gsd-pi 2.78.1-dev.e9d88a536 → 2.78.1-dev.eccf86e27

package/dist/resources/extensions/gsd/docs/COORDINATION.md

@@ -0,0 +1,42 @@
+# Auto-mode coordination is single-host
+
+The DB-backed coordination tables introduced by Phase B (`workers`,
+`milestone_leases`, `unit_dispatches`, `cancellation_requests`,
+`command_queue`) and the supporting `runtime_kv` table from Phase C all
+rely on **shared SQLite WAL on local disk**. They do not work across
+machines.
+
+## Why single-host only
+
+- SQLite WAL coordination — the locking primitives that make
+  `claimMilestoneLease`, `recordDispatchClaim`, and `claimNextCommand`
+  atomic — is local-disk only. Network filesystems (NFS, SMB, S3FS) and
+  fuse mounts break the lock semantics that the WAL relies on.
+- Heartbeat TTL (`workers.last_heartbeat_at`) compares timestamps written
+  with SQLite wall-clock time (`datetime('now')`). Across machines without
+  wall-clock synchronization (for example NTP/chrony), TTL filtering can
+  produce phantom-active or premature-crashed verdicts. Monotonic clocks
+  are not used for these comparisons.
+- Fencing tokens (`milestone_leases.fencing_token`) are monotonically
+  ordered by SQL within a single transaction. Cross-host races could
+  produce duplicate tokens if two SQLite processes opened the same DB
+  on a network mount.
+
+## What does work
+
+- Multiple `gsd auto` worker processes on the **same machine**, sharing
+  the project's SQLite DB via WAL. The lease check refuses concurrent
+  claims on the same milestone; the dispatch ledger's partial unique
+  index refuses double-claims of the same unit.
+- A single `gsd auto` worker plus arbitrary read-only consumers
+  (dashboards, doctors) on the same machine.
+- Worktree-based parallelism on the same machine, where each worker
+  holds a different milestone lease.
+
+## Multi-host alternatives
+
+If you need to coordinate `gsd auto` workers across machines, you need
+a real coordinator: Postgres for the ledger + a leader-election service
+(etcd, Consul) for the leases. That's out of scope for these phases.
+The schema and module shapes here would need a non-trivial backend
+swap before they could ride on top of either.

package/dist/resources/extensions/gsd/doctor-proactive.js

@@ -24,6 +24,7 @@ import { resolveMilestoneIntegrationBranch } from "./git-service.js";
 import { nativeIsRepo, nativeHasChanges, nativeLastCommitEpoch, nativeGetCurrentBranch, nativeAddTracked, nativeCommit } from "./native-git-bridge.js";
 import { loadEffectiveGSDPreferences } from "./preferences.js";
 import { runEnvironmentChecks } from "./doctor-environment.js";
+import { ensureDbOpen } from "./bootstrap/dynamic-tools.js";
 /** In-memory health history for the current auto-mode session. */
 let healthHistory = [];
 /** Count of consecutive units with unresolved errors. */
@@ -159,6 +160,9 @@ export async function preDispatchHealthGate(basePath) {
     // If a stale lock exists, the crash recovery path should handle it,
     // not a new dispatch. This prevents double-dispatch after crashes.
     try {
+        if (existsSync(join(gsdRoot(basePath), "gsd.db"))) {
+            await ensureDbOpen(basePath);
+        }
         const lock = readCrashLock(basePath);
         if (lock && !isLockProcessAlive(lock)) {
             // Auto-clear it since we're about to dispatch anyway

package/dist/resources/extensions/gsd/doctor-runtime-checks.js

@@ -6,6 +6,8 @@ import { deriveState, isGhostMilestone, isReusableGhostMilestone } from "./state
 import { saveFile } from "./files.js";
 import { nativeIsRepo, nativeForEachRef, nativeUpdateRef } from "./native-git-bridge.js";
 import { readCrashLock, isLockProcessAlive, clearLock } from "./crash-recovery.js";
+import { getActiveAutoWorkers } from "./db/auto-workers.js";
+import { normalizeRealPath } from "./paths.js";
 import { ensureGitignore, isGsdGitignored } from "./gitignore.js";
 import { readAllSessionStatuses, isSessionStale, removeSessionStatus } from "./session-status-io.js";
 import { recoverFailedMigration } from "./migrate-external.js";
@@ -26,6 +28,9 @@ function hasAssessmentVerdict(basePath, mid, sid) {
 export async function checkRuntimeHealth(basePath, issues, fixesApplied, shouldFix) {
     const root = gsdRoot(basePath);
     // ── Stale crash lock ──────────────────────────────────────────────────
+    // Phase C pt 2: the lock state lives in the workers + unit_dispatches
+    // tables now, not auto.lock. readCrashLock synthesizes a LockData from
+    // the DB; isLockProcessAlive is a pure OS PID check.
