gsd-pi 2.73.0-dev.e1c09f2 → 2.73.1-dev.d987996

package/src/resources/extensions/gsd/bootstrap/crash-log.ts

@@ -0,0 +1,32 @@
+/**
+ * crash-log.ts — Write crash diagnostics to ~/.gsd/crash/<timestamp>.log
+ *
+ * Zero cross-dependencies: only uses Node.js built-ins so it can be imported
+ * safely from uncaughtException / unhandledRejection handlers and from tests
+ * without pulling in the full extension dependency tree.
+ */
+
+import { appendFileSync, mkdirSync } from "node:fs";
+import { homedir } from "node:os";
+import { join } from "node:path";
+
+/**
+ * Write a crash log to ~/.gsd/crash/<timestamp>.log (or $GSD_HOME/crash/).
+ * Never throws — must be safe to call from any error handler.
+ */
+export function writeCrashLog(err: Error, source: string): void {
+  try {
+    const crashDir = join(process.env.GSD_HOME ?? join(homedir(), ".gsd"), "crash");
+    mkdirSync(crashDir, { recursive: true });
+    const ts = new Date().toISOString().replace(/[:.]/g, "-");
+    const logPath = join(crashDir, `${ts}.log`);
+    const lines = [
+      `[gsd] ${source}: ${err.message}`,
+      `timestamp: ${new Date().toISOString()}`,
+      `pid: ${process.pid}`,
+      err.stack ?? "(no stack trace available)",
+      "",
+    ];
+    appendFileSync(logPath, lines.join("\n"));
+  } catch { /* never throw from crash handler */ }
+}

package/src/resources/extensions/gsd/bootstrap/register-extension.ts

@@ -11,6 +11,9 @@ import { registerJournalTools } from "./journal-tools.js";
 import { registerQueryTools } from "./query-tools.js";
 import { registerHooks } from "./register-hooks.js";
 import { registerShortcuts } from "./register-shortcuts.js";
+import { writeCrashLog } from "./crash-log.js";
+
+export { writeCrashLog } from "./crash-log.js";
 
 export function handleRecoverableExtensionProcessError(err: Error): boolean {
   if ((err as NodeJS.ErrnoException).code === "EPIPE") {
@@ -33,16 +36,25 @@ export function handleRecoverableExtensionProcessError(err: Error): boolean {
 function installEpipeGuard(): void {
   if (!process.listeners("uncaughtException").some((listener) => listener.name === "_gsdEpipeGuard")) {
     const _gsdEpipeGuard = (err: Error): void => {
-      if (handleRecoverableExtensionProcessError(err)) {
-        return;
-      }
-      // Log unhandled errors instead of re-throwing — throwing inside an
-      // uncaughtException handler is a fatal double-fault in Node.js (#3163).
-      process.stderr.write(`[gsd] uncaught extension error (non-fatal): ${err.message}\n`);
-      if (err.stack) process.stderr.write(`${err.stack}\n`);
+      if (handleRecoverableExtensionProcessError(err)) return;
+      // Write crash log and exit cleanly for unrecoverable errors.
+      // Logging and continuing was the original double-fault fix (#3163), but
+      // continuing in an indeterminate state is worse than a clean exit (#3348).
+      writeCrashLog(err, "uncaughtException");
+      process.exit(1);
     };
     process.on("uncaughtException", _gsdEpipeGuard);
   }
+
+  if (!process.listeners("unhandledRejection").some((listener) => listener.name === "_gsdRejectionGuard")) {
+    const _gsdRejectionGuard = (reason: unknown, _promise: Promise<unknown>): void => {
+      const err = reason instanceof Error ? reason : new Error(String(reason));
+      if (handleRecoverableExtensionProcessError(err)) return;
+      writeCrashLog(err, "unhandledRejection");
+      process.exit(1);
+    };
+    process.on("unhandledRejection", _gsdRejectionGuard);
+  }
 }
 
 export function registerGsdExtension(pi: ExtensionAPI): void {

package/src/resources/extensions/gsd/crash-recovery.ts

@@ -15,6 +15,7 @@ import { join } from "node:path";
 import { gsdRoot } from "./paths.js";
 import { atomicWriteSync } from "./atomic-write.js";
 import { effectiveLockFile } from "./session-lock.js";
+import { emitJournalEvent, queryJournal } from "./journal.js";
 
