gsd-pi 2.71.0-dev.e17e0ce → 2.72.0-dev.3118184

package/src/resources/extensions/gsd/bootstrap/register-shortcuts.ts

@@ -93,9 +93,6 @@ export function registerShortcuts(pi: ExtensionAPI): void {
     handler: openParallelOverlay,
   });
 
-  // Fallback for terminals where Ctrl+Alt letter chords are not forwarded reliably.
-  pi.registerShortcut(Key.ctrlShift(GSD_SHORTCUTS.parallel.key), {
-    description: shortcutDesc(`${GSD_SHORTCUTS.parallel.action} (fallback)`, GSD_SHORTCUTS.parallel.command),
-    handler: openParallelOverlay,
-  });
+  // No Ctrl+Shift+P fallback — conflicts with cycleModelBackward (shift+ctrl+p).
+  // Use Ctrl+Alt+P or /gsd parallel watch instead.
 }

package/src/resources/extensions/gsd/commands-handlers.ts

@@ -78,6 +78,10 @@ export function parseDoctorArgs(args: string) {
   return { jsonMode, dryRun, fixFlag, includeBuild, includeTests, mode, requestedScope };
 }
 
+export function isDoctorHealActionable(issue: { fixable: boolean; severity: string }): boolean {
+  return issue.fixable && issue.severity !== "info";
+}
+
 export async function handleDoctor(args: string, ctx: ExtensionCommandContext, pi: ExtensionAPI): Promise<void> {
   const { jsonMode, dryRun, fixFlag, includeBuild, includeTests, mode, requestedScope } = parseDoctorArgs(args);
   const scope = await selectDoctorScope(projectRoot(), requestedScope);
@@ -109,7 +113,7 @@ export async function handleDoctor(args: string, ctx: ExtensionCommandContext, p
       scope: effectiveScope,
       includeWarnings: true,
     });
-    const actionable = unresolved.filter(issue => issue.severity === "error");
+    const actionable = unresolved.filter(isDoctorHealActionable);
     if (actionable.length === 0) {
       ctx.ui.notify("Doctor heal found nothing actionable to hand off to the LLM.", "info");
       return;

package/src/resources/extensions/gsd/context-injector.ts

@@ -16,7 +16,7 @@
 import { readFileSync, existsSync } from "node:fs";
 import { join, resolve, sep } from "node:path";
 import type { StepDefinition } from "./definition-loader.js";
-import { readFrozenDefinition } from "./custom-workflow-engine.js";
+import { readFrozenDefinition } from "./definition-io.js";
 
 /** Maximum characters per artifact to prevent context window blowout. */
 const MAX_CONTEXT_CHARS = 10_000;

package/src/resources/extensions/gsd/custom-workflow-engine.ts

@@ -22,7 +22,6 @@ import type {
 } from "./engine-types.js";
 import { readFileSync } from "node:fs";
 import { join } from "node:path";
-import { parse } from "yaml";
 import {
   readGraph,
   writeGraph,
@@ -32,16 +31,13 @@ import {
   type WorkflowGraph,
 } from "./graph.js";
 import { injectContext } from "./context-injector.js";
-import type { WorkflowDefinition, StepDefinition } from "./definition-loader.js";
+import type { StepDefinition } from "./definition-loader.js";
+import { readFrozenDefinition } from "./definition-io.js";
 import { parseUnitId } from "./unit-id.js";
 import { withFileLock } from "./file-lock.js";
 
-/** Read and parse the frozen DEFINITION.yaml from a run directory. */
-export function readFrozenDefinition(runDir: string): WorkflowDefinition {
-  const defPath = join(runDir, "DEFINITION.yaml");
-  const raw = readFileSync(defPath, "utf-8");
-  return parse(raw, { schema: "core" }) as WorkflowDefinition;
-}
+// Re-export for downstream consumers
+export { readFrozenDefinition } from "./definition-io.js";
 
 export class CustomWorkflowEngine implements WorkflowEngine {
   readonly engineId = "custom";

