@opengsd/gsd-pi 1.8.1 → 1.9.0-dev.97ef11e3

package/src/resources/extensions/gsd/commands-verdict.ts

@@ -11,6 +11,7 @@ import { executeValidateMilestone } from "./tools/workflow-tool-executors.js";
 import { ensureDbOpen } from "./bootstrap/dynamic-tools.js";
 import { getLatestAssessmentByScope } from "./gsd-db.js";
 import { checkpointWorkflowDatabase } from "./db-workspace.js";
+import { formatVerdictRecordedNotice, formatVerdictRejectedNotice } from "./stop-notice.js";
 import {
   VALIDATION_VERDICTS,
   extractVerdict,
@@ -165,17 +166,17 @@ export async function handleVerdict(
   basePath: string,
 ): Promise<void> {
   if (!rawArgs.trim()) {
-    ctx.ui.notify(USAGE, "warning");
+    ctx.ui.notify(formatVerdictRejectedNotice(USAGE), "warning");
     return;
   }
 
   const parsed = parseArgs(rawArgs);
   if ("error" in parsed) {
-    ctx.ui.notify(`${parsed.error}\n${USAGE}`, "warning");
+    ctx.ui.notify(formatVerdictRejectedNotice(`${parsed.error}\n${USAGE}`), "warning");
     return;
   }
   if (!parsed.verdict) {
-    ctx.ui.notify(USAGE, "warning");
+    ctx.ui.notify(formatVerdictRejectedNotice(USAGE), "warning");
     return;
   }
 
@@ -184,7 +185,7 @@ export async function handleVerdict(
     const state = await deriveState(basePath);
     if (!state.activeMilestone) {
       ctx.ui.notify(
-        "No active milestone — pass --milestone Mxxx to target a specific milestone.",
+        formatVerdictRejectedNotice("No active milestone — pass --milestone Mxxx to target a specific milestone."),
         "warning",
       );
       return;
@@ -195,7 +196,9 @@ export async function handleVerdict(
   const existingValidation = await loadExistingValidation(basePath, milestoneId);
   if (!existingValidation) {
     ctx.ui.notify(
-      `No milestone validation found for ${milestoneId}. Run /gsd auto to validate first, then retry /gsd verdict.`,
+      formatVerdictRejectedNotice(
+        `No milestone validation found for ${milestoneId}. Run /gsd auto to validate first, then retry /gsd verdict.`,
+      ),
       "warning",
     );
     return;
@@ -205,7 +208,7 @@ export async function handleVerdict(
 
   if (parsed.verdict !== "pass" && !parsed.rationale) {
     ctx.ui.notify(
-      `--rationale is required when overriding to ${parsed.verdict}.`,
+      formatVerdictRejectedNotice(`--rationale is required when overriding to ${parsed.verdict}.`),
       "warning",
     );
     return;
@@ -234,7 +237,7 @@ export async function handleVerdict(
   if (result.isError) {
     const msg =
       result.content[0]?.type === "text" ? result.content[0].text : "Unknown error";
-    ctx.ui.notify(msg, "error");
+    ctx.ui.notify(formatVerdictRejectedNotice(msg), "error");
     return;
   }
 
@@ -244,12 +247,16 @@ export async function handleVerdict(
   const effectiveVerdict = extractEffectiveVerdict(result.details, parsed.verdict);
   if (effectiveVerdict !== parsed.verdict) {
     ctx.ui.notify(
-      `Milestone ${milestoneId} verdict requested: ${parsed.verdict}, effective: ${effectiveVerdict} (${existingValidation.source})`,
+      formatVerdictRecordedNotice(
+        `Milestone ${milestoneId} verdict requested: ${parsed.verdict}, effective: ${effectiveVerdict} (${existingValidation.source})`,
+      ),
       "warning",
     );
   } else {
     ctx.ui.notify(
-      `Milestone ${milestoneId} verdict: ${prevVerdict} -> ${effectiveVerdict} (${existingValidation.source})`,
+      formatVerdictRecordedNotice(
+        `Milestone ${milestoneId} verdict: ${prevVerdict} -> ${effectiveVerdict} (${existingValidation.source})`,
+      ),
       "success",
     );
   }

package/src/resources/extensions/gsd/compat/compat-marker.ts

@@ -6,8 +6,8 @@
 // (drift to import). gsd-core is oblivious to this file and ignores it.
 
