@opengsd/gsd-pi 1.2.0-dev.955e4da0 → 1.2.0-dev.d6c5343c

package/dist/resources/extensions/gsd/auto/orchestrator.js

@@ -42,21 +42,14 @@ import { isDbAvailable, getSlice, getTask, } from "../gsd-db.js";
 import { refreshWorkflowDatabaseFromDisk } from "../db-workspace.js";
 import { getErrorMessage } from "../error-utils.js";
 import { logWarning } from "../workflow-logger.js";
+import { normalizeRealPath } from "../paths.js";
+import { buildDispatchKey, createDispatchHistory, STUCK_WINDOW_SIZE, } from "./dispatch-history.js";
 import { existsSync, readFileSync } from "node:fs";
 import { join } from "node:path";
 import { evaluateAllCompleteSettlement } from "../milestone-settlement.js";
 function now() {
     return Date.now();
 }
-/**
- * Size of the dispatch-decision ring buffer used by the Auto Orchestration
- * module's stuck-loop detector. When the same `${unitType}:${unitId}` key
- * fills the window, advance() blocks with `action: "stop"`.
- *
- * Mirrors the legacy `STUCK_WINDOW_SIZE` in auto/phases.ts so behaviour is
- * preserved across the eventual cutover (issue #5791).
- */
-export const STUCK_WINDOW_SIZE = 6;
 function noRemainingUnitsOutcome(stateSnapshot) {
     if (stateSnapshot.phase === "complete") {
         return {
@@ -244,7 +237,9 @@ export class AutoOrchestrator {
     seq = 0;
     lastAdvanceKey = null;
     lastFinalizedUnitKey = null;
-    dispatchKeyWindow = [];
+    // Dispatch History module (#482): the dispatch-decision window with
+    // cross-session DB rehydration and full detect-stuck rules.
+    dispatchHistory;
     // ADR-030 Phase Transition Invariant: the prior advance's reconciled Phase,
     // the "from" endpoint of the edge check. In-memory; reset on start/resume/stop
     // so the first advance of a session has no edge to assert.
@@ -260,6 +255,13 @@ export class AutoOrchestrator {
         this.runtimeBasePath = context.runtimeBasePath;
         this.s = context.session;
         this.flowId = `auto-orchestrator-${Date.now()}`;
+        this.dispatchHistory = createDispatchHistory({
+            windowSize: STUCK_WINDOW_SIZE,
+            // Same stable scope the auto-loop uses for stuck-state persistence so
+            // rehydration reads the rows the dispatch ledger wrote for this project.
+            resolveScopeId: () => normalizeRealPath(this.s.scope?.workspace.projectRoot ??
+                (this.s.originalBasePath || this.s.basePath || this.runtimeBasePath)) || null,
+        });
     }
     // ── Live base-path resolution (was the wiring factory's getLiveDispatchBasePath) ──
     getLiveDispatchBasePath() {
@@ -612,7 +614,7 @@ export class AutoOrchestrator {
      * skipped result) instead of stopping.
      */
     tryStuckArtifactRecovery(unitType, unitId) {
-        const key = `${unitType}:${unitId}`;
+        const key = buildDispatchKey(unitType, unitId);
         if (this.lastStuckRecoveryKey === key)
             return false; // already tried this episode
         const basePath = this.getLiveDispatchBasePath();
@@ -627,7 +629,7 @@ export class AutoOrchestrator {
             return false;
         this.lastStuckRecoveryKey = key;
         invalidateAllCaches();
-        this.dispatchKeyWindow = [];
+        this.dispatchHistory.clearOnRecovery();
         this.lastAdvanceKey = null;
         this.lastFinalizedUnitKey = null;
         return true;
@@ -653,7 +655,12 @@ export class AutoOrchestrator {
     async start(_sessionContext) {
         this.lastAdvanceKey = null;
         this.lastFinalizedUnitKey = null;
-        this.dispatchKeyWindow = [];
+        // #482: the DB dispatch ledger is the source of truth across sessions.
