gsd-pi 2.51.0 → 2.52.0-dev.655ad8a

package/dist/resources/extensions/gsd/state.js

@@ -6,6 +6,7 @@ import { parseSummary, loadFile, parseRequirementCounts, parseContextDependsOn,
 import { resolveMilestoneFile, resolveSlicePath, resolveSliceFile, resolveTaskFile, resolveTasksDir, resolveGsdRootFile, gsdRoot, } from './paths.js';
 import { findMilestoneIds } from './milestone-ids.js';
 import { loadQueueOrder, sortByQueueOrder } from './queue-order.js';
+import { isClosedStatus } from './status-guards.js';
 import { nativeBatchParseGsdFiles } from './native-parser-bridge.js';
 import { join, resolve } from 'path';
 import { existsSync, readdirSync } from 'node:fs';
@@ -39,19 +40,13 @@ export function isMilestoneComplete(roadmap) {
     return roadmap.slices.length > 0 && roadmap.slices.every(s => s.done);
 }
 /**
- * Check whether a VALIDATION file's verdict is terminal (pass or needs-attention).
- * A non-terminal verdict (needs-remediation) means validation must re-run
- * after remediation slices are executed.
+ * Check whether a VALIDATION file's verdict is terminal.
+ * Any successfully extracted verdict (pass, needs-attention, needs-remediation,
+ * fail, etc.) means validation completed. Only return false when no verdict
+ * could be parsed — i.e. extractVerdict() returns undefined (#2769).
  */
 export function isValidationTerminal(validationContent) {
-    const v = extractVerdict(validationContent);
-    if (!v)
-        return false;
-    // 'pass' and 'needs-attention' are always terminal.
-    // 'needs-remediation' is treated as terminal to prevent infinite loops
-    // when no remediation slices exist in the roadmap (#832). The validation
-    // report is preserved on disk for manual review.
-    return v === 'pass' || v === 'needs-attention' || v === 'needs-remediation';
+    return extractVerdict(validationContent) != null;
 }
 const CACHE_TTL_MS = 100;
 let _stateCache = null;
@@ -144,7 +139,23 @@ export async function deriveState(basePath) {
     let result;
     // Dual-path: try DB-backed derivation first when hierarchy tables are populated
     if (isDbAvailable()) {
-        const dbMilestones = getAllMilestones();
+        let dbMilestones = getAllMilestones();
+        // Disk→DB reconciliation (#2631): when the milestones table is empty
+        // (e.g. failed initial migration per #2529), the reconciliation code
+        // inside deriveStateFromDb is unreachable. Populate from disk here so
+        // the DB path activates correctly.
+        if (dbMilestones.length === 0) {
+            const diskIds = findMilestoneIds(basePath);
+            let synced = false;
+            for (const diskId of diskIds) {
+                if (!isGhostMilestone(basePath, diskId)) {
+                    insertMilestone({ id: diskId, status: 'active' });
+                    synced = true;
+                }
+            }
+            if (synced)
+                dbMilestones = getAllMilestones();
+        }
         if (dbMilestones.length > 0) {
             const stopDbTimer = debugTime("derive-state-db");
             result = await deriveStateFromDb(basePath);
@@ -187,12 +198,6 @@ function extractContextTitle(content, fallback) {
     return stripMilestonePrefix(h1.slice(2).trim()) || fallback;
 }
 // ─── DB-backed State Derivation ────────────────────────────────────────────
-/**
- * Helper: check if a DB status counts as "done" (handles K002 ambiguity).
- */
-function isStatusDone(status) {
-    return status === 'complete' || status === 'done';
-}
 /**
  * Derive GSD state from the milestones/slices/tasks DB tables.
  * Flag files (PARKED, VALIDATION, CONTINUE, REPLAN, REPLAN-TRIGGER, CONTEXT-DRAFT)
@@ -276,7 +281,7 @@ export async function deriveStateFromDb(basePath) {
             parkedMilestoneIds.add(m.id);
             continue;
         }
-        if (isStatusDone(m.status)) {
+        if (isClosedStatus(m.status)) {
             completeMilestoneIds.add(m.id);
             continue;
         }
@@ -288,7 +293,7 @@ export async function deriveStateFromDb(basePath) {
         }
         // Check roadmap: all slices done means milestone is complete
         const slices = getMilestoneSlices(m.id);
-        if (slices.length > 0 && slices.every(s => isStatusDone(s.status))) {
+        if (slices.length > 0 && slices.every(s => isClosedStatus(s.status))) {
             // All slices done but no summary — still counts as complete for dep resolution