 export interface LockData {
   pid: number;
@@ -118,3 +119,61 @@ export function formatCrashInfo(lock: LockData): string {
 
   return lines.join("\n");
 }
+
+/**
+ * Emit a synthetic unit-end event for a unit that crashed without emitting its own.
+ *
+ * Queries the journal to find the most recent unit-start for the crashed unit.
+ * If a matching unit-end already exists (e.g. the hard timeout fired), this is a
+ * no-op. Called during crash recovery, before clearing the stale lock.
+ *
+ * Addresses the gap reported in #3348 where `unit-start` was emitted but no
+ * `unit-end` followed — side effects landed but the worker died before closeout.
+ */
+export function emitCrashRecoveredUnitEnd(basePath: string, lock: LockData): void {
+  // Skip bootstrap / starting pseudo-units — they have no meaningful unit-start event.
+  if (!lock.unitType || !lock.unitId || lock.unitType === "starting") return;
+
+  try {
+    const all = queryJournal(basePath);
+
+    // Find the most recent unit-start for this unitId
+    const starts = all.filter(
+      (e) => e.eventType === "unit-start" && e.data?.unitId === lock.unitId,
+    );
+    if (starts.length === 0) return;
+
+    const lastStart = starts[starts.length - 1];
+
+    // Check if a unit-end was already emitted (e.g. hard timeout fired after the crash)
+    const alreadyClosed = all.some(
+      (e) =>
+        e.eventType === "unit-end" &&
+        e.data?.unitId === lock.unitId &&
+        e.causedBy?.flowId === lastStart.flowId &&
+        e.causedBy?.seq === lastStart.seq,
+    );
+    if (alreadyClosed) return;
+
+    // Find the highest seq in this flow for monotonic ordering
+    const maxSeq = all
+      .filter((e) => e.flowId === lastStart.flowId)
+      .reduce((max, e) => Math.max(max, e.seq), lastStart.seq);
+
+    emitJournalEvent(basePath, {
+      ts: new Date().toISOString(),
+      flowId: lastStart.flowId,
+      seq: maxSeq + 1,
+      eventType: "unit-end",
+      data: {
+        unitType: lock.unitType,
+        unitId: lock.unitId,
+        status: "crash-recovered",
+        artifactVerified: false,
+      },
+      causedBy: { flowId: lastStart.flowId, seq: lastStart.seq },
+    });
+  } catch {
+    // Never throw from crash recovery path — journal failure must not block recovery
+  }
+}

package/src/resources/extensions/gsd/gsd-db.ts

@@ -1564,6 +1564,23 @@ export interface TaskRow {
   sequence: number;
 }
 
+function parseTaskArrayColumn(raw: unknown): string[] {
+  if (typeof raw !== "string" || raw.trim() === "") return [];
+
+  try {
+    const parsed = JSON.parse(raw);
+    if (Array.isArray(parsed)) return parsed.map((value) => String(value));
+    if (parsed === null || parsed === undefined || parsed === "") return [];
+    return [String(parsed)];
+  } catch {
+    // Older/corrupt rows may contain comma-separated strings instead of JSON.
+    return raw
+      .split(",")
+      .map((value) => value.trim())
+      .filter(Boolean);
+  }
+}
+
 function rowToTask(row: Record<string, unknown>): TaskRow {
   const parseTaskArray = (value: unknown): string[] => {
     if (Array.isArray(value)) {
@@ -1603,8 +1620,8 @@ function rowToTask(row: Record<string, unknown>): TaskRow {
     blocker_discovered: (row["blocker_discovered"] as number) === 1,
     deviations: row["deviations"] as string,
     known_issues: row["known_issues"] as string,
-    key_files: JSON.parse((row["key_files"] as string) || "[]"),
-    key_decisions: JSON.parse((row["key_decisions"] as string) || "[]"),
+    key_files: parseTaskArrayColumn(row["key_files"]),
+    key_decisions: parseTaskArrayColumn(row["key_decisions"]),
     full_summary_md: row["full_summary_md"] as string,
     description: (row["description"] as string) ?? "",
     estimate: (row["estimate"] as string) ?? "",
@@ -2200,6 +2217,39 @@ export function deleteSlice(milestoneId: string, sliceId: string): void {
   });
 }
 