 import { createHash } from "node:crypto";
-import { existsSync, readFileSync, renameSync, unlinkSync, writeFileSync, mkdirSync } from "node:fs";
-import { dirname, join } from "node:path";
+import { existsSync, readFileSync, realpathSync, renameSync, unlinkSync, writeFileSync, mkdirSync } from "node:fs";
+import { dirname, join, isAbsolute, normalize, relative, resolve } from "node:path";
 
 /** Current marker schema version. Bump on breaking format changes + migrate. */
 export const COMPAT_MARKER_SCHEMA = 2;
@@ -34,8 +34,10 @@ export interface PlanningMarker {
 
 /**
  * Per-file projection entry. `sha` is a normalized-content SHA-256; `entities`
- * is the list of DB entity ids (milestone/slice/task) that the file projects,
- * so repair can scope re-import rather than re-importing the whole tree.
+ * is the list of DB entity ids (milestone/slice/task) that the file projects.
+ * External-edit repair derives milestone ids from this list so markdown status
+ * authority is limited to the drifted projection's milestone scope while the
+ * importer still walks the whole tree.
  */
 export interface ProjectionEntry {
   sha: string;
@@ -52,6 +54,13 @@ export interface CompatMarker {
   piVersion: string;
 }
 
+export interface ReadCompatMarkerOptions {
+  /** Rewrite invalid-but-derivable marker keys back to safe root-relative keys. */
+  healInvalidKeys?: boolean;
+  /** Quarantine malformed/unsafe markers. Disable only for read-only previews. */
+  quarantineInvalid?: boolean;
+}
+
 /** Marker returned when no marker exists yet (fresh project, first gsd-pi run). */
 export const EMPTY_MARKER: CompatMarker = {
   schema: COMPAT_MARKER_SCHEMA,
@@ -79,6 +88,37 @@ export function computeProjectionSha(content: string): string {
   return createHash("sha256").update(normalizeForHash(content)).digest("hex").slice(0, 16);
 }
 
+function normalizeRealPath(p: string): string {
+  try {
+    return realpathSync.native(p);
+  } catch {
+    return resolve(p);
+  }
+}
+
+function rootRelativeKey(rootPath: string, absPath: string): string | null {
+  const root = normalizeRealPath(rootPath);
+  const abs = normalizeRealPath(absPath);
+  const rel = relative(root, abs);
+  if (!rel || rel === ".." || rel.startsWith(`..${sepForRelative(rel)}`) || isAbsolute(rel)) {
+    return null;
+  }
+  return rel.replace(/\\/g, "/");
+}
+
+function sepForRelative(rel: string): string {
+  return rel.includes("\\") ? "\\" : "/";
+}
+
+export function deriveCompatProjectionKey(absPath: string, roots: readonly string[]): string {
+  for (const root of roots) {
+    const key = rootRelativeKey(root, absPath);
+    if (key) return key;
+  }
+  const fallbackRoot = roots[roots.length - 1] ?? dirname(absPath);
+  return relative(fallbackRoot, absPath).replace(/\\/g, "/");
+}
+
 /**
  * Read & validate the marker. A missing marker → EMPTY_MARKER (treat every
  * projection as external on next reconcile). A malformed marker is quarantined
@@ -86,7 +126,12 @@ export function computeProjectionSha(content: string): string {
  * EMPTY_MARKER. A schema-mismatch returns EMPTY_MARKER (forward-compat: refuse
  * to act on a future format we don't understand).
  */
-export function readCompatMarker(basePath: string): CompatMarker {
+export function readCompatMarker(
+  basePath: string,
+  options: ReadCompatMarkerOptions = {},
+): CompatMarker {
+  const healInvalidKeys = options.healInvalidKeys ?? true;
+  const quarantineInvalid = options.quarantineInvalid ?? true;
   const path = compatMarkerPath(basePath);
   if (!existsSync(path)) return emptyMarker();
 
@@ -101,12 +146,16 @@ export function readCompatMarker(basePath: string): CompatMarker {
   try {
     parsed = JSON.parse(raw);
   } catch {
-    quarantine(basePath, raw);
+    if (quarantineInvalid) quarantine(basePath, raw);
     return emptyMarker();
   }
 