+        // Discard any in-memory window and rebuild it from the ledger so a unit
+        // that was re-dispatched in previous sessions is detected as stuck here
+        // instead of silently re-dispatching forever.
+        this.dispatchHistory.clearOnRecovery();
+        this.dispatchHistory.rehydrate();
         this.lastStuckRecoveryKey = null;
         this.lastDerivedPhase = null;
         this.status.phase = "running";
@@ -753,7 +760,7 @@ export class AutoOrchestrator {
                     this.status.phase = "paused";
                     this.status.activeUnit = undefined;
                     this.lastAdvanceKey = null;
-                    this.dispatchKeyWindow = [];
+                    this.dispatchHistory.clearOnRecovery();
                     this.bumpTransition();
                     this.journalTransition({ name: "advance-blocked", reason: settlementBlock.reason });
                     this.postAdvanceRecord(settlementBlock);
@@ -769,7 +776,7 @@ export class AutoOrchestrator {
                 this.status.phase = "stopped";
                 this.status.activeUnit = undefined;
                 this.lastAdvanceKey = null;
-                this.dispatchKeyWindow = [];
+                this.dispatchHistory.clearOnRecovery();
                 this.bumpTransition();
                 this.journalTransition({ name: "advance-stopped", reason: stopped.reason });
                 this.postAdvanceRecord(stopped);
@@ -817,16 +824,12 @@ export class AutoOrchestrator {
                 this.postAdvanceRecord(blocked);
                 return blocked;
             }
-            const nextKey = `${decision.unitType}:${decision.unitId}`;
-            // Record every dispatch decision in the ring buffer before pre-flight
+            // Record every dispatch decision in the history window before pre-flight
             // checks so the stuck-loop detector observes the full decision history
             // (including decisions that idempotency would otherwise short-circuit).
-            // The ring is capped at STUCK_WINDOW_SIZE and evicts oldest-first.
-            this.dispatchKeyWindow.push(nextKey);
-            if (this.dispatchKeyWindow.length > STUCK_WINDOW_SIZE) {
-                this.dispatchKeyWindow.shift();
-            }
-            const matchingCount = this.dispatchKeyWindow.filter((k) => k === nextKey).length;
+            // The window is capped at STUCK_WINDOW_SIZE and evicts oldest-first.
+            const nextKey = this.dispatchHistory.recordDispatch(decision.unitType, decision.unitId);
+            const matchingCount = this.dispatchHistory.countMatching(nextKey);
             if (this.lastFinalizedUnitKey === nextKey) {
                 // #442: the unit re-dispatched immediately after finalizing may have
                 // actually completed on disk with a stale DB. Verify + recover before
@@ -858,22 +861,30 @@ export class AutoOrchestrator {
             // checks coexist: idempotency for the common immediate-repeat case,
             // stuck-loop for the saturated-window case.
             if (this.lastAdvanceKey === nextKey && matchingCount < STUCK_WINDOW_SIZE) {
+                // Unit already active — benign no-op. Return skipped so the loop re-polls
+                // without cancelling the in-flight unit (blocked+pause would force-cancel it).
                 this.clearPendingDispatch();
-                const blocked = { kind: "blocked", reason: "idempotent advance: unit already active", action: "pause" };
+                const skipped = { kind: "skipped", reason: "idempotent advance: unit already active" };
                 this.journalTransition({
-                    name: "advance-blocked",
-                    reason: blocked.reason,
+                    name: "advance-skipped",
+                    reason: skipped.reason,
                     unitType: decision.unitType,
                     unitId: decision.unitId,
                 });
-                this.postAdvanceRecord(blocked);
-                return blocked;
+                this.postAdvanceRecord(skipped);
+                return skipped;
             }
-            // Stuck-loop detection: when the ring is saturated with copies of
-            // `nextKey` (count >= STUCK_WINDOW_SIZE), the orchestrator has been
-            // picking the same unit across the whole window and must hard-stop with
-            // a diagnosable reason.
