gsd-pi 2.51.0 → 2.52.0-dev.585e355

package/src/resources/extensions/gsd/tools/plan-milestone.ts

@@ -1,4 +1,6 @@
 import { clearParseCache } from "../files.js";
+import { isClosedStatus } from "../status-guards.js";
+import { isNonEmptyString, validateStringArray } from "../validation.js";
 import {
   transaction,
   getMilestone,
@@ -6,7 +8,6 @@ import {
   insertSlice,
   upsertMilestonePlanning,
   upsertSlicePlanning,
-  _getAdapter,
 } from "../gsd-db.js";
 import { invalidateStateCache } from "../state.js";
 import { renderRoadmapFromDb } from "../markdown-renderer.js";
@@ -55,20 +56,6 @@ export interface PlanMilestoneResult {
   roadmapPath: string;
 }
 
-function isNonEmptyString(value: unknown): value is string {
-  return typeof value === "string" && value.trim().length > 0;
-}
-
-function validateStringArray(value: unknown, field: string): string[] {
-  if (!Array.isArray(value)) {
-    throw new Error(`${field} must be an array`);
-  }
-  if (value.some((item) => !isNonEmptyString(item))) {
-    throw new Error(`${field} must contain only non-empty strings`);
-  }
-  return value;
-}
-
 function validateRiskEntries(value: unknown): Array<{ risk: string; whyItMatters: string }> {
   if (!Array.isArray(value)) {
     throw new Error("keyRisks must be an array");
@@ -189,27 +176,34 @@ export async function handlePlanMilestone(
     return { error: `validation failed: ${(err as Error).message}` };
   }
 
-  // ── State machine preconditions ─────────────────────────────────────────
-  const existingMilestone = getMilestone(params.milestoneId);
-  if (existingMilestone && (existingMilestone.status === "complete" || existingMilestone.status === "done")) {
-    return { error: `cannot re-plan milestone ${params.milestoneId}: it is already complete` };
-  }
+  // ── Guards + DB writes inside a single transaction (prevents TOCTOU) ───
+  // Guards must be inside the transaction so the state they check cannot
+  // change between the read and the write (#2723).
+  let guardError: string | null = null;
 
-  // Validate depends_on: all dependencies must exist and be complete
-  if (params.dependsOn && params.dependsOn.length > 0) {
-    for (const depId of params.dependsOn) {
-      const dep = getMilestone(depId);
-      if (!dep) {
-        return { error: `depends_on references unknown milestone: ${depId}` };
+  try {
+    transaction(() => {
+      const existingMilestone = getMilestone(params.milestoneId);
+      if (existingMilestone && isClosedStatus(existingMilestone.status)) {
+        guardError = `cannot re-plan milestone ${params.milestoneId}: it is already complete`;
+        return;
       }
-      if (dep.status !== "complete" && dep.status !== "done") {
-        return { error: `depends_on milestone ${depId} is not yet complete (status: ${dep.status})` };
+
+      // Validate depends_on: all dependencies must exist and be complete
+      if (params.dependsOn && params.dependsOn.length > 0) {
+        for (const depId of params.dependsOn) {
+          const dep = getMilestone(depId);
+          if (!dep) {
+            guardError = `depends_on references unknown milestone: ${depId}`;
+            return;
+          }
+          if (!isClosedStatus(dep.status)) {
+            guardError = `depends_on milestone ${depId} is not yet complete (status: ${dep.status})`;
+            return;
+          }
+        }
       }
-    }
-  }
 
-  try {
-    transaction(() => {
       insertMilestone({
         id: params.milestoneId,
         title: params.title,
@@ -254,6 +248,10 @@ export async function handlePlanMilestone(
     return { error: `db write failed: ${(err as Error).message}` };
   }
 
+  if (guardError) {
+    return { error: guardError };
+  }
+
   let roadmapPath: string;
   try {
     const renderResult = await renderRoadmapFromDb(basePath, params.milestoneId);

package/src/resources/extensions/gsd/tools/plan-slice.ts

@@ -1,4 +1,6 @@
 import { clearParseCache } from "../files.js";
+import { isClosedStatus } from "../status-guards.js";
+import { isNonEmptyString, validateStringArray } from "../validation.js";
 import {
   transaction,
   getMilestone,
@@ -7,7 +9,6 @@ import {
   upsertSlicePlanning,
   upsertTaskPlanning,
   insertGateRow,
-  _getAdapter,
 } from "../gsd-db.js";
 import type { GateId } from "../types.js";
 import { invalidateStateCache } from "../state.js";
@@ -51,20 +52,6 @@ export interface PlanSliceResult {
   taskPlanPaths: string[];
 }
 