+  if (healInvalidKeys && healMarkerProjectionKeys(basePath, parsed) && isValidMarker(parsed)) {
+    writeCompatMarker(basePath, parsed);
+  }
+
   if (!isValidMarker(parsed)) {
-    quarantine(basePath, raw);
+    if (quarantineInvalid) quarantine(basePath, raw);
     return emptyMarker();
   }
   // Promote older markers by defaulting absent fields. Schema 1 → 2 only adds
@@ -220,14 +269,76 @@ function isValidProjectionEntry(x: unknown): x is ProjectionEntry {
   return true;
 }
 
+/**
+ * Projection-map keys are repo-relative paths under .gsd/ or .planning/.
+ * The marker is repo-controlled content, so a key must never escape its
+ * root: reject absolute paths, drive letters, backslashes, and any
+ * normalized form that starts with "..". Mirrors the write-side guard in
+ * db-writer.ts.
+ */
+function isSafeProjectionKey(key: string): boolean {
+  if (key.length === 0 || key.includes("\\") || key.includes("\0")) return false;
+  if (isAbsolute(key) || /^[A-Za-z]:/.test(key)) return false;
+  const norm = normalize(key);
+  return norm !== ".." && !norm.startsWith("../") && !isAbsolute(norm);
+}
+
 function isValidProjectionMap(x: unknown): boolean {
   if (typeof x !== "object" || x === null) return false;
-  for (const v of Object.values(x as Record<string, unknown>)) {
+  for (const [k, v] of Object.entries(x as Record<string, unknown>)) {
+    if (!isSafeProjectionKey(k)) return false;
     if (!isValidProjectionEntry(v)) return false;
   }
   return true;
 }
 
+function healMarkerProjectionKeys(basePath: string, marker: unknown): marker is CompatMarker {
+  if (typeof marker !== "object" || marker === null) return false;
+  const m = marker as Record<string, unknown>;
+  let changed = false;
+
+  if (typeof m.projections === "object" && m.projections !== null) {
+    changed = healProjectionMapKeys(basePath, ".gsd", m.projections as Record<string, ProjectionEntry>) || changed;
+  }
+
+  const planning = m.planning;
+  if (typeof planning === "object" && planning !== null) {
+    const p = planning as Record<string, unknown>;
+    if (typeof p.projections === "object" && p.projections !== null) {
+      changed = healProjectionMapKeys(basePath, ".planning", p.projections as Record<string, ProjectionEntry>) || changed;
+    }
+    if (typeof p.passthrough === "object" && p.passthrough !== null) {
+      changed = healProjectionMapKeys(basePath, ".planning", p.passthrough as Record<string, ProjectionEntry>) || changed;
+    }
+  }
+
+  return changed;
+}
+
+function healProjectionMapKeys(
+  basePath: string,
+  rootName: ".gsd" | ".planning",
+  map: Record<string, ProjectionEntry>,
+): boolean {
+  let changed = false;
+  const root = join(basePath, rootName);
+
+  for (const key of Object.keys(map)) {
+    if (isSafeProjectionKey(key)) continue;
+    if (key.includes("\0") || isAbsolute(key) || /^[A-Za-z]:/.test(key)) continue;
+    const healedKey = rootRelativeKey(root, resolve(root, key));
+    if (!healedKey || !isSafeProjectionKey(healedKey)) continue;
+
+    if (!map[healedKey]) {
+      map[healedKey] = map[key]!;
+    }
+    delete map[key];
+    changed = true;
+  }
+
+  return changed;
+}
+
 function isValidPlanningMarker(x: unknown): x is PlanningMarker {
   if (typeof x !== "object" || x === null) return false;
   const p = x as Record<string, unknown>;

