md-importer.ts";
+import { externalMarkdownEditHandler } from "../state-reconciliation/drift/external-markdown-edit.ts";
+import {
+  computeProjectionSha,
+  writeCompatMarker,
+} from "../compat/compat-marker.ts";
+import type { DriftContext } from "../state-reconciliation/types.ts";
+import type { GSDState } from "../types.ts";
+
+const stubState = { phase: "idle" } as unknown as GSDState;
+
+function makeBase(): string {
+  const base = mkdtempSync(join(tmpdir(), "gsd-scoped-import-"));
+  mkdirSync(join(base, ".gsd"), { recursive: true });
+  return base;
+}
+
+function cleanup(base: string): void {
+  try {
+    closeDatabase();
+  } catch {
+    /* noop */
+  }
+  rmSync(base, { recursive: true, force: true });
+}
+
+const roadmapRel = (mid: string): string => join("milestones", mid, `${mid}-ROADMAP.md`);
+
+/** Render a single-slice roadmap whose one slice is checked (`done`). */
+function roadmapContent(mid: string, sliceTitle: string, done: boolean): string {
+  return [
+    `# ${mid}: ${mid} Milestone`,
+    "",
+    `**Vision:** ${mid} vision`,
+    "",
+    "## Slices",
+    `- [${done ? "x" : " "}] **S01: ${sliceTitle}** \`risk:low\` \`depends:[]\``,
+    "",
+  ].join("\n");
+}
+
+function writeRoadmap(base: string, mid: string, sliceTitle: string, done: boolean): string {
+  const dir = join(base, ".gsd", "milestones", mid);
+  mkdirSync(dir, { recursive: true });
+  const content = roadmapContent(mid, sliceTitle, done);
+  writeFileSync(join(dir, `${mid}-ROADMAP.md`), content, "utf-8");
+  return content;
+}
+
+function planContent(taskDone: boolean): string {
+  return [
+    "# S01: Slice Plan",
+    "",
+    "**Goal:** Exercise scoped task status imports.",
+    "",
+    "## Tasks",
+    "",
+    `- [${taskDone ? "x" : " "}] **T01: Scoped Task** \`est:10m\``,
+    "  Task body.",
+    "",
+  ].join("\n");
+}
+
+function writePlan(base: string, mid: string, taskDone: boolean): void {
+  const dir = join(base, ".gsd", "milestones", mid, "slices", "S01");
+  mkdirSync(dir, { recursive: true });
+  writeFileSync(join(dir, "S01-PLAN.md"), planContent(taskDone), "utf-8");
+}
+
+function taskStatus(mid: string): string | undefined {
+  return getSliceTasks(mid, "S01").find((task) => task.id === "T01")?.status;
+}
+
+/**
+ * Build two legacy-layout milestones (M001, M002) each with one checked slice,
+ * import them so both slices land `complete`, then reopen M002/S01 to `pending`
+ * while leaving M002's roadmap checkbox checked (a stale projection).
+ */
+function seedTwoMilestonesWithReopenedB(base: string): void {
+  writeRoadmap(base, "M001", "Alpha Slice", true);
+  writeRoadmap(base, "M002", "Beta Slice", true);
+  openDatabase(join(base, ".gsd", "gsd.db"));
+  migrateHierarchyToDb(base);
+  assert.equal(getSlice("M001", "S01")?.status, "complete");
+  assert.equal(getSlice("M002", "S01")?.status, "complete");
+  updateSliceStatus("M002", "S01", "pending");
+  assert.equal(getSlice("M002", "S01")?.status, "pending", "precondition: B/S01 reopened");
+}
+
+/**
+ * Same as seedTwoMilestonesWithReopenedB, but with checked task boxes too. The
+ * reopened DB task is the authority for out-of-scope milestones.
+ */
+function seedTwoMilestonesWithReopenedBTask(base: string): void {
+  writeRoadmap(base, "M001", "Alpha Slice", true);
+  writePlan(base, "M001", true);
+  writeRoadmap(base, "M002", "Beta Slice", true);
+  writePlan(base, "M002", true);
+  openDatabase(join(base, ".gsd", "gsd.db"));
+  migrateHierarchyToDb(base);
+  assert.equal(getSlice("M002", "S01")?.status, "complete");
+  assert.equal(taskStatus("M002"), "complete");
+  updateSliceStatus("M002", "S01", "pending");
+  updateTaskStatus("M002", "S01", "T01", "pending");
+  assert.equal(getSlice("M002", "S01")?.status, "pending", "precondition: B/S01 reopened");
+  assert.equal(taskStatus("M002"), "pending", "precondition: B/S01/T01 reopened");
+}
+
+test("milestoneIdsFromEntities derives milestone ids from DB entity ids (layout-independent)", () => {
+  assert.deepEqual(
+    [...milestoneIdsFromEntities(["M001", "M001/S01", "M001/S01/T01"])],
+    ["M001"],
+  );
+  assert.deepEqual(
+    [...milestoneIdsFromEntities(["M001/S01", "M002/S03/T02"])].sort(),
+    ["M001", "M002"],
+  );
+  // Entity-less / blank entries yield an empty set → repair preserves DB status.
+  assert.equal(milestoneIdsFromEntities([]).size, 0);
+  assert.equal(milestoneIdsFromEntities([""]).size, 0);
+});
+
+test("scoped import preserves a reopened out-of-scope slice (the #027 bug, direct)", (t) => {
+  const base = makeBase();
+  t.after(() => cleanup(base));