package/src/resources/extensions/gsd/definition-io.ts

@@ -0,0 +1,18 @@
+/**
+ * definition-io.ts — Read frozen DEFINITION.yaml from a run directory.
+ *
+ * Extracted from custom-workflow-engine.ts to break the circular dependency
+ * between context-injector.ts and custom-workflow-engine.ts.
+ */
+
+import { readFileSync } from "node:fs";
+import { join } from "node:path";
+import { parse } from "yaml";
+import type { WorkflowDefinition } from "./definition-loader.js";
+
+/** Read and parse the frozen DEFINITION.yaml from a run directory. */
+export function readFrozenDefinition(runDir: string): WorkflowDefinition {
+  const defPath = join(runDir, "DEFINITION.yaml");
+  const raw = readFileSync(defPath, "utf-8");
+  return parse(raw, { schema: "core" }) as WorkflowDefinition;
+}

package/src/resources/extensions/gsd/dispatch-guard.ts

@@ -107,6 +107,11 @@ export function getPriorSliceCompletionBlocker(
         // it may be a cross-milestone reference handled elsewhere.
       }
     } else {
+      const milestoneUsesExplicitDeps = slices.some((slice) => slice.depends.length > 0);
+      if (milestoneUsesExplicitDeps) {
+        return null;
+      }
+
       // Positional fallback is only a heuristic for legacy slices with no
       // declared dependencies. Skip any earlier slice that depends on the
       // target, directly or transitively, or we can deadlock a valid zero-dep

package/src/resources/extensions/gsd/doctor-providers.ts

@@ -185,11 +185,35 @@ const PROVIDER_ROUTES: Record<string, string[]> = {
   google: ["google-gemini-cli"],
 };
 
+/**
+ * Providers that use external CLI authentication (not API keys).
+ * These are always considered "ok" — the host CLI handles auth.
+ */
+const CLI_AUTH_PROVIDERS = new Set([
+  "claude-code",
+  "openai-codex",
+  "google-gemini-cli",
+  "google-antigravity",
+]);
+
 function checkLlmProviders(): ProviderCheckResult[] {
   const required = collectConfiguredModelProviders();
   const results: ProviderCheckResult[] = [];
 
   for (const providerId of required) {
+    // CLI-authenticated providers don't need API keys — skip key check
+    if (CLI_AUTH_PROVIDERS.has(providerId)) {
+      const info = PROVIDER_REGISTRY.find(p => p.id === providerId);
+      results.push({
+        name: providerId,
+        label: info?.label ?? providerId,
+        category: "llm",
+        status: "ok",
+        message: `${info?.label ?? providerId} — CLI auth (no key needed)`,
+        required: true,
+      });
+      continue;
+    }
     const info = PROVIDER_REGISTRY.find(p => p.id === providerId);
     const label = providerId === "anthropic-vertex"
       ? "Anthropic Vertex"

package/src/resources/extensions/gsd/doctor-runtime-checks.ts

@@ -303,13 +303,16 @@ export async function checkRuntimeHealth(
         content.split("\n").map(l => l.trim()).filter(l => l && !l.startsWith("#")),
       );
 
-      // Check for critical runtime patterns that must be present
+      // Check for critical runtime patterns that must be present.
+      // NOTE: GSD_RUNTIME_PATTERNS in gitignore.ts is the canonical source of truth.
+      // This is a minimal subset for the doctor check.
       const criticalPatterns = [
         ".gsd/activity/",
         ".gsd/runtime/",
         ".gsd/auto.lock",
-        ".gsd/gsd.db",
-        ".gsd/completed-units.json",
+        ".gsd/gsd.db*",
+        ".gsd/completed-units*.json",
+        ".gsd/event-log.jsonl",
       ];
 
