gsd-pi 2.51.0-dev.ae8f7cb → 2.52.0-dev.585e355

package/dist/resources/extensions/gsd/tools/complete-task.js

@@ -8,7 +8,8 @@
  */
 import { join } from "node:path";
 import { mkdirSync } from "node:fs";
-import { transaction, insertMilestone, insertSlice, insertTask, insertVerificationEvidence, getMilestone, getSlice, getTask, _getAdapter, } from "../gsd-db.js";
+import { isClosedStatus } from "../status-guards.js";
+import { transaction, insertMilestone, insertSlice, insertTask, insertVerificationEvidence, getMilestone, getSlice, getTask, updateTaskStatus, setTaskSummaryMd, deleteVerificationEvidence, } from "../gsd-db.js";
 import { resolveSliceFile, resolveTasksDir, clearPathCache } from "../paths.js";
 import { checkOwnership, taskUnitKey } from "../unit-ownership.js";
 import { saveFile, clearParseCache } from "../files.js";
@@ -122,17 +123,17 @@ export async function handleCompleteTask(params, basePath) {
         // Milestone/slice not existing is OK — insertMilestone/insertSlice below will auto-create.
         // Only block if they exist and are closed.
         const milestone = getMilestone(params.milestoneId);
-        if (milestone && (milestone.status === "complete" || milestone.status === "done")) {
+        if (milestone && isClosedStatus(milestone.status)) {
             guardError = `cannot complete task in a closed milestone: ${params.milestoneId} (status: ${milestone.status})`;
             return;
         }
         const slice = getSlice(params.milestoneId, params.sliceId);
-        if (slice && (slice.status === "complete" || slice.status === "done")) {
+        if (slice && isClosedStatus(slice.status)) {
             guardError = `cannot complete task in a closed slice: ${params.sliceId} (status: ${slice.status})`;
             return;
         }
         const existingTask = getTask(params.milestoneId, params.sliceId, params.taskId);
-        if (existingTask && (existingTask.status === "complete" || existingTask.status === "done")) {
+        if (existingTask && isClosedStatus(existingTask.status)) {
             guardError = `task ${params.taskId} is already complete — use gsd_task_reopen first if you need to redo it`;
             return;
         }
@@ -202,27 +203,16 @@ export async function handleCompleteTask(params, basePath) {
     catch (renderErr) {
         // Disk render failed — roll back DB status so state stays consistent
         process.stderr.write(`gsd-db: complete_task — disk render failed, rolling back DB status: ${renderErr.message}\n`);
-        const rollbackAdapter = _getAdapter();
-        if (rollbackAdapter) {
-            rollbackAdapter.prepare(`UPDATE tasks SET status = 'pending' WHERE milestone_id = :mid AND slice_id = :sid AND id = :tid`).run({
-                ":mid": params.milestoneId,
-                ":sid": params.sliceId,
-                ":tid": params.taskId,
-            });
-        }
+        // Delete orphaned verification_evidence rows first (FK constraint
+        // references tasks, so evidence must go before status change).
+        // Without this, retries accumulate duplicate evidence rows (#2724).
+        deleteVerificationEvidence(params.milestoneId, params.sliceId, params.taskId);
+        updateTaskStatus(params.milestoneId, params.sliceId, params.taskId, 'pending');
         invalidateStateCache();
         return { error: `disk render failed: ${renderErr.message}` };
     }
     // Store rendered markdown in DB for D004 recovery
-    const adapter = _getAdapter();
-    if (adapter) {
-        adapter.prepare(`UPDATE tasks SET full_summary_md = :md WHERE milestone_id = :mid AND slice_id = :sid AND id = :tid`).run({
-            ":md": summaryMd,
-            ":mid": params.milestoneId,
-            ":sid": params.sliceId,
-            ":tid": params.taskId,
-        });
-    }
+    setTaskSummaryMd(params.milestoneId, params.sliceId, params.taskId, summaryMd);
     // Invalidate all caches
     invalidateStateCache();
     clearPathCache();

