gsd-pi 2.58.0 → 2.59.0-dev.023bd39

package/src/resources/extensions/gsd/tests/uat-stuck-loop-orphaned-worktree.test.ts

@@ -0,0 +1,289 @@
+/**
+ * uat-stuck-loop-orphaned-worktree.test.ts — Regression tests for #2821.
+ *
+ * Reproduces two cascading bugs:
+ *
+ * Bug 1 — UAT stuck-loop: syncProjectRootToWorktree uses force:false for
+ *   milestone files. When the project root has an ASSESSMENT with a verdict
+ *   but the worktree has a stale/empty ASSESSMENT (or none at all after DB
+ *   rebuild), the verdict is NOT synced into the worktree. checkNeedsRunUat
+ *   finds no verdict → re-dispatches run-uat indefinitely.
+ *
+ * Bug 2 — Orphaned worktree: removeWorktree silently swallows failures when
+ *   git worktree remove fails (untracked files, CWD inside worktree, etc.).
+ *   The worktree directory and branch persist on disk after teardown.
+ *   teardownAutoWorktree has a fallback rmSync but it also fails when the
+ *   git internal .git/worktrees/<name> directory holds a lock.
+ */
+
+import { describe, test, beforeEach, afterEach } from "node:test";
+import assert from "node:assert/strict";
+import {
+  mkdtempSync,
+  mkdirSync,
+  writeFileSync,
+  rmSync,
+  existsSync,
+  readFileSync,
+} from "node:fs";
+import { join } from "node:path";
+import { tmpdir } from "node:os";
+import { execFileSync } from "node:child_process";
+
+import { syncProjectRootToWorktree } from "../auto-worktree.ts";
+import {
+  createWorktree,
+  removeWorktree,
+  worktreePath,
+} from "../worktree-manager.ts";
+
+function git(args: string[], cwd: string): string {
+  return execFileSync("git", args, {
+    cwd,
+    stdio: ["ignore", "pipe", "pipe"],
+    encoding: "utf-8",
+  }).trim();
+}
+
+function makeBaseRepo(): string {
+  const base = mkdtempSync(join(tmpdir(), "gsd-2821-"));
+  git(["init", "-b", "main"], base);
+  git(["config", "user.name", "Test"], base);
+  git(["config", "user.email", "test@test.com"], base);
+  writeFileSync(join(base, "README.md"), "# test\n");
+  mkdirSync(join(base, ".gsd", "milestones", "M011"), { recursive: true });
+  git(["add", "."], base);
+  git(["commit", "-m", "init"], base);
+  return base;
+}
+
+// ─── Bug 1: ASSESSMENT force-sync ─────────────────────────────────────────
+
+describe("#2821 Bug 1 — ASSESSMENT file force-synced on resume", () => {
+  let mainBase: string;
+  let wtBase: string;
+
+  beforeEach(() => {
+    mainBase = mkdtempSync(join(tmpdir(), "gsd-2821-main-"));
+    wtBase = mkdtempSync(join(tmpdir(), "gsd-2821-wt-"));
+    mkdirSync(join(mainBase, ".gsd", "milestones", "M011", "slices", "S01"), {
+      recursive: true,
+    });
+    mkdirSync(join(wtBase, ".gsd", "milestones", "M011", "slices", "S01"), {
+      recursive: true,
+    });
+  });
+
+  afterEach(() => {
+    rmSync(mainBase, { recursive: true, force: true });
+    rmSync(wtBase, { recursive: true, force: true });
+  });
+
+  test("force-syncs ASSESSMENT with verdict from project root into worktree when worktree copy has no verdict", () => {
+    // Project root has ASSESSMENT with a PASS verdict (written by run-uat, synced by post-unit)
+    const prAssessment = join(
+      mainBase,
+      ".gsd",
+      "milestones",
+      "M011",
+      "slices",
+      "S01",
+      "S01-ASSESSMENT.md",
+    );
+    writeFileSync(
+      prAssessment,
+      "---\nverdict: pass\n---\n# S01 Assessment\nAll tests pass.\n",
+    );
+
+    // Worktree has a stale ASSESSMENT with FAIL verdict (from the initial run-uat execution)
+    const wtAssessment = join(
+      wtBase,
+      ".gsd",
+      "milestones",
+      "M011",
+      "slices",
+      "S01",
+      "S01-ASSESSMENT.md",
+    );
+    writeFileSync(
+      wtAssessment,
+      "---\nverdict: fail\n---\n# S01 Assessment\nSome tests fail.\n",
+    );
+
+    syncProjectRootToWorktree(mainBase, wtBase, "M011");
+
+    // The worktree ASSESSMENT must now have the project root's PASS verdict
+    const content = readFileSync(wtAssessment, "utf-8");
+    assert.ok(
+      content.includes("verdict: pass"),
+      `Expected worktree ASSESSMENT to have verdict:pass after sync, got: ${content.slice(0, 100)}`,
+    );
+  });
+
+  test("force-syncs ASSESSMENT from project root when worktree has no ASSESSMENT at all", () => {
+    // Project root has ASSESSMENT with verdict
+    const prAssessment = join(
+      mainBase,