-            if (matchingCount >= STUCK_WINDOW_SIZE) {
+            // Stuck-loop detection: when the window is saturated with copies of
+            // `nextKey` (count >= STUCK_WINDOW_SIZE), consult the Dispatch History
+            // module's full detect-stuck rule set for the verdict instead of the old
+            // bare saturation count. This keeps the saturation threshold (the window
+            // deliberately records benign idempotent repeats, so earlier-firing
+            // rules would false-positive on pause/resume re-advances) while gaining
+            // retry-budget suppression and diagnosable rule reasons. A saturated
+            // window with no verdict means the dispatch ledger says we are inside
+            // the unit's retry-backoff budget — let the retry proceed.
+            const stuckVerdict = matchingCount >= STUCK_WINDOW_SIZE ? this.dispatchHistory.detectStuck() : null;
+            if (stuckVerdict) {
                 // #442: before declaring a stuck loop, verify the unit didn't actually
                 // complete on disk (stale DB) and recover if so — legacy graduated
                 // stuck-recovery parity. Otherwise hard-stop with a diagnosable reason.
@@ -884,7 +895,7 @@ export class AutoOrchestrator {
                 this.clearPendingDispatch();
                 const blocked = {
                     kind: "blocked",
-                    reason: `stuck-loop: ${nextKey} picked ${matchingCount} times`,
+                    reason: `stuck-loop: ${stuckVerdict.reason}`,
                     action: "stop",
                 };
                 this.journalTransition({
@@ -974,7 +985,7 @@ export class AutoOrchestrator {
             if (result.kind === "stopped") {
                 this.lastAdvanceKey = null;
                 this.lastFinalizedUnitKey = null;
-                this.dispatchKeyWindow = [];
+                this.dispatchHistory.clearOnRecovery();
                 this.status.activeUnit = undefined;
             }
             this.bumpTransition();
@@ -1003,8 +1014,14 @@ export class AutoOrchestrator {
     async resume() {
         this.lastAdvanceKey = null;
         this.lastFinalizedUnitKey = null;
-        // Preserve dispatchKeyWindow across resume so stuck-loop detection
-        // accumulates across pause/resume cycles rather than resetting each time.
+        // Preserve the dispatch-history window across an in-process resume so
+        // stuck-loop detection accumulates across pause/resume cycles rather than
+        // resetting each time (#572 regression). When the window is empty (fresh
+        // orchestrator resuming a prior session), rehydrate it from the DB
+        // dispatch ledger so cross-session re-dispatch loops are detected (#482).
+        if (this.dispatchHistory.getRecentWindow().length === 0) {
+            this.dispatchHistory.rehydrate();
+        }
         this.lastStuckRecoveryKey = null;
         // ADR-030: drop the prior "from" — the first advance after resume has no
         // edge to assert (avoids a false illegal-edge across the pause boundary).
@@ -1025,10 +1042,10 @@ export class AutoOrchestrator {
         this.lastAdvanceKey = null;
         this.lastFinalizedUnitKey = null;
         this.lastDerivedPhase = null;
-        // Preserve dispatchKeyWindow on pause so stuck-loop detection accumulates
-        // across pause/resume cycles. Only clear on a hard stop.
+        // Preserve the dispatch-history window on pause so stuck-loop detection
+        // accumulates across pause/resume cycles. Only clear on a hard stop.