             // if a summary file exists
             // Note: without summary file, the milestone is in validating/completing state, not complete
@@ -307,7 +312,7 @@ export async function deriveStateFromDb(basePath) {
         }
         // Ghost milestone check: no slices in DB AND no substantive files on disk
         const slices = getMilestoneSlices(m.id);
-        if (slices.length === 0 && !isStatusDone(m.status)) {
+        if (slices.length === 0 && !isClosedStatus(m.status)) {
             // Check disk for ghost detection
             if (isGhostMilestone(basePath, m.id))
                 continue;
@@ -328,7 +333,7 @@ export async function deriveStateFromDb(basePath) {
             continue;
         }
         // Not complete — determine if it should be active
-        const allSlicesDone = slices.length > 0 && slices.every(s => isStatusDone(s.status));
+        const allSlicesDone = slices.length > 0 && slices.every(s => isClosedStatus(s.status));
         // Get title — prefer DB, fall back to context file extraction
         let title = stripMilestonePrefix(m.title) || m.id;
         if (title === m.id) {
@@ -465,7 +470,10 @@ export async function deriveStateFromDb(basePath) {
         };
     }
     // ── All slices done → validating/completing ─────────────────────────
-    const allSlicesDone = activeMilestoneSlices.every(s => isStatusDone(s.status));
+    // Guard: [].every() === true (vacuous truth). Without the length check,
+    // an empty slice array causes a premature phase transition to
+    // validating-milestone. See: https://github.com/gsd-build/gsd-2/issues/2667
+    const allSlicesDone = activeMilestoneSlices.length > 0 && activeMilestoneSlices.every(s => isClosedStatus(s.status));
     if (allSlicesDone) {
         const validationFile = resolveMilestoneFile(basePath, activeMilestone.id, "VALIDATION");
         const validationContent = validationFile ? await loadFile(validationFile) : null;
@@ -495,14 +503,14 @@ export async function deriveStateFromDb(basePath) {
     }
     // ── Find active slice (first incomplete with deps satisfied) ─────────
     const sliceProgress = {
-        done: activeMilestoneSlices.filter(s => isStatusDone(s.status)).length,
+        done: activeMilestoneSlices.filter(s => isClosedStatus(s.status)).length,
         total: activeMilestoneSlices.length,
     };
-    const doneSliceIds = new Set(activeMilestoneSlices.filter(s => isStatusDone(s.status)).map(s => s.id));
+    const doneSliceIds = new Set(activeMilestoneSlices.filter(s => isClosedStatus(s.status)).map(s => s.id));
     let activeSlice = null;
     let activeSliceRow = null;
     for (const s of activeMilestoneSlices) {
-        if (isStatusDone(s.status))
+        if (isClosedStatus(s.status))
             continue;
         if (s.depends.every(dep => doneSliceIds.has(dep))) {
             activeSlice = { id: s.id, title: s.title };
@@ -542,7 +550,7 @@ export async function deriveStateFromDb(basePath) {
     // causing the dispatcher to re-dispatch the same completed task forever.
     let reconciled = false;
     for (const t of tasks) {
-        if (isStatusDone(t.status))
+        if (isClosedStatus(t.status))
             continue;
         const summaryPath = resolveTaskFile(basePath, activeMilestone.id, activeSlice.id, t.id, "SUMMARY");
         if (summaryPath && existsSync(summaryPath)) {
@@ -562,10 +570,10 @@ export async function deriveStateFromDb(basePath) {
         tasks = getSliceTasks(activeMilestone.id, activeSlice.id);
     }
     const taskProgress = {
-        done: tasks.filter(t => isStatusDone(t.status)).length,
+        done: tasks.filter(t => isClosedStatus(t.status)).length,
         total: tasks.length,
     };
-    const activeTaskRow = tasks.find(t => !isStatusDone(t.status));
+    const activeTaskRow = tasks.find(t => !isClosedStatus(t.status));
     if (!activeTaskRow && tasks.length > 0) {
         // All tasks done but slice not marked complete → summarizing
         return {
@@ -620,7 +628,7 @@ export async function deriveStateFromDb(basePath) {
         };
     }
     // ── Blocker detection: check completed tasks for blocker_discovered ──
-    const completedTasks = tasks.filter(t => isStatusDone(t.status));
+    const completedTasks = tasks.filter(t => isClosedStatus(t.status));
     let blockerTaskId = null;
     for (const ct of completedTasks) {
         if (ct.blocker_discovered) {

