@opengsd/gsd-pi 1.2.0-dev.955e4da0 → 1.2.0-dev.d6c5343c

package/src/resources/extensions/gsd/auto/detect-stuck.ts

@@ -5,6 +5,7 @@
  */
 
 import type { WindowEntry } from "./types.js";
+import { parseDispatchKey } from "./dispatch-key.js";
 import { summarizeLogs } from "../workflow-logger.js";
 import { getLatestForUnit } from "../db/unit-dispatches.js";
 
@@ -15,6 +16,15 @@ import { getLatestForUnit } from "../db/unit-dispatches.js";
  */
 const ENOENT_PATH_RE = /ENOENT[^']*'([^']+)'/;
 
+function rowInsideRetryBudget(row: ReturnType<typeof getLatestForUnit>): boolean {
+  if (!row) return false;
+  if (row.attempt_n >= row.max_attempts) return false;
+  if (!row.next_run_at) return false;
+  const nextRun = Date.parse(row.next_run_at);
+  if (!Number.isFinite(nextRun)) return false;
+  return nextRun > Date.now();
+}
+
 /**
  * Phase B / codex review MEDIUM B3 — retry coupling.
  *
@@ -24,19 +34,26 @@ const ENOENT_PATH_RE = /ENOENT[^']*'([^']+)'/;
  * waiting on its own backoff. Suppress the stuck verdict in that case so
  * the retry budget can fully drain before we declare stuck.
  *
+ * Window keys are compound (`unitType:unitId`, legacy `unitType/unitId`)
+ * while the production dispatch ledger keys rows by the bare unit id with
+ * the unit type in its own column. Look the bare unit id up first (with a
+ * unit_type match — the production shape), then fall back to the full
+ * compound key (test fixtures / legacy rows).
+ *
  * Returns true if the dispatch ledger says we should suppress the stuck
  * signal; false (no suppression) when the ledger is unavailable or has
  * no opinion.
  */
 function retryBudgetSuppresses(unitKey: string): boolean {
   try {
-    const latest = getLatestForUnit(unitKey);
-    if (!latest) return false;
-    if (latest.attempt_n >= latest.max_attempts) return false;
-    if (!latest.next_run_at) return false;
-    const nextRun = Date.parse(latest.next_run_at);
-    if (!Number.isFinite(nextRun)) return false;
-    return nextRun > Date.now();
+    const parsed = parseDispatchKey(unitKey);
+    if (parsed) {
+      const bare = getLatestForUnit(parsed.unitId);
+      if (bare && bare.unit_type === parsed.unitType && rowInsideRetryBudget(bare)) {
+        return true;
+      }
+    }
+    return rowInsideRetryBudget(getLatestForUnit(unitKey));
   } catch {
     return false;
   }
@@ -71,6 +88,12 @@ export function detectStuck(
   const last = window[window.length - 1];
   const prev = window[window.length - 2];
 
+  // Rules 2 and 2b share one retry-budget verdict for `last.key` — compute it
+  // at most once per invocation (it hits the dispatch ledger).
+  let suppressionVerdict: boolean | undefined;
+  const suppressed = (): boolean =>
+    (suppressionVerdict ??= retryBudgetSuppresses(last.key));
+
   // Rule 1: Same error repeated consecutively
   if (last.error && prev.error && last.error === prev.error) {
     return {
@@ -83,7 +106,7 @@ export function detectStuck(
   // says we're inside the retry-backoff window (codex MEDIUM B3).
   if (window.length >= 3) {
     const lastThree = window.slice(-3);
-    if (lastThree.every((u) => u.key === last.key) && !retryBudgetSuppresses(last.key)) {
+    if (lastThree.every((u) => u.key === last.key) && !suppressed()) {
       return {
         stuck: true,
         reason: `${last.key} derived 3 consecutive times without progress${suffix}`,
@@ -94,7 +117,7 @@ export function detectStuck(
   // Rule 2b: Same unit key 3+ times anywhere in the active window — same
   // retry-budget suppression as Rule 2.
   const countInWindow = window.filter((entry) => entry.key === last.key).length;
-  if (countInWindow >= 3 && !retryBudgetSuppresses(last.key)) {
+  if (countInWindow >= 3 && !suppressed()) {
     return {
       stuck: true,
       reason: `${last.key} derived ${countInWindow} times in last ${window.length} attempts without progress${suffix}`,