         if (reason !== "pause") {
-            this.dispatchKeyWindow = [];
+            this.dispatchHistory.clearOnRecovery();
         }
         this.lastStuckRecoveryKey = null;
         this.bumpTransition();
@@ -1040,9 +1057,9 @@ export class AutoOrchestrator {
         return { ...this.status, activeUnit: this.status.activeUnit ? { ...this.status.activeUnit } : undefined };
     }
     async completeActiveUnit(unit) {
-        const unitKey = `${unit.unitType}:${unit.unitId}`;
+        const unitKey = buildDispatchKey(unit.unitType, unit.unitId);
         const activeUnitKey = this.status.activeUnit
-            ? `${this.status.activeUnit.unitType}:${this.status.activeUnit.unitId}`
+            ? buildDispatchKey(this.status.activeUnit.unitType, this.status.activeUnit.unitId)
             : null;
         if (activeUnitKey !== unitKey)
             return;
@@ -1059,9 +1076,9 @@ export class AutoOrchestrator {
         });
     }
     async retryActiveUnit(unit) {
-        const unitKey = `${unit.unitType}:${unit.unitId}`;
+        const unitKey = buildDispatchKey(unit.unitType, unit.unitId);
         const activeUnitKey = this.status.activeUnit
-            ? `${this.status.activeUnit.unitType}:${this.status.activeUnit.unitId}`
+            ? buildDispatchKey(this.status.activeUnit.unitType, this.status.activeUnit.unitId)
             : null;
         if (activeUnitKey !== unitKey && this.lastFinalizedUnitKey !== unitKey)
             return;

package/dist/resources/extensions/gsd/auto/phases.js

@@ -10,10 +10,11 @@
  */
 import { importExtensionModule } from "@gsd/pi-coding-agent";
 import { USER_DRIVEN_DEEP_UNITS, isAwaitingUserInput, } from "../auto-post-unit.js";
-import { lastAssistantText } from "../user-input-boundary.js";
+import { lastAssistantText } from "../consent-question.js";
 import { resolveEffectiveUnitIsolationMode } from "../preferences.js";
 import { MAX_RECOVERY_CHARS, BUDGET_THRESHOLDS, MAX_FINALIZE_TIMEOUTS, } from "./types.js";
 import { detectStuck } from "./detect-stuck.js";
+import { STUCK_WINDOW_SIZE } from "./dispatch-history.js";
 import { runUnit } from "./run-unit.js";
 import { debugLog } from "../debug-logger.js";
 import { resolveWorktreeProjectRoot, normalizeWorktreePathForCompare } from "../worktree-root.js";
@@ -60,7 +61,6 @@ import { buildPhaseHandoffOutcome, setAutoActiveStatus, setAutoOutcomeWidget } f
 import { getConsecutiveDispatchBlocker } from "../dispatch-guard.js";
 import { captureRootDirtySnapshot, detectRootWriteLeak, formatRootWriteLeakMessage, } from "../root-write-leak-guard.js";
 import { classifyError, isTransient } from "../error-classifier.js";
-export const STUCK_WINDOW_SIZE = 6;
 const STUCK_RECOVERY_ATTEMPTS_KEY = "stuck_recovery_attempts";
 const ZERO_TOOL_PROVIDER_ERROR_PREFIX_RE = /^(?:api error(?::|$|\s*\()|provider error(?::|$|\s*\()|request failed\b|(?:http\s*)?(?:429|500|502|503)\b|\b(?:econnreset|etimedout|econnrefused|epipe)\b|socket hang up\b|fetch failed\b|(?:network|connection|server) error(?::|$)|connection (?:reset|refused)(?::|$|\s+by\b)|dns\b.*(?:fail|error|timeout)|unexpected eof\b|stream idle timeout\b|partial response received\b|stream_exhausted\b|terminated(?::|$)|(?:connection|stream|request)\b.{0,40}\bterminated\b|other side closed\b|rate.?limit(?:ed| exceeded| reached| error)|too many requests\b|you(?:'ve| have) (?:hit|reached) your (?:\w+ )?limit\b|.*\b(?:usage|session|weekly|daily|monthly|quota) limit\b|limit\b.{0,40}\bresets?\b|out of extra usage\b|service.?unavailable\b|internal(?: server)? error(?::|$)|internal(?:[_-]server)?[_-]error\b|server[_-]error\b|(?:provider|server|api|model|codex|claude|openai|anthropic|gemini)\b.{0,80}\boverloaded\b|overloaded\b.{0,80}\b(?:provider|server|api|model)\b|context (?:window|length) exceed|context window exceed)/i;