package/src/resources/extensions/gsd/constants.ts

@@ -31,36 +31,37 @@ export const CACHE_MAX = 50;
  * By scoping tools to this allowlist during discuss dispatches, the grammar
  * sent to the provider stays well under provider limits.
  *
- * Included tools and why:
+ * Included tools and why (canonical names only — aliases are no longer
+ * advertised to models by default, see plan 035):
  *   - gsd_summary_save: writes CONTEXT.md artifacts (all discuss prompts)
- *   - gsd_save_summary: alias for above
  *   - gsd_decision_save: records decisions (discuss.md output phase)
- *   - gsd_save_decision: alias for above
  *   - gsd_plan_milestone: writes roadmap (discuss.md single/multi milestone)
- *   - gsd_milestone_plan: alias for above
  *   - gsd_milestone_generate_id: generates milestone IDs (discuss.md multi-milestone)
- *   - gsd_generate_milestone_id: alias for above
  *   - gsd_requirement_save: creates requirements during discuss
- *   - gsd_save_requirement: alias for above
  *   - gsd_requirement_update: updates requirements during discuss
- *   - gsd_update_requirement: alias for above
  */
 export const DISCUSS_TOOLS_ALLOWLIST: readonly string[] = [
   // Context / summary writing
   "gsd_summary_save",
-  "gsd_save_summary",
   // Decision recording
   "gsd_decision_save",
-  "gsd_save_decision",
   // Milestone planning (needed for discuss.md output phase)
   "gsd_plan_milestone",
-  "gsd_milestone_plan",
   // Milestone ID generation (multi-milestone flow)
   "gsd_milestone_generate_id",
-  "gsd_generate_milestone_id",
   // Requirement updates
   "gsd_requirement_save",
-  "gsd_save_requirement",
   "gsd_requirement_update",
-  "gsd_update_requirement",
 ];
+
+// ─── Context Injection ────────────────────────────────────────────────────────
+
+/**
+ * Leading marker stamped on every buildContextMessage() output
+ * (bootstrap/system-context.ts). Single source of truth for the producer and
+ * the consumer: the provider payload policy (filterSupersededContextInjections
+ * in context-masker.ts) matches this prefix to find and dedupe injected
+ * memory/guided/forensics messages after convertToLlm strips their customType.
+ * Both sides import it from here — do not inline the literal in either module.
+ */
+export const GSD_CONTEXT_MESSAGE_SENTINEL = "[GSD Context Injection]";

package/src/resources/extensions/gsd/context-masker.ts

@@ -1,3 +1,5 @@
+import { GSD_CONTEXT_MESSAGE_SENTINEL } from "./constants.js";
+
 /**
  * Observation masking for GSD auto-mode sessions.
  *
@@ -75,6 +77,26 @@ function findTurnBoundary(messages: MaskableMessage[], keepRecentTurns: number):
   return 0;
 }
 
+function countRealUserTurns(messages: MaskableMessage[]): number {
+  let count = 0;
+  for (const m of messages) {
+    if (m.role === "user" && !isBashResultUserMessage(m)) count++;
+  }
+  return count;
+}
+
+/**
+ * Quantizes how many recent turns stay unmasked so the boundary only moves
+ * forward once per full block of `keepRecentTurns` new turns, instead of
+ * every turn. Keeps the masked prefix byte-stable within a block, which is
+ * what lets the LLM provider's prompt cache survive across turns.
+ */
+function quantizedKeepTurns(totalTurns: number, keepRecentTurns: number): number {
+  if (keepRecentTurns <= 0 || totalTurns < 2 * keepRecentTurns) return totalTurns;
+  const maskedTurns = Math.floor((totalTurns - keepRecentTurns) / keepRecentTurns) * keepRecentTurns;
+  return totalTurns - maskedTurns;
+}
+
 /**
  * Detect user messages that originated from bashExecution.
  * After convertToLlm, these are {role: "user", content: [{type:"text", text:"Ran `cmd`\n..."}]}.
@@ -95,7 +117,8 @@ function isMaskableMessage(m: MaskableMessage): boolean {
 
 export function createObservationMask(keepRecentTurns: number = 8) {
   return (messages: MaskableMessage[]): MaskableMessage[] => {
-    const boundary = findTurnBoundary(messages, keepRecentTurns);
+    const totalTurns = countRealUserTurns(messages);
+    const boundary = findTurnBoundary(messages, quantizedKeepTurns(totalTurns, keepRecentTurns));
     if (boundary === 0) return messages;
 
     return messages.map((m, i) => {
@@ -126,6 +149,14 @@ function findResponsesTurnBoundary(items: ResponsesInputItem[], keepRecentTurns:
   return 0;
 }
 
+function countResponsesRealUserTurns(items: ResponsesInputItem[]): number {
+  let count = 0;
+  for (const item of items) {
+    if (item.role === "user" && !isResponsesBashResultUserItem(item)) count++;
+  }
+  return count;
+}
+
 /**
  * Observation masking for OpenAI/Codex Responses API payloads.
  *
@@ -135,7 +166,8 @@ function findResponsesTurnBoundary(items: ResponsesInputItem[], keepRecentTurns:
  */
 export function createResponsesInputObservationMask(keepRecentTurns: number = 8) {
   return (items: ResponsesInputItem[]): ResponsesInputItem[] => {
-    const boundary = findResponsesTurnBoundary(items, keepRecentTurns);
+    const totalTurns = countResponsesRealUserTurns(items);
+    const boundary = findResponsesTurnBoundary(items, quantizedKeepTurns(totalTurns, keepRecentTurns));
     if (boundary === 0) return items;
 