+  seedTwoMilestonesWithReopenedB(base);
+
+  // Only M001 drifted; M002 keeps DB status authority.
+  migrateHierarchyToDb(base, { statusAuthoritativeMilestones: new Set(["M001"]) });
+
+  assert.equal(
+    getSlice("M002", "S01")?.status,
+    "pending",
+    "reopened out-of-scope slice must NOT be reverted to complete by a stale checkbox",
+  );
+});
+
+test("scoped import preserves reopened tasks in an out-of-scope slice", (t) => {
+  const base = makeBase();
+  t.after(() => cleanup(base));
+  seedTwoMilestonesWithReopenedBTask(base);
+
+  // Only M001 drifted; M002's stale checked roadmap and plan boxes must not
+  // re-complete either its reopened slice or its reopened task.
+  migrateHierarchyToDb(base, { statusAuthoritativeMilestones: new Set(["M001"]) });
+
+  assert.equal(
+    getSlice("M002", "S01")?.status,
+    "pending",
+    "reopened out-of-scope slice must stay pending",
+  );
+  assert.equal(
+    taskStatus("M002"),
+    "pending",
+    "reopened out-of-scope task must NOT be reverted to complete by a stale plan checkbox",
+  );
+});
+
+test("scoped import keeps markdown authority for the in-scope (drifted) milestone", (t) => {
+  const base = makeBase();
+  t.after(() => cleanup(base));
+  seedTwoMilestonesWithReopenedB(base);
+
+  // Sanctioned interop: M002's own roadmap was externally edited — the checked
+  // box IS authoritative for the drifted milestone.
+  migrateHierarchyToDb(base, { statusAuthoritativeMilestones: new Set(["M002"]) });
+
+  assert.equal(
+    getSlice("M002", "S01")?.status,
+    "complete",
+    "the drifted milestone's checkbox must close its slice (markdown authority)",
+  );
+});
+
+test("no-opts import is unchanged: markdown checkbox wins (pins the default)", (t) => {
+  const base = makeBase();
+  t.after(() => cleanup(base));
+  seedTwoMilestonesWithReopenedB(base);
+
+  // No scope → full markdown authority, exactly as before #027. Initial-migration
+  // and gsd-core full-import semantics must not silently change.
+  migrateHierarchyToDb(base);
+
+  assert.equal(
+    getSlice("M002", "S01")?.status,
+    "complete",
+    "without a scope, the stale checkbox closes the slice — today's behavior",
+  );
+});
+
+test("scoped import still imports NEW out-of-scope content with its parsed status", (t) => {
+  const base = makeBase();
+  t.after(() => cleanup(base));
+  // Both milestones are on disk but neither is in the DB yet. M002 is out of the
+  // authority scope, but a row that does not exist yet takes the parsed status
+  // regardless of scope (new content is new content).
+  writeRoadmap(base, "M001", "Alpha Slice", true);
+  writeRoadmap(base, "M002", "Beta Slice", true);
+  openDatabase(join(base, ".gsd", "gsd.db"));
+
+  migrateHierarchyToDb(base, { statusAuthoritativeMilestones: new Set(["M001"]) });
+
+  assert.equal(getSlice("M002", "S01")?.status, "complete", "new out-of-scope slice imports as parsed");
+});
+
+test("external-markdown-edit repair scopes authority to the drifted milestone (end-to-end)", async (t) => {
+  const base = makeBase();
+  t.after(() => cleanup(base));
+  seedTwoMilestonesWithReopenedB(base);
+
+  // Externally edit M001's roadmap (change the slice title) so its sha drifts;
+  // leave M002's roadmap byte-identical to its marker baseline (not drifted).
+  writeRoadmap(base, "M001", "Alpha Slice EDITED", true);
+  const m002Content = roadmapContent("M002", "Beta Slice", true);
+
+  writeCompatMarker(base, {
+    schema: 2,
+    lastWriter: "gsd-pi",
+    lastProjectedAt: "2026-07-07T00:00:00.000Z",
+    projections: {
+      [roadmapRel("M001")]: { sha: "stale000000000000", entities: ["M001"] },
+      [roadmapRel("M002")]: { sha: computeProjectionSha(m002Content), entities: ["M002"] },
+    },
+    piVersion: "1.8.1",
+  });
+
+  const ctx: DriftContext = { basePath: base, state: stubState };
+  const drift = await externalMarkdownEditHandler.detect(stubState, ctx);
+  assert.equal(drift.length, 1, "only M001's roadmap should be detected as drifted");
+  assert.deepEqual(drift[0].entities, ["M001"]);
+
+  await externalMarkdownEditHandler.repair(drift[0], ctx);
+
+  // B was NOT the drifted file — its reopened slice must survive the repair.
+  assert.equal(
+    getSlice("M002", "S01")?.status,
+    "pending",
+    "repair of an unrelated file must not revert B/S01",
+  );
+  // A WAS drifted — its edit is imported (title updated, status stays complete).
+  assert.equal(getSlice("M001", "S01")?.title, "Alpha Slice EDITED", "A's external edit is imported");
+  assert.equal(getSlice("M001", "S01")?.status, "complete");
+});