+      ".gsd",
+      "milestones",
+      "M011",
+      "slices",
+      "S01",
+      "S01-ASSESSMENT.md",
+    );
+    writeFileSync(
+      prAssessment,
+      "---\nverdict: pass\n---\n# S01 Assessment\n",
+    );
+
+    // Worktree has NO ASSESSMENT (deleted during DB rebuild)
+    // — file simply doesn't exist
+
+    syncProjectRootToWorktree(mainBase, wtBase, "M011");
+
+    const wtAssessment = join(
+      wtBase,
+      ".gsd",
+      "milestones",
+      "M011",
+      "slices",
+      "S01",
+      "S01-ASSESSMENT.md",
+    );
+    assert.ok(
+      existsSync(wtAssessment),
+      "ASSESSMENT should be copied to worktree when missing",
+    );
+    const content = readFileSync(wtAssessment, "utf-8");
+    assert.ok(
+      content.includes("verdict: pass"),
+      `Synced ASSESSMENT should contain verdict:pass, got: ${content.slice(0, 100)}`,
+    );
+  });
+
+  test("does NOT overwrite worktree ASSESSMENT when project root has no verdict", () => {
+    // Project root has ASSESSMENT without verdict (incomplete)
+    const prAssessment = join(
+      mainBase,
+      ".gsd",
+      "milestones",
+      "M011",
+      "slices",
+      "S01",
+      "S01-ASSESSMENT.md",
+    );
+    writeFileSync(prAssessment, "# S01 Assessment\nIn progress...\n");
+
+    // Worktree has ASSESSMENT with verdict:fail
+    const wtAssessment = join(
+      wtBase,
+      ".gsd",
+      "milestones",
+      "M011",
+      "slices",
+      "S01",
+      "S01-ASSESSMENT.md",
+    );
+    writeFileSync(
+      wtAssessment,
+      "---\nverdict: fail\n---\n# S01 Assessment\nSome tests fail.\n",
+    );
+
+    syncProjectRootToWorktree(mainBase, wtBase, "M011");
+
+    // Worktree copy should NOT be overwritten by the verdictless project root copy
+    const content = readFileSync(wtAssessment, "utf-8");
+    assert.ok(
+      content.includes("verdict: fail"),
+      `Worktree ASSESSMENT should keep verdict:fail when project root has no verdict, got: ${content.slice(0, 100)}`,
+    );
+  });
+});
+
+// ─── Bug 2: Orphaned worktree cleanup ─────────────────────────────────────
+
+describe("#2821 Bug 2 — removeWorktree cleans up despite untracked files", () => {
+  let base: string;
+
+  beforeEach(() => {
+    base = makeBaseRepo();
+  });
+
+  afterEach(() => {
+    rmSync(base, { recursive: true, force: true });
+  });
+
+  test("removes worktree directory even when it contains untracked files", () => {
+    const info = createWorktree(base, "M011", {
+      branch: "milestone/M011",
+    });
+
+    // Simulate run-uat writing untracked files (S01-UAT-RESULT.md, ASSESSMENT)
+    mkdirSync(
+      join(info.path, ".gsd", "milestones", "M011", "slices", "S01"),
+      { recursive: true },
+    );
+    writeFileSync(
+      join(
+        info.path,
+        ".gsd",
+        "milestones",
+        "M011",
+        "slices",
+        "S01",
+        "S01-UAT-RESULT.md",
+      ),
+      "# UAT Result\nverdict: fail\n",
+    );
+    writeFileSync(
+      join(
+        info.path,
+        ".gsd",
+        "milestones",
+        "M011",
+        "slices",
+        "S01",
+        "S01-ASSESSMENT.md",
+      ),
+      "---\nverdict: fail\n---\n# Assessment\n",
+    );
+
+    removeWorktree(base, "M011", {
+      branch: "milestone/M011",
+      deleteBranch: true,
+      force: true,
+    });
+
+    const wtDir = worktreePath(base, "M011");
+    assert.ok(
+      !existsSync(wtDir),
+      `Worktree directory should be removed after teardown, but still exists at ${wtDir}`,
+    );
+  });
+
+  test("removes git internal worktree metadata after filesystem removal", () => {
+    createWorktree(base, "M011", {
+      branch: "milestone/M011",
+    });
+
+    removeWorktree(base, "M011", {
+      branch: "milestone/M011",
+      deleteBranch: true,
+      force: true,
+    });
+
+    // The git internal worktree directory should be cleaned up
+    const gitInternalWorktreeDir = join(base, ".git", "worktrees", "M011");
+    assert.ok(
+      !existsSync(gitInternalWorktreeDir),
+      `Git internal worktree dir should be removed: ${gitInternalWorktreeDir}`,
+    );
+
+    // The branch should be deleted
+    const branches = git(["branch"], base);
+    assert.ok(
+      !branches.includes("milestone/M011"),
+      "milestone/M011 branch should be deleted after removeWorktree",
+    );
+  });
+});