     try {
         const lock = readCrashLock(basePath);
         if (lock) {
@@ -36,13 +41,13 @@ export async function checkRuntimeHealth(basePath, issues, fixesApplied, shouldF
                     code: "stale_crash_lock",
                     scope: "project",
                     unitId: "project",
-                    message: `Stale auto.lock from PID ${lock.pid} (started ${lock.startedAt}, was executing ${lock.unitType} ${lock.unitId}) — process is no longer running`,
-                    file: ".gsd/auto.lock",
+                    message: `Stale auto-mode worker (PID ${lock.pid}, started ${lock.startedAt}, was executing ${lock.unitType} ${lock.unitId}) — process is no longer running`,
+                    file: "<workers table>",
                     fixable: true,
                 });
                 if (shouldFix("stale_crash_lock")) {
                     clearLock(basePath);
-                    fixesApplied.push("cleared stale auto.lock");
+                    fixesApplied.push("cleared stale auto-mode worker state");
                 }
             }
         }
@@ -60,9 +65,20 @@ export async function checkRuntimeHealth(basePath, issues, fixesApplied, shouldF
         if (existsSync(lockDir)) {
             const statRes = statSync(lockDir);
             if (statRes.isDirectory()) {
-                // Check if any live process actually holds this lock
-                const lock = readCrashLock(basePath);
-                const lockHolderAlive = lock ? isLockProcessAlive(lock) : false;
+                // Phase C pt 2: "any live process holds the lock?" check now means
+                // "is any worker registered with status='active' AND a fresh
+                // heartbeat for this project?" — readCrashLock returns null for
+                // healthy live workers (it surfaces stale ones only), so we must
+                // consult getActiveAutoWorkers directly.
+                const projectRoot = normalizeRealPath(basePath);
+                const activeWorkers = getActiveAutoWorkers().filter((w) => w.project_root_realpath === projectRoot && isLockProcessAlive({
+                    pid: w.pid,
+                    startedAt: w.started_at,
+                    unitType: "starting",
+                    unitId: "bootstrap",
+                    unitStartedAt: w.started_at,
+                }));
+                const lockHolderAlive = activeWorkers.length > 0;
                 if (!lockHolderAlive) {
                     issues.push({
                         severity: "error",

package/dist/resources/extensions/gsd/doctor.js

@@ -2,8 +2,8 @@ import { existsSync, mkdirSync, lstatSync, readdirSync, readFileSync } from "nod
 import { join } from "node:path";
 import { loadFile, parseSummary, saveFile, parseTaskPlanMustHaves, countMustHavesMentionedInSummary } from "./files.js";
 import { parseRoadmap as parseLegacyRoadmap, parsePlan as parseLegacyPlan } from "./parsers-legacy.js";
-import { isDbAvailable, getMilestoneSlices, getSliceTasks } from "./gsd-db.js";
-import { resolveMilestoneFile, resolveMilestonePath, resolveSliceFile, resolveSlicePath, resolveTaskFile, resolveTasksDir, milestonesDir, gsdRoot, relMilestoneFile, relSliceFile, relTaskFile, relSlicePath, relGsdRootFile, resolveGsdRootFile, relMilestonePath } from "./paths.js";
+import { isDbAvailable, openDatabase, getMilestoneSlices, getSliceTasks } from "./gsd-db.js";
+import { resolveMilestoneFile, resolveMilestonePath, resolveSliceFile, resolveSlicePath, resolveTaskFile, resolveTasksDir, milestonesDir, gsdRoot, relMilestoneFile, relSliceFile, relTaskFile, relSlicePath, relGsdRootFile, resolveGsdRootFile, relMilestonePath, resolveGsdPathContract } from "./paths.js";
 import { deriveState, isMilestoneComplete } from "./state.js";
 import { invalidateAllCaches } from "./cache.js";
 import { loadEffectiveGSDPreferences } from "./preferences.js";
@@ -309,6 +309,16 @@ export async function runGSDDoctor(basePath, options) {
     const fix = options?.fix === true;
     const dryRun = options?.dryRun === true;
     const fixLevel = options?.fixLevel ?? "all";
+    // CLI doctor can run before any tool handler has opened the DB. Runtime
+    // health checks need the existing project DB to surface DB-backed crash
+    // locks, paused sessions, and coordination rows.