package/src/resources/extensions/gsd/tests/flat-phase-migration.test.ts

@@ -57,6 +57,19 @@ test("needsFlatPhaseMigration returns false when no .gsd/milestones/", () => {
   assert.equal(needsFlatPhaseMigration(base), false);
 });
 
+test("needsFlatPhaseMigration ignores legacy anchor runtime scaffolding", () => {
+  const base = mkdtempSync(join(tmpdir(), `gsd-anchor-nomig-${randomUUID()}`));
+  mkdirSync(join(base, ".gsd", "phases"), { recursive: true });
+  mkdirSync(join(base, ".gsd", "milestones", "M001", "anchors"), { recursive: true });
+  writeFileSync(
+    join(base, ".gsd", "milestones", "M001", "anchors", "research-slice.json"),
+    "{}",
+    "utf-8",
+  );
+  tmpDirs.push(base);
+  assert.equal(needsFlatPhaseMigration(base), false);
+});
+
 test("migrateToFlatPhase moves content from milestones/ to phases/", async () => {
   const base = makeTmp();
   await migrateToFlatPhase(base);
@@ -109,6 +122,59 @@ test("migrateToFlatPhase creates a backup", async () => {
   assert.ok(backups.length >= 1, "at least one migrate-* backup dir should exist");
 });
 