     return items.map((item, i) => {
@@ -219,3 +251,67 @@ export function truncateResponsesInputResultItems(items: ResponsesInputItem[], m
     return item;
   });
 }
+
+// GSD injects at most one context message per turn (memory/guided/forensics —
+// see buildContextMessage in bootstrap/system-context.ts), marked with
+// GSD_CONTEXT_MESSAGE_SENTINEL. convertToLlm strips the distinguishing
+// customType before the payload reaches this hook, so detection is by content
+// prefix instead. Pre-sentinel session history lacks the sentinel, so we also
+// match the stable *bracketed* GSD block labels those injections begin with,
+// letting resumed sessions dedupe older memory/guided blocks.
+//
+// Only GSD-specific bracketed markers belong here — never generic prose. A
+// message is dropped from the payload when it matches, so a natural-language
+// prefix (e.g. the forensics prompt "Debug GSD itself.") could silently delete
+// a real user message that happens to start the same way. Legacy forensics
+// injections without memory are therefore left un-deduped by design; those
+// with memory still match via the "[GSD Context Metadata]" wrapper.
+const LEGACY_GSD_CONTEXT_INJECTION_PREFIXES = [
+  "[GSD Context Metadata]",
+  "[MEMORY — Critical and prompt-relevant memories from the GSD memory store]",
+  "[GSD Guided Execute Context]",
+] as const;
+
+function isGsdContextInjectionText(text: string | undefined): boolean {
+  if (typeof text !== "string") return false;
+  if (text.startsWith(GSD_CONTEXT_MESSAGE_SENTINEL)) return true;
+  return LEGACY_GSD_CONTEXT_INJECTION_PREFIXES.some((prefix) => text.startsWith(prefix));
+}
+
+function isGsdContextInjectionMessage(m: MaskableMessage): boolean {
+  if (m.role !== "user") return false;
+  return isGsdContextInjectionText(firstTextFromContent(m.content));
+}
+
+/**
+ * Removes every GSD context-injection user message except the latest one.
+ * Each turn re-injects a near-identical memory/guided/forensics block; left
+ * in place they duplicate verbatim across an N-turn session. Removal (not
+ * masking) — an empty placeholder still costs tokens and shifts message
+ * positions, breaking cache byte-stability. Pure function: stored history is
+ * never mutated, only the outgoing payload array.
+ */
+export function filterSupersededContextInjections(messages: MaskableMessage[]): MaskableMessage[] {
+  let lastIndex = -1;
+  for (let i = 0; i < messages.length; i++) {
+    if (isGsdContextInjectionMessage(messages[i])) lastIndex = i;
+  }
+  if (lastIndex === -1) return messages;
+  return messages.filter((m, i) => i === lastIndex || !isGsdContextInjectionMessage(m));
+}
+
+function isResponsesGsdContextInjectionItem(item: ResponsesInputItem): boolean {
+  if (item.role !== "user") return false;
+  return isGsdContextInjectionText(firstTextFromContent(item.content));
+}
+
+export function filterSupersededResponsesContextInjections(
+  items: ResponsesInputItem[],
+): ResponsesInputItem[] {
+  let lastIndex = -1;
+  for (let i = 0; i < items.length; i++) {
+    if (isResponsesGsdContextInjectionItem(items[i])) lastIndex = i;
+  }
+  if (lastIndex === -1) return items;
+  return items.filter((item, i) => i === lastIndex || !isResponsesGsdContextInjectionItem(item));
+}

package/src/resources/extensions/gsd/db/command-queue.ts

@@ -15,6 +15,7 @@
 
 import {
   _getAdapter,
+  immediateTransaction,
   isDbAvailable,
   transaction,
 } from "../gsd-db.js";
@@ -75,7 +76,12 @@ export function claimNextCommand(workerId: string): CommandQueueRow | null {
   const now = new Date().toISOString();
   const db = _getAdapter()!;
 