package/dist/resources/extensions/gsd/tools/plan-milestone.js

@@ -1,22 +1,12 @@
 import { clearParseCache } from "../files.js";
+import { isClosedStatus } from "../status-guards.js";
+import { isNonEmptyString, validateStringArray } from "../validation.js";
 import { transaction, getMilestone, insertMilestone, insertSlice, upsertMilestonePlanning, upsertSlicePlanning, } from "../gsd-db.js";
 import { invalidateStateCache } from "../state.js";
 import { renderRoadmapFromDb } from "../markdown-renderer.js";
 import { renderAllProjections } from "../workflow-projections.js";
 import { writeManifest } from "../workflow-manifest.js";
 import { appendEvent } from "../workflow-events.js";
-function isNonEmptyString(value) {
-    return typeof value === "string" && value.trim().length > 0;
-}
-function validateStringArray(value, field) {
-    if (!Array.isArray(value)) {
-        throw new Error(`${field} must be an array`);
-    }
-    if (value.some((item) => !isNonEmptyString(item))) {
-        throw new Error(`${field} must contain only non-empty strings`);
-    }
-    return value;
-}
 function validateRiskEntries(value) {
     if (!Array.isArray(value)) {
         throw new Error("keyRisks must be an array");
@@ -145,25 +135,31 @@ export async function handlePlanMilestone(rawParams, basePath) {
     catch (err) {
         return { error: `validation failed: ${err.message}` };
     }
-    // ── State machine preconditions ─────────────────────────────────────────
-    const existingMilestone = getMilestone(params.milestoneId);
-    if (existingMilestone && (existingMilestone.status === "complete" || existingMilestone.status === "done")) {
-        return { error: `cannot re-plan milestone ${params.milestoneId}: it is already complete` };
-    }
-    // Validate depends_on: all dependencies must exist and be complete
-    if (params.dependsOn && params.dependsOn.length > 0) {
-        for (const depId of params.dependsOn) {
-            const dep = getMilestone(depId);
-            if (!dep) {
-                return { error: `depends_on references unknown milestone: ${depId}` };
-            }
-            if (dep.status !== "complete" && dep.status !== "done") {
-                return { error: `depends_on milestone ${depId} is not yet complete (status: ${dep.status})` };
-            }
-        }
-    }
+    // ── Guards + DB writes inside a single transaction (prevents TOCTOU) ───
+    // Guards must be inside the transaction so the state they check cannot
+    // change between the read and the write (#2723).
+    let guardError = null;
     try {
         transaction(() => {
+            const existingMilestone = getMilestone(params.milestoneId);
+            if (existingMilestone && isClosedStatus(existingMilestone.status)) {
+                guardError = `cannot re-plan milestone ${params.milestoneId}: it is already complete`;
+                return;
+            }
+            // Validate depends_on: all dependencies must exist and be complete
+            if (params.dependsOn && params.dependsOn.length > 0) {
+                for (const depId of params.dependsOn) {
+                    const dep = getMilestone(depId);
+                    if (!dep) {
+                        guardError = `depends_on references unknown milestone: ${depId}`;
+                        return;
+                    }
+                    if (!isClosedStatus(dep.status)) {
+                        guardError = `depends_on milestone ${depId} is not yet complete (status: ${dep.status})`;
+                        return;
+                    }
+                }
+            }
             insertMilestone({
                 id: params.milestoneId,
                 title: params.title,
@@ -206,6 +202,9 @@ export async function handlePlanMilestone(rawParams, basePath) {
     catch (err) {
         return { error: `db write failed: ${err.message}` };
     }
+    if (guardError) {
+        return { error: guardError };
+    }
     let roadmapPath;
     try {
         const renderResult = await renderRoadmapFromDb(basePath, params.milestoneId);