+test("migrateToFlatPhase backs up existing phases projection before clearing it", async () => {
+  const base = makeTmp();
+  const reviewPath = join(base, ".gsd", "phases", "01-foundation", "PLAN-REVIEW.md");
+  mkdirSync(join(base, ".gsd", "phases", "01-foundation"), { recursive: true });
+  writeFileSync(reviewPath, "# Plan Review\n\nHand-authored review.", "utf-8");
+
+  await migrateToFlatPhase(base);
+
+  const backupRoot = join(base, ".gsd-backups");
+  const backups = readdirSync(backupRoot).filter(d => d.startsWith("migrate-"));
+  assert.equal(backups.length, 1, "one migrate backup should exist");
+  const backedUpReview = join(backupRoot, backups[0]!, "__phases", "01-foundation", "PLAN-REVIEW.md");
+  assert.equal(
+    readFileSync(backedUpReview, "utf-8"),
+    "# Plan Review\n\nHand-authored review.",
+    "pre-existing phases/ files should have a recovery copy",
+  );
+});
+
+test("failed migration restores pre-existing phases projection from backup", async (t) => {
+  const base = makeTmp();
+  const phasesPath = join(base, ".gsd", "phases");
+  const reviewPath = join(phasesPath, "01-foundation", "PLAN-REVIEW.md");
+  mkdirSync(join(phasesPath, "01-foundation"), { recursive: true });
+  writeFileSync(reviewPath, "# Plan Review\n\nHand-authored review.", "utf-8");
+
+  let sabotagedClear = false;
+  const restoreFsOps = _setFlatPhaseMigrationFsOpsForTest({
+    rmSync(target, opts) {
+      rmSync(target, opts as never);
+      if (target === phasesPath && !sabotagedClear) {
+        sabotagedClear = true;
+        writeFileSync(phasesPath, "not a directory", "utf-8");
+      }
+    },
+  });
+  t.after(restoreFsOps);
+
+  await assert.rejects(migrateToFlatPhase(base), /flat-phase migration render failed/);
+
+  assert.equal(sabotagedClear, true, "test should force a post-clear render failure");
+  assert.equal(
+    readFileSync(reviewPath, "utf-8"),
+    "# Plan Review\n\nHand-authored review.",
+    "rollback should restore the pre-existing phases/ files",
+  );
+  const backupRoot = join(base, ".gsd-backups");
+  const leaked = existsSync(backupRoot)
+    ? readdirSync(backupRoot).filter((d) => d.startsWith("migrate-"))
+    : [];
+  assert.equal(leaked.length, 0, "rollback should still clean the backup it created");
+});
+
 test("failed migration rolls back without leaking a .gsd-backups/migrate-* dir", async (t) => {
   const base = makeTmp();
   const milestonesPath = join(base, ".gsd", "milestones");
@@ -136,6 +202,33 @@ test("failed migration rolls back without leaking a .gsd-backups/migrate-* dir",
   assert.equal(leaked.length, 0, "rollback must delete the migrate-* backup it created");
 });
 
+test("resumed migration stores phases backup in retained migrate snapshot", async () => {
+  const base = makeTmp();
+  const milestonesPath = join(base, ".gsd", "milestones");
+  const migratingPath = join(base, ".gsd", "milestones.migrating");
+  const reviewPath = join(base, ".gsd", "phases", "01-foundation", "PLAN-REVIEW.md");
+  mkdirSync(join(base, ".gsd", "phases", "01-foundation"), { recursive: true });
+  writeFileSync(reviewPath, "# Plan Review\n\nResume recovery copy.", "utf-8");
+  renameSync(milestonesPath, migratingPath);
+
+  await migrateToFlatPhase(base);
+
+  assert.equal(existsSync(migratingPath), false, "resume staging dir should be removed after success");
+  const backupRoot = join(base, ".gsd-backups");
+  const backups = readdirSync(backupRoot).filter((d) => d.startsWith("migrate-"));
+  assert.equal(backups.length, 1, "resumed migration should create one retained migrate backup");
+  assert.equal(
+    readFileSync(join(backupRoot, backups[0]!, "__phases", "01-foundation", "PLAN-REVIEW.md"), "utf-8"),
+    "# Plan Review\n\nResume recovery copy.",
+    "resume should retain the phases snapshot under .gsd-backups",
+  );
+  assert.equal(
+    existsSync(join(migratingPath, "__phases")),
+    false,
+    "resume should not store the phases snapshot inside the disposable migrating tree",
+  );
+});
+
 test("migrateToFlatPhase preserves milestone/slice/task counts in DB", async () => {
   const base = makeTmp();
   const msBefore = getAllMilestones().length;
@@ -190,6 +283,42 @@ test("migrateToFlatPhase prunes legacy milestones artifact rows after flat rende
   );
 });
 