-function isNonEmptyString(value: unknown): value is string {
-  return typeof value === "string" && value.trim().length > 0;
-}
-
-function validateStringArray(value: unknown, field: string): string[] {
-  if (!Array.isArray(value)) {
-    throw new Error(`${field} must be an array`);
-  }
-  if (value.some((item) => !isNonEmptyString(item))) {
-    throw new Error(`${field} must contain only non-empty strings`);
-  }
-  return value;
-}
-
 function validateTasks(value: unknown): PlanSliceTaskInput[] {
   if (!Array.isArray(value) || value.length === 0) {
     throw new Error("tasks must be a non-empty array");
@@ -146,24 +133,33 @@ export async function handlePlanSlice(
     return { error: `validation failed: ${(err as Error).message}` };
   }
 
-  const parentMilestone = getMilestone(params.milestoneId);
-  if (!parentMilestone) {
-    return { error: `milestone not found: ${params.milestoneId}` };
-  }
-  if (parentMilestone.status === "complete" || parentMilestone.status === "done") {
-    return { error: `cannot plan slice in a closed milestone: ${params.milestoneId} (status: ${parentMilestone.status})` };
-  }
-
-  const parentSlice = getSlice(params.milestoneId, params.sliceId);
-  if (!parentSlice) {
-    return { error: `missing parent slice: ${params.milestoneId}/${params.sliceId}` };
-  }
-  if (parentSlice.status === "complete" || parentSlice.status === "done") {
-    return { error: `cannot re-plan slice ${params.sliceId}: it is already complete — use gsd_slice_reopen first` };
-  }
+  // ── Guards + DB writes inside a single transaction (prevents TOCTOU) ───
+  // Guards must be inside the transaction so the state they check cannot
+  // change between the read and the write (#2723).
+  let guardError: string | null = null;
 
   try {
     transaction(() => {
+      const parentMilestone = getMilestone(params.milestoneId);
+      if (!parentMilestone) {
+        guardError = `milestone not found: ${params.milestoneId}`;
+        return;
+      }
+      if (isClosedStatus(parentMilestone.status)) {
+        guardError = `cannot plan slice in a closed milestone: ${params.milestoneId} (status: ${parentMilestone.status})`;
+        return;
+      }
+
+      const parentSlice = getSlice(params.milestoneId, params.sliceId);
+      if (!parentSlice) {
+        guardError = `missing parent slice: ${params.milestoneId}/${params.sliceId}`;
+        return;
+      }
+      if (isClosedStatus(parentSlice.status)) {
+        guardError = `cannot re-plan slice ${params.sliceId}: it is already complete — use gsd_slice_reopen first`;
+        return;
+      }
+
       upsertSlicePlanning(params.milestoneId, params.sliceId, {
         goal: params.goal,
         successCriteria: params.successCriteria,
@@ -211,6 +207,10 @@ export async function handlePlanSlice(
     return { error: `db write failed: ${(err as Error).message}` };
   }
 
+  if (guardError) {
+    return { error: guardError };
+  }
+
   try {
     const renderResult = await renderPlanFromDb(basePath, params.milestoneId, params.sliceId);
     invalidateStateCache();

package/src/resources/extensions/gsd/tools/plan-task.ts

@@ -1,4 +1,6 @@
 import { clearParseCache } from "../files.js";
+import { isClosedStatus } from "../status-guards.js";
+import { isNonEmptyString, validateStringArray } from "../validation.js";
 import { transaction, getSlice, getTask, insertTask, upsertTaskPlanning } from "../gsd-db.js";
 import { invalidateStateCache } from "../state.js";
 import { renderTaskPlanFromDb } from "../markdown-renderer.js";
@@ -32,20 +34,6 @@ export interface PlanTaskResult {
   taskPlanPath: string;
 }
 