package/dist/resources/extensions/gsd/tools/plan-slice.js

@@ -1,22 +1,12 @@
 import { clearParseCache } from "../files.js";
+import { isClosedStatus } from "../status-guards.js";
+import { isNonEmptyString } from "../validation.js";
 import { transaction, getMilestone, getSlice, insertTask, upsertSlicePlanning, upsertTaskPlanning, insertGateRow, } from "../gsd-db.js";
 import { invalidateStateCache } from "../state.js";
 import { renderPlanFromDb } from "../markdown-renderer.js";
 import { renderAllProjections } from "../workflow-projections.js";
 import { writeManifest } from "../workflow-manifest.js";
 import { appendEvent } from "../workflow-events.js";
-function isNonEmptyString(value) {
-    return typeof value === "string" && value.trim().length > 0;
-}
-function validateStringArray(value, field) {
-    if (!Array.isArray(value)) {
-        throw new Error(`${field} must be an array`);
-    }
-    if (value.some((item) => !isNonEmptyString(item))) {
-        throw new Error(`${field} must contain only non-empty strings`);
-    }
-    return value;
-}
 function validateTasks(value) {
     if (!Array.isArray(value) || value.length === 0) {
         throw new Error("tasks must be a non-empty array");
@@ -102,22 +92,30 @@ export async function handlePlanSlice(rawParams, basePath) {
     catch (err) {
         return { error: `validation failed: ${err.message}` };
     }
-    const parentMilestone = getMilestone(params.milestoneId);
-    if (!parentMilestone) {
-        return { error: `milestone not found: ${params.milestoneId}` };
-    }
-    if (parentMilestone.status === "complete" || parentMilestone.status === "done") {
-        return { error: `cannot plan slice in a closed milestone: ${params.milestoneId} (status: ${parentMilestone.status})` };
-    }
-    const parentSlice = getSlice(params.milestoneId, params.sliceId);
-    if (!parentSlice) {
-        return { error: `missing parent slice: ${params.milestoneId}/${params.sliceId}` };
-    }
-    if (parentSlice.status === "complete" || parentSlice.status === "done") {
-        return { error: `cannot re-plan slice ${params.sliceId}: it is already complete — use gsd_slice_reopen first` };
-    }
+    // ── Guards + DB writes inside a single transaction (prevents TOCTOU) ───
+    // Guards must be inside the transaction so the state they check cannot
+    // change between the read and the write (#2723).
+    let guardError = null;
     try {
         transaction(() => {
+            const parentMilestone = getMilestone(params.milestoneId);
+            if (!parentMilestone) {
+                guardError = `milestone not found: ${params.milestoneId}`;
+                return;
+            }
+            if (isClosedStatus(parentMilestone.status)) {
+                guardError = `cannot plan slice in a closed milestone: ${params.milestoneId} (status: ${parentMilestone.status})`;
+                return;
+            }
+            const parentSlice = getSlice(params.milestoneId, params.sliceId);
+            if (!parentSlice) {
+                guardError = `missing parent slice: ${params.milestoneId}/${params.sliceId}`;
+                return;
+            }
+            if (isClosedStatus(parentSlice.status)) {
+                guardError = `cannot re-plan slice ${params.sliceId}: it is already complete — use gsd_slice_reopen first`;
+                return;
+            }
             upsertSlicePlanning(params.milestoneId, params.sliceId, {
                 goal: params.goal,
                 successCriteria: params.successCriteria,
@@ -163,6 +161,9 @@ export async function handlePlanSlice(rawParams, basePath) {
     catch (err) {
         return { error: `db write failed: ${err.message}` };
     }
+    if (guardError) {
+        return { error: guardError };
+    }
     try {
         const renderResult = await renderPlanFromDb(basePath, params.milestoneId, params.sliceId);
         invalidateStateCache();