+test("migrateToFlatPhase prunes stale flat-phase artifact rows that renderAll intentionally skips", async () => {
+  const base = makeTmp();
+  insertArtifact({
+    path: "phases/01-foundation/T01-PLAN.md",
+    artifact_type: "PLAN",
+    milestone_id: "M001",
+    slice_id: "S01",
+    task_id: "T01",
+    full_content: "# Legacy standalone task plan\n",
+  });
+  insertArtifact({
+    path: "phases/01-foundation/01-01-RESEARCH.md",
+    artifact_type: "RESEARCH",
+    milestone_id: "M001",
+    slice_id: "S01",
+    task_id: null,
+    full_content: "",
+  });
+
+  await migrateToFlatPhase(base);
+
+  const rows = _getAdapter()!
+    .prepare("SELECT path FROM artifacts ORDER BY path")
+    .all() as Array<{ path: string }>;
+  assert.equal(
+    rows.some((row) => row.path === "phases/01-foundation/T01-PLAN.md"),
+    false,
+    "standalone task PLAN rows should be pruned when the flat renderer does not recreate the file",
+  );
+  assert.equal(
+    rows.some((row) => row.path === "phases/01-foundation/01-01-RESEARCH.md"),
+    false,
+    "empty-content artifact rows should be pruned when the flat renderer skips the file",
+  );
+});
+
 test("migrateToFlatPhase is idempotent (second run is a no-op)", async () => {
   const base = makeTmp();
   await migrateToFlatPhase(base);
@@ -199,6 +328,79 @@ test("migrateToFlatPhase is idempotent (second run is a no-op)", async () => {
   assert.equal(backups.length, 1, "should only have one backup");
 });
 
+test("re-fired migration reuses the existing backup instead of leaking a new migrate-* dir (#1292)", async () => {
+  const base = makeTmp();
+  await migrateToFlatPhase(base);
+  const backupRoot = join(base, ".gsd-backups");
+  const firstBackups = readdirSync(backupRoot).filter((d) => d.startsWith("migrate-"));
+  assert.equal(firstBackups.length, 1, "first migration snapshots exactly one backup");
+
+  // Simulate the re-fire: the legacy .gsd/milestones/ layout reappears (e.g. a
+  // marker-key mismatch re-imports the whole tree). The DB rows still exist, so
+  // the migration gate proceeds again — it must not snapshot a second backup.
+  mkdirSync(join(base, ".gsd", "milestones", "M001", "slices", "S01", "tasks", "T01"), { recursive: true });
+  assert.equal(needsFlatPhaseMigration(base), true, "reappeared legacy layout re-triggers migration");
+
+  await migrateToFlatPhase(base);
+
+  const afterBackups = readdirSync(backupRoot).filter((d) => d.startsWith("migrate-"));
+  assert.deepEqual(afterBackups, firstBackups, "re-fire must not leak a second migrate-* backup");
+  assert.equal(existsSync(join(base, ".gsd", "milestones")), false, "legacy milestones/ removed again");
+});
+
+test("rollback after a re-fired migration preserves the reused migrate-* backup", async (t) => {
+  const base = makeTmp();
+  await migrateToFlatPhase(base);
+  const backupRoot = join(base, ".gsd-backups");
+  const firstBackups = readdirSync(backupRoot).filter((d) => d.startsWith("migrate-"));
+  assert.equal(firstBackups.length, 1, "first migration snapshots exactly one backup");
+
+  mkdirSync(join(base, ".gsd", "milestones", "M001", "slices", "S01", "tasks", "T01"), { recursive: true });
+  const milestonesPath = join(base, ".gsd", "milestones");
+  const phasesPath = join(base, ".gsd", "phases");
+
+  const restoreFsOps = _setFlatPhaseMigrationFsOpsForTest({
+    rmSync(target, opts) {
+      if (target === phasesPath) {
+        throw Object.assign(new Error("simulated locked phases/"), { code: "EPERM" });
+      }
+      return rmSync(target, opts as never);
+    },
+  });
+  t.after(restoreFsOps);
+
+  await assert.rejects(migrateToFlatPhase(base), /simulated locked/);
+
+  const afterBackups = readdirSync(backupRoot).filter((d) => d.startsWith("migrate-"));
+  assert.deepEqual(afterBackups, firstBackups, "rollback must preserve the reused backup");
+  assert.ok(existsSync(milestonesPath), "legacy milestones/ should be restored on rollback");
+});
+
+test("migration ignores an empty/partial leftover backup and writes a complete one (#1292)", async () => {
+  const base = makeTmp();
+
+  // Simulate a prior first-time backup that crashed mid-cpSync: an empty
+  // migrate-<ts>/ leftover with no milestones/ content. It is the newest entry,
+  // so mtime-based selection would reuse it as the rollback copy if content were
+  // not validated — silently retaining a recovery copy missing the legacy tree.
+  const backupRoot = join(base, ".gsd-backups");
+  const emptyLeftover = join(backupRoot, "migrate-crashed");
+  mkdirSync(emptyLeftover, { recursive: true });
+
+  await migrateToFlatPhase(base);
+
+  assert.ok(existsSync(join(base, ".gsd", "phases", "01-foundation")), "flat phase should render");
+  // The empty leftover must not have been reused; a fresh, content-bearing
+  // backup that actually captured the legacy milestones/ tree must be created.
+  const contentBackups = readdirSync(backupRoot)
+    .filter((d) => d.startsWith("migrate-"))
+    .filter((d) => existsSync(join(backupRoot, d, "M001")));
+  assert.ok(
+    contentBackups.length >= 1,
+    "a complete backup containing the legacy milestones/ tree must be created, not the empty leftover",
+  );
+});
+
 test("migrateToFlatPhase preserves slice sidecar artifacts and skips recovery placeholder PLAN", async () => {
   const base = makeTmp({ withTask: false });
   const legacySliceDir = join(base, ".gsd", "milestones", "M001", "slices", "S01");