package/dist/resources/extensions/gsd/status-guards.js

@@ -0,0 +1,12 @@
+/**
+ * Status predicates for GSD state-machine guards.
+ *
+ * The DB stores status as free-form strings. Two values indicate
+ * "closed": "complete" (canonical) and "done" (legacy / alias).
+ * Every inline `status === "complete" || status === "done"` should
+ * use isClosedStatus() instead.
+ */
+/** Returns true when a milestone, slice, or task status indicates closure. */
+export function isClosedStatus(status) {
+    return status === "complete" || status === "done";
+}

package/dist/resources/extensions/gsd/tools/complete-milestone.js

@@ -7,8 +7,9 @@
  */
 import { join } from "node:path";
 import { mkdirSync } from "node:fs";
-import { transaction, getMilestone, getMilestoneSlices, getSliceTasks, _getAdapter, } from "../gsd-db.js";
+import { transaction, getMilestone, getMilestoneSlices, getSliceTasks, updateMilestoneStatus, } from "../gsd-db.js";
 import { resolveMilestonePath, clearPathCache } from "../paths.js";
+import { isClosedStatus } from "../status-guards.js";
 import { saveFile, clearParseCache } from "../files.js";
 import { invalidateStateCache } from "../state.js";
 import { renderAllProjections } from "../workflow-projections.js";
@@ -89,7 +90,7 @@ export async function handleCompleteMilestone(params, basePath) {
             guardError = `milestone not found: ${params.milestoneId}`;
             return;
         }
-        if (milestone.status === "complete" || milestone.status === "done") {
+        if (isClosedStatus(milestone.status)) {
             guardError = `milestone ${params.milestoneId} is already complete`;
             return;
         }
@@ -99,7 +100,7 @@ export async function handleCompleteMilestone(params, basePath) {
             guardError = `no slices found for milestone ${params.milestoneId}`;
             return;
         }
-        const incompleteSlices = slices.filter(s => s.status !== "complete" && s.status !== "done");
+        const incompleteSlices = slices.filter(s => !isClosedStatus(s.status));
         if (incompleteSlices.length > 0) {
             const incompleteIds = incompleteSlices.map(s => `${s.id} (status: ${s.status})`).join(", ");
             guardError = `incomplete slices: ${incompleteIds}`;
@@ -108,7 +109,7 @@ export async function handleCompleteMilestone(params, basePath) {
         // Deep check: verify all tasks in all slices are complete
         for (const slice of slices) {
             const tasks = getSliceTasks(params.milestoneId, slice.id);
-            const incompleteTasks = tasks.filter(t => t.status !== "complete" && t.status !== "done");
+            const incompleteTasks = tasks.filter(t => !isClosedStatus(t.status));
             if (incompleteTasks.length > 0) {
                 const ids = incompleteTasks.map(t => `${t.id} (status: ${t.status})`).join(", ");
                 guardError = `slice ${slice.id} has incomplete tasks: ${ids}`;
@@ -116,11 +117,7 @@ export async function handleCompleteMilestone(params, basePath) {
             }
         }
         // All guards passed — perform write
-        const adapter = _getAdapter();
-        adapter.prepare(`UPDATE milestones SET status = 'complete', completed_at = :completed_at WHERE id = :mid`).run({
-            ":completed_at": completedAt,
-            ":mid": params.milestoneId,
-        });
+        updateMilestoneStatus(params.milestoneId, 'complete', completedAt);
     });
     if (guardError) {
         return { error: guardError };
@@ -144,10 +141,7 @@ export async function handleCompleteMilestone(params, basePath) {
     catch (renderErr) {
         // Disk render failed — roll back DB status so state stays consistent
         process.stderr.write(`gsd-db: complete_milestone — disk render failed, rolling back DB status: ${renderErr.message}\n`);
-        const rollbackAdapter = _getAdapter();
-        if (rollbackAdapter) {
-            rollbackAdapter.prepare(`UPDATE milestones SET status = 'active', completed_at = NULL WHERE id = :mid`).run({ ":mid": params.milestoneId });
-        }
+        updateMilestoneStatus(params.milestoneId, 'active', null);
         invalidateStateCache();
         return { error: `disk render failed: ${renderErr.message}` };
     }