+    const dbPath = resolveGsdPathContract(basePath).projectDb;
+    if (existsSync(dbPath)) {
+        try {
+            openDatabase(dbPath);
+        }
+        catch { /* surfaced later as db_unavailable */ }
+    }
     // Issue codes that represent completion state transitions — creating summary
     // stubs, marking slices/milestones done in the roadmap. These belong to the
     // dispatch lifecycle (complete-slice, complete-milestone units), not to

package/dist/resources/extensions/gsd/gsd-db.js

@@ -136,10 +136,137 @@ function openRawDb(path) {
     const Database = providerModule;
     return new Database(path);
 }
-export const SCHEMA_VERSION = 23;
+export const SCHEMA_VERSION = 25;
 function indexExists(db, name) {
     return !!db.prepare("SELECT 1 as present FROM sqlite_master WHERE type = 'index' AND name = ?").get(name);
 }
+/**
+ * Create the v24 coordination tables (workers, milestone_leases,
+ * unit_dispatches, cancellation_requests, command_queue) and their indexes.
+ *
+ * Idempotent — uses IF NOT EXISTS throughout. Called from both the
+ * fresh-install path and the v24 migration block in migrateSchema().
+ *
+ * Single-host invariant: these tables coordinate concurrent auto-mode
+ * workers via shared SQLite WAL on local disk only. NFS / network
+ * filesystems break the coordination semantics — multi-host execution
+ * needs a real coordinator (etcd, Postgres) and is out of scope.
+ */
+function createCoordinationTablesV24(db) {
+    const ddl = [
+        `CREATE TABLE IF NOT EXISTS workers (
+      worker_id TEXT PRIMARY KEY,
+      host TEXT NOT NULL,
+      pid INTEGER NOT NULL,
+      started_at TEXT NOT NULL,
+      version TEXT NOT NULL,
+      last_heartbeat_at TEXT NOT NULL,
+      status TEXT NOT NULL,
+      project_root_realpath TEXT NOT NULL
+    )`,
+        `CREATE TABLE IF NOT EXISTS milestone_leases (
+      milestone_id TEXT PRIMARY KEY,
+      worker_id TEXT NOT NULL,
+      fencing_token INTEGER NOT NULL,
+      acquired_at TEXT NOT NULL,
+      expires_at TEXT NOT NULL,
+      status TEXT NOT NULL,
+      FOREIGN KEY (worker_id) REFERENCES workers(worker_id),
+      FOREIGN KEY (milestone_id) REFERENCES milestones(id)
+    )`,
+        `CREATE TABLE IF NOT EXISTS unit_dispatches (
+      id INTEGER PRIMARY KEY AUTOINCREMENT,
+      trace_id TEXT NOT NULL,
+      turn_id TEXT,
+      worker_id TEXT NOT NULL,
+      milestone_lease_token INTEGER NOT NULL,
+      milestone_id TEXT NOT NULL,
+      slice_id TEXT,
+      task_id TEXT,
+      unit_type TEXT NOT NULL,
+      unit_id TEXT NOT NULL,
+      status TEXT NOT NULL,
+      attempt_n INTEGER NOT NULL DEFAULT 1,
+      started_at TEXT NOT NULL,
+      ended_at TEXT,
+      exit_reason TEXT,
+      error_summary TEXT,
+      verification_evidence_id INTEGER,
+      next_run_at TEXT,
+      retry_after_ms INTEGER,
+      max_attempts INTEGER NOT NULL DEFAULT 3,
+      last_error_code TEXT,
+      last_error_at TEXT,
+      FOREIGN KEY (worker_id) REFERENCES workers(worker_id),
+      FOREIGN KEY (verification_evidence_id) REFERENCES verification_evidence(id)
+    )`,
+        `CREATE TABLE IF NOT EXISTS cancellation_requests (
+      id INTEGER PRIMARY KEY AUTOINCREMENT,
+      requested_at TEXT NOT NULL,
+      requested_by TEXT NOT NULL,
+      scope TEXT NOT NULL,
+      scope_id TEXT NOT NULL,
+      dispatch_id INTEGER,
+      reason TEXT NOT NULL,
+      status TEXT NOT NULL,
+      acked_at TEXT,
+      acked_worker_id TEXT,
+      FOREIGN KEY (dispatch_id) REFERENCES unit_dispatches(id),
+      FOREIGN KEY (acked_worker_id) REFERENCES workers(worker_id)