package/src/resources/extensions/gsd/tests/gate-storage.test.ts

@@ -19,6 +19,11 @@ import {
   insertMilestone,
   insertSlice,
 } from "../gsd-db.ts";
+import { getDb } from "../db/engine.ts";
+
+function gateRunCount(gateId: string): number {
+  return (getDb().prepare("SELECT count(*) AS cnt FROM gate_runs WHERE gate_id = :gid").get({ ":gid": gateId }) as { cnt: number }).cnt;
+}
 
 describe("quality_gates CRUD", () => {
   let tmpDir: string;
@@ -83,6 +88,30 @@ describe("quality_gates CRUD", () => {
     assert.ok(results[0].evaluated_at);
   });
 
+  test("saveGateResult commits the verdict and the gate_runs ledger row together", () => {
+    insertGateRow({ milestoneId: "M001", sliceId: "S01", gateId: "Q3", scope: "slice" });
+    saveGateResult({
+      milestoneId: "M001", sliceId: "S01", gateId: "Q3",
+      verdict: "pass", rationale: "OK", findings: "",
+    });
+    assert.equal(getGateResults("M001", "S01")[0].status, "complete");
+    assert.equal(gateRunCount("Q3"), 1, "exactly one ledger row must accompany the verdict");
+  });
+
+  test("saveGateResult rolls back the verdict UPDATE if the ledger INSERT fails", () => {
+    insertGateRow({ milestoneId: "M001", sliceId: "S01", gateId: "Q3", scope: "slice" });
+    // Force the insertGateRun step to throw after the UPDATE by removing the
+    // ledger table. Atomicity means the gate row must stay pending.
+    getDb().exec("DROP TABLE gate_runs");
+    assert.throws(() => saveGateResult({
+      milestoneId: "M001", sliceId: "S01", gateId: "Q3",
+      verdict: "pass", rationale: "OK", findings: "",
+    }));
+    const gate = getGateResults("M001", "S01")[0];
+    assert.equal(gate.status, "pending", "gate verdict UPDATE must roll back when the ledger INSERT fails");
+    assert.equal(gate.verdict ?? "", "", "verdict must not persist after rollback");
+  });
+
   test("saveGateResult throws when the gate row does not exist", () => {
     assert.throws(
       () => saveGateResult({