package/dist/resources/extensions/gsd/tools/complete-slice.js

@@ -8,7 +8,8 @@
  */
 import { join } from "node:path";
 import { mkdirSync } from "node:fs";
-import { transaction, insertMilestone, insertSlice, getSlice, getSliceTasks, getMilestone, updateSliceStatus, _getAdapter, } from "../gsd-db.js";
+import { isClosedStatus } from "../status-guards.js";
+import { transaction, insertMilestone, insertSlice, getSlice, getSliceTasks, getMilestone, updateSliceStatus, setSliceSummaryMd, } from "../gsd-db.js";
 import { resolveSlicePath, clearPathCache } from "../paths.js";
 import { checkOwnership, sliceUnitKey } from "../unit-ownership.js";
 import { saveFile, clearParseCache } from "../files.js";
@@ -179,12 +180,12 @@ export async function handleCompleteSlice(params, basePath) {
         // Milestone/slice not existing is OK — insertMilestone/insertSlice below will auto-create.
         // Only block if they exist and are closed.
         const milestone = getMilestone(params.milestoneId);
-        if (milestone && (milestone.status === "complete" || milestone.status === "done")) {
+        if (milestone && isClosedStatus(milestone.status)) {
             guardError = `cannot complete slice in a closed milestone: ${params.milestoneId} (status: ${milestone.status})`;
             return;
         }
         const slice = getSlice(params.milestoneId, params.sliceId);
-        if (slice && (slice.status === "complete" || slice.status === "done")) {
+        if (slice && isClosedStatus(slice.status)) {
             guardError = `slice ${params.sliceId} is already complete — use gsd_slice_reopen first if you need to redo it`;
             return;
         }
@@ -194,7 +195,7 @@ export async function handleCompleteSlice(params, basePath) {
             guardError = `no tasks found for slice ${params.sliceId} in milestone ${params.milestoneId}`;
             return;
         }
-        const incompleteTasks = tasks.filter(t => t.status !== "complete" && t.status !== "done");
+        const incompleteTasks = tasks.filter(t => !isClosedStatus(t.status));
         if (incompleteTasks.length > 0) {
             const incompleteIds = incompleteTasks.map(t => `${t.id} (status: ${t.status})`).join(", ");
             guardError = `incomplete tasks: ${incompleteIds}`;
@@ -240,26 +241,12 @@ export async function handleCompleteSlice(params, basePath) {
     catch (renderErr) {
         // Disk render failed — roll back DB status so state stays consistent
         process.stderr.write(`gsd-db: complete_slice — disk render failed, rolling back DB status: ${renderErr.message}\n`);
-        const rollbackAdapter = _getAdapter();
-        if (rollbackAdapter) {
-            rollbackAdapter.prepare(`UPDATE slices SET status = 'pending' WHERE milestone_id = :mid AND id = :sid`).run({
-                ":mid": params.milestoneId,
-                ":sid": params.sliceId,
-            });
-        }
+        updateSliceStatus(params.milestoneId, params.sliceId, 'pending');
         invalidateStateCache();
         return { error: `disk render failed: ${renderErr.message}` };
     }
     // Store rendered markdown in DB for D004 recovery
-    const adapter = _getAdapter();
-    if (adapter) {
-        adapter.prepare(`UPDATE slices SET full_summary_md = :summary_md, full_uat_md = :uat_md WHERE milestone_id = :mid AND id = :sid`).run({
-            ":summary_md": summaryMd,
-            ":uat_md": uatMd,
-            ":mid": params.milestoneId,
-            ":sid": params.sliceId,
-        });
-    }
+    setSliceSummaryMd(params.milestoneId, params.sliceId, summaryMd, uatMd);
     // Invalidate all caches
     invalidateStateCache();
     clearPathCache();