+export function deleteMilestone(milestoneId: string): void {
+  if (!currentDb) throw new GSDError(GSD_STALE_STATE, "gsd-db: No database open");
+  transaction(() => {
+    currentDb!.prepare(
+      `DELETE FROM verification_evidence WHERE milestone_id = :mid`,
+    ).run({ ":mid": milestoneId });
+    currentDb!.prepare(
+      `DELETE FROM quality_gates WHERE milestone_id = :mid`,
+    ).run({ ":mid": milestoneId });
+    currentDb!.prepare(
+      `DELETE FROM tasks WHERE milestone_id = :mid`,
+    ).run({ ":mid": milestoneId });
+    currentDb!.prepare(
+      `DELETE FROM slice_dependencies WHERE milestone_id = :mid`,
+    ).run({ ":mid": milestoneId });
+    currentDb!.prepare(
+      `DELETE FROM slices WHERE milestone_id = :mid`,
+    ).run({ ":mid": milestoneId });
+    currentDb!.prepare(
+      `DELETE FROM replan_history WHERE milestone_id = :mid`,
+    ).run({ ":mid": milestoneId });
+    currentDb!.prepare(
+      `DELETE FROM assessments WHERE milestone_id = :mid`,
+    ).run({ ":mid": milestoneId });
+    currentDb!.prepare(
+      `DELETE FROM artifacts WHERE milestone_id = :mid`,
+    ).run({ ":mid": milestoneId });
+    currentDb!.prepare(
+      `DELETE FROM milestones WHERE id = :mid`,
+    ).run({ ":mid": milestoneId });
+  });
+}
+
 export function updateSliceFields(milestoneId: string, sliceId: string, fields: {
   title?: string;
   risk?: string;

package/src/resources/extensions/gsd/milestone-actions.ts

@@ -20,7 +20,8 @@ import {
 } from "./paths.js";
 import { invalidateAllCaches } from "./cache.js";
 import { loadQueueOrder, saveQueueOrder } from "./queue-order.js";
-import { getMilestone, isDbAvailable, updateMilestoneStatus } from "./gsd-db.js";
+import { deleteMilestone, getMilestone, isDbAvailable, updateMilestoneStatus } from "./gsd-db.js";
+import { removeWorktree } from "./worktree-manager.js";
 import { logWarning } from "./workflow-logger.js";
 
 // ─── Park ──────────────────────────────────────────────────────────────────
@@ -110,6 +111,15 @@ export function discardMilestone(basePath: string, milestoneId: string): boolean
   const mDir = resolveMilestonePath(basePath, milestoneId);
   if (!mDir || !existsSync(mDir)) return false;
 
+  try {
+    removeWorktree(basePath, milestoneId, {
+      branch: `milestone/${milestoneId}`,
+      deleteBranch: true,
+    });
+  } catch (err) {
+    logWarning("engine", `discardMilestone worktree cleanup failed for ${milestoneId}: ${(err as Error).message}`);
+  }
+
   rmSync(mDir, { recursive: true, force: true });
 
   // Prune from queue order if present
@@ -118,6 +128,14 @@ export function discardMilestone(basePath: string, milestoneId: string): boolean
     saveQueueOrder(basePath, order.filter(id => id !== milestoneId));
   }
 
+  if (isDbAvailable()) {
+    try {
+      deleteMilestone(milestoneId);
+    } catch (err) {
+      logWarning("engine", `discardMilestone DB cleanup failed for ${milestoneId}: ${(err as Error).message}`);
+    }
+  }
+
   invalidateAllCaches();
   return true;
 }