 const ZERO_TOOL_PROVIDER_ERROR_SIGNAL_RE = /(?:\b(?:http|status(?: code)?|code|error:)\s*(?:429|500|502|503)\b|\b(?:api|provider) error\s*[:(]?\s*(?:429|500|502|503)\b|\b(?:typeerror|error):\s*(?:fetch failed\b|socket hang up\b|terminated(?::|$)|connection (?:reset|refused)(?::|$|\s+by\b)|(?:network|connection|server) error(?::|$)|stream idle timeout\b|partial response received\b|unexpected eof\b)|\b(?:server_error|api_error|stream_exhausted(?:_without_result)?)\b|\b(?:econnreset|etimedout|econnrefused|epipe)\b|context (?:window|length) exceed|context window exceed)/i;

package/dist/resources/extensions/gsd/auto-direct-dispatch.js

@@ -4,9 +4,8 @@
  */
 import { deriveState } from "./state.js";
 import { loadFile } from "./files.js";
-import { isDbAvailable, getMilestoneSlices } from "./gsd-db.js";
-import { parseRoadmap } from "./parsers-legacy.js";
-import { resolveMilestoneFile, resolveSliceFile, relSliceFile, } from "./paths.js";
+import { isDbAvailable, getClosedSliceIds } from "./gsd-db.js";
+import { resolveSliceFile, relSliceFile, } from "./paths.js";
 import { buildResearchSlicePrompt, buildResearchMilestonePrompt, buildPlanSlicePrompt, buildPlanMilestonePrompt, buildExecuteTaskPrompt, buildCompleteSlicePrompt, buildCompleteMilestonePrompt, buildValidateMilestonePrompt, buildReassessRoadmapPrompt, buildRunUatPrompt, buildReplanSlicePrompt, } from "./auto-prompts.js";
 import { loadEffectiveGSDPreferences } from "./preferences.js";
 import { pauseAuto } from "./auto.js";
@@ -135,21 +134,9 @@ export async function dispatchDirectPhase(ctx, pi, phase, base) {
         }
         case "reassess":
         case "reassess-roadmap": {
-            // DB primary path — get completed slices, fall back to file parsing when DB has no data
-            let completedSliceIds = [];
-            if (isDbAvailable()) {
-                completedSliceIds = getMilestoneSlices(mid).filter(s => s.status === "complete").map(s => s.id);
-            }
-            if (completedSliceIds.length === 0) {
-                // File-based fallback: parse roadmap checkboxes
-                const roadmapPath = resolveMilestoneFile(dispatchBase, mid, "ROADMAP");
-                if (roadmapPath) {
-                    const roadmapContent = await loadFile(roadmapPath);
-                    if (roadmapContent) {
-                        completedSliceIds = parseRoadmap(roadmapContent).slices.filter(s => s.done).map(s => s.id);
-                    }
-                }
-            }
+            // DB-authoritative read (ADR-017) — markdown projections are never
+            // consulted for dispatch decisions. No DB rows means no completed slices.
+            const completedSliceIds = isDbAvailable() ? getClosedSliceIds(mid) : [];
             if (completedSliceIds.length === 0) {
                 ctx.ui.notify("Cannot dispatch reassess-roadmap: no completed slices.", "warning");
                 return;
@@ -173,20 +160,9 @@ export async function dispatchDirectPhase(ctx, pi, phase, base) {
             // incomplete) slice. After slice completion, state.activeSlice advances
             // to the next incomplete slice, so we find the last done slice from the
             // roadmap instead (#1693).
-            let uatCompletedSliceIds = [];
-            if (isDbAvailable()) {
-                uatCompletedSliceIds = getMilestoneSlices(mid).filter(s => s.status === "complete").map(s => s.id);
-            }
-            if (uatCompletedSliceIds.length === 0) {
-                // File-based fallback: parse roadmap checkboxes
-                const roadmapPath = resolveMilestoneFile(dispatchBase, mid, "ROADMAP");
-                if (roadmapPath) {
-                    const roadmapContent = await loadFile(roadmapPath);
-                    if (roadmapContent) {
-                        uatCompletedSliceIds = parseRoadmap(roadmapContent).slices.filter(s => s.done).map(s => s.id);
-                    }
-                }
-            }
+            // DB-authoritative read (ADR-017) — no markdown fallback for dispatch
+            // decisions.