       // If blanket .gsd/ or .gsd is present, all patterns are covered

package/src/resources/extensions/gsd/error-classifier.ts

@@ -44,6 +44,9 @@ export function resetRetryState(state: RetryState): void {
 
 const PERMANENT_RE = /auth|unauthorized|forbidden|invalid.*key|invalid.*api|billing|quota exceeded|account/i;
 const RATE_LIMIT_RE = /rate.?limit|too many requests|429/i;
+// OpenRouter affordability-style quota errors should be treated as transient
+// so core retry logic can lower maxTokens and continue in-session.
+const AFFORDABILITY_RE = /requires more credits|can only afford|insufficient credits|not enough credits|fewer max_tokens/i;
 const NETWORK_RE = /network|ECONNRESET|ETIMEDOUT|ECONNREFUSED|socket hang up|fetch failed|connection.*reset|dns/i;
 const SERVER_RE = /internal server error|500|502|503|overloaded|server_error|api_error|service.?unavailable/i;
 // ECONNRESET/ECONNREFUSED are in NETWORK_RE (same-model retry first).
@@ -67,7 +70,7 @@ const RESET_DELAY_RE = /reset in (\d+)s/i;
  */
 export function classifyError(errorMsg: string, retryAfterMs?: number): ErrorClass {
   const isPermanent = PERMANENT_RE.test(errorMsg);
-  const isRateLimit = RATE_LIMIT_RE.test(errorMsg);
+  const isRateLimit = RATE_LIMIT_RE.test(errorMsg) || AFFORDABILITY_RE.test(errorMsg);
 
   // 1. Permanent — but rate limit takes precedence
   if (isPermanent && !isRateLimit) {