-  return transaction((): CommandQueueRow | null => {
+  // BEGIN IMMEDIATE: this is a read-then-write claim. Under WAL, a deferred
+  // transaction that reads first and then upgrades to a writer can fail with
+  // SQLITE_BUSY_SNAPSHOT (not retried by busy_timeout) when two workers race;
+  // taking the write lock up front serializes claimants so the loser waits
+  // and then sees the row already claimed (changes !== 1 → null).
+  return immediateTransaction((): CommandQueueRow | null => {
     // Find the oldest unclaimed command targeted at this worker OR
     // broadcast. The partial index covers both via NULL-in-B-tree.
     const row = db.prepare(

package/src/resources/extensions/gsd/db/engine.ts

@@ -10,7 +10,7 @@
 // writer layer.
 import { createRequire } from "node:module";
 import { existsSync, copyFileSync, mkdirSync, realpathSync } from "node:fs";
-import { dirname, join } from "node:path";
+import { dirname, join, resolve } from "node:path";
 import { GSDError, GSD_STALE_STATE } from "../errors.js";
 import type { GsdWorkspace, MilestoneScope } from "../workspace.js";
 import { logError, logWarning } from "../workflow-logger.js";
@@ -46,6 +46,7 @@ import {
   applyMigrationV27ArtifactHash,
   applyMigrationV28MemoryLastHitAt,
   applyMigrationV29RepositoryTargets,
+  applyMigrationV30ReworkBriefs,
 } from "../db-migration-steps.js";
 import {
   isMemoriesFtsAvailableSchema,
@@ -70,7 +71,10 @@ let _gsdRequire: ReturnType<typeof createRequire> | null | undefined;
 function getGsdRequire(): ReturnType<typeof createRequire> | null {
   if (_gsdRequire !== undefined) return _gsdRequire;
   try {
-    _gsdRequire = createRequire(import.meta.url);
+    // Next.js may emit this module into a CommonJS chunk. Avoid ESM-only module
+    // metadata syntax here; it is a hard parse error there.
+    const packageRoot = process.env.GSD_WEB_PACKAGE_ROOT || process.env.GSD_PKG_ROOT || process.cwd();
+    _gsdRequire = createRequire(resolve(packageRoot, "package.json"));
   } catch {
     _gsdRequire = null;
   }
@@ -93,7 +97,7 @@ const providerLoader = createSqliteProviderLoader({
   nodeVersion: process.versions.node,
   writeStderr: (message: string) => process.stderr.write(message),
 });
-export const SCHEMA_VERSION = 29;
+export const SCHEMA_VERSION = 30;
 function initSchema(db: DbAdapter, fileBacked: boolean, dbPath: string | null): void {
   const conservativeFilePragmas = fileBacked && _isLikelyWslDrvFsPathForTest(dbPath);
   if (fileBacked) db.exec(conservativeFilePragmas ? "PRAGMA journal_mode=DELETE" : "PRAGMA journal_mode=WAL");
@@ -114,21 +118,39 @@ function initSchema(db: DbAdapter, fileBacked: boolean, dbPath: string | null):
 