package/src/resources/extensions/gsd/tests/unit-ownership.test.ts

@@ -3,7 +3,7 @@
 
 import test from 'node:test';
 import assert from 'node:assert/strict';
-import { mkdtempSync, rmSync, existsSync, readFileSync } from 'node:fs';
+import { mkdtempSync, rmSync } from 'node:fs';
 import { join } from 'node:path';
 import { tmpdir } from 'node:os';
 
@@ -14,6 +14,8 @@ import {
   checkOwnership,
   taskUnitKey,
   sliceUnitKey,
+  initOwnershipTable,
+  closeOwnershipDb,
 } from '../unit-ownership.ts';
 
 function makeTmpBase(): string {
@@ -34,28 +36,51 @@ test('sliceUnitKey: builds correct key', () => {
   assert.equal(sliceUnitKey('M001', 'S01'), 'M001/S01');
 });
 
-// ─── Claim / get / release ───────────────────────────────────────────────
+// ─── Claim / get / release (SQLite-backed) ──────────────────────────────
 
-test('claimUnit: creates claim file and records agent', () => {
+test('claimUnit: creates DB and records agent', () => {
   const base = makeTmpBase();
   try {
-    claimUnit(base, 'M001/S01/T01', 'executor-01');
+    initOwnershipTable(base);
+    const claimed = claimUnit(base, 'M001/S01/T01', 'executor-01');
 