+    )`,
+        `CREATE TABLE IF NOT EXISTS command_queue (
+      id INTEGER PRIMARY KEY AUTOINCREMENT,
+      target_worker TEXT,
+      command TEXT NOT NULL,
+      args_json TEXT NOT NULL DEFAULT '{}',
+      enqueued_at TEXT NOT NULL,
+      claimed_at TEXT,
+      claimed_by TEXT,
+      completed_at TEXT,
+      result_json TEXT
+    )`,
+    ];
+    for (const stmt of ddl)
+        db.exec(stmt);
+    // Indexes — created here so both fresh-install and v24-migration paths
+    // produce identical structure.
+    db.exec("CREATE INDEX IF NOT EXISTS idx_unit_dispatches_active ON unit_dispatches(milestone_id, status)");
+    db.exec("CREATE INDEX IF NOT EXISTS idx_unit_dispatches_trace ON unit_dispatches(trace_id, turn_id)");
+    // Partial unique index — prevents two workers from claiming the same
+    // unit concurrently. Codex review MEDIUM B2: enforces double-claim guard
+    // at the DB level.
+    db.exec("CREATE UNIQUE INDEX IF NOT EXISTS idx_unit_dispatches_active_per_unit "
+        + "ON unit_dispatches(unit_id) WHERE status IN ('claimed','running')");
+    // command_queue index — SQLite indexes NULLs in B-trees, so this single
+    // index serves both targeted (target_worker = ?) and broadcast
+    // (target_worker IS NULL) queries. Codex review LOW B4 documented.
+    db.exec("CREATE INDEX IF NOT EXISTS idx_command_queue_pending ON command_queue(target_worker, claimed_at)");
+}
+/**
+ * Create the v25 runtime_kv table. Idempotent — uses IF NOT EXISTS.
+ *
+ * STRICT INVARIANT: runtime_kv is NON-CORRECTNESS-CRITICAL. UI cursors,
+ * dashboard caches, last-seen-version markers, resume cursors, and other
+ * "soft" state are OK. Anything that drives auto-mode control flow gets
+ * typed columns in unit_dispatches / workers / milestone_leases — never
+ * a bag of JSON in runtime_kv.
+ *
+ * Scope partitioning: ('global', '', key) for project-wide values;
+ * ('worker', worker_id, key) for per-worker state (resume cursors);
+ * ('milestone', milestone_id, key) for per-milestone soft state.
+ */
+function createRuntimeKvTableV25(db) {
+    db.exec(`
+    CREATE TABLE IF NOT EXISTS runtime_kv (
+      scope TEXT NOT NULL,
+      scope_id TEXT NOT NULL DEFAULT '',
+      key TEXT NOT NULL,
+      value_json TEXT NOT NULL,
+      updated_at TEXT NOT NULL,
+      PRIMARY KEY (scope, scope_id, key)
+    )
+  `);
+}
 function dedupeVerificationEvidenceRows(db) {
     db.exec(`
     DELETE FROM verification_evidence
@@ -513,6 +640,8 @@ function initSchema(db, fileBacked) {
         db.exec(`CREATE VIEW IF NOT EXISTS active_memories AS SELECT * FROM memories WHERE superseded_by IS NULL`);
         const existing = db.prepare("SELECT count(*) as cnt FROM schema_version").get();
         if (existing && existing["cnt"] === 0) {
+            createCoordinationTablesV24(db);
+            createRuntimeKvTableV25(db);
             // Fresh install — all tables are created above with the full current schema,
             // so it is safe to create all migration-specific indexes here.  For existing
             // databases these indexes are created inside the individual migration guards
@@ -1142,6 +1271,26 @@ function migrateSchema(db) {
                 ":applied_at": new Date().toISOString(),
             });
         }
+        if (currentVersion < 24) {
+            // v24: auto-mode coordination tables. See createCoordinationTablesV24
+            // for full schema + invariants. No-op for fresh installs (the same
+            // helper runs in the fresh-install path); for upgraded DBs this is
+            // the only place these tables get created.