package/dist/resources/extensions/gsd/tools/plan-task.js

@@ -1,22 +1,12 @@
 import { clearParseCache } from "../files.js";
+import { isClosedStatus } from "../status-guards.js";
+import { isNonEmptyString, validateStringArray } from "../validation.js";
 import { transaction, getSlice, getTask, insertTask, upsertTaskPlanning } from "../gsd-db.js";
 import { invalidateStateCache } from "../state.js";
 import { renderTaskPlanFromDb } from "../markdown-renderer.js";
 import { renderAllProjections } from "../workflow-projections.js";
 import { writeManifest } from "../workflow-manifest.js";
 import { appendEvent } from "../workflow-events.js";
-function isNonEmptyString(value) {
-    return typeof value === "string" && value.trim().length > 0;
-}
-function validateStringArray(value, field) {
-    if (!Array.isArray(value)) {
-        throw new Error(`${field} must be an array`);
-    }
-    if (value.some((item) => !isNonEmptyString(item))) {
-        throw new Error(`${field} must contain only non-empty strings`);
-    }
-    return value;
-}
 function validateParams(params) {
     if (!isNonEmptyString(params?.milestoneId))
         throw new Error("milestoneId is required");
@@ -50,19 +40,26 @@ export async function handlePlanTask(rawParams, basePath) {
     catch (err) {
         return { error: `validation failed: ${err.message}` };
     }
-    const parentSlice = getSlice(params.milestoneId, params.sliceId);
-    if (!parentSlice) {
-        return { error: `missing parent slice: ${params.milestoneId}/${params.sliceId}` };
-    }
-    if (parentSlice.status === "complete" || parentSlice.status === "done") {
-        return { error: `cannot plan task in a closed slice: ${params.sliceId} (status: ${parentSlice.status})` };
-    }
-    const existingTask = getTask(params.milestoneId, params.sliceId, params.taskId);
-    if (existingTask && (existingTask.status === "complete" || existingTask.status === "done")) {
-        return { error: `cannot re-plan task ${params.taskId}: it is already complete — use gsd_task_reopen first` };
-    }
+    // ── Guards + DB writes inside a single transaction (prevents TOCTOU) ───
+    // Guards must be inside the transaction so the state they check cannot
+    // change between the read and the write (#2723).
+    let guardError = null;
     try {
         transaction(() => {
+            const parentSlice = getSlice(params.milestoneId, params.sliceId);
+            if (!parentSlice) {
+                guardError = `missing parent slice: ${params.milestoneId}/${params.sliceId}`;
+                return;
+            }
+            if (isClosedStatus(parentSlice.status)) {
+                guardError = `cannot plan task in a closed slice: ${params.sliceId} (status: ${parentSlice.status})`;
+                return;
+            }
+            const existingTask = getTask(params.milestoneId, params.sliceId, params.taskId);
+            if (existingTask && isClosedStatus(existingTask.status)) {
+                guardError = `cannot re-plan task ${params.taskId}: it is already complete — use gsd_task_reopen first`;
+                return;
+            }
             if (!existingTask) {
                 insertTask({
                     id: params.taskId,
@@ -88,6 +85,9 @@ export async function handlePlanTask(rawParams, basePath) {
     catch (err) {
         return { error: `db write failed: ${err.message}` };
     }
+    if (guardError) {
+        return { error: guardError };
+    }
     try {
         const renderResult = await renderTaskPlanFromDb(basePath, params.milestoneId, params.sliceId, params.taskId);
         invalidateStateCache();