package/dist/resources/extensions/gsd/tools/complete-task.js

@@ -8,7 +8,8 @@
  */
 import { join } from "node:path";
 import { mkdirSync } from "node:fs";
-import { transaction, insertMilestone, insertSlice, insertTask, insertVerificationEvidence, getMilestone, getSlice, getTask, _getAdapter, } from "../gsd-db.js";
+import { isClosedStatus } from "../status-guards.js";
+import { transaction, insertMilestone, insertSlice, insertTask, insertVerificationEvidence, getMilestone, getSlice, getTask, updateTaskStatus, setTaskSummaryMd, deleteVerificationEvidence, } from "../gsd-db.js";
 import { resolveSliceFile, resolveTasksDir, clearPathCache } from "../paths.js";
 import { checkOwnership, taskUnitKey } from "../unit-ownership.js";
 import { saveFile, clearParseCache } from "../files.js";
@@ -122,17 +123,17 @@ export async function handleCompleteTask(params, basePath) {
         // Milestone/slice not existing is OK — insertMilestone/insertSlice below will auto-create.
         // Only block if they exist and are closed.
         const milestone = getMilestone(params.milestoneId);
-        if (milestone && (milestone.status === "complete" || milestone.status === "done")) {
+        if (milestone && isClosedStatus(milestone.status)) {
             guardError = `cannot complete task in a closed milestone: ${params.milestoneId} (status: ${milestone.status})`;
             return;
         }
         const slice = getSlice(params.milestoneId, params.sliceId);
-        if (slice && (slice.status === "complete" || slice.status === "done")) {
+        if (slice && isClosedStatus(slice.status)) {
             guardError = `cannot complete task in a closed slice: ${params.sliceId} (status: ${slice.status})`;
             return;
         }
         const existingTask = getTask(params.milestoneId, params.sliceId, params.taskId);
-        if (existingTask && (existingTask.status === "complete" || existingTask.status === "done")) {
+        if (existingTask && isClosedStatus(existingTask.status)) {
             guardError = `task ${params.taskId} is already complete — use gsd_task_reopen first if you need to redo it`;
             return;
         }
@@ -202,27 +203,16 @@ export async function handleCompleteTask(params, basePath) {
     catch (renderErr) {
         // Disk render failed — roll back DB status so state stays consistent
         process.stderr.write(`gsd-db: complete_task — disk render failed, rolling back DB status: ${renderErr.message}\n`);
-        const rollbackAdapter = _getAdapter();
-        if (rollbackAdapter) {
-            rollbackAdapter.prepare(`UPDATE tasks SET status = 'pending' WHERE milestone_id = :mid AND slice_id = :sid AND id = :tid`).run({
-                ":mid": params.milestoneId,
-                ":sid": params.sliceId,
-                ":tid": params.taskId,
-            });
-        }
+        // Delete orphaned verification_evidence rows first (FK constraint
+        // references tasks, so evidence must go before status change).
+        // Without this, retries accumulate duplicate evidence rows (#2724).
+        deleteVerificationEvidence(params.milestoneId, params.sliceId, params.taskId);
+        updateTaskStatus(params.milestoneId, params.sliceId, params.taskId, 'pending');
         invalidateStateCache();
         return { error: `disk render failed: ${renderErr.message}` };
     }
     // Store rendered markdown in DB for D004 recovery
-    const adapter = _getAdapter();
-    if (adapter) {
-        adapter.prepare(`UPDATE tasks SET full_summary_md = :md WHERE milestone_id = :mid AND slice_id = :sid AND id = :tid`).run({
-            ":md": summaryMd,
-            ":mid": params.milestoneId,
-            ":sid": params.sliceId,
-            ":tid": params.taskId,
-        });
-    }
+    setTaskSummaryMd(params.milestoneId, params.sliceId, params.taskId, summaryMd);
     // Invalidate all caches
     invalidateStateCache();
     clearPathCache();