+            createCoordinationTablesV24(db);
+            db.prepare("INSERT INTO schema_version (version, applied_at) VALUES (:version, :applied_at)").run({
+                ":version": 24,
+                ":applied_at": new Date().toISOString(),
+            });
+        }
+        if (currentVersion < 25) {
+            // v25: runtime_kv non-correctness-critical key-value storage. See
+            // createRuntimeKvTableV25 for the full schema + invariants.
+            createRuntimeKvTableV25(db);
+            db.prepare("INSERT INTO schema_version (version, applied_at) VALUES (:version, :applied_at)").run({
+                ":version": 25,
+                ":applied_at": new Date().toISOString(),
+            });
+        }
         db.exec("COMMIT");
     }
     catch (err) {
@@ -1156,6 +1305,193 @@ let _exitHandlerRegistered = false;
 let _dbOpenAttempted = false;
 let _lastDbError = null;
 let _lastDbPhase = null;
+/**
+ * Identity key of the workspace whose connection is currently active
+ * (currentDb). Set by openDatabaseByWorkspace(); null when the active
+ * connection was opened via the legacy openDatabase(path) path.
+ */
+let _currentIdentityKey = null;
+/**
+ * Workspace-scoped connection cache.
+ * Key: GsdWorkspace.identityKey (realpath-normalized project root).
+ * Value: the DB path and open adapter for that workspace.
+ *
+ * Sibling worktrees of the same project share the same identityKey (set by
+ * createWorkspace) and therefore reuse the same cached connection, preserving
+ * shared-WAL semantics. Different projects get distinct cache entries.
+ *
+ * NOTE: Only one connection is "active" at a time (currentDb/currentPath).
+ * The cache allows fast re-activation of a previously opened connection when
+ * callers switch between known workspaces via openDatabaseByWorkspace().
+ */
+const _dbCache = new Map();
+/** Test helper: expose the internal cache for inspection. Not for production use. */
+export function _getDbCache() {
+    return _dbCache;
+}
+/**
+ * Close and evict every entry in the workspace connection cache, then call
+ * closeDatabase() to close the active connection.
+ *
+ * Use this for test teardown or process-shutdown paths where every open
+ * connection must be flushed. Normal callers should use closeDatabase() or
+ * closeDatabaseByWorkspace() instead.
+ */
+export function closeAllDatabases() {
+    // Close all non-active cached connections first.
+    for (const [key, entry] of _dbCache) {
+        if (entry.db === currentDb)
+            continue; // handled by closeDatabase() below
+        _dbCache.delete(key);
+        try {
+            entry.db.exec("PRAGMA wal_checkpoint(TRUNCATE)");
+        }
+        catch { /* best-effort */ }
+        try {
+            entry.db.exec("PRAGMA incremental_vacuum(64)");
+        }
+        catch { /* best-effort */ }
+        try {
+            entry.db.close();
+        }
+        catch { /* best-effort */ }
+    }
+    closeDatabase();
+}
+/**
+ * Open (or reuse) the database connection scoped to the given workspace.
+ *
+ * Uses workspace.identityKey as the cache key, so sibling worktrees of the
+ * same project resolve to the same connection. On a cache hit the existing
+ * adapter is reactivated as the current connection without re-opening the
+ * file. On a cache miss, delegates to openDatabase() for the full
+ * open + schema-init + migration flow, then caches the result.
+ *
+ * When switching to a different workspace, the previously active connection
+ * is preserved in the cache (not closed), so callers can switch back to it
+ * cheaply via a subsequent openDatabaseByWorkspace() call.
+ *
+ * @param workspace A GsdWorkspace created by createWorkspace().
+ * @returns true if the connection is open and ready, false otherwise.