+            const uatCompletedSliceIds = isDbAvailable() ? getClosedSliceIds(mid) : [];
             if (uatCompletedSliceIds.length === 0) {
                 ctx.ui.notify("Cannot dispatch run-uat: no completed slices.", "warning");
                 return;

package/dist/resources/extensions/gsd/auto-dispatch.js

@@ -2,11 +2,10 @@
 // File Purpose: Declarative auto-mode dispatch rules and dispatch resolver.
 import { loadFile, extractUatType, loadActiveOverrides } from "./files.js";
 import { getUatBrowserToolSupportError } from "./uat-policy.js";
-import { isDbAvailable, getMilestoneSlices, getPendingGatesForTurn, markPendingGatesOmittedForTurn, getMilestone, insertArtifact, insertAssessment, setSliceSketchFlag, transaction, getAssessment, } from "./gsd-db.js";
+import { isDbAvailable, getMilestoneSlices, getMilestoneSliceSummaries, getClosedSliceIds, getPendingGatesForTurn, markPendingGatesOmittedForTurn, getMilestone, insertArtifact, insertAssessment, setSliceSketchFlag, transaction, getAssessment, } from "./gsd-db.js";
 import { isClosedStatus } from "./status-guards.js";
 import { extractVerdict, isAcceptableUatVerdict } from "./verdict-parser.js";
 import { gsdRoot, resolveGsdPathContract, resolveMilestoneFile, resolveMilestonePath, resolveSliceFile, resolveSlicePath, resolveTaskFile, relTaskFile, relSliceFile, buildMilestoneFileName, buildSliceFileName, buildTaskFileName, gsdProjectionRoot, } from "./paths.js";
-import { parseRoadmap } from "./parsers-legacy.js";
 import { validateArtifact } from "./schemas/validate.js";
 import { existsSync, mkdirSync, readFileSync, writeFileSync, unlinkSync, readdirSync } from "node:fs";
 import { logWarning, logError } from "./workflow-logger.js";
@@ -19,10 +18,14 @@ import { selectReactiveDispatchBatch } from "./uok/execution-graph.js";
 import { getMilestonePipelineVariant } from "./milestone-scope-classifier.js";
 import { EXECUTION_ENTRY_PHASES, hasFinalizedMilestoneContext } from "./uok/plan-v2.js";
 import { isAutoActive } from "./auto.js";
-import { markDepthVerified } from "./bootstrap/write-gate.js";
+// Host adapter explicitly: auto-dispatch runs in the extension host, and the
+// ambient write-gate exports env-sniff the adapter per call (they are reserved
+// for the workflow MCP child's dynamic-import surface).
+import { hostWriteGateAdapter } from "./bootstrap/write-gate.js";
 import { ensureWorkflowPreferencesCaptured } from "./planning-depth.js";
 import { MILESTONE_ID_RE } from "./milestone-ids.js";
-import { getWorkflowTransportSupportError, getRequiredWorkflowToolsForAutoUnit, } from "./workflow-mcp.js";
+import { getWorkflowTransportSupportError, getRequiredWorkflowToolsForAutoUnit, resolveWorkflowMcpProjectRoot, } from "./workflow-mcp.js";
+import { prepareBrowserDaemonForUat } from "./browser-daemon-auto-prep.js";
 import { PROJECT_RESEARCH_INFLIGHT_MARKER, } from "./project-research-policy.js";
 import { isWorkflowPrefsCaptured, resolveDeepProjectSetupState, } from "./deep-project-setup-policy.js";
 import { annotateBackgroundable } from "./delegation-policy.js";
@@ -289,30 +292,13 @@ function persistSliceAssessmentBackfill(assessmentRelPath, mid, sliceId, content
     });
 }
 function backfillMissingAssessmentsFromSummaries(basePath, mid) {
-    const completedSliceIds = new Set();
-    if (isDbAvailable()) {
-        for (const slice of getMilestoneSlices(mid)) {
-            if (slice.status === "complete" || slice.status === "done") {
-                completedSliceIds.add(slice.id);
-            }
-        }
-    }
-    else {
-        const roadmapFile = resolveMilestoneFile(basePath, mid, "ROADMAP");
-        if (!roadmapFile)
-            return;
-        try {
-            const roadmap = parseRoadmap(readFileSync(roadmapFile, "utf-8"));
-            for (const slice of roadmap.slices) {
-                if (slice.done)
-                    completedSliceIds.add(slice.id);
-            }
-        }
-        catch {
-            return;
-        }
-    }
-    for (const sliceId of completedSliceIds) {
+    // DB-authoritative (ADR-017): no markdown fallback. Without DB rows there
+    // is nothing to backfill.