package/src/resources/extensions/gsd/auto/dispatch-history.ts

@@ -0,0 +1,152 @@
+// Project/App: gsd-pi
+// File Purpose: Dispatch History module — the single home for the auto
+// orchestrator's dispatch-decision window, cross-session rehydration, and
+// stuck detection (#482 / #442 deepening).
+/**
+ * auto/dispatch-history.ts — Dispatch History module.
+ *
+ * Owns the sliding window of recent dispatch decisions that the Auto
+ * Orchestration module consults for idempotency and stuck-loop detection.
+ *
+ * Before this module existed the orchestrator kept a private in-memory
+ * `dispatchKeyWindow: string[]` that was reset to `[]` in start()/resume().
+ * Because a fresh orchestrator is constructed per session, the window never
+ * saw dispatches from a previous session — a unit could be re-dispatched
+ * across session restarts indefinitely (issue #482: 146 re-dispatches of the
+ * same unit). This module rehydrates the window from the DB dispatch ledger
+ * (`unit_dispatches`, via getRecentUnitKeysForProjectRoot) so stuck detection
+ * survives process restarts, and it delegates the verdict to the full
+ * detect-stuck rule set (repeat-error / consecutive / oscillation / ENOENT,
+ * with retry-budget suppression) instead of the bare saturation count.
+ *
+ * Key format: the canonical dispatch key is `${unitType}:${unitId}`
+ * (e.g. "execute-task:M001/S01/T01"). The legacy auto/phases.ts path and the
+ * DB rehydration helper use `${unitType}/${unitId}`; normalizeDispatchKey
+ * converts those on rehydrate so one format lives in the window. The key
+ * grammar itself lives in auto/dispatch-key.ts and is re-exported here for
+ * import stability.
+ */
+
+import type { WindowEntry } from "./types.js";
+import { buildDispatchKey, normalizeDispatchKey } from "./dispatch-key.js";
+import { detectStuck } from "./detect-stuck.js";
+import {
+  getLatestForUnit,
+  getRecentUnitKeysForProjectRoot,
+} from "../db/unit-dispatches.js";
+import { debugLog } from "../debug-logger.js";
+
+export { buildDispatchKey, normalizeDispatchKey, parseDispatchKey } from "./dispatch-key.js";
+
+/**
+ * Size of the dispatch-decision ring buffer. Mirrors the legacy
+ * `STUCK_WINDOW_SIZE` in auto/phases.ts so behaviour is preserved across the
+ * cutover (issue #5791).
+ */
+export const STUCK_WINDOW_SIZE = 6;
+
+export interface DispatchHistory {
+  /**
+   * Record a dispatch decision in the window (evicting oldest-first past the
+   * window size). When the window already holds an entry for the same unit,
+   * attaches the latest ledger error summary so the repeat-error and ENOENT
+   * stuck rules can fire; first-time dispatches (the common case) skip the
+   * ledger lookup entirely. Returns the canonical key.
+   */
+  recordDispatch(unitType: string, unitId: string): string;
+  /** Read-only view of the current window, oldest-first. */
+  getRecentWindow(): readonly WindowEntry[];
+  /** Number of window entries matching the given canonical key. */
+  countMatching(key: string): number;
+  /**
+   * Run the full detect-stuck rule set over the window (all four rules plus
+   * retry-budget suppression via the dispatch ledger).
+   */
+  detectStuck(): { stuck: true; reason: string } | null;
+  /**
+   * Seed the window from the DB dispatch ledger (cross-session continuity,
+   * #482). Legacy `${unitType}/${unitId}` keys are normalized. Degrades to a
+   * no-op when the ledger is unavailable. Returns the number of entries
+   * rehydrated.
+   */
+  rehydrate(): number;
+  /** Clear the window after a successful stuck recovery (or hard stop). */
+  clearOnRecovery(): void;
+}
+
+export interface DispatchHistoryOptions {
+  /**
+   * Stable project scope used to rehydrate from the dispatch ledger. Resolved
+   * lazily so worktree adoption after construction is respected. Return
+   * null/empty to skip rehydration.
+   */
+  resolveScopeId: () => string | null;
+  windowSize?: number;
+}
+
+function lookupLatestLedgerError(unitType: string, unitId: string): string | undefined {
+  try {
+    const row = getLatestForUnit(unitId);
+    // The ledger keys rows by bare unit id; require a unit_type match so
+    // another unit type's error on the same id is never attached (it would
+    // trip the repeat-error rule spuriously).
+    if (!row || row.unit_type !== unitType) return undefined;
+    return row.error_summary ?? undefined;
+  } catch {
+    return undefined;
+  }
+}
+
+export function createDispatchHistory(options: DispatchHistoryOptions): DispatchHistory {
+  const windowSize = options.windowSize ?? STUCK_WINDOW_SIZE;
+  let window: WindowEntry[] = [];
+
+  return {
+    recordDispatch(unitType: string, unitId: string): string {
+      const key = buildDispatchKey(unitType, unitId);
+      // Ledger errors only feed the repeat-error/ENOENT rules, which need a
+      // prior occurrence of the same unit in the window — first-dispatch
+      // advances (the common case) pay zero DB cost.
+      const error = window.some((entry) => entry.key === key)
+        ? lookupLatestLedgerError(unitType, unitId)
+        : undefined;
+      window.push({ key, error });
+      while (window.length > windowSize) window.shift();
+      return key;
+    },
+
+    getRecentWindow(): readonly WindowEntry[] {
+      return window;
+    },
+
+    countMatching(key: string): number {
+      return window.filter((entry) => entry.key === key).length;
+    },
+
+    detectStuck(): { stuck: true; reason: string } | null {
+      return detectStuck(window);
+    },
+
+    rehydrate(): number {
+      const scopeId = options.resolveScopeId();
+      if (!scopeId) return 0;
+      try {
+        const persisted = getRecentUnitKeysForProjectRoot(scopeId, windowSize);
+        if (persisted.length === 0) return 0;
+        window = persisted.map(({ key }) => ({ key: normalizeDispatchKey(key) }));
+        while (window.length > windowSize) window.shift();
+        return window.length;
+      } catch (err) {
+        debugLog("dispatchHistory", {
+          phase: "rehydrate-failed",
+          error: err instanceof Error ? err.message : String(err),
+        });
+        return 0;
+      }
+    },
+
+    clearOnRecovery(): void {
+      window = [];
+    },
+  };
+}