-function isNonEmptyString(value: unknown): value is string {
-  return typeof value === "string" && value.trim().length > 0;
-}
-
-function validateStringArray(value: unknown, field: string): string[] {
-  if (!Array.isArray(value)) {
-    throw new Error(`${field} must be an array`);
-  }
-  if (value.some((item) => !isNonEmptyString(item))) {
-    throw new Error(`${field} must contain only non-empty strings`);
-  }
-  return value;
-}
-
 function validateParams(params: PlanTaskParams): PlanTaskParams {
   if (!isNonEmptyString(params?.milestoneId)) throw new Error("milestoneId is required");
   if (!isNonEmptyString(params?.sliceId)) throw new Error("sliceId is required");
@@ -77,21 +65,29 @@ export async function handlePlanTask(
     return { error: `validation failed: ${(err as Error).message}` };
   }
 
-  const parentSlice = getSlice(params.milestoneId, params.sliceId);
-  if (!parentSlice) {
-    return { error: `missing parent slice: ${params.milestoneId}/${params.sliceId}` };
-  }
-  if (parentSlice.status === "complete" || parentSlice.status === "done") {
-    return { error: `cannot plan task in a closed slice: ${params.sliceId} (status: ${parentSlice.status})` };
-  }
-
-  const existingTask = getTask(params.milestoneId, params.sliceId, params.taskId);
-  if (existingTask && (existingTask.status === "complete" || existingTask.status === "done")) {
-    return { error: `cannot re-plan task ${params.taskId}: it is already complete — use gsd_task_reopen first` };
-  }
+  // ── Guards + DB writes inside a single transaction (prevents TOCTOU) ───
+  // Guards must be inside the transaction so the state they check cannot
+  // change between the read and the write (#2723).
+  let guardError: string | null = null;
 
   try {
     transaction(() => {
+      const parentSlice = getSlice(params.milestoneId, params.sliceId);
+      if (!parentSlice) {
+        guardError = `missing parent slice: ${params.milestoneId}/${params.sliceId}`;
+        return;
+      }
+      if (isClosedStatus(parentSlice.status)) {
+        guardError = `cannot plan task in a closed slice: ${params.sliceId} (status: ${parentSlice.status})`;
+        return;
+      }
+
+      const existingTask = getTask(params.milestoneId, params.sliceId, params.taskId);
+      if (existingTask && isClosedStatus(existingTask.status)) {
+        guardError = `cannot re-plan task ${params.taskId}: it is already complete — use gsd_task_reopen first`;
+        return;
+      }
+
       if (!existingTask) {
         insertTask({
           id: params.taskId,
@@ -117,6 +113,10 @@ export async function handlePlanTask(
     return { error: `db write failed: ${(err as Error).message}` };
   }
 
+  if (guardError) {
+    return { error: guardError };
+  }
+
   try {
     const renderResult = await renderTaskPlanFromDb(basePath, params.milestoneId, params.sliceId, params.taskId);
     invalidateStateCache();

package/src/resources/extensions/gsd/tools/reassess-roadmap.ts

@@ -1,4 +1,7 @@
+import { join } from "node:path";
 import { clearParseCache } from "../files.js";
+import { isClosedStatus } from "../status-guards.js";
+import { isNonEmptyString } from "../validation.js";
 import {
   transaction,
   getMilestone,
@@ -14,7 +17,6 @@ import { renderRoadmapFromDb, renderAssessmentFromDb } from "../markdown-rendere
 import { renderAllProjections } from "../workflow-projections.js";
 import { writeManifest } from "../workflow-manifest.js";
 import { appendEvent } from "../workflow-events.js";
-import { join } from "node:path";
 
 export interface SliceChangeInput {
   sliceId: string;
@@ -47,9 +49,6 @@ export interface ReassessRoadmapResult {
   roadmapPath: string;
 }
 
-function isNonEmptyString(value: unknown): value is string {
-  return typeof value === "string" && value.trim().length > 0;
-}
 
 function validateParams(params: ReassessRoadmapParams): ReassessRoadmapParams {
   if (!isNonEmptyString(params?.milestoneId)) throw new Error("milestoneId is required");
@@ -104,47 +103,6 @@ export async function handleReassessRoadmap(
     return { error: `validation failed: ${(err as Error).message}` };
   }
 