package/src/resources/extensions/gsd/gate-registry.ts

@@ -0,0 +1,251 @@
+/**
+ * GSD Gate Registry — single source of truth for quality-gate ownership.
+ *
+ * Each gate declares which workflow turn owns it, the scope at which it is
+ * persisted in the `quality_gates` table, and the question/guidance text used
+ * in the prompt that turn sends. The registry replaces the ad-hoc
+ * `GATE_QUESTIONS` table that used to live in `auto-prompts.ts`, and every
+ * layer of the prompt system (prompt builders, dispatch rules, state
+ * derivation, tool handlers) consults it so a pending gate can never be
+ * silently dropped.
+ *
+ * Design notes:
+ *   - `GATE_REGISTRY` is exhaustiveness-checked against `GateId` via
+ *     `satisfies Record<GateId, GateDefinition>`, so adding a new GateId
+ *     without a registry entry is a compile error.
+ *   - `getGatesForTurn(turn)` returns the definitions a turn owns.
+ *   - `assertGateCoverage(pending, turn)` throws a GSDError if the pending
+ *     list for a turn contains unknown gates, or if any gate owned by the
+ *     turn is missing from the pending list.
+ */
+
+import { GSDError, GSD_PARSE_ERROR } from "./errors.js";
+import type { GateId, GateRow, GateScope } from "./types.js";
+
+/** Which workflow turn is responsible for evaluating / closing a gate. */
+export type OwnerTurn =
+  | "gate-evaluate"
+  | "execute-task"
+  | "complete-slice"
+  | "validate-milestone";
+
+export interface GateDefinition {
+  id: GateId;
+  scope: GateScope;
+  ownerTurn: OwnerTurn;
+  /** One-line question the assistant must answer. */
+  question: string;
+  /** Markdown guidance describing what a good answer looks like. */
+  guidance: string;
+  /** H3 section header used in the artifact the turn writes
+   *  (e.g. "Operational Readiness" for Q8 in the slice summary). */
+  promptSection: string;
+}
+
+export const GATE_REGISTRY = {
+  Q3: {
+    id: "Q3",
+    scope: "slice",
+    ownerTurn: "gate-evaluate",
+    question: "How can this be exploited?",
+    guidance: [
+      "Identify abuse scenarios: parameter tampering, replay attacks, privilege escalation.",
+      "Map data exposure risks: PII, tokens, secrets accessible through this slice.",
+      "Define input trust boundaries: untrusted user input reaching DB, API, or filesystem.",
+      "If none apply, return verdict 'omitted' with rationale explaining why.",
+    ].join("\n"),
+    promptSection: "Abuse Surface",
+  },
+  Q4: {
+    id: "Q4",
+    scope: "slice",
+    ownerTurn: "gate-evaluate",
+    question: "What existing promises does this break?",
+    guidance: [
+      "List which existing requirements (R001, R003, etc.) are touched by this slice.",
+      "Identify what must be re-tested after shipping.",
+      "Flag decisions that should be revisited given the new scope.",
+      "If no existing requirements are affected, return verdict 'omitted'.",
+    ].join("\n"),
+    promptSection: "Broken Promises",
+  },
+  Q5: {
+    id: "Q5",
+    scope: "task",
+    ownerTurn: "execute-task",
+    question: "What breaks when dependencies fail?",
+    guidance: [
+      "Enumerate the task's external dependencies (APIs, filesystem, network, subprocesses).",
+      "Describe the failure path for each: timeout, malformed response, connection loss.",
+      "Verify the implementation handles each failure or explicitly bubbles the error.",
+      "Return verdict 'omitted' only if the task has no external dependencies.",
+    ].join("\n"),
+    promptSection: "Failure Modes",
+  },
+  Q6: {
+    id: "Q6",
+    scope: "task",
+    ownerTurn: "execute-task",
+    question: "What is the 10x load breakpoint?",
+    guidance: [
+      "Identify the resource that saturates first at 10x the expected load.",
+      "Describe the protection applied (pool sizing, rate limiting, pagination, caching).",
+      "Return verdict 'omitted' if the task has no runtime load dimension.",
+    ].join("\n"),
+    promptSection: "Load Profile",
+  },
+  Q7: {
+    id: "Q7",
+    scope: "task",
+    ownerTurn: "execute-task",
+    question: "What negative tests protect this task?",
+    guidance: [
+      "List malformed inputs, error paths, and boundary conditions the tests cover.",
+      "Point to the specific test files or cases that assert each negative scenario.",
+      "Return verdict 'omitted' only if the task has no meaningful negative surface.",
+    ].join("\n"),
+    promptSection: "Negative Tests",
+  },
+  Q8: {
+    id: "Q8",
+    scope: "slice",
+    ownerTurn: "complete-slice",
+    question: "How will ops know this slice is healthy or broken?",
+    guidance: [
+      "Describe the health signal (metric, log line, dashboard) that proves the slice works.",
+      "Describe the failure signal that triggers an alert or paging.",
+      "Document the recovery procedure and any monitoring gaps.",
+      "Return verdict 'omitted' only for slices with no runtime behavior at all.",
+    ].join("\n"),