package/src/resources/extensions/gsd/auto/dispatch-key.ts

@@ -0,0 +1,39 @@
+// Project/App: gsd-pi
+// File Purpose: Dispatch-key grammar — the single home for building, parsing,
+// and normalizing the auto orchestrator's dispatch keys.
+/**
+ * auto/dispatch-key.ts — Dispatch-key grammar.
+ *
+ * Canonical key: `${unitType}:${unitId}` (e.g. "execute-task:M001/S01/T01").
+ * Legacy key: `${unitType}/${unitId}` (auto/phases.ts, DB rehydration). Unit
+ * ids themselves contain "/" (M001/S01/T01) — the first segment is the unit
+ * type.
+ *
+ * Leaf node in the import DAG: both dispatch-history.ts and detect-stuck.ts
+ * consume this grammar, so it lives below them.
+ */
+
+/** Build the canonical dispatch key for a unit. One format, one home. */
+export function buildDispatchKey(unitType: string, unitId: string): string {
+  return `${unitType}:${unitId}`;
+}
+
+/** Split a canonical or legacy dispatch key into its unit type and id. */
+export function parseDispatchKey(key: string): { unitType: string; unitId: string } | null {
+  const colon = key.indexOf(":");
+  if (colon > 0) {
+    return { unitType: key.slice(0, colon), unitId: key.slice(colon + 1) };
+  }
+  const slash = key.indexOf("/");
+  if (slash > 0) {
+    return { unitType: key.slice(0, slash), unitId: key.slice(slash + 1) };
+  }
+  return null;
+}
+
+/** Normalize a legacy `${unitType}/${unitId}` key to the canonical format. */
+export function normalizeDispatchKey(key: string): string {
+  if (key.includes(":")) return key;
+  const parsed = parseDispatchKey(key);
+  return parsed ? buildDispatchKey(parsed.unitType, parsed.unitId) : key;
+}