+    if (!isDbAvailable())
+        return;
+    // Canonical closed vocabulary (complete/done/skipped/closed) — a skipped or
+    // closed slice with a SUMMARY gets the same assessment backfill treatment.
+    for (const sliceId of getClosedSliceIds(mid)) {
         const summaryPath = resolveSliceFile(basePath, mid, sliceId, "SUMMARY");
         if (!summaryPath || !existsSync(summaryPath))
             continue;
@@ -488,7 +474,7 @@ export const DISPATCH_RULES = [
             // deadlock. Deep planning is still user-driven even inside auto-mode,
             // so it must wait for explicit approval instead of taking this bypass.
             if (shouldBypassMilestoneDepthGateInAuto(prefs)) {
-                markDepthVerified(mid, basePath);
+                hostWriteGateAdapter.markDepthVerified(mid, basePath);
             }
             return {
                 action: "dispatch",
@@ -540,6 +526,16 @@ export const DISPATCH_RULES = [
             if (browserToolError) {
                 return { action: "stop", reason: browserToolError, level: "warning" };
             }
+            const browserDaemonError = prepareBrowserDaemonForUat({
+                uatType,
+                sessionProvider,
+                sessionAuthMode,
+                sessionBaseUrl,
+                projectRoot: resolveWorkflowMcpProjectRoot(basePath),
+            });
+            if (browserDaemonError) {
+                return { action: "stop", reason: browserDaemonError, level: "warning" };
+            }
             // Cap run-uat dispatch attempts to prevent infinite replay (#3624).
             // Check before incrementing so an exhausted counter cannot create a
             // no-progress skip loop that starves later dispatch rules.
@@ -569,24 +565,11 @@ export const DISPATCH_RULES = [
             // Only applies when UAT dispatch is enabled
             if (!prefs?.uat_dispatch)
                 return null;
-            // DB-first: prefer closed slices from DB; fall back to ROADMAP on disk.
-            let closedSliceIds;
-            if (isDbAvailable()) {
-                closedSliceIds = getMilestoneSlices(mid)
-                    .filter(s => isClosedStatus(s.status))
-                    .map(s => s.id);
-            }
-            else {
-                // Filesystem fallback for degraded / unmigrated projects.
-                // `slice.done` in the parsed ROADMAP is the disk-level closed signal.
-                const roadmapFile = resolveMilestoneFile(basePath, mid, "ROADMAP");
-                const roadmapContent = roadmapFile ? await loadFile(roadmapFile) : null;
-                if (!roadmapContent)
-                    return null;
-                const roadmap = parseRoadmap(roadmapContent);
-                closedSliceIds = roadmap.slices.filter(s => s.done).map(s => s.id);
-            }
-            for (const sliceId of closedSliceIds) {
+            // DB-authoritative (ADR-017): closed slices come from the DB only; the
+            // ROADMAP projection is never parsed for gate decisions.