package/dist/resources/extensions/gsd/tools/plan-milestone.js

@@ -1,22 +1,12 @@
 import { clearParseCache } from "../files.js";
+import { isClosedStatus } from "../status-guards.js";
+import { isNonEmptyString, validateStringArray } from "../validation.js";
 import { transaction, getMilestone, insertMilestone, insertSlice, upsertMilestonePlanning, upsertSlicePlanning, } from "../gsd-db.js";
 import { invalidateStateCache } from "../state.js";
 import { renderRoadmapFromDb } from "../markdown-renderer.js";
 import { renderAllProjections } from "../workflow-projections.js";
 import { writeManifest } from "../workflow-manifest.js";
 import { appendEvent } from "../workflow-events.js";
-function isNonEmptyString(value) {
-    return typeof value === "string" && value.trim().length > 0;
-}
-function validateStringArray(value, field) {
-    if (!Array.isArray(value)) {
-        throw new Error(`${field} must be an array`);
-    }
-    if (value.some((item) => !isNonEmptyString(item))) {
-        throw new Error(`${field} must contain only non-empty strings`);
-    }
-    return value;
-}
 function validateRiskEntries(value) {
     if (!Array.isArray(value)) {
         throw new Error("keyRisks must be an array");
@@ -145,25 +135,31 @@ export async function handlePlanMilestone(rawParams, basePath) {
     catch (err) {
         return { error: `validation failed: ${err.message}` };
     }
-    // ── State machine preconditions ─────────────────────────────────────────
-    const existingMilestone = getMilestone(params.milestoneId);
-    if (existingMilestone && (existingMilestone.status === "complete" || existingMilestone.status === "done")) {
-        return { error: `cannot re-plan milestone ${params.milestoneId}: it is already complete` };
-    }
-    // Validate depends_on: all dependencies must exist and be complete
-    if (params.dependsOn && params.dependsOn.length > 0) {
-        for (const depId of params.dependsOn) {
-            const dep = getMilestone(depId);
-            if (!dep) {
-                return { error: `depends_on references unknown milestone: ${depId}` };
-            }
-            if (dep.status !== "complete" && dep.status !== "done") {
-                return { error: `depends_on milestone ${depId} is not yet complete (status: ${dep.status})` };
-            }
-        }
-    }
+    // ── Guards + DB writes inside a single transaction (prevents TOCTOU) ───
+    // Guards must be inside the transaction so the state they check cannot
+    // change between the read and the write (#2723).
+    let guardError = null;
     try {
         transaction(() => {
+            const existingMilestone = getMilestone(params.milestoneId);
+            if (existingMilestone && isClosedStatus(existingMilestone.status)) {
+                guardError = `cannot re-plan milestone ${params.milestoneId}: it is already complete`;
+                return;
+            }
+            // Validate depends_on: all dependencies must exist and be complete
+            if (params.dependsOn && params.dependsOn.length > 0) {
+                for (const depId of params.dependsOn) {
+                    const dep = getMilestone(depId);
+                    if (!dep) {
+                        guardError = `depends_on references unknown milestone: ${depId}`;
+                        return;
+                    }
+                    if (!isClosedStatus(dep.status)) {
+                        guardError = `depends_on milestone ${depId} is not yet complete (status: ${dep.status})`;
+                        return;
+                    }
+                }
+            }
             insertMilestone({
                 id: params.milestoneId,
                 title: params.title,
@@ -206,6 +202,9 @@ export async function handlePlanMilestone(rawParams, basePath) {
     catch (err) {
         return { error: `db write failed: ${err.message}` };
     }
+    if (guardError) {
+        return { error: guardError };
+    }
     let roadmapPath;
     try {
         const renderResult = await renderRoadmapFromDb(basePath, params.milestoneId);