package/src/resources/extensions/gsd/auto/loop.ts

@@ -25,7 +25,8 @@ import {
   type IterationData,
 } from "./types.js";
 import { _clearCurrentResolve } from "./resolve.js";
-import { runGuards, runFinalize, STUCK_WINDOW_SIZE } from "./phases.js";
+import { runGuards, runFinalize } from "./phases.js";
+import { STUCK_WINDOW_SIZE } from "./dispatch-history.js";
 import { debugLog } from "../debug-logger.js";
 import { isInfrastructureError, isTransientCooldownError, getCooldownRetryAfterMs, COOLDOWN_FALLBACK_WAIT_MS, MAX_COOLDOWN_RETRIES } from "./infra-errors.js";
 import { ModelPolicyDispatchBlockedError } from "../auto-model-selection.js";
@@ -389,6 +390,8 @@ export async function autoLoop(
   const unitDispatchDeps = createExecutionGraphUnitDispatchDeps();
   // Load persisted stuck state so counters survive session restarts (#3704)
   const persisted = loadStuckState(s);
+  // Load persisted verification retry state so the exhausted-unit guard fires on restart (#651)
+  hydrateCustomVerifyRetryCounts(s, { logFailure: logCustomVerifyRetryLoadFailure });
   const loopState: LoopState = {
     recentUnits: persisted.recentUnits,
     stuckRecoveryAttempts: persisted.stuckRecoveryAttempts,

package/src/resources/extensions/gsd/auto/orchestrator.ts

@@ -64,6 +64,13 @@ import {
 import { refreshWorkflowDatabaseFromDisk } from "../db-workspace.js";
 import { getErrorMessage } from "../error-utils.js";
 import { logWarning } from "../workflow-logger.js";
+import { normalizeRealPath } from "../paths.js";
+import {
+  buildDispatchKey,
+  createDispatchHistory,
+  STUCK_WINDOW_SIZE,
+  type DispatchHistory,
+} from "./dispatch-history.js";
 import { existsSync, readFileSync } from "node:fs";
 import { join } from "node:path";
 import { evaluateAllCompleteSettlement } from "../milestone-settlement.js";
@@ -72,16 +79,6 @@ function now(): number {
   return Date.now();
 }
 
-/**
- * Size of the dispatch-decision ring buffer used by the Auto Orchestration
- * module's stuck-loop detector. When the same `${unitType}:${unitId}` key
- * fills the window, advance() blocks with `action: "stop"`.
- *
- * Mirrors the legacy `STUCK_WINDOW_SIZE` in auto/phases.ts so behaviour is
- * preserved across the eventual cutover (issue #5791).
- */
-export const STUCK_WINDOW_SIZE = 6;
-
 function noRemainingUnitsOutcome(stateSnapshot: GSDState): AutoTerminalOutcome {
   if (stateSnapshot.phase === "complete") {
     return {
@@ -330,7 +327,9 @@ export class AutoOrchestrator implements AutoOrchestrationModule {
   private seq = 0;
   private lastAdvanceKey: string | null = null;
   private lastFinalizedUnitKey: string | null = null;
-  private dispatchKeyWindow: string[] = [];
+  // Dispatch History module (#482): the dispatch-decision window with
+  // cross-session DB rehydration and full detect-stuck rules.
+  private readonly dispatchHistory: DispatchHistory;
   // ADR-030 Phase Transition Invariant: the prior advance's reconciled Phase,
   // the "from" endpoint of the edge check. In-memory; reset on start/resume/stop
   // so the first advance of a session has no edge to assert.
@@ -347,6 +346,16 @@ export class AutoOrchestrator implements AutoOrchestrationModule {
     this.runtimeBasePath = context.runtimeBasePath;
     this.s = context.session;
     this.flowId = `auto-orchestrator-${Date.now()}`;
+    this.dispatchHistory = createDispatchHistory({
+      windowSize: STUCK_WINDOW_SIZE,
+      // Same stable scope the auto-loop uses for stuck-state persistence so
+      // rehydration reads the rows the dispatch ledger wrote for this project.
+      resolveScopeId: () =>
+        normalizeRealPath(
+          this.s.scope?.workspace.projectRoot ??
+            (this.s.originalBasePath || this.s.basePath || this.runtimeBasePath),
+        ) || null,
+    });
   }
 