package/dist/resources/extensions/gsd/tools/reassess-roadmap.js

@@ -1,14 +1,13 @@
+import { join } from "node:path";
 import { clearParseCache } from "../files.js";
+import { isClosedStatus } from "../status-guards.js";
+import { isNonEmptyString } from "../validation.js";
 import { transaction, getMilestone, getMilestoneSlices, getSlice, insertSlice, updateSliceFields, insertAssessment, deleteSlice, } from "../gsd-db.js";
 import { invalidateStateCache } from "../state.js";
 import { renderRoadmapFromDb, renderAssessmentFromDb } from "../markdown-renderer.js";
 import { renderAllProjections } from "../workflow-projections.js";
 import { writeManifest } from "../workflow-manifest.js";
 import { appendEvent } from "../workflow-events.js";
-import { join } from "node:path";
-function isNonEmptyString(value) {
-    return typeof value === "string" && value.trim().length > 0;
-}
 function validateParams(params) {
     if (!isNonEmptyString(params?.milestoneId))
         throw new Error("milestoneId is required");
@@ -61,48 +60,55 @@ export async function handleReassessRoadmap(rawParams, basePath) {
     catch (err) {
         return { error: `validation failed: ${err.message}` };
     }
-    // ── Verify milestone exists and is active ────────────────────────
-    const milestone = getMilestone(params.milestoneId);
-    if (!milestone) {
-        return { error: `milestone not found: ${params.milestoneId}` };
-    }
-    if (milestone.status === "complete" || milestone.status === "done") {
-        return { error: `cannot reassess a closed milestone: ${params.milestoneId} (status: ${milestone.status})` };
-    }
-    // ── Verify completedSliceId is actually complete ──────────────────
-    const completedSlice = getSlice(params.milestoneId, params.completedSliceId);
-    if (!completedSlice) {
-        return { error: `completedSliceId not found: ${params.milestoneId}/${params.completedSliceId}` };
-    }
-    if (completedSlice.status !== "complete" && completedSlice.status !== "done") {
-        return { error: `completedSliceId ${params.completedSliceId} is not complete (status: ${completedSlice.status}) — reassess can only be called after a slice finishes` };
-    }
-    // ── Structural enforcement ────────────────────────────────────────
-    const existingSlices = getMilestoneSlices(params.milestoneId);
-    const completedSliceIds = new Set();
-    for (const slice of existingSlices) {
-        if (slice.status === "complete" || slice.status === "done") {
-            completedSliceIds.add(slice.id);
-        }
-    }
-    // Reject modifications to completed slices
-    for (const modifiedSlice of params.sliceChanges.modified) {
-        if (completedSliceIds.has(modifiedSlice.sliceId)) {
-            return { error: `cannot modify completed slice ${modifiedSlice.sliceId}` };
-        }
-    }
-    // Reject removal of completed slices
-    for (const removedId of params.sliceChanges.removed) {
-        if (completedSliceIds.has(removedId)) {
-            return { error: `cannot remove completed slice ${removedId}` };
-        }
-    }
     // ── Compute assessment artifact path ──────────────────────────────
     // Assessment lives in the completed slice's directory
     const assessmentRelPath = join(".gsd", "milestones", params.milestoneId, "slices", params.completedSliceId, `${params.completedSliceId}-ASSESSMENT.md`);
-    // ── Transaction: DB mutations ─────────────────────────────────────
+    // ── Guards + DB writes inside a single transaction (prevents TOCTOU) ───
+    // Guards must be inside the transaction so the state they check cannot
+    // change between the read and the write (#2723).
+    let guardError = null;
     try {
         transaction(() => {
+            // Verify milestone exists and is active
+            const milestone = getMilestone(params.milestoneId);
+            if (!milestone) {
+                guardError = `milestone not found: ${params.milestoneId}`;
+                return;
+            }
+            if (isClosedStatus(milestone.status)) {
+                guardError = `cannot reassess a closed milestone: ${params.milestoneId} (status: ${milestone.status})`;
+                return;
+            }
+            // Verify completedSliceId is actually complete
+            const completedSlice = getSlice(params.milestoneId, params.completedSliceId);
+            if (!completedSlice) {
+                guardError = `completedSliceId not found: ${params.milestoneId}/${params.completedSliceId}`;
+                return;
+            }
+            if (!isClosedStatus(completedSlice.status)) {
+                guardError = `completedSliceId ${params.completedSliceId} is not complete (status: ${completedSlice.status}) — reassess can only be called after a slice finishes`;
+                return;
+            }
+            // Structural enforcement — reject modifications/removal of completed slices
+            const existingSlices = getMilestoneSlices(params.milestoneId);
+            const completedSliceIds = new Set();
+            for (const slice of existingSlices) {
+                if (isClosedStatus(slice.status)) {
+                    completedSliceIds.add(slice.id);
+                }
+            }
+            for (const modifiedSlice of params.sliceChanges.modified) {
+                if (completedSliceIds.has(modifiedSlice.sliceId)) {
+                    guardError = `cannot modify completed slice ${modifiedSlice.sliceId}`;
+                    return;
+                }
+            }
+            for (const removedId of params.sliceChanges.removed) {
+                if (completedSliceIds.has(removedId)) {
+                    guardError = `cannot remove completed slice ${removedId}`;
+                    return;
+                }
+            }
             // Record assessment
             insertAssessment({
                 path: assessmentRelPath,
@@ -142,6 +148,9 @@ export async function handleReassessRoadmap(rawParams, basePath) {
     catch (err) {
         return { error: `db write failed: ${err.message}` };
     }
+    if (guardError) {
+        return { error: guardError };
+    }
     // ── Render artifacts ──────────────────────────────────────────────
     try {
         const roadmapResult = await renderRoadmapFromDb(basePath, params.milestoneId);

package/dist/resources/extensions/gsd/tools/reopen-slice.js

@@ -11,6 +11,7 @@
 // Copyright (c) 2026 Jeremy McSpadden <jeremy@fluxlabs.net>
 import { getMilestone, getSlice, getSliceTasks, updateSliceStatus, updateTaskStatus, transaction, } from "../gsd-db.js";
 import { invalidateStateCache } from "../state.js";
+import { isClosedStatus } from "../status-guards.js";
 import { renderAllProjections } from "../workflow-projections.js";
 import { writeManifest } from "../workflow-manifest.js";
 import { appendEvent } from "../workflow-events.js";
@@ -31,8 +32,8 @@ export async function handleReopenSlice(params, basePath) {
             guardError = `milestone not found: ${params.milestoneId}`;
             return;
         }
-        if (milestone.status === "complete" || milestone.status === "done") {
-            guardError = `cannot reopen slice inside a closed milestone: ${params.milestoneId} (status: ${milestone.status})`;
+        if (isClosedStatus(milestone.status)) {
+            guardError = `cannot reopen slice in a closed milestone: ${params.milestoneId} (status: ${milestone.status})`;
             return;
         }
         const slice = getSlice(params.milestoneId, params.sliceId);
@@ -40,7 +41,7 @@ export async function handleReopenSlice(params, basePath) {
             guardError = `slice not found: ${params.milestoneId}/${params.sliceId}`;
             return;
         }
-        if (slice.status !== "complete" && slice.status !== "done") {
+        if (!isClosedStatus(slice.status)) {
             guardError = `slice ${params.sliceId} is not complete (status: ${slice.status}) — nothing to reopen`;
             return;
         }