+ */
+export function openDatabaseByWorkspace(workspace) {
+    const key = workspace.identityKey;
+    const dbPath = workspace.contract.projectDb;
+    const cached = _dbCache.get(key);
+    if (cached) {
+        // Reactivate the cached connection as the current singleton.
+        currentDb = cached.db;
+        currentPath = cached.dbPath;
+        currentPid = process.pid;
+        _dbOpenAttempted = true;
+        _currentIdentityKey = key;
+        return true;
+    }
+    // Cache miss — need to open a new connection.
+    //
+    // If there is a currently active workspace connection, stash it in the
+    // cache under its identity key before calling openDatabase(), because
+    // openDatabase() will call closeDatabase() when the path changes (which
+    // would destroy the existing adapter). By nulling out currentDb first,
+    // we prevent openDatabase() from closing the live adapter.
+    let oldDb = null;
+    let oldPath = null;
+    let oldPid = 0;
+    let oldKey = null;
+    if (currentDb !== null && _currentIdentityKey !== null) {
+        // Snapshot the old globals so we can restore them on failure.
+        oldDb = currentDb;
+        oldPath = currentPath;
+        oldPid = currentPid;
+        oldKey = _currentIdentityKey;
+        // Save the current connection so it stays alive in the cache.
+        _dbCache.set(_currentIdentityKey, {
+            dbPath: currentPath,
+            db: currentDb,
+        });
+        // Detach from globals so openDatabase() opens fresh without closing it.
+        currentDb = null;
+        currentPath = null;
+        currentPid = 0;
+        _currentIdentityKey = null;
+    }
+    // Run the full open/schema/migration flow for the new workspace.
+    // openDatabase() can throw on corrupt DB or permission error — catch so we
+    // can restore the previous connection rather than leaving globals null.
+    let opened;
+    try {
+        opened = openDatabase(dbPath);
+    }
+    catch (err) {
+        // Failed to open the new DB. Restore the previous workspace connection so
+        // the caller's workspace remains active (it is still safe in _dbCache).
+        if (oldDb !== null) {
+            currentDb = oldDb;
+            currentPath = oldPath;
+            currentPid = oldPid;
+            _currentIdentityKey = oldKey;
+        }
+        throw err;
+    }
+    if (opened && currentDb) {
+        _dbCache.set(key, { dbPath, db: currentDb });
+        _currentIdentityKey = key;
+    }
+    else if (!opened && oldDb !== null) {
+        // Restore the previous connection so the caller's workspace remains active.
+        // The failed attempt left no live adapter, so the globals stayed null.
+        currentDb = oldDb;
+        currentPath = oldPath;
+        currentPid = oldPid;
+        _currentIdentityKey = oldKey;
+    }
+    return opened;
+}
+/**
+ * Open (or reuse) the database connection scoped to the workspace in a
+ * MilestoneScope. Thin delegation to openDatabaseByWorkspace().
+ */
+export function openDatabaseByScope(scope) {
+    return openDatabaseByWorkspace(scope.workspace);
+}
+/**
+ * Close the database connection for the given workspace and remove it from
+ * the cache. If the workspace's connection is currently active (currentDb),
+ * performs a full closeDatabase() including WAL checkpoint. Otherwise only
+ * removes the cache entry (the adapter was already replaced by a later open).
+ */
+export function closeDatabaseByWorkspace(workspace) {
+    const key = workspace.identityKey;
+    const cached = _dbCache.get(key);
+    if (!cached)
+        return;
+    _dbCache.delete(key);
+    if (currentDb === cached.db) {
+        // This workspace's connection is the active one — full close.
+        closeDatabase();
+    }
+    else {
+        // Connection was displaced by a later open; close the adapter directly.
+        try {
+            cached.db.exec("PRAGMA wal_checkpoint(TRUNCATE)");
+        }
+        catch (e) {
+            logWarning("db", `WAL checkpoint (byWorkspace) failed: ${e.message}`);
+        }
+        try {
+            cached.db.exec("PRAGMA incremental_vacuum(64)");
+        }
+        catch (e) {
+            logWarning("db", `incremental vacuum (byWorkspace) failed: ${e.message}`);
+        }
+        try {
+            cached.db.close();
+        }
+        catch (e) {
+            logWarning("db", `database close (byWorkspace) failed: ${e.message}`);
+        }
+    }
+}
 export function getDbProvider() {
     loadProvider();
     return providerName;
@@ -1300,6 +1636,13 @@ export function closeDatabase() {
         catch (e) {
             logWarning("db", `database close failed: ${e.message}`);
         }
+        // If this connection was workspace-tracked, evict it from the cache so
+        // subsequent openDatabaseByWorkspace() calls re-open rather than reactivate
+        // a closed adapter.