-  // ── Verify milestone exists and is active ────────────────────────
-  const milestone = getMilestone(params.milestoneId);
-  if (!milestone) {
-    return { error: `milestone not found: ${params.milestoneId}` };
-  }
-  if (milestone.status === "complete" || milestone.status === "done") {
-    return { error: `cannot reassess a closed milestone: ${params.milestoneId} (status: ${milestone.status})` };
-  }
-
-  // ── Verify completedSliceId is actually complete ──────────────────
-  const completedSlice = getSlice(params.milestoneId, params.completedSliceId);
-  if (!completedSlice) {
-    return { error: `completedSliceId not found: ${params.milestoneId}/${params.completedSliceId}` };
-  }
-  if (completedSlice.status !== "complete" && completedSlice.status !== "done") {
-    return { error: `completedSliceId ${params.completedSliceId} is not complete (status: ${completedSlice.status}) — reassess can only be called after a slice finishes` };
-  }
-
-  // ── Structural enforcement ────────────────────────────────────────
-  const existingSlices = getMilestoneSlices(params.milestoneId);
-  const completedSliceIds = new Set<string>();
-  for (const slice of existingSlices) {
-    if (slice.status === "complete" || slice.status === "done") {
-      completedSliceIds.add(slice.id);
-    }
-  }
-
-  // Reject modifications to completed slices
-  for (const modifiedSlice of params.sliceChanges.modified) {
-    if (completedSliceIds.has(modifiedSlice.sliceId)) {
-      return { error: `cannot modify completed slice ${modifiedSlice.sliceId}` };
-    }
-  }
-
-  // Reject removal of completed slices
-  for (const removedId of params.sliceChanges.removed) {
-    if (completedSliceIds.has(removedId)) {
-      return { error: `cannot remove completed slice ${removedId}` };
-    }
-  }
-
   // ── Compute assessment artifact path ──────────────────────────────
   // Assessment lives in the completed slice's directory
   const assessmentRelPath = join(
@@ -153,9 +111,58 @@ export async function handleReassessRoadmap(
     `${params.completedSliceId}-ASSESSMENT.md`,
   );
 
-  // ── Transaction: DB mutations ─────────────────────────────────────
+  // ── Guards + DB writes inside a single transaction (prevents TOCTOU) ───
+  // Guards must be inside the transaction so the state they check cannot
+  // change between the read and the write (#2723).
+  let guardError: string | null = null;
+
   try {
     transaction(() => {
+      // Verify milestone exists and is active
+      const milestone = getMilestone(params.milestoneId);
+      if (!milestone) {
+        guardError = `milestone not found: ${params.milestoneId}`;
+        return;
+      }
+      if (isClosedStatus(milestone.status)) {
+        guardError = `cannot reassess a closed milestone: ${params.milestoneId} (status: ${milestone.status})`;
+        return;
+      }
+
+      // Verify completedSliceId is actually complete
+      const completedSlice = getSlice(params.milestoneId, params.completedSliceId);
+      if (!completedSlice) {
+        guardError = `completedSliceId not found: ${params.milestoneId}/${params.completedSliceId}`;
+        return;
+      }
+      if (!isClosedStatus(completedSlice.status)) {
+        guardError = `completedSliceId ${params.completedSliceId} is not complete (status: ${completedSlice.status}) — reassess can only be called after a slice finishes`;
+        return;
+      }
+
+      // Structural enforcement — reject modifications/removal of completed slices
+      const existingSlices = getMilestoneSlices(params.milestoneId);
+      const completedSliceIds = new Set<string>();
+      for (const slice of existingSlices) {
+        if (isClosedStatus(slice.status)) {
+          completedSliceIds.add(slice.id);
+        }
+      }
+
+      for (const modifiedSlice of params.sliceChanges.modified) {
+        if (completedSliceIds.has(modifiedSlice.sliceId)) {
+          guardError = `cannot modify completed slice ${modifiedSlice.sliceId}`;
+          return;
+        }
+      }
+
+      for (const removedId of params.sliceChanges.removed) {
+        if (completedSliceIds.has(removedId)) {
+          guardError = `cannot remove completed slice ${removedId}`;
+          return;
+        }
+      }
+
       // Record assessment
       insertAssessment({
         path: assessmentRelPath,
@@ -198,6 +205,10 @@ export async function handleReassessRoadmap(
     return { error: `db write failed: ${(err as Error).message}` };
   }
 