-    assert.ok(existsSync(join(base, '.gsd', 'unit-claims.json')), 'claim file should exist');
+    assert.equal(claimed, true, 'first claim should succeed');
     assert.equal(getOwner(base, 'M001/S01/T01'), 'executor-01');
   } finally {
+    closeOwnershipDb(base);
     cleanup(base);
   }
 });
 
-test('claimUnit: overwrites existing claim (last writer wins)', () => {
+test('claimUnit: rejects second claim on same unit (first-writer-wins)', () => {
   const base = makeTmpBase();
   try {
-    claimUnit(base, 'M001/S01/T01', 'executor-01');
-    claimUnit(base, 'M001/S01/T01', 'executor-02');
+    initOwnershipTable(base);
+    const first = claimUnit(base, 'M001/S01/T01', 'executor-01');
+    const second = claimUnit(base, 'M001/S01/T01', 'executor-02');
 
-    assert.equal(getOwner(base, 'M001/S01/T01'), 'executor-02');
+    assert.equal(first, true, 'first claim should succeed');
+    assert.equal(second, false, 'second claim should fail (first-writer-wins)');
+    assert.equal(getOwner(base, 'M001/S01/T01'), 'executor-01',
+      'original owner must be preserved');
   } finally {
+    closeOwnershipDb(base);
+    cleanup(base);
+  }
+});
+
+test('claimUnit: same agent re-claiming same unit succeeds', () => {
+  const base = makeTmpBase();
+  try {
+    initOwnershipTable(base);
+    const first = claimUnit(base, 'M001/S01/T01', 'agent-a');
+    const second = claimUnit(base, 'M001/S01/T01', 'agent-a');
+
+    assert.equal(first, true);
+    assert.equal(second, true, 're-claim by same agent should succeed');
+    assert.equal(getOwner(base, 'M001/S01/T01'), 'agent-a');
+  } finally {
+    closeOwnershipDb(base);
     cleanup(base);
   }
 });
@@ -63,21 +88,25 @@ test('claimUnit: overwrites existing claim (last writer wins)', () => {
 test('claimUnit: multiple units can be claimed independently', () => {
   const base = makeTmpBase();
   try {
+    initOwnershipTable(base);
     claimUnit(base, 'M001/S01/T01', 'agent-a');
     claimUnit(base, 'M001/S01/T02', 'agent-b');
 
     assert.equal(getOwner(base, 'M001/S01/T01'), 'agent-a');
     assert.equal(getOwner(base, 'M001/S01/T02'), 'agent-b');
   } finally {
+    closeOwnershipDb(base);
     cleanup(base);
   }
 });
 
-test('getOwner: returns null when no claim file exists', () => {
+test('getOwner: returns null when no DB initialized', () => {
   const base = makeTmpBase();
   try {
+    initOwnershipTable(base);
     assert.equal(getOwner(base, 'M001/S01/T01'), null);
   } finally {
+    closeOwnershipDb(base);
     cleanup(base);
   }
 });
@@ -85,9 +114,11 @@ test('getOwner: returns null when no claim file exists', () => {
 test('getOwner: returns null for unclaimed unit', () => {
   const base = makeTmpBase();
   try {
+    initOwnershipTable(base);
     claimUnit(base, 'M001/S01/T01', 'agent-a');
     assert.equal(getOwner(base, 'M001/S01/T99'), null);
   } finally {
+    closeOwnershipDb(base);
     cleanup(base);
   }
 });
@@ -95,11 +126,13 @@ test('getOwner: returns null for unclaimed unit', () => {
 test('releaseUnit: removes claim', () => {
   const base = makeTmpBase();
   try {
+    initOwnershipTable(base);
     claimUnit(base, 'M001/S01/T01', 'agent-a');
     releaseUnit(base, 'M001/S01/T01');
 
     assert.equal(getOwner(base, 'M001/S01/T01'), null);
   } finally {
+    closeOwnershipDb(base);
     cleanup(base);
   }
 });
@@ -107,32 +140,43 @@ test('releaseUnit: removes claim', () => {
 test('releaseUnit: no-op for non-existent claim', () => {
   const base = makeTmpBase();
   try {
+    initOwnershipTable(base);
     // Should not throw
     releaseUnit(base, 'M001/S01/T01');
   } finally {
+    closeOwnershipDb(base);
     cleanup(base);
   }
 });
 