package/dist/resources/extensions/gsd/tools/reopen-task.js

@@ -10,6 +10,7 @@
 // Copyright (c) 2026 Jeremy McSpadden <jeremy@fluxlabs.net>
 import { getMilestone, getSlice, getTask, updateTaskStatus, transaction, } from "../gsd-db.js";
 import { invalidateStateCache } from "../state.js";
+import { isClosedStatus } from "../status-guards.js";
 import { renderAllProjections } from "../workflow-projections.js";
 import { writeManifest } from "../workflow-manifest.js";
 import { appendEvent } from "../workflow-events.js";
@@ -32,7 +33,7 @@ export async function handleReopenTask(params, basePath) {
             guardError = `milestone not found: ${params.milestoneId}`;
             return;
         }
-        if (milestone.status === "complete" || milestone.status === "done") {
+        if (isClosedStatus(milestone.status)) {
             guardError = `cannot reopen task in a closed milestone: ${params.milestoneId} (status: ${milestone.status})`;
             return;
         }
@@ -41,8 +42,8 @@ export async function handleReopenTask(params, basePath) {
             guardError = `slice not found: ${params.milestoneId}/${params.sliceId}`;
             return;
         }
-        if (slice.status === "complete" || slice.status === "done") {
-            guardError = `cannot reopen task inside a closed slice: ${params.sliceId} (status: ${slice.status}) — use gsd_slice_reopen first`;
+        if (isClosedStatus(slice.status)) {
+            guardError = `cannot reopen task in a closed slice: ${params.sliceId} (status: ${slice.status}) — use gsd_slice_reopen first`;
             return;
         }
         const task = getTask(params.milestoneId, params.sliceId, params.taskId);
@@ -50,7 +51,7 @@ export async function handleReopenTask(params, basePath) {
             guardError = `task not found: ${params.milestoneId}/${params.sliceId}/${params.taskId}`;
             return;
         }
-        if (task.status !== "complete" && task.status !== "done") {
+        if (!isClosedStatus(task.status)) {
             guardError = `task ${params.taskId} is not complete (status: ${task.status}) — nothing to reopen`;
             return;
         }