+  if (guardError) {
+    return { error: guardError };
+  }
+
   // ── Render artifacts ──────────────────────────────────────────────
   try {
     const roadmapResult = await renderRoadmapFromDb(basePath, params.milestoneId);

package/src/resources/extensions/gsd/tools/reopen-slice.ts

@@ -20,6 +20,7 @@ import {
   transaction,
 } from "../gsd-db.js";
 import { invalidateStateCache } from "../state.js";
+import { isClosedStatus } from "../status-guards.js";
 import { renderAllProjections } from "../workflow-projections.js";
 import { writeManifest } from "../workflow-manifest.js";
 import { appendEvent } from "../workflow-events.js";
@@ -62,8 +63,8 @@ export async function handleReopenSlice(
       guardError = `milestone not found: ${params.milestoneId}`;
       return;
     }
-    if (milestone.status === "complete" || milestone.status === "done") {
-      guardError = `cannot reopen slice inside a closed milestone: ${params.milestoneId} (status: ${milestone.status})`;
+    if (isClosedStatus(milestone.status)) {
+      guardError = `cannot reopen slice in a closed milestone: ${params.milestoneId} (status: ${milestone.status})`;
       return;
     }
 
@@ -72,7 +73,7 @@ export async function handleReopenSlice(
       guardError = `slice not found: ${params.milestoneId}/${params.sliceId}`;
       return;
     }
-    if (slice.status !== "complete" && slice.status !== "done") {
+    if (!isClosedStatus(slice.status)) {
       guardError = `slice ${params.sliceId} is not complete (status: ${slice.status}) — nothing to reopen`;
       return;
     }

package/src/resources/extensions/gsd/tools/reopen-task.ts

@@ -18,6 +18,7 @@ import {
   transaction,
 } from "../gsd-db.js";
 import { invalidateStateCache } from "../state.js";
+import { isClosedStatus } from "../status-guards.js";
 import { renderAllProjections } from "../workflow-projections.js";
 import { writeManifest } from "../workflow-manifest.js";
 import { appendEvent } from "../workflow-events.js";
@@ -63,7 +64,7 @@ export async function handleReopenTask(
       guardError = `milestone not found: ${params.milestoneId}`;
       return;
     }
-    if (milestone.status === "complete" || milestone.status === "done") {
+    if (isClosedStatus(milestone.status)) {
       guardError = `cannot reopen task in a closed milestone: ${params.milestoneId} (status: ${milestone.status})`;
       return;
     }
@@ -73,8 +74,8 @@ export async function handleReopenTask(
       guardError = `slice not found: ${params.milestoneId}/${params.sliceId}`;
       return;
     }
-    if (slice.status === "complete" || slice.status === "done") {
-      guardError = `cannot reopen task inside a closed slice: ${params.sliceId} (status: ${slice.status}) — use gsd_slice_reopen first`;
+    if (isClosedStatus(slice.status)) {
+      guardError = `cannot reopen task in a closed slice: ${params.sliceId} (status: ${slice.status}) — use gsd_slice_reopen first`;
       return;
     }
 
@@ -83,7 +84,7 @@ export async function handleReopenTask(
       guardError = `task not found: ${params.milestoneId}/${params.sliceId}/${params.taskId}`;
       return;
     }
-    if (task.status !== "complete" && task.status !== "done") {
+    if (!isClosedStatus(task.status)) {
       guardError = `task ${params.taskId} is not complete (status: ${task.status}) — nothing to reopen`;
       return;
     }

package/src/resources/extensions/gsd/tools/replan-slice.ts

@@ -10,6 +10,8 @@ import {
   deleteTask,
 } from "../gsd-db.js";
 import { invalidateStateCache } from "../state.js";
+import { isClosedStatus } from "../status-guards.js";
+import { isNonEmptyString } from "../validation.js";
 import { renderPlanFromDb, renderReplanFromDb } from "../markdown-renderer.js";
 import { renderAllProjections } from "../workflow-projections.js";
 import { writeManifest } from "../workflow-manifest.js";
@@ -48,10 +50,6 @@ export interface ReplanSliceResult {
   planPath: string;
 }
 
-function isNonEmptyString(value: unknown): value is string {
-  return typeof value === "string" && value.trim().length > 0;
-}
-
 function validateParams(params: ReplanSliceParams): ReplanSliceParams {
   if (!isNonEmptyString(params?.milestoneId)) throw new Error("milestoneId is required");
   if (!isNonEmptyString(params?.sliceId)) throw new Error("sliceId is required");
@@ -90,52 +88,61 @@ export async function handleReplanSlice(
     return { error: `validation failed: ${(err as Error).message}` };
   }
 