   // ── Live base-path resolution (was the wiring factory's getLiveDispatchBasePath) ──
@@ -765,7 +774,7 @@ export class AutoOrchestrator implements AutoOrchestrationModule {
    * skipped result) instead of stopping.
    */
   private tryStuckArtifactRecovery(unitType: string, unitId: string): boolean {
-    const key = `${unitType}:${unitId}`;
+    const key = buildDispatchKey(unitType, unitId);
     if (this.lastStuckRecoveryKey === key) return false; // already tried this episode
     const basePath = this.getLiveDispatchBasePath();
     if (!verifyExpectedArtifact(unitType, unitId, basePath)) return false;
@@ -777,7 +786,7 @@ export class AutoOrchestrator implements AutoOrchestrationModule {
     if (!refreshed.ok && refreshed.fatal) return false;
     this.lastStuckRecoveryKey = key;
     invalidateAllCaches();
-    this.dispatchKeyWindow = [];
+    this.dispatchHistory.clearOnRecovery();
     this.lastAdvanceKey = null;
     this.lastFinalizedUnitKey = null;
     return true;
@@ -808,7 +817,12 @@ export class AutoOrchestrator implements AutoOrchestrationModule {
   public async start(_sessionContext: AutoSessionContext): Promise<AutoAdvanceResult> {
     this.lastAdvanceKey = null;
     this.lastFinalizedUnitKey = null;
-    this.dispatchKeyWindow = [];
+    // #482: the DB dispatch ledger is the source of truth across sessions.
+    // Discard any in-memory window and rebuild it from the ledger so a unit
+    // that was re-dispatched in previous sessions is detected as stuck here
+    // instead of silently re-dispatching forever.
+    this.dispatchHistory.clearOnRecovery();
+    this.dispatchHistory.rehydrate();
     this.lastStuckRecoveryKey = null;
     this.lastDerivedPhase = null;
     this.status.phase = "running";
@@ -913,7 +927,7 @@ export class AutoOrchestrator implements AutoOrchestrationModule {
           this.status.phase = "paused";
           this.status.activeUnit = undefined;
           this.lastAdvanceKey = null;
-          this.dispatchKeyWindow = [];
+          this.dispatchHistory.clearOnRecovery();
           this.bumpTransition();
           this.journalTransition({ name: "advance-blocked", reason: settlementBlock.reason });
           this.postAdvanceRecord(settlementBlock);
@@ -929,7 +943,7 @@ export class AutoOrchestrator implements AutoOrchestrationModule {
         this.status.phase = "stopped";
         this.status.activeUnit = undefined;
         this.lastAdvanceKey = null;
-        this.dispatchKeyWindow = [];
+        this.dispatchHistory.clearOnRecovery();
         this.bumpTransition();
         this.journalTransition({ name: "advance-stopped", reason: stopped.reason });
         this.postAdvanceRecord(stopped);
@@ -979,18 +993,13 @@ export class AutoOrchestrator implements AutoOrchestrationModule {
         return blocked;
       }
 
-      const nextKey = `${decision.unitType}:${decision.unitId}`;
-
-      // Record every dispatch decision in the ring buffer before pre-flight
+      // Record every dispatch decision in the history window before pre-flight
       // checks so the stuck-loop detector observes the full decision history
       // (including decisions that idempotency would otherwise short-circuit).
-      // The ring is capped at STUCK_WINDOW_SIZE and evicts oldest-first.
-      this.dispatchKeyWindow.push(nextKey);
-      if (this.dispatchKeyWindow.length > STUCK_WINDOW_SIZE) {
-        this.dispatchKeyWindow.shift();
-      }
+      // The window is capped at STUCK_WINDOW_SIZE and evicts oldest-first.
+      const nextKey = this.dispatchHistory.recordDispatch(decision.unitType, decision.unitId);
 