package/dist/resources/extensions/gsd/tools/replan-slice.js

@@ -1,13 +1,12 @@
 import { clearParseCache } from "../files.js";
 import { transaction, getSlice, getSliceTasks, getTask, insertTask, upsertTaskPlanning, insertReplanHistory, deleteTask, } from "../gsd-db.js";
 import { invalidateStateCache } from "../state.js";
+import { isClosedStatus } from "../status-guards.js";
+import { isNonEmptyString } from "../validation.js";
 import { renderPlanFromDb, renderReplanFromDb } from "../markdown-renderer.js";
 import { renderAllProjections } from "../workflow-projections.js";
 import { writeManifest } from "../workflow-manifest.js";
 import { appendEvent } from "../workflow-events.js";
-function isNonEmptyString(value) {
-    return typeof value === "string" && value.trim().length > 0;
-}
 function validateParams(params) {
     if (!isNonEmptyString(params?.milestoneId))
         throw new Error("milestoneId is required");
@@ -46,46 +45,54 @@ export async function handleReplanSlice(rawParams, basePath) {
     catch (err) {
         return { error: `validation failed: ${err.message}` };
     }
-    // ── Verify parent slice exists and is not closed ─────────────────
-    const parentSlice = getSlice(params.milestoneId, params.sliceId);
-    if (!parentSlice) {
-        return { error: `missing parent slice: ${params.milestoneId}/${params.sliceId}` };
-    }
-    if (parentSlice.status === "complete" || parentSlice.status === "done") {
-        return { error: `cannot replan a closed slice: ${params.sliceId} (status: ${parentSlice.status})` };
-    }
-    // ── Verify blocker task exists and is complete ────────────────────
-    const blockerTask = getTask(params.milestoneId, params.sliceId, params.blockerTaskId);
-    if (!blockerTask) {
-        return { error: `blockerTaskId not found: ${params.milestoneId}/${params.sliceId}/${params.blockerTaskId}` };
-    }
-    if (blockerTask.status !== "complete" && blockerTask.status !== "done") {
-        return { error: `blockerTaskId ${params.blockerTaskId} is not complete (status: ${blockerTask.status}) — the blocker task must be finished before a replan is triggered` };
-    }
-    // ── Structural enforcement ────────────────────────────────────────
-    const existingTasks = getSliceTasks(params.milestoneId, params.sliceId);
-    const completedTaskIds = new Set();
-    for (const task of existingTasks) {
-        if (task.status === "complete" || task.status === "done") {
-            completedTaskIds.add(task.id);
-        }
-    }
-    // Reject updates to completed tasks
-    for (const updatedTask of params.updatedTasks) {
-        if (completedTaskIds.has(updatedTask.taskId)) {
-            return { error: `cannot modify completed task ${updatedTask.taskId}` };
-        }
-    }
-    // Reject removal of completed tasks
-    for (const removedId of params.removedTaskIds) {
-        if (completedTaskIds.has(removedId)) {
-            return { error: `cannot remove completed task ${removedId}` };
-        }
-    }
-    // ── Transaction: DB mutations ─────────────────────────────────────
-    const existingTaskIds = new Set(existingTasks.map((t) => t.id));
+    // ── Guards + DB writes inside a single transaction (prevents TOCTOU) ───
+    // Guards must be inside the transaction so the state they check cannot
+    // change between the read and the write (#2723).
+    let guardError = null;
+    let existingTaskIds = new Set();
     try {
         transaction(() => {
+            // Verify parent slice exists and is not closed
+            const parentSlice = getSlice(params.milestoneId, params.sliceId);
+            if (!parentSlice) {
+                guardError = `missing parent slice: ${params.milestoneId}/${params.sliceId}`;
+                return;
+            }
+            if (isClosedStatus(parentSlice.status)) {
+                guardError = `cannot replan a closed slice: ${params.sliceId} (status: ${parentSlice.status})`;
+                return;
+            }
+            // Verify blocker task exists and is complete
+            const blockerTask = getTask(params.milestoneId, params.sliceId, params.blockerTaskId);
+            if (!blockerTask) {
+                guardError = `blockerTaskId not found: ${params.milestoneId}/${params.sliceId}/${params.blockerTaskId}`;
+                return;
+            }
+            if (!isClosedStatus(blockerTask.status)) {
+                guardError = `blockerTaskId ${params.blockerTaskId} is not complete (status: ${blockerTask.status}) — the blocker task must be finished before a replan is triggered`;
+                return;
+            }
+            // Structural enforcement — reject modifications/removal of completed tasks
+            const existingTasks = getSliceTasks(params.milestoneId, params.sliceId);
+            const completedTaskIds = new Set();
+            for (const task of existingTasks) {
+                if (isClosedStatus(task.status)) {
+                    completedTaskIds.add(task.id);
+                }
+            }
+            for (const updatedTask of params.updatedTasks) {
+                if (completedTaskIds.has(updatedTask.taskId)) {
+                    guardError = `cannot modify completed task ${updatedTask.taskId}`;
+                    return;
+                }
+            }
+            for (const removedId of params.removedTaskIds) {
+                if (completedTaskIds.has(removedId)) {
+                    guardError = `cannot remove completed task ${removedId}`;
+                    return;
+                }
+            }
+            existingTaskIds = new Set(existingTasks.map((t) => t.id));
             // Record replan history
             insertReplanHistory({
                 milestoneId: params.milestoneId,
@@ -138,6 +145,9 @@ export async function handleReplanSlice(rawParams, basePath) {
     catch (err) {
         return { error: `db write failed: ${err.message}` };
     }
+    if (guardError) {
+        return { error: guardError };
+    }
     // ── Render artifacts ──────────────────────────────────────────────
     try {
         const renderResult = await renderPlanFromDb(basePath, params.milestoneId, params.sliceId);