-// ─── checkOwnership ──────────────────────────────────────────────────────
-
-test('checkOwnership: returns null when no actorName provided (opt-in)', () => {
+test('releaseUnit: allows reclaim after release', () => {
   const base = makeTmpBase();
   try {
+    initOwnershipTable(base);
     claimUnit(base, 'M001/S01/T01', 'agent-a');
+    releaseUnit(base, 'M001/S01/T01');
 
-    // No actorName → ownership not enforced
-    assert.equal(checkOwnership(base, 'M001/S01/T01', undefined), null);
+    const reclaimed = claimUnit(base, 'M001/S01/T01', 'agent-b');
+    assert.equal(reclaimed, true, 'reclaim after release should succeed');
+    assert.equal(getOwner(base, 'M001/S01/T01'), 'agent-b');
   } finally {
+    closeOwnershipDb(base);
     cleanup(base);
   }
 });
 
-test('checkOwnership: returns null when no claim file exists', () => {
+// ─── checkOwnership ──────────────────────────────────────────────────────
+
+test('checkOwnership: returns null when no actorName provided (opt-in)', () => {
   const base = makeTmpBase();
   try {
-    assert.equal(checkOwnership(base, 'M001/S01/T01', 'agent-a'), null);
+    initOwnershipTable(base);
+    claimUnit(base, 'M001/S01/T01', 'agent-a');
+
+    // No actorName → ownership not enforced
+    assert.equal(checkOwnership(base, 'M001/S01/T01', undefined), null);
   } finally {
+    closeOwnershipDb(base);
     cleanup(base);
   }
 });
@@ -140,11 +184,13 @@ test('checkOwnership: returns null when no claim file exists', () => {
 test('checkOwnership: returns null when unit is unclaimed', () => {
   const base = makeTmpBase();
   try {
+    initOwnershipTable(base);
     claimUnit(base, 'M001/S01/T01', 'agent-a');
 
     // Different unit, unclaimed
     assert.equal(checkOwnership(base, 'M001/S01/T99', 'agent-b'), null);
   } finally {
+    closeOwnershipDb(base);
     cleanup(base);
   }
 });
@@ -152,10 +198,12 @@ test('checkOwnership: returns null when unit is unclaimed', () => {
 test('checkOwnership: returns null when actor matches owner', () => {
   const base = makeTmpBase();
   try {
+    initOwnershipTable(base);
     claimUnit(base, 'M001/S01/T01', 'agent-a');
 
     assert.equal(checkOwnership(base, 'M001/S01/T01', 'agent-a'), null);
   } finally {
+    closeOwnershipDb(base);
     cleanup(base);
   }
 });
@@ -163,6 +211,7 @@ test('checkOwnership: returns null when actor matches owner', () => {
 test('checkOwnership: returns error string when actor does not match owner', () => {
   const base = makeTmpBase();
   try {
+    initOwnershipTable(base);
     claimUnit(base, 'M001/S01/T01', 'agent-a');
 