package/dist/resources/extensions/gsd/tools/plan-slice.js

@@ -1,22 +1,12 @@
 import { clearParseCache } from "../files.js";
+import { isClosedStatus } from "../status-guards.js";
+import { isNonEmptyString } from "../validation.js";
 import { transaction, getMilestone, getSlice, insertTask, upsertSlicePlanning, upsertTaskPlanning, insertGateRow, } from "../gsd-db.js";
 import { invalidateStateCache } from "../state.js";
 import { renderPlanFromDb } from "../markdown-renderer.js";
 import { renderAllProjections } from "../workflow-projections.js";
 import { writeManifest } from "../workflow-manifest.js";
 import { appendEvent } from "../workflow-events.js";
-function isNonEmptyString(value) {
-    return typeof value === "string" && value.trim().length > 0;
-}
-function validateStringArray(value, field) {
-    if (!Array.isArray(value)) {
-        throw new Error(`${field} must be an array`);
-    }
-    if (value.some((item) => !isNonEmptyString(item))) {
-        throw new Error(`${field} must contain only non-empty strings`);
-    }
-    return value;
-}
 function validateTasks(value) {
     if (!Array.isArray(value) || value.length === 0) {
         throw new Error("tasks must be a non-empty array");
@@ -102,22 +92,30 @@ export async function handlePlanSlice(rawParams, basePath) {
     catch (err) {
         return { error: `validation failed: ${err.message}` };
     }
-    const parentMilestone = getMilestone(params.milestoneId);
-    if (!parentMilestone) {
-        return { error: `milestone not found: ${params.milestoneId}` };
-    }
-    if (parentMilestone.status === "complete" || parentMilestone.status === "done") {
-        return { error: `cannot plan slice in a closed milestone: ${params.milestoneId} (status: ${parentMilestone.status})` };
-    }
-    const parentSlice = getSlice(params.milestoneId, params.sliceId);
-    if (!parentSlice) {
-        return { error: `missing parent slice: ${params.milestoneId}/${params.sliceId}` };
-    }
-    if (parentSlice.status === "complete" || parentSlice.status === "done") {
-        return { error: `cannot re-plan slice ${params.sliceId}: it is already complete — use gsd_slice_reopen first` };
-    }
+    // ── Guards + DB writes inside a single transaction (prevents TOCTOU) ───
+    // Guards must be inside the transaction so the state they check cannot
+    // change between the read and the write (#2723).
+    let guardError = null;
     try {
         transaction(() => {
+            const parentMilestone = getMilestone(params.milestoneId);
+            if (!parentMilestone) {
+                guardError = `milestone not found: ${params.milestoneId}`;
+                return;
+            }
+            if (isClosedStatus(parentMilestone.status)) {
+                guardError = `cannot plan slice in a closed milestone: ${params.milestoneId} (status: ${parentMilestone.status})`;
+                return;
+            }
+            const parentSlice = getSlice(params.milestoneId, params.sliceId);
+            if (!parentSlice) {
+                guardError = `missing parent slice: ${params.milestoneId}/${params.sliceId}`;
+                return;
+            }
+            if (isClosedStatus(parentSlice.status)) {
+                guardError = `cannot re-plan slice ${params.sliceId}: it is already complete — use gsd_slice_reopen first`;
+                return;
+            }
             upsertSlicePlanning(params.milestoneId, params.sliceId, {
                 goal: params.goal,
                 successCriteria: params.successCriteria,
@@ -163,6 +161,9 @@ export async function handlePlanSlice(rawParams, basePath) {
     catch (err) {
         return { error: `db write failed: ${err.message}` };
     }
+    if (guardError) {
+        return { error: guardError };
+    }
     try {
         const renderResult = await renderPlanFromDb(basePath, params.milestoneId, params.sliceId);
         invalidateStateCache();