package/src/resources/extensions/gsd/tests/crash-handler-secondary.test.ts

@@ -0,0 +1,235 @@
+/**
+ * Regression tests for #3348 secondary issues — crash handler gaps surfaced after #3696
+ *
+ * 1. register-extension.ts: writeCrashLog writes to ~/.gsd/crash/ directory
+ * 2. register-extension.ts: _gsdRejectionGuard registered for unhandledRejection
+ * 3. register-extension.ts: _gsdEpipeGuard exits with code 1 for unrecoverable errors (no log-and-continue)
+ * 4. crash-recovery.ts: emitCrashRecoveredUnitEnd closes open unit-start journal entries
+ */
+
+import { describe, test } from 'node:test';
+import assert from 'node:assert/strict';
+import { existsSync, mkdirSync, readFileSync, readdirSync, rmSync } from 'node:fs';
+import { join } from 'node:path';
+import { tmpdir } from 'node:os';
+import { randomUUID } from 'node:crypto';
+import { fileURLToPath } from 'node:url';
+import { dirname } from 'node:path';
+
+const __filename = fileURLToPath(import.meta.url);
+const __dirname = dirname(__filename);
+
+function makeTmpBase(): string {
+  const base = join(tmpdir(), `gsd-test-${randomUUID()}`);
+  mkdirSync(join(base, '.gsd'), { recursive: true });
+  return base;
+}
+
+// ─── register-extension source assertions ────────────────────────────────────
+
+const registerExtSrc = readFileSync(
+  join(__dirname, '..', 'bootstrap', 'register-extension.ts'),
+  'utf-8',
+);
+
+describe('register-extension crash handler secondary fixes (#3348)', () => {
+  test('writeCrashLog is exported and writes a file to the crash directory', async () => {
+    // Dynamic import so GSD_HOME can be pointed at a temp dir without polluting ~/.gsd
+    const tmpHome = join(tmpdir(), `gsd-crash-test-${randomUUID()}`);
+    const origHome = process.env.GSD_HOME;
+    process.env.GSD_HOME = tmpHome;
+    try {
+      const { writeCrashLog } = await import('../bootstrap/crash-log.ts');
+      const err = new Error('test crash from secondary regression test');
+      writeCrashLog(err, 'uncaughtException');
+
+      const crashDir = join(tmpHome, 'crash');
+      assert.ok(existsSync(crashDir), 'crash directory should be created');
+
+      const logs = readdirSync(crashDir).filter((f) => f.endsWith('.log'));
+      assert.equal(logs.length, 1, 'exactly one crash log should be written');
+
+      const content = readFileSync(join(crashDir, logs[0]), 'utf-8');
+      assert.ok(content.includes('test crash from secondary regression test'), 'log should contain error message');
+      assert.ok(content.includes('uncaughtException'), 'log should identify the source');
+      assert.ok(content.includes('pid:'), 'log should include process pid');
+    } finally {
+      process.env.GSD_HOME = origHome;
+      rmSync(tmpHome, { recursive: true, force: true });
+    }
+  });
+
+  test('_gsdRejectionGuard is registered for unhandledRejection', () => {
+    assert.match(
+      registerExtSrc,
+      /_gsdRejectionGuard/,
+      '_gsdRejectionGuard handler should be defined',
+    );
+    assert.match(
+      registerExtSrc,
+      /unhandledRejection/,
+      'installEpipeGuard should register an unhandledRejection handler',
+    );
+  });
+
+  test('_gsdEpipeGuard calls process.exit(1) for unrecoverable errors, not log-and-continue', () => {
+    // The original #3696 fix replaced "throw err" with a log-and-continue.
+    // The secondary fix replaces that with writeCrashLog + process.exit(1).
+    assert.ok(
+      !registerExtSrc.includes('process.stderr.write(`[gsd] uncaught extension error (non-fatal)'),
+      '_gsdEpipeGuard should NOT log errors as non-fatal and continue',
+    );
+    assert.match(
+      registerExtSrc,
+      /process\.exit\(1\)/,
+      '_gsdEpipeGuard should call process.exit(1) for unrecoverable errors',
+    );
+  });
+
+  test('writeCrashLog never throws even when directory is unwritable', async () => {
+    const { writeCrashLog } = await import('../bootstrap/crash-log.ts');
+    const origHome = process.env.GSD_HOME;
+    // Point at a path that will fail to mkdir (e.g. a file that exists as non-dir)
+    const tmpFile = join(tmpdir(), `gsd-not-a-dir-${randomUUID()}`);
+    // Don't create it — mkdirSync with bad path should be caught internally
+    process.env.GSD_HOME = join(tmpFile, 'nested', 'deeply');
+    try {
+      // Should not throw
+      assert.doesNotThrow(() => {
+        writeCrashLog(new Error('should not throw'), 'test');
+      });
+    } finally {
+      process.env.GSD_HOME = origHome;
+    }
+  });
+});
+
+// ─── emitCrashRecoveredUnitEnd ────────────────────────────────────────────────
+