-      const matchingCount = this.dispatchKeyWindow.filter((k) => k === nextKey).length;
+      const matchingCount = this.dispatchHistory.countMatching(nextKey);
       if (this.lastFinalizedUnitKey === nextKey) {
         // #442: the unit re-dispatched immediately after finalizing may have
         // actually completed on disk with a stale DB. Verify + recover before
@@ -1023,23 +1032,32 @@ export class AutoOrchestrator implements AutoOrchestrationModule {
       // checks coexist: idempotency for the common immediate-repeat case,
       // stuck-loop for the saturated-window case.
       if (this.lastAdvanceKey === nextKey && matchingCount < STUCK_WINDOW_SIZE) {
+        // Unit already active — benign no-op. Return skipped so the loop re-polls
+        // without cancelling the in-flight unit (blocked+pause would force-cancel it).
         this.clearPendingDispatch();
-        const blocked: AutoAdvanceResult = { kind: "blocked", reason: "idempotent advance: unit already active", action: "pause" };
+        const skipped: AutoAdvanceResult = { kind: "skipped", reason: "idempotent advance: unit already active" };
         this.journalTransition({
-          name: "advance-blocked",
-          reason: blocked.reason,
+          name: "advance-skipped",
+          reason: skipped.reason,
           unitType: decision.unitType,
           unitId: decision.unitId,
         });
-        this.postAdvanceRecord(blocked);
-        return blocked;
+        this.postAdvanceRecord(skipped);
+        return skipped;
       }
 
-      // Stuck-loop detection: when the ring is saturated with copies of
-      // `nextKey` (count >= STUCK_WINDOW_SIZE), the orchestrator has been
-      // picking the same unit across the whole window and must hard-stop with
-      // a diagnosable reason.
-      if (matchingCount >= STUCK_WINDOW_SIZE) {
+      // Stuck-loop detection: when the window is saturated with copies of
+      // `nextKey` (count >= STUCK_WINDOW_SIZE), consult the Dispatch History
+      // module's full detect-stuck rule set for the verdict instead of the old
+      // bare saturation count. This keeps the saturation threshold (the window
+      // deliberately records benign idempotent repeats, so earlier-firing
+      // rules would false-positive on pause/resume re-advances) while gaining
+      // retry-budget suppression and diagnosable rule reasons. A saturated
+      // window with no verdict means the dispatch ledger says we are inside
+      // the unit's retry-backoff budget — let the retry proceed.
+      const stuckVerdict =
+        matchingCount >= STUCK_WINDOW_SIZE ? this.dispatchHistory.detectStuck() : null;
+      if (stuckVerdict) {
         // #442: before declaring a stuck loop, verify the unit didn't actually
         // complete on disk (stale DB) and recover if so — legacy graduated
         // stuck-recovery parity. Otherwise hard-stop with a diagnosable reason.
@@ -1050,7 +1068,7 @@ export class AutoOrchestrator implements AutoOrchestrationModule {
         this.clearPendingDispatch();
         const blocked: AutoAdvanceResult = {
           kind: "blocked",
-          reason: `stuck-loop: ${nextKey} picked ${matchingCount} times`,
+          reason: `stuck-loop: ${stuckVerdict.reason}`,
           action: "stop",
         };
         this.journalTransition({
@@ -1144,7 +1162,7 @@ export class AutoOrchestrator implements AutoOrchestrationModule {
       if (result.kind === "stopped") {
         this.lastAdvanceKey = null;
         this.lastFinalizedUnitKey = null;
-        this.dispatchKeyWindow = [];
+        this.dispatchHistory.clearOnRecovery();
         this.status.activeUnit = undefined;
       }
       this.bumpTransition();
@@ -1173,8 +1191,14 @@ export class AutoOrchestrator implements AutoOrchestrationModule {
   public async resume(): Promise<AutoAdvanceResult> {
     this.lastAdvanceKey = null;
     this.lastFinalizedUnitKey = null;
-    // Preserve dispatchKeyWindow across resume so stuck-loop detection
-    // accumulates across pause/resume cycles rather than resetting each time.
+    // Preserve the dispatch-history window across an in-process resume so
+    // stuck-loop detection accumulates across pause/resume cycles rather than
+    // resetting each time (#572 regression). When the window is empty (fresh
+    // orchestrator resuming a prior session), rehydrate it from the DB
+    // dispatch ledger so cross-session re-dispatch loops are detected (#482).
+    if (this.dispatchHistory.getRecentWindow().length === 0) {
+      this.dispatchHistory.rehydrate();
+    }
     this.lastStuckRecoveryKey = null;
     // ADR-030: drop the prior "from" — the first advance after resume has no
     // edge to assert (avoids a false illegal-edge across the pause boundary).
@@ -1196,10 +1220,10 @@ export class AutoOrchestrator implements AutoOrchestrationModule {
     this.lastAdvanceKey = null;
     this.lastFinalizedUnitKey = null;
     this.lastDerivedPhase = null;
-    // Preserve dispatchKeyWindow on pause so stuck-loop detection accumulates
-    // across pause/resume cycles. Only clear on a hard stop.
+    // Preserve the dispatch-history window on pause so stuck-loop detection
+    // accumulates across pause/resume cycles. Only clear on a hard stop.
     if (reason !== "pause") {
-      this.dispatchKeyWindow = [];
+      this.dispatchHistory.clearOnRecovery();
     }
     this.lastStuckRecoveryKey = null;
     this.bumpTransition();
@@ -1213,9 +1237,9 @@ export class AutoOrchestrator implements AutoOrchestrationModule {
   }
 