+    promptSection: "Operational Readiness",
+  },
+  MV01: {
+    id: "MV01",
+    scope: "milestone",
+    ownerTurn: "validate-milestone",
+    question: "Is every success criterion in the milestone roadmap satisfied?",
+    guidance: [
+      "Walk the success-criteria checklist from the milestone roadmap.",
+      "For each criterion, point to the slice / assessment / verification evidence that proves it.",
+      "Return verdict 'flag' if any criterion is unmet or unverifiable.",
+    ].join("\n"),
+    promptSection: "Success Criteria Checklist",
+  },
+  MV02: {
+    id: "MV02",
+    scope: "milestone",
+    ownerTurn: "validate-milestone",
+    question: "Does every slice have a SUMMARY.md and a passing assessment?",
+    guidance: [
+      "Confirm every slice listed in the roadmap has a SUMMARY.md.",
+      "Confirm each slice has an ASSESSMENT verdict of 'pass' (or justified 'omitted').",
+      "Flag missing artifacts and slices with outstanding follow-ups or known limitations.",
+    ].join("\n"),
+    promptSection: "Slice Delivery Audit",
+  },
+  MV03: {
+    id: "MV03",
+    scope: "milestone",
+    ownerTurn: "validate-milestone",
+    question: "Do the slices integrate end-to-end?",
+    guidance: [
+      "Trace at least one cross-slice flow proving the pieces compose.",
+      "Flag gaps where two slices were built in isolation with no integration evidence.",
+    ].join("\n"),
+    promptSection: "Cross-Slice Integration",
+  },
+  MV04: {
+    id: "MV04",
+    scope: "milestone",
+    ownerTurn: "validate-milestone",
+    question: "Are all touched requirements covered and still coherent?",
+    guidance: [
+      "For each requirement advanced, validated, surfaced, or invalidated across the milestone's slices, confirm the milestone-level evidence matches.",
+      "Flag requirements that slices claim to advance but no artifact proves.",
+    ].join("\n"),
+    promptSection: "Requirement Coverage",
+  },
+} as const satisfies Record<GateId, GateDefinition>;
+
+export type GateRegistry = typeof GATE_REGISTRY;
+
+/** Stable ordered lists per owner turn — iteration order matches declaration. */
+const ORDERED_GATES: readonly GateDefinition[] = Object.values(GATE_REGISTRY) as readonly GateDefinition[];
+
+/** Return every gate owned by a turn, in stable declaration order. */
+export function getGatesForTurn(turn: OwnerTurn): GateDefinition[] {
+  return ORDERED_GATES.filter((g) => g.ownerTurn === turn);
+}
+
+/** Return the set of gate ids a turn owns. */
+export function getGateIdsForTurn(turn: OwnerTurn): Set<GateId> {
+  return new Set(getGatesForTurn(turn).map((g) => g.id));
+}
+
+/** Look up a definition by gate id, or undefined if unknown. */
+export function getGateDefinition(id: string): GateDefinition | undefined {
+  return (GATE_REGISTRY as Record<string, GateDefinition>)[id];
+}
+
+/** Look up the owner turn for a gate id. Throws if the gate is unknown. */
+export function getOwnerTurn(id: GateId): OwnerTurn {
+  const def = GATE_REGISTRY[id];
+  if (!def) {
+    throw new GSDError(GSD_PARSE_ERROR, `gate-registry: unknown gate id "${id}"`);
+  }
+  return def.ownerTurn;
+}
+
+/**
+ * Assert that the pending gate rows for a turn match what the registry says
+ * the turn owns. Fails loudly rather than silently skipping.
+ *
+ * - Every row in `pending` must have a definition whose `ownerTurn` matches `turn`.
+ *   (The caller is responsible for scoping the pending list — e.g. filtering
+ *   by slice scope before passing it in.)
+ * - `options.requireAll` (default true): every gate the turn owns must appear
+ *   in `pending`. Set to false for turns like `execute-task` that only need
+ *   coverage for the subset of gates that were seeded (e.g. tasks with no
+ *   external dependencies have no Q5 row).
+ */
+export function assertGateCoverage(
+  pending: ReadonlyArray<Pick<GateRow, "gate_id">>,
+  turn: OwnerTurn,
+  options: { requireAll?: boolean } = {},
+): void {
+  const requireAll = options.requireAll ?? true;
+  const expected = getGateIdsForTurn(turn);
+  const pendingIds = new Set(pending.map((g) => g.gate_id));
+
+  const unknown: string[] = [];
+  for (const id of pendingIds) {
+    const def = getGateDefinition(id);
+    if (!def) {
+      unknown.push(id);
+      continue;
+    }
+    if (def.ownerTurn !== turn) {
+      unknown.push(`${id} (owned by ${def.ownerTurn}, not ${turn})`);
+    }
+  }
+
+  if (unknown.length > 0) {
+    throw new GSDError(
+      GSD_PARSE_ERROR,
+      `assertGateCoverage: turn "${turn}" received pending gates it does not own: ${unknown.join(", ")}`,
+    );
+  }
+
+  if (requireAll) {
+    const missing: GateId[] = [];
+    for (const id of expected) {
+      if (!pendingIds.has(id)) missing.push(id);
+    }
+    if (missing.length > 0) {
+      throw new GSDError(
+        GSD_PARSE_ERROR,
+        `assertGateCoverage: turn "${turn}" is missing required gates: ${missing.join(", ")}`,
+      );
+    }
+  }
+}