+            if (!isDbAvailable())
+                return null;
+            for (const sliceId of getClosedSliceIds(mid)) {
                 const result = await readUatGateVerdict(basePath, mid, sliceId);
                 if (!result)
                     continue;
@@ -641,7 +624,7 @@ export const DISPATCH_RULES = [
             // H6 fix (#4973): keep the non-deep auto-mode bypass, but do not
             // pre-verify deep planning's user-facing milestone approval gate.
             if (shouldBypassMilestoneDepthGateInAuto(prefs)) {
-                markDepthVerified(mid, basePath);
+                hostWriteGateAdapter.markDepthVerified(mid, basePath);
             }
             return {
                 action: "dispatch",
@@ -823,7 +806,7 @@ export const DISPATCH_RULES = [
             // H6 fix (#4973): keep the non-deep auto-mode bypass, but do not
             // pre-verify deep planning's user-facing milestone approval gate.
             if (shouldBypassMilestoneDepthGateInAuto(prefs)) {
-                markDepthVerified(mid, basePath);
+                hostWriteGateAdapter.markDepthVerified(mid, basePath);
             }
             return {
                 action: "dispatch",
@@ -905,18 +888,18 @@ export const DISPATCH_RULES = [
             // behavior.
             if (await getMilestonePipelineVariant(mid) === "trivial")
                 return null;
-            // Load roadmap to find all slices
-            const roadmapFile = resolveExistingExpectedArtifact("plan-milestone", mid, basePath) ??
-                resolveMilestoneFile(basePath, mid, "ROADMAP");
-            const roadmapContent = roadmapFile ? await loadFile(roadmapFile) : null;
-            if (!roadmapContent)
+            // DB-authoritative slice list (ADR-017): the ROADMAP projection is
+            // never parsed for dispatch decisions. No DB / no rows → skip this rule.
+            if (!isDbAvailable())
+                return null;
+            const dbSlices = getMilestoneSliceSummaries(mid);
+            if (dbSlices.length === 0)
                 return null;
-            const roadmap = parseRoadmap(roadmapContent);
             // Find slices that need research (no RESEARCH file, dependencies done)
             const milestoneResearchFile = resolveExistingExpectedArtifact("research-milestone", mid, basePath) ??
                 resolveMilestoneFile(basePath, mid, "RESEARCH");
             const researchReadySlices = [];
-            for (const slice of roadmap.slices) {
+            for (const slice of dbSlices) {
                 if (slice.done)
                     continue;
                 // Skip S01 when milestone research exists
@@ -926,7 +909,7 @@ export const DISPATCH_RULES = [
                 if (resolveExistingExpectedArtifact("research-slice", `${mid}/${slice.id}`, basePath))
                     continue;
                 // Skip if dependencies aren't done (check for SUMMARY files)
-                const depsComplete = (slice.depends ?? []).every((depId) => !!resolveExistingExpectedArtifact("complete-slice", `${mid}/${depId}`, basePath));
+                const depsComplete = slice.depends.every((depId) => !!resolveExistingExpectedArtifact("complete-slice", `${mid}/${depId}`, basePath));
                 if (!depsComplete)
                     continue;
                 researchReadySlices.push({ id: slice.id, title: slice.title });

package/dist/resources/extensions/gsd/auto-model-selection.js

@@ -839,15 +839,34 @@ export function resolveModelId(modelId, availableModels, currentProvider) {
         if (providerMatch)
             return providerMatch;
     }
-    // Prefer "anthropic" as the canonical provider for Anthropic models.
-    // Transport-specific tiebreaker (ADR-012): intentionally keys on provider,
-    // not api — we want the plain Anthropic transport when multiple are available.
-    const anthropicMatch = candidates.find(m => m.provider === "anthropic");
-    if (anthropicMatch)
-        return anthropicMatch;
+    // Subscription/OAuth routes beat pay-per-token API when the same model ID
+    // exists on multiple providers. Order matters — first match wins.
+    for (const provider of BARE_ID_SUBSCRIPTION_PROVIDER_PRECEDENCE) {
+        const match = candidates.find(m => m.provider === provider);
+        if (match)
+            return match;
+    }
     // Fall back to first non-extension candidate, or any candidate
     return candidates.find