   public async completeActiveUnit(unit: { unitType: string; unitId: string }): Promise<void> {
-    const unitKey = `${unit.unitType}:${unit.unitId}`;
+    const unitKey = buildDispatchKey(unit.unitType, unit.unitId);
     const activeUnitKey = this.status.activeUnit
-      ? `${this.status.activeUnit.unitType}:${this.status.activeUnit.unitId}`
+      ? buildDispatchKey(this.status.activeUnit.unitType, this.status.activeUnit.unitId)
       : null;
     if (activeUnitKey !== unitKey) return;
 
@@ -1233,9 +1257,9 @@ export class AutoOrchestrator implements AutoOrchestrationModule {
   }
 
   public async retryActiveUnit(unit: { unitType: string; unitId: string }): Promise<void> {
-    const unitKey = `${unit.unitType}:${unit.unitId}`;
+    const unitKey = buildDispatchKey(unit.unitType, unit.unitId);
     const activeUnitKey = this.status.activeUnit
-      ? `${this.status.activeUnit.unitType}:${this.status.activeUnit.unitId}`
+      ? buildDispatchKey(this.status.activeUnit.unitType, this.status.activeUnit.unitId)
       : null;
     if (activeUnitKey !== unitKey && this.lastFinalizedUnitKey !== unitKey) return;
 

package/src/resources/extensions/gsd/auto/phases.ts

@@ -19,7 +19,7 @@ import {
   type PostUnitContext,
   type PreVerificationOpts,
 } from "../auto-post-unit.js";
-import { lastAssistantText } from "../user-input-boundary.js";
+import { lastAssistantText } from "../consent-question.js";
 import { resolveEffectiveUnitIsolationMode } from "../preferences.js";
 import type { Phase } from "../types.js";
 import {
@@ -33,6 +33,7 @@ import {
   type IterationData,
 } from "./types.js";
 import { detectStuck } from "./detect-stuck.js";
+import { STUCK_WINDOW_SIZE } from "./dispatch-history.js";
 import { runUnit } from "./run-unit.js";
 import { debugLog } from "../debug-logger.js";
 import { resolveWorktreeProjectRoot, normalizeWorktreePathForCompare } from "../worktree-root.js";
@@ -107,7 +108,6 @@ import {
 } from "../root-write-leak-guard.js";
 import { classifyError, isTransient } from "../error-classifier.js";
 