package/src/resources/extensions/gsd/git-service.ts

@@ -192,22 +192,25 @@ export interface PreMergeCheckResult {
 /**
  * GSD runtime paths that should be excluded from smart staging.
  * These are transient/generated artifacts that should never be committed.
- * Matches the union of SKIP_PATHS + SKIP_EXACT in worktree-manager.ts
- * and the first 7 entries in gitignore.ts BASELINE_PATTERNS.
+ *
+ * NOTE: GSD_RUNTIME_PATTERNS in gitignore.ts is the canonical source of truth.
+ * This array must stay synchronized with it.
  */
 export const RUNTIME_EXCLUSION_PATHS: readonly string[] = [
   ".gsd/activity/",
+  ".gsd/forensics/",
   ".gsd/runtime/",
   ".gsd/worktrees/",
+  ".gsd/parallel/",
   ".gsd/auto.lock",
   ".gsd/metrics.json",
-  ".gsd/completed-units.json",
+  ".gsd/completed-units*.json", // covers completed-units.json and archived completed-units-{MID}.json
+  ".gsd/state-manifest.json",
   ".gsd/STATE.md",
-  ".gsd/gsd.db",
-  ".gsd/gsd.db-shm",   // SQLite WAL sidecar — always created alongside gsd.db (#2296)
-  ".gsd/gsd.db-wal",   // SQLite WAL sidecar — always created alongside gsd.db (#2296)
-  ".gsd/journal/",     // daily-rotated JSONL event journal (#2296)
-  ".gsd/doctor-history.jsonl", // doctor run history (#2296)
+  ".gsd/gsd.db*",
+  ".gsd/journal/",
+  ".gsd/doctor-history.jsonl",
+  ".gsd/event-log.jsonl",
   ".gsd/DISCUSSION-MANIFEST.json",
 ];
 

package/src/resources/extensions/gsd/gitignore.ts

@@ -15,6 +15,12 @@ import { GIT_NO_PROMPT_ENV } from "./git-constants.js";
 
 /**
  * GSD runtime patterns for git index cleanup.
+ *
+ * CANONICAL SOURCE OF TRUTH: This array is the authoritative list of runtime
+ * ignore patterns. Other modules (RUNTIME_EXCLUSION_PATHS in git-service.ts,
+ * SKIP_* arrays in worktree-manager.ts, criticalPatterns in doctor-runtime-checks.ts)
+ * must stay synchronized with this list.
+ *
  * With external state (symlink), these are a no-op in most cases,
  * but retained for backwards compatibility during migration.
  */
@@ -26,13 +32,13 @@ const GSD_RUNTIME_PATTERNS = [
   ".gsd/parallel/",
   ".gsd/auto.lock",
   ".gsd/metrics.json",
-  ".gsd/completed-units.json",
+  ".gsd/completed-units*.json", // covers completed-units.json and archived completed-units-{MID}.json
+  ".gsd/state-manifest.json",
   ".gsd/STATE.md",
-  ".gsd/gsd.db",
-  ".gsd/gsd.db-shm",   // SQLite WAL sidecar — always created alongside gsd.db (#2296)
-  ".gsd/gsd.db-wal",   // SQLite WAL sidecar — always created alongside gsd.db (#2296)
-  ".gsd/journal/",     // daily-rotated JSONL event journal (#2296)
-  ".gsd/doctor-history.jsonl", // doctor run history (#2296)
+  ".gsd/gsd.db*",
+  ".gsd/journal/",
+  ".gsd/doctor-history.jsonl",
+  ".gsd/event-log.jsonl",
   ".gsd/DISCUSSION-MANIFEST.json",
   ".gsd/milestones/**/*-CONTINUE.md",
   ".gsd/milestones/**/continue.md",

package/src/resources/extensions/gsd/gsd-db.ts

@@ -10,6 +10,7 @@ import { existsSync, copyFileSync, mkdirSync, realpathSync } from "node:fs";
 import { dirname } from "node:path";
 import type { Decision, Requirement, GateRow, GateId, GateScope, GateStatus, GateVerdict } from "./types.js";
 import { GSDError, GSD_STALE_STATE } from "./errors.js";
+import { getGateIdsForTurn, type OwnerTurn } from "./gate-registry.js";
 import { logError, logWarning } from "./workflow-logger.js";
 
 const _require = createRequire(import.meta.url);
@@ -162,13 +163,36 @@ function openRawDb(path: string): unknown {
 
 const SCHEMA_VERSION = 14;
 