-  // ── Verify parent slice exists and is not closed ─────────────────
-  const parentSlice = getSlice(params.milestoneId, params.sliceId);
-  if (!parentSlice) {
-    return { error: `missing parent slice: ${params.milestoneId}/${params.sliceId}` };
-  }
-  if (parentSlice.status === "complete" || parentSlice.status === "done") {
-    return { error: `cannot replan a closed slice: ${params.sliceId} (status: ${parentSlice.status})` };
-  }
+  // ── Guards + DB writes inside a single transaction (prevents TOCTOU) ───
+  // Guards must be inside the transaction so the state they check cannot
+  // change between the read and the write (#2723).
+  let guardError: string | null = null;
+  let existingTaskIds: Set<string> = new Set();
 
-  // ── Verify blocker task exists and is complete ────────────────────
-  const blockerTask = getTask(params.milestoneId, params.sliceId, params.blockerTaskId);
-  if (!blockerTask) {
-    return { error: `blockerTaskId not found: ${params.milestoneId}/${params.sliceId}/${params.blockerTaskId}` };
-  }
-  if (blockerTask.status !== "complete" && blockerTask.status !== "done") {
-    return { error: `blockerTaskId ${params.blockerTaskId} is not complete (status: ${blockerTask.status}) — the blocker task must be finished before a replan is triggered` };
-  }
+  try {
+    transaction(() => {
+      // Verify parent slice exists and is not closed
+      const parentSlice = getSlice(params.milestoneId, params.sliceId);
+      if (!parentSlice) {
+        guardError = `missing parent slice: ${params.milestoneId}/${params.sliceId}`;
+        return;
+      }
+      if (isClosedStatus(parentSlice.status)) {
+        guardError = `cannot replan a closed slice: ${params.sliceId} (status: ${parentSlice.status})`;
+        return;
+      }
 
-  // ── Structural enforcement ────────────────────────────────────────
-  const existingTasks = getSliceTasks(params.milestoneId, params.sliceId);
-  const completedTaskIds = new Set<string>();
-  for (const task of existingTasks) {
-    if (task.status === "complete" || task.status === "done") {
-      completedTaskIds.add(task.id);
-    }
-  }
+      // Verify blocker task exists and is complete
+      const blockerTask = getTask(params.milestoneId, params.sliceId, params.blockerTaskId);
+      if (!blockerTask) {
+        guardError = `blockerTaskId not found: ${params.milestoneId}/${params.sliceId}/${params.blockerTaskId}`;
+        return;
+      }
+      if (!isClosedStatus(blockerTask.status)) {
+        guardError = `blockerTaskId ${params.blockerTaskId} is not complete (status: ${blockerTask.status}) — the blocker task must be finished before a replan is triggered`;
+        return;
+      }
 
-  // Reject updates to completed tasks
-  for (const updatedTask of params.updatedTasks) {
-    if (completedTaskIds.has(updatedTask.taskId)) {
-      return { error: `cannot modify completed task ${updatedTask.taskId}` };
-    }
-  }
+      // Structural enforcement — reject modifications/removal of completed tasks
+      const existingTasks = getSliceTasks(params.milestoneId, params.sliceId);
+      const completedTaskIds = new Set<string>();
+      for (const task of existingTasks) {
+        if (isClosedStatus(task.status)) {
+          completedTaskIds.add(task.id);
+        }
+      }
 
-  // Reject removal of completed tasks
-  for (const removedId of params.removedTaskIds) {
-    if (completedTaskIds.has(removedId)) {
-      return { error: `cannot remove completed task ${removedId}` };
-    }
-  }
+      for (const updatedTask of params.updatedTasks) {
+        if (completedTaskIds.has(updatedTask.taskId)) {
+          guardError = `cannot modify completed task ${updatedTask.taskId}`;
+          return;
+        }
+      }
 
-  // ── Transaction: DB mutations ─────────────────────────────────────
-  const existingTaskIds = new Set(existingTasks.map((t) => t.id));
+      for (const removedId of params.removedTaskIds) {
+        if (completedTaskIds.has(removedId)) {
+          guardError = `cannot remove completed task ${removedId}`;
+          return;
+        }
+      }
+
+      existingTaskIds = new Set(existingTasks.map((t) => t.id));
 
-  try {
-    transaction(() => {
       // Record replan history
       insertReplanHistory({
         milestoneId: params.milestoneId,
@@ -189,6 +196,10 @@ export async function handleReplanSlice(
     return { error: `db write failed: ${(err as Error).message}` };
   }
 
+  if (guardError) {
+    return { error: guardError };
+  }
+
   // ── Render artifacts ──────────────────────────────────────────────
   try {
     const renderResult = await renderPlanFromDb(basePath, params.milestoneId, params.sliceId);