     const err = checkOwnership(base, 'M001/S01/T01', 'agent-b');
@@ -170,6 +219,40 @@ test('checkOwnership: returns error string when actor does not match owner', ()
     assert.match(err!, /owned by agent-a/);
     assert.match(err!, /not agent-b/);
   } finally {
+    closeOwnershipDb(base);
+    cleanup(base);
+  }
+});
+
+// ─── Race condition: first-writer-wins atomicity ─────────────────────────
+
+test('claimUnit: concurrent claims — only first writer wins (no lost update)', () => {
+  const base = makeTmpBase();
+  try {
+    initOwnershipTable(base);
+
+    // Simulate the race described in #2728:
+    // Two agents both try to claim the same unit.
+    // With SQLite INSERT OR IGNORE, only the first succeeds.
+    const results: boolean[] = [];
+    const agents = ['agent-alpha', 'agent-beta', 'agent-gamma'];
+    for (const agent of agents) {
+      results.push(claimUnit(base, 'M001/S01/T01', agent));
+    }
+
+    // Exactly one agent should have won
+    const wins = results.filter(r => r === true);
+    assert.equal(wins.length, 1, 'exactly one agent should win the claim');
+
+    // The winner is the first agent (deterministic in single-threaded)
+    assert.equal(results[0], true);
+    assert.equal(results[1], false);
+    assert.equal(results[2], false);
+
+    // The owner must be the first agent
+    assert.equal(getOwner(base, 'M001/S01/T01'), 'agent-alpha');
+  } finally {
+    closeOwnershipDb(base);
     cleanup(base);
   }
 });