+describe('emitCrashRecoveredUnitEnd (#3348)', () => {
+  test('emits synthetic unit-end when unit-start has no matching unit-end', async () => {
+    const base = makeTmpBase();
+    try {
+      const { emitJournalEvent, queryJournal } = await import('../journal.ts');
+      const { emitCrashRecoveredUnitEnd } = await import('../crash-recovery.ts');
+
+      const flowId = randomUUID();
+      const unitStartSeq = 5;
+
+      // Emit a unit-start with no corresponding unit-end (simulating a crash)
+      emitJournalEvent(base, {
+        ts: new Date().toISOString(),
+        flowId,
+        seq: unitStartSeq,
+        eventType: 'unit-start',
+        data: { unitType: 'execute-task', unitId: 'M001/S01/T01' },
+      });
+
+      const lock = {
+        pid: 99999,
+        startedAt: new Date().toISOString(),
+        unitType: 'execute-task',
+        unitId: 'M001/S01/T01',
+        unitStartedAt: new Date().toISOString(),
+      };
+
+      emitCrashRecoveredUnitEnd(base, lock);
+
+      const events = queryJournal(base);
+      const ends = events.filter((e) => e.eventType === 'unit-end');
+      assert.equal(ends.length, 1, 'should emit exactly one unit-end');
+      assert.equal(ends[0].data?.unitId, 'M001/S01/T01');
+      assert.equal(ends[0].data?.status, 'crash-recovered');
+      assert.equal(ends[0].causedBy?.flowId, flowId);
+      assert.equal(ends[0].causedBy?.seq, unitStartSeq);
+      assert.ok(ends[0].seq > unitStartSeq, 'unit-end seq must be higher than unit-start seq');
+    } finally {
+      rmSync(base, { recursive: true, force: true });
+    }
+  });
+
+  test('is a no-op when unit-end was already emitted (e.g. hard timeout fired)', async () => {
+    const base = makeTmpBase();
+    try {
+      const { emitJournalEvent, queryJournal } = await import('../journal.ts');
+      const { emitCrashRecoveredUnitEnd } = await import('../crash-recovery.ts');
+
+      const flowId = randomUUID();
+      emitJournalEvent(base, {
+        ts: new Date().toISOString(),
+        flowId,
+        seq: 3,
+        eventType: 'unit-start',
+        data: { unitType: 'plan-slice', unitId: 'M001/S02' },
+      });
+      // Hard timeout already emitted a unit-end
+      emitJournalEvent(base, {
+        ts: new Date().toISOString(),
+        flowId,
+        seq: 4,
+        eventType: 'unit-end',
+        data: { unitType: 'plan-slice', unitId: 'M001/S02', status: 'cancelled' },
+        causedBy: { flowId, seq: 3 },
+      });
+
+      const lock = {
+        pid: 99999,
+        startedAt: new Date().toISOString(),
+        unitType: 'plan-slice',
+        unitId: 'M001/S02',
+        unitStartedAt: new Date().toISOString(),
+      };
+      emitCrashRecoveredUnitEnd(base, lock);
+
+      const ends = queryJournal(base).filter((e) => e.eventType === 'unit-end');
+      assert.equal(ends.length, 1, 'should not emit a duplicate unit-end');
+      assert.equal(ends[0].data?.status, 'cancelled', 'original unit-end should be preserved');
+    } finally {
+      rmSync(base, { recursive: true, force: true });
+    }
+  });
+
+  test('is a no-op for "starting" pseudo-units (bootstrap crash)', async () => {
+    const base = makeTmpBase();
+    try {
+      const { queryJournal } = await import('../journal.ts');
+      const { emitCrashRecoveredUnitEnd } = await import('../crash-recovery.ts');
+
+      const lock = {
+        pid: 99999,
+        startedAt: new Date().toISOString(),
+        unitType: 'starting',
+        unitId: 'bootstrap',
+        unitStartedAt: new Date().toISOString(),
+      };
+      emitCrashRecoveredUnitEnd(base, lock);
+
+      const events = queryJournal(base);
+      assert.equal(events.length, 0, 'should emit nothing for starting/bootstrap pseudo-units');
+    } finally {
+      rmSync(base, { recursive: true, force: true });
+    }
+  });
+
+  test('is a no-op when no unit-start exists in the journal', async () => {
+    const base = makeTmpBase();
+    try {
+      const { queryJournal } = await import('../journal.ts');
+      const { emitCrashRecoveredUnitEnd } = await import('../crash-recovery.ts');
+
+      const lock = {
+        pid: 99999,
+        startedAt: new Date().toISOString(),
+        unitType: 'execute-task',
+        unitId: 'M002/S01/T03',
+        unitStartedAt: new Date().toISOString(),
+      };
+      emitCrashRecoveredUnitEnd(base, lock);
+
+      const events = queryJournal(base);
+      assert.equal(events.length, 0, 'should emit nothing when there is no journal entry to close');
+    } finally {
+      rmSync(base, { recursive: true, force: true });
+    }
+  });
+});