package/dist/resources/extensions/gsd/tools/plan-task.js

@@ -1,22 +1,12 @@
 import { clearParseCache } from "../files.js";
+import { isClosedStatus } from "../status-guards.js";
+import { isNonEmptyString, validateStringArray } from "../validation.js";
 import { transaction, getSlice, getTask, insertTask, upsertTaskPlanning } from "../gsd-db.js";
 import { invalidateStateCache } from "../state.js";
 import { renderTaskPlanFromDb } from "../markdown-renderer.js";
 import { renderAllProjections } from "../workflow-projections.js";
 import { writeManifest } from "../workflow-manifest.js";
 import { appendEvent } from "../workflow-events.js";
-function isNonEmptyString(value) {
-    return typeof value === "string" && value.trim().length > 0;
-}
-function validateStringArray(value, field) {
-    if (!Array.isArray(value)) {
-        throw new Error(`${field} must be an array`);
-    }
-    if (value.some((item) => !isNonEmptyString(item))) {
-        throw new Error(`${field} must contain only non-empty strings`);
-    }
-    return value;
-}
 function validateParams(params) {
     if (!isNonEmptyString(params?.milestoneId))
         throw new Error("milestoneId is required");
@@ -50,19 +40,26 @@ export async function handlePlanTask(rawParams, basePath) {
     catch (err) {
         return { error: `validation failed: ${err.message}` };
     }
-    const parentSlice = getSlice(params.milestoneId, params.sliceId);
-    if (!parentSlice) {
-        return { error: `missing parent slice: ${params.milestoneId}/${params.sliceId}` };
-    }
-    if (parentSlice.status === "complete" || parentSlice.status === "done") {
-        return { error: `cannot plan task in a closed slice: ${params.sliceId} (status: ${parentSlice.status})` };
-    }
-    const existingTask = getTask(params.milestoneId, params.sliceId, params.taskId);
-    if (existingTask && (existingTask.status === "complete" || existingTask.status === "done")) {
-        return { error: `cannot re-plan task ${params.taskId}: it is already complete — use gsd_task_reopen first` };
-    }
+    // ── Guards + DB writes inside a single transaction (prevents TOCTOU) ───
+    // Guards must be inside the transaction so the state they check cannot
+    // change between the read and the write (#2723).
+    let guardError = null;
     try {
         transaction(() => {
+            const parentSlice = getSlice(params.milestoneId, params.sliceId);
+            if (!parentSlice) {
+                guardError = `missing parent slice: ${params.milestoneId}/${params.sliceId}`;
+                return;
+            }
+            if (isClosedStatus(parentSlice.status)) {
+                guardError = `cannot plan task in a closed slice: ${params.sliceId} (status: ${parentSlice.status})`;
+                return;
+            }
+            const existingTask = getTask(params.milestoneId, params.sliceId, params.taskId);
+            if (existingTask && isClosedStatus(existingTask.status)) {
+                guardError = `cannot re-plan task ${params.taskId}: it is already complete — use gsd_task_reopen first`;
+                return;
+            }
             if (!existingTask) {
                 insertTask({
                     id: params.taskId,
@@ -88,6 +85,9 @@ export async function handlePlanTask(rawParams, basePath) {
     catch (err) {
         return { error: `db write failed: ${err.message}` };
     }
+    if (guardError) {
+        return { error: guardError };
+    }
     try {
         const renderResult = await renderTaskPlanFromDb(basePath, params.milestoneId, params.sliceId, params.taskId);
         invalidateStateCache();