+function indexExists(db: DbAdapter, name: string): boolean {
+  return !!db.prepare(
+    "SELECT 1 as present FROM sqlite_master WHERE type = 'index' AND name = ?",
+  ).get(name);
+}
+
+function dedupeVerificationEvidenceRows(db: DbAdapter): void {
+  db.exec(`
+    DELETE FROM verification_evidence
+    WHERE rowid NOT IN (
+      SELECT MIN(rowid)
+      FROM verification_evidence
+      GROUP BY task_id, slice_id, milestone_id, command, verdict
+    )
+  `);
+}
+
+function ensureVerificationEvidenceDedupIndex(db: DbAdapter): void {
+  if (indexExists(db, "idx_verification_evidence_dedup")) return;
+  dedupeVerificationEvidenceRows(db);
+  db.exec("CREATE UNIQUE INDEX IF NOT EXISTS idx_verification_evidence_dedup ON verification_evidence(task_id, slice_id, milestone_id, command, verdict)");
+}
+
 function initSchema(db: DbAdapter, fileBacked: boolean): void {
   if (fileBacked) db.exec("PRAGMA journal_mode=WAL");
   if (fileBacked) db.exec("PRAGMA busy_timeout = 5000");
   if (fileBacked) db.exec("PRAGMA synchronous = NORMAL");
   if (fileBacked) db.exec("PRAGMA auto_vacuum = INCREMENTAL");
   if (fileBacked) db.exec("PRAGMA cache_size = -8000");   // 8 MB page cache
-  if (fileBacked) db.exec("PRAGMA mmap_size = 67108864");  // 64 MB mmap
+  if (fileBacked && process.platform !== "darwin") db.exec("PRAGMA mmap_size = 67108864");  // 64 MB mmap
   db.exec("PRAGMA temp_store = MEMORY");
   db.exec("PRAGMA foreign_keys = ON");
 
@@ -409,7 +433,7 @@ function initSchema(db: DbAdapter, fileBacked: boolean): void {
     db.exec("CREATE INDEX IF NOT EXISTS idx_milestones_status ON milestones(status)");
     db.exec("CREATE INDEX IF NOT EXISTS idx_quality_gates_pending ON quality_gates(milestone_id, slice_id, status)");
     db.exec("CREATE INDEX IF NOT EXISTS idx_verification_evidence_task ON verification_evidence(milestone_id, slice_id, task_id)");
-    db.exec("CREATE UNIQUE INDEX IF NOT EXISTS idx_verification_evidence_dedup ON verification_evidence(task_id, slice_id, milestone_id, command, verdict)");
+    ensureVerificationEvidenceDedupIndex(db);
 
     // v14 index — slice dependency lookups
     db.exec("CREATE INDEX IF NOT EXISTS idx_slice_deps_target ON slice_dependencies(milestone_id, depends_on_slice_id)");
@@ -742,7 +766,7 @@ function migrateSchema(db: DbAdapter): void {
       db.exec("CREATE INDEX IF NOT EXISTS idx_milestones_status ON milestones(status)");
       db.exec("CREATE INDEX IF NOT EXISTS idx_quality_gates_pending ON quality_gates(milestone_id, slice_id, status)");
       db.exec("CREATE INDEX IF NOT EXISTS idx_verification_evidence_task ON verification_evidence(milestone_id, slice_id, task_id)");
-      db.exec("CREATE UNIQUE INDEX IF NOT EXISTS idx_verification_evidence_dedup ON verification_evidence(task_id, slice_id, milestone_id, command, verdict)");
+      ensureVerificationEvidenceDedupIndex(db);
       db.prepare("INSERT INTO schema_version (version, applied_at) VALUES (:version, :applied_at)").run({
         ":version": 13,
         ":applied_at": new Date().toISOString(),
@@ -856,6 +880,7 @@ export function closeDatabase(): void {
     currentDb = null;
     currentPath = null;
     currentPid = 0;
+    _dbOpenAttempted = false;
   }
 }
 