package/src/resources/extensions/gsd/tests/gsd-db.test.ts

@@ -15,10 +15,14 @@ import {
   getRequirementById,
   getActiveDecisions,
   getActiveRequirements,
-  getTask,
   transaction,
   _getAdapter,
   _resetProvider,
+  insertMilestone,
+  insertSlice,
+  insertTask,
+  getTask,
+  getSliceTasks,
 } from '../gsd-db.ts';
 
 // ═══════════════════════════════════════════════════════════════════════════
@@ -460,6 +464,60 @@ describe('gsd-db', () => {
     assert.ok(!wasDbOpenAttempted(), 'wasDbOpenAttempted should reset after closeDatabase');
   });
 
+  test('gsd-db: rowToTask tolerates corrupt comma-separated task arrays', () => {
+    openDatabase(':memory:');
+    insertMilestone({ id: 'M001', status: 'active' });
+    insertSlice({ milestoneId: 'M001', id: 'S01', status: 'active' });
+    insertTask({
+      milestoneId: 'M001',
+      sliceId: 'S01',
+      id: 'T01',
+      title: 'Recover corrupt arrays',
+      planning: {
+        description: 'desc',
+        estimate: 'small',
+        files: ['src/original.ts'],
+        verify: 'npm test',
+        inputs: ['docs/original.md'],
+        expectedOutput: ['dist/original.md'],
+        observabilityImpact: '',
+      },
+    });
+
+    const adapter = _getAdapter()!;
+    adapter.prepare(
+      `UPDATE tasks
+         SET files = ?, inputs = ?, expected_output = ?, key_files = ?, key_decisions = ?
+       WHERE milestone_id = ? AND slice_id = ? AND id = ?`,
+    ).run(
+      'src-erf/Models/foo.cs, src-erf/Models/bar.cs',
+      'docs/input-a.md, docs/input-b.md',
+      'dist/out-a.md, dist/out-b.md',
+      'src/resources/extensions/gsd/gsd-db.ts, src/resources/extensions/gsd/state.ts',
+      '"decision-1"',
+      'M001',
+      'S01',
+      'T01',
+    );
+
+    const task = getTask('M001', 'S01', 'T01');
+    assert.ok(task, 'getTask should still return the corrupt row');
+    assert.deepStrictEqual(task!.files, ['src-erf/Models/foo.cs', 'src-erf/Models/bar.cs']);
+    assert.deepStrictEqual(task!.inputs, ['docs/input-a.md', 'docs/input-b.md']);
+    assert.deepStrictEqual(task!.expected_output, ['dist/out-a.md', 'dist/out-b.md']);
+    assert.deepStrictEqual(
+      task!.key_files,
+      ['src/resources/extensions/gsd/gsd-db.ts', 'src/resources/extensions/gsd/state.ts'],
+    );
+    assert.deepStrictEqual(task!.key_decisions, ['decision-1']);
+
+    const sliceTasks = getSliceTasks('M001', 'S01');
+    assert.equal(sliceTasks.length, 1, 'getSliceTasks should also survive corrupt rows');
+    assert.deepStrictEqual(sliceTasks[0]!.files, task!.files);
+
+    closeDatabase();
+  });
+
   // ─── Final Report ──────────────────────────────────────────────────────────
 