-export const STUCK_WINDOW_SIZE = 6;
 const STUCK_RECOVERY_ATTEMPTS_KEY = "stuck_recovery_attempts";
 const ZERO_TOOL_PROVIDER_ERROR_PREFIX_RE =
   /^(?:api error(?::|$|\s*\()|provider error(?::|$|\s*\()|request failed\b|(?:http\s*)?(?:429|500|502|503)\b|\b(?:econnreset|etimedout|econnrefused|epipe)\b|socket hang up\b|fetch failed\b|(?:network|connection|server) error(?::|$)|connection (?:reset|refused)(?::|$|\s+by\b)|dns\b.*(?:fail|error|timeout)|unexpected eof\b|stream idle timeout\b|partial response received\b|stream_exhausted\b|terminated(?::|$)|(?:connection|stream|request)\b.{0,40}\bterminated\b|other side closed\b|rate.?limit(?:ed| exceeded| reached| error)|too many requests\b|you(?:'ve| have) (?:hit|reached) your (?:\w+ )?limit\b|.*\b(?:usage|session|weekly|daily|monthly|quota) limit\b|limit\b.{0,40}\bresets?\b|out of extra usage\b|service.?unavailable\b|internal(?: server)? error(?::|$)|internal(?:[_-]server)?[_-]error\b|server[_-]error\b|(?:provider|server|api|model|codex|claude|openai|anthropic|gemini)\b.{0,80}\boverloaded\b|overloaded\b.{0,80}\b(?:provider|server|api|model)\b|context (?:window|length) exceed|context window exceed)/i;

package/src/resources/extensions/gsd/auto-direct-dispatch.ts

@@ -10,10 +10,9 @@ import type {
 
 import { deriveState } from "./state.js";
 import { loadFile } from "./files.js";
-import { isDbAvailable, getMilestoneSlices } from "./gsd-db.js";
-import { parseRoadmap } from "./parsers-legacy.js";
+import { isDbAvailable, getClosedSliceIds } from "./gsd-db.js";
 import {
-  resolveMilestoneFile, resolveSliceFile, relSliceFile,
+  resolveSliceFile, relSliceFile,
 } from "./paths.js";
 import {
   buildResearchSlicePrompt,
@@ -182,21 +181,9 @@ export async function dispatchDirectPhase(
 
     case "reassess":
     case "reassess-roadmap": {
-      // DB primary path — get completed slices, fall back to file parsing when DB has no data
-      let completedSliceIds: string[] = [];
-      if (isDbAvailable()) {
-        completedSliceIds = getMilestoneSlices(mid).filter(s => s.status === "complete").map(s => s.id);
-      }
-      if (completedSliceIds.length === 0) {
-        // File-based fallback: parse roadmap checkboxes
-        const roadmapPath = resolveMilestoneFile(dispatchBase, mid, "ROADMAP");
-        if (roadmapPath) {
-          const roadmapContent = await loadFile(roadmapPath);
-          if (roadmapContent) {
-            completedSliceIds = parseRoadmap(roadmapContent).slices.filter(s => s.done).map(s => s.id);
-          }
-        }
-      }
+      // DB-authoritative read (ADR-017) — markdown projections are never
+      // consulted for dispatch decisions. No DB rows means no completed slices.
+      const completedSliceIds = isDbAvailable() ? getClosedSliceIds(mid) : [];
       if (completedSliceIds.length === 0) {
         ctx.ui.notify("Cannot dispatch reassess-roadmap: no completed slices.", "warning");
         return;
@@ -222,20 +209,9 @@ export async function dispatchDirectPhase(
       // incomplete) slice. After slice completion, state.activeSlice advances
       // to the next incomplete slice, so we find the last done slice from the
       // roadmap instead (#1693).
-      let uatCompletedSliceIds: string[] = [];
-      if (isDbAvailable()) {
-        uatCompletedSliceIds = getMilestoneSlices(mid).filter(s => s.status === "complete").map(s => s.id);
-      }
-      if (uatCompletedSliceIds.length === 0) {
-        // File-based fallback: parse roadmap checkboxes
-        const roadmapPath = resolveMilestoneFile(dispatchBase, mid, "ROADMAP");
-        if (roadmapPath) {
-          const roadmapContent = await loadFile(roadmapPath);
-          if (roadmapContent) {
-            uatCompletedSliceIds = parseRoadmap(roadmapContent).slices.filter(s => s.done).map(s => s.id);
-          }
-        }
-      }
+      // DB-authoritative read (ADR-017) — no markdown fallback for dispatch
+      // decisions.
+      const uatCompletedSliceIds = isDbAvailable() ? getClosedSliceIds(mid) : [];
       if (uatCompletedSliceIds.length === 0) {
         ctx.ui.notify("Cannot dispatch run-uat: no completed slices.", "warning");
         return;