+        if (_currentIdentityKey !== null) {
+            _dbCache.delete(_currentIdentityKey);
+            _currentIdentityKey = null;
+        }
         currentDb = null;
         currentPath = null;
         currentPid = 0;
@@ -2682,6 +3025,7 @@ export function deleteMilestone(milestoneId) {
         currentDb.prepare(`DELETE FROM replan_history WHERE milestone_id = :mid`).run({ ":mid": milestoneId });
         currentDb.prepare(`DELETE FROM assessments WHERE milestone_id = :mid`).run({ ":mid": milestoneId });
         currentDb.prepare(`DELETE FROM artifacts WHERE milestone_id = :mid`).run({ ":mid": milestoneId });
+        currentDb.prepare(`DELETE FROM milestone_leases WHERE milestone_id = :mid`).run({ ":mid": milestoneId });
         currentDb.prepare(`DELETE FROM milestones WHERE id = :mid`).run({ ":mid": milestoneId });
     });
 }
@@ -2996,15 +3340,21 @@ export function deleteArtifactByPath(path) {
     currentDb.prepare("DELETE FROM artifacts WHERE path = :path").run({ ":path": path });
 }
 /**
- * Drop all rows from tasks/slices/milestones in dependency order inside a
- * transaction. Used by `gsd recover` to rebuild engine state from markdown.
+ * Drop hierarchy rows in dependency order inside a transaction. Used by
+ * `gsd recover` to rebuild engine state from markdown.
  */
 export function clearEngineHierarchy() {
     if (!currentDb)
         throw new GSDError(GSD_STALE_STATE, "gsd-db: No database open");
     transaction(() => {
+        currentDb.exec("DELETE FROM verification_evidence");
+        currentDb.exec("DELETE FROM quality_gates");
+        currentDb.exec("DELETE FROM slice_dependencies");
+        currentDb.exec("DELETE FROM assessments");
+        currentDb.exec("DELETE FROM replan_history");
         currentDb.exec("DELETE FROM tasks");
         currentDb.exec("DELETE FROM slices");
+        currentDb.exec("DELETE FROM milestone_leases");
         currentDb.exec("DELETE FROM milestones");
     });
 }
@@ -3087,6 +3437,7 @@ export function restoreManifest(manifest) {
         db.exec("DELETE FROM verification_evidence");
         db.exec("DELETE FROM tasks");
         db.exec("DELETE FROM slices");
+        db.exec("DELETE FROM milestone_leases");
         db.exec("DELETE FROM milestones");
         db.exec("DELETE FROM decisions WHERE 1=1");
         // Restore milestones
@@ -3149,6 +3500,7 @@ export function bulkInsertLegacyHierarchy(payload) {
     transaction(() => {
         db.prepare(`DELETE FROM tasks WHERE milestone_id IN (${placeholders})`).run(...clearMilestoneIds);
         db.prepare(`DELETE FROM slices WHERE milestone_id IN (${placeholders})`).run(...clearMilestoneIds);
+        db.prepare(`DELETE FROM milestone_leases WHERE milestone_id IN (${placeholders})`).run(...clearMilestoneIds);
         db.prepare(`DELETE FROM milestones WHERE id IN (${placeholders})`).run(...clearMilestoneIds);
         const insertMilestone = db.prepare("INSERT INTO milestones (id, title, status, created_at) VALUES (?, ?, ?, ?)");
         for (const m of milestones) {

package/dist/resources/extensions/gsd/guided-flow-queue.js

@@ -150,7 +150,7 @@ export async function showQueueAdd(ctx, pi, basePath, state) {
     ].join(" ");
     // ── Dispatch the queue prompt ───────────────────────────────────────
     // Activate the queue phase so the write-gate applies to CONTEXT.md writes
-    setQueuePhaseActive(true);
+    setQueuePhaseActive(true, basePath);
     const queueInlinedTemplates = inlineTemplate("context", "Context");
     const prompt = loadPrompt("queue", {
         preamble,