     const existing = db.prepare("SELECT count(*) as cnt FROM schema_version").get();
     if (existing && (existing["cnt"] as number) === 0) {
-      createCoordinationTablesV24(db);
-      createRuntimeKvTableV25(db);
-
-      // Fresh install — all tables are created above with the full current schema,
-      // so it is safe to create all migration-specific indexes here.  For existing
-      // databases these indexes are created inside the individual migration guards
-      // in migrateSchema() after the corresponding columns have been added.
-      db.exec("CREATE INDEX IF NOT EXISTS idx_tasks_escalation_pending ON tasks(milestone_id, slice_id, escalation_pending)");
-      db.exec("CREATE INDEX IF NOT EXISTS idx_memories_scope ON memories(scope)");
-      db.exec("CREATE INDEX IF NOT EXISTS idx_memory_sources_kind ON memory_sources(kind)");
-      db.exec("CREATE INDEX IF NOT EXISTS idx_memory_sources_scope ON memory_sources(scope)");
-      db.exec("CREATE INDEX IF NOT EXISTS idx_memory_relations_from ON memory_relations(from_id)");
-      db.exec("CREATE INDEX IF NOT EXISTS idx_memory_relations_to ON memory_relations(to_id)");
-
-      recordSchemaVersion(db, SCHEMA_VERSION);
+      // An empty schema_version table usually means a fresh install, but it can
+      // also be a legacy/truncated DB that already holds user data. Stamping
+      // that DB SCHEMA_VERSION without running migrations would mis-mark it as
+      // fully migrated and break at first query. Probe before stamping.
+      const hasData = ["milestones", "decisions", "memories"].some((t) => {
+        try {
+          const r = db.prepare(`SELECT count(*) as cnt FROM ${t}`).get();
+          return ((r?.["cnt"] as number) ?? 0) > 0;
+        } catch { /* table absent on a truly fresh DB — treat as no data */ return false; }
+      });
+      if (hasData) {
+        // Legacy DB with data but no version row: record the baseline so
+        // migrateSchema runs the full chain instead of stamping the current version.
+        recordSchemaVersion(db, 1);
+      } else {
+        createCoordinationTablesV24(db);
+        createRuntimeKvTableV25(db);
+
+        // Fresh install — all tables are created above with the full current schema,
+        // so it is safe to create all migration-specific indexes here.  For existing
+        // databases these indexes are created inside the individual migration guards
+        // in migrateSchema() after the corresponding columns have been added.
+        db.exec("CREATE INDEX IF NOT EXISTS idx_tasks_escalation_pending ON tasks(milestone_id, slice_id, escalation_pending)");
+        db.exec("CREATE INDEX IF NOT EXISTS idx_memories_scope ON memories(scope)");
+        db.exec("CREATE INDEX IF NOT EXISTS idx_memory_sources_kind ON memory_sources(kind)");
+        db.exec("CREATE INDEX IF NOT EXISTS idx_memory_sources_scope ON memory_sources(scope)");
+        db.exec("CREATE INDEX IF NOT EXISTS idx_memory_relations_from ON memory_relations(from_id)");
+        db.exec("CREATE INDEX IF NOT EXISTS idx_memory_relations_to ON memory_relations(to_id)");
+        db.exec("CREATE INDEX IF NOT EXISTS idx_rework_briefs_task ON rework_briefs(milestone_id, slice_id, task_id)");
+        db.exec("CREATE INDEX IF NOT EXISTS idx_rework_findings_status ON rework_brief_findings(brief_id, severity, status)");
+
+        recordSchemaVersion(db, SCHEMA_VERSION);
+      }
     }
 
     db.exec("COMMIT");
@@ -183,9 +205,19 @@ function copyQualityGateRowsToRepairedTable(db: DbAdapter): void {
   `);
 }
 
+let _migrationFaultForTest = false;
+/** Test-only: force migrateSchema to throw after applying its steps but before COMMIT. */
+export function _setMigrationFaultForTest(v: boolean): void { _migrationFaultForTest = v; }
+
 function migrateSchema(db: DbAdapter, dbPath: string | null): void {
   const currentVersion = getCurrentSchemaVersion(db);
-  if (currentVersion >= SCHEMA_VERSION) return;
+  if (currentVersion > SCHEMA_VERSION) {
+    throw new Error(
+      `gsd.db schema is v${currentVersion}, newer than the v${SCHEMA_VERSION} this gsd-pi supports. ` +
+      `Update gsd-pi (npm i -g @opengsd/gsd-pi) before opening this project.`,
+    );
+  }
+  if (currentVersion === SCHEMA_VERSION) return;
 
   backupDatabaseBeforeMigration(db, dbPath, currentVersion, {
     existsSync,
@@ -351,6 +383,13 @@ function migrateSchema(db: DbAdapter, dbPath: string | null): void {
       recordSchemaVersion(db, 29);
     }
 
+    if (currentVersion < 30) {
+      applyMigrationV30ReworkBriefs(db);
+      recordSchemaVersion(db, 30);
+    }
+
+    if (_migrationFaultForTest) throw new Error("migration fault injected for test");
+
     db.exec("COMMIT");
   } catch (err) {
     db.exec("ROLLBACK");

package/src/resources/extensions/gsd/db/writers/cascades.ts

@@ -211,7 +211,11 @@ export function skipSliceCascade(milestoneId: string, sliceId: string): SkipSlic
   transaction(() => {
     const slice = getSlice(milestoneId, sliceId);
     if (!slice) { outcome = { ok: false, reason: "slice-not-found" }; return; }
-    if (slice.status === "complete" || slice.status === "done") {
+    // Reject any closed slice except "skipped" (which falls through to the
+    // wasAlreadySkipped no-op). isClosedStatus covers the "closed"/"done"
+    // aliases too — hand-picking literals here nulls a completed slice's
+    // completed_at on re-skip.
+    if (isClosedStatus(slice.status) && slice.status !== "skipped") {
       outcome = { ok: false, reason: "slice-already-complete" };
       return;
     }