@@ -1540,6 +1565,30 @@ export interface TaskRow {
 }
 
 function rowToTask(row: Record<string, unknown>): TaskRow {
+  const parseTaskArray = (value: unknown): string[] => {
+    if (Array.isArray(value)) {
+      return value.filter((entry): entry is string => typeof entry === "string");
+    }
+    if (typeof value !== "string") return [];
+
+    const trimmed = value.trim();
+    if (!trimmed) return [];
+
+    try {
+      const parsed = JSON.parse(trimmed);
+      if (Array.isArray(parsed)) {
+        return parsed.filter((entry): entry is string => typeof entry === "string");
+      }
+      if (typeof parsed === "string" && parsed.trim()) {
+        return [parsed.trim()];
+      }
+    } catch {
+      // Older/corrupt DB rows may contain raw comma-separated paths instead of JSON arrays.
+    }
+
+    return trimmed.split(",").map((entry) => entry.trim()).filter(Boolean);
+  };
+
   return {
     milestone_id: row["milestone_id"] as string,
     slice_id: row["slice_id"] as string,
@@ -1559,10 +1608,10 @@ function rowToTask(row: Record<string, unknown>): TaskRow {
     full_summary_md: row["full_summary_md"] as string,
     description: (row["description"] as string) ?? "",
     estimate: (row["estimate"] as string) ?? "",
-    files: JSON.parse((row["files"] as string) || "[]"),
+    files: parseTaskArray(row["files"]),
     verify: (row["verify"] as string) ?? "",
-    inputs: JSON.parse((row["inputs"] as string) || "[]"),
-    expected_output: JSON.parse((row["expected_output"] as string) || "[]"),
+    inputs: parseTaskArray(row["inputs"]),
+    expected_output: parseTaskArray(row["expected_output"]),
     observability_impact: (row["observability_impact"] as string) ?? "",
     full_plan_md: (row["full_plan_md"] as string) ?? "",
     sequence: (row["sequence"] as number) ?? 0,
@@ -2302,3 +2351,53 @@ export function getPendingSliceGateCount(milestoneId: string, sliceId: string):
   ).get({ ":mid": milestoneId, ":sid": sliceId });
   return row ? (row["cnt"] as number) : 0;
 }
+
+/**
+ * Return pending gate rows owned by a specific workflow turn.
+ *
+ * Unlike `getPendingGates(..., scope)`, this filters by the registry's
+ * `ownerTurn` metadata so callers can distinguish Q3/Q4 (owned by
+ * gate-evaluate) from Q8 (owned by complete-slice) even though both are
+ * scope:"slice". Pass `taskId` to narrow task-scoped results to one task.
+ */
+export function getPendingGatesForTurn(
+  milestoneId: string,
+  sliceId: string,
+  turn: OwnerTurn,
+  taskId?: string,
+): GateRow[] {
+  if (!currentDb) return [];
+  const ids = getGateIdsForTurn(turn);
+  if (ids.size === 0) return [];
+  const idList = [...ids];
+  const placeholders = idList.map((_, i) => `:gid${i}`).join(",");
+  const params: Record<string, unknown> = {
+    ":mid": milestoneId,
+    ":sid": sliceId,
+  };
+  idList.forEach((id, i) => {
+    params[`:gid${i}`] = id;
+  });
+  let sql =
+    `SELECT * FROM quality_gates
+     WHERE milestone_id = :mid AND slice_id = :sid
+       AND status = 'pending'
+       AND gate_id IN (${placeholders})`;
+  if (taskId !== undefined) {
+    sql += ` AND task_id = :tid`;
+    params[":tid"] = taskId;
+  }
+  return currentDb.prepare(sql).all(params).map(rowToGate);
+}
+
+/**
+ * Count pending gates for a turn. Convenience wrapper used by state
+ * derivation to decide whether a phase transition should pause.
+ */
+export function getPendingGateCountForTurn(
+  milestoneId: string,
+  sliceId: string,
+  turn: OwnerTurn,
+): number {
+  return getPendingGatesForTurn(milestoneId, sliceId, turn).length;
+}