package/src/resources/extensions/gsd/tests/vacuum-recovery.test.ts

@@ -0,0 +1,154 @@
+import { describe, test } from 'node:test';
+import assert from 'node:assert/strict';
+import * as fs from 'node:fs';
+import * as path from 'node:path';
+import * as os from 'node:os';
+import { createRequire } from 'node:module';
+import {
+  openDatabase,
+  closeDatabase,
+  isDbAvailable,
+  _getAdapter,
+} from '../gsd-db.ts';
+
+const _require = createRequire(import.meta.url);
+
+// ═══════════════════════════════════════════════════════════════════════════
+// Helpers
+// ═══════════════════════════════════════════════════════════════════════════
+
+function tempDbPath(): string {
+  const dir = fs.mkdtempSync(path.join(os.tmpdir(), 'gsd-vacuum-test-'));
+  return path.join(dir, 'test.db');
+}
+
+function cleanup(dbPath: string): void {
+  closeDatabase();
+  try {
+    const dir = path.dirname(dbPath);
+    for (const f of fs.readdirSync(dir)) {
+      fs.unlinkSync(path.join(dir, f));
+    }
+    fs.rmdirSync(dir);
+  } catch { /* best effort */ }
+}
+
+/**
+ * Create a SQLite DB with a corrupt freelist that causes DDL to fail
+ * with "database disk image is malformed" but is recoverable via VACUUM.
+ *
+ * Strategy:
+ * 1. Create a DB with schema_version at v0 (so initSchema needs to run DDL)
+ * 2. Add padding rows to create many pages, then delete + drop to free them
+ * 3. Corrupt the freelist trunk pointer to point at a B-tree page
+ *
+ * This simulates the real-world scenario described in #2519: an interrupted
+ * WAL checkpoint leaves the freelist in an inconsistent state.
+ */
+function createCorruptFreelistDb(dbPath: string): void {
+  // Use node:sqlite directly to build the minimal corrupt DB
+  const sqlite = _require('node:sqlite');
+  const db = new sqlite.DatabaseSync(dbPath);
+  db.exec('PRAGMA journal_mode=WAL');
+  db.exec('CREATE TABLE schema_version (version INTEGER NOT NULL, applied_at TEXT NOT NULL)');
+  db.exec("INSERT INTO schema_version VALUES (0, '2024-01-01')");
+  // Pad with data to create many pages, then free them
+  db.exec('CREATE TABLE _padding (id INTEGER PRIMARY KEY, data TEXT)');
+  for (let i = 0; i < 30; i++) {
+    db.exec(`INSERT INTO _padding (data) VALUES ('${'x'.repeat(4000)}')`);
+  }
+  db.exec('DELETE FROM _padding');
+  db.exec('DROP TABLE _padding');
+  db.exec('PRAGMA wal_checkpoint(TRUNCATE)');
+  db.close();
+
+  // Remove WAL/SHM files to ensure clean file-only state
+  try { fs.unlinkSync(dbPath + '-wal'); } catch { /* may not exist */ }
+  try { fs.unlinkSync(dbPath + '-shm'); } catch { /* may not exist */ }
+
+  // Corrupt: point freelist trunk (offset 32-35) to page 2 (a B-tree page),
+  // and claim 10 free pages (offset 36-39)
+  const fd = fs.openSync(dbPath, 'r+');
+  try {
+    const buf = Buffer.alloc(8);
+    buf.writeUInt32BE(2, 0);   // trunk page = page 2 (actually a B-tree page)
+    buf.writeUInt32BE(10, 4);  // freelist count = 10
+    fs.writeSync(fd, buf, 0, 8, 32);
+  } finally {
+    fs.closeSync(fd);
+  }
+}
+
+// ═══════════════════════════════════════════════════════════════════════════
+// Tests
+// ═══════════════════════════════════════════════════════════════════════════
+
+describe('openDatabase VACUUM recovery on corrupt freelist', () => {
+
+  test('recovers a file-backed DB with corrupt freelist via VACUUM', () => {
+    const dbPath = tempDbPath();
+
+    // Create a DB with corrupt freelist (schema at v0 so initSchema runs DDL)
+    createCorruptFreelistDb(dbPath);
+
+    // Without the fix, this throws "database disk image is malformed".
+    // With the fix, openDatabase detects "malformed", runs VACUUM, retries.
+    const ok = openDatabase(dbPath);
+    assert.ok(ok, 'openDatabase should succeed after VACUUM recovery');
+    assert.ok(isDbAvailable(), 'DB should be available after recovery');
+
+    // Verify full schema was applied
+    const adapter = _getAdapter()!;
+    const row = adapter.prepare(
+      'SELECT MAX(version) as version FROM schema_version',
+    ).get();
+    assert.ok(
+      typeof row?.['version'] === 'number' && (row['version'] as number) > 0,
+      'schema_version should have a positive version after recovery',
+    );
+
+    cleanup(dbPath);
+  });
+
+  test('does not attempt VACUUM for non-malformed errors', () => {
+    // openDatabase with :memory: never hits the fileBacked VACUUM path,
+    // so non-malformed errors propagate directly. We verify by checking
+    // that a non-file error from an in-memory DB propagates unchanged.
+    // (In-memory DBs always succeed for initSchema, so this is a design
+    // check — the VACUUM path is only for fileBacked = true.)
+    const ok = openDatabase(':memory:');
+    assert.ok(ok, 'in-memory DB should open fine');
+    closeDatabase();
+  });
+
+  test('throws if VACUUM itself fails on unrecoverable corruption', () => {
+    const dbPath = tempDbPath();
+
+    // Create a file with valid SQLite header but thoroughly corrupt content
+    const page = Buffer.alloc(4096);
+    // SQLite magic: "SQLite format 3\0"
+    page.write('SQLite format 3\0', 0, 'utf8');
+    // Page size: 4096 (big-endian at offset 16)
+    page.writeUInt16BE(4096, 16);
+    page[18] = 1;  // write version
+    page[19] = 1;  // read version
+    page[20] = 0;  // reserved space
+    page[21] = 64; // max embedded payload fraction
+    page[22] = 32; // min embedded payload fraction
+    page[23] = 32; // leaf payload fraction
+    page.writeUInt32BE(1, 28);   // page_count = 1
+    page.writeUInt32BE(999, 32); // corrupt freelist trunk
+    page.writeUInt32BE(5, 36);   // freelist count = 5
+
+    fs.writeFileSync(dbPath, page);
+
+    // Should throw — VACUUM cannot save a thoroughly corrupt file
+    assert.throws(
+      () => openDatabase(dbPath),
+      /./,
+      'should throw for unrecoverable corruption',
+    );
+
+    cleanup(dbPath);
+  });
+});