 });

package/src/resources/extensions/gsd/tests/park-milestone.test.ts

@@ -3,10 +3,22 @@ import assert from 'node:assert/strict';
 import { mkdtempSync, mkdirSync, rmSync, writeFileSync, existsSync, readFileSync } from 'node:fs';
 import { join } from 'node:path';
 import { tmpdir } from 'node:os';
+import { execSync } from 'node:child_process';
 
 import { deriveState, invalidateStateCache, getActiveMilestoneId } from '../state.ts';
 import { clearPathCache } from '../paths.ts';
 import { parkMilestone, unparkMilestone, discardMilestone, isParked, getParkedReason } from '../milestone-actions.ts';
+import {
+  closeDatabase,
+  getMilestone,
+  getMilestoneSlices,
+  getSliceTasks,
+  insertMilestone,
+  insertSlice,
+  insertTask,
+  openDatabase,
+} from "../gsd-db.ts";
+import { createWorktree } from "../worktree-manager.ts";
 
 
 
@@ -60,9 +72,29 @@ function createMilestone(base: string, mid: string, opts?: { withRoadmap?: boole
 }
 
 function cleanup(base: string): void {
+  try {
+    closeDatabase();
+  } catch {
+    // ignore
+  }
   rmSync(base, { recursive: true, force: true });
 }
 
+function run(cmd: string, cwd: string): string {
+  return execSync(cmd, { cwd, stdio: ["ignore", "pipe", "pipe"], encoding: "utf-8" }).trim();
+}
+
+function initGitRepo(base: string): void {
+  writeFileSync(join(base, "README.md"), "# test\n", "utf-8");
+  writeFileSync(join(base, ".gsd", "STATE.md"), "# State\n", "utf-8");
+  run("git init", base);
+  run("git config user.email test@test.com", base);
+  run("git config user.name Test", base);
+  run("git add .", base);
+  run('git commit -m "init"', base);
+  run("git branch -M main", base);
+}
+
 function clearCaches(): void {
   clearPathCache();
   invalidateStateCache();
@@ -294,6 +326,38 @@ test('discardMilestone updates queue order', () => {
     }
 });
 
+test('discardMilestone removes DB rows, worktree, and milestone branch', () => {
+    const base = createFixtureBase();
+    try {
+      createMilestone(base, 'M001', { withRoadmap: true });
+      initGitRepo(base);
+      clearCaches();
+
+      assert.ok(openDatabase(join(base, '.gsd', 'gsd.db')), 'database opens');
+      insertMilestone({ id: 'M001', title: 'Discard me', status: 'active' });
+      insertSlice({ milestoneId: 'M001', id: 'S01', title: 'Only slice', status: 'pending' });
+      insertTask({ milestoneId: 'M001', sliceId: 'S01', id: 'T01', title: 'Only task', status: 'pending' });
+
+      const wt = createWorktree(base, 'M001', { branch: 'milestone/M001' });
+      assert.ok(existsSync(wt.path), 'worktree exists before discard');
+      assert.ok(run('git branch', base).includes('milestone/M001'), 'milestone branch exists before discard');
+      assert.ok(getMilestone('M001'), 'milestone exists in DB before discard');
+      assert.equal(getMilestoneSlices('M001').length, 1, 'slice exists in DB before discard');
+      assert.equal(getSliceTasks('M001', 'S01').length, 1, 'task exists in DB before discard');
+
+      const success = discardMilestone(base, 'M001');
+      assert.ok(success, 'discardMilestone returns true');
+
+      assert.equal(getMilestone('M001'), null, 'milestone row removed from DB');
+      assert.equal(getMilestoneSlices('M001').length, 0, 'slice rows removed from DB');
+      assert.equal(getSliceTasks('M001', 'S01').length, 0, 'task rows removed from DB');
+      assert.ok(!existsSync(wt.path), 'worktree removed after discard');
+      assert.ok(!run('git branch', base).includes('milestone/M001'), 'milestone branch removed after discard');
+    } finally {
+      cleanup(base);
+    }
+});
+
   // ─── Test 12: All milestones parked → no active milestone ─────────────
 test('All milestones parked → no active', async () => {
     const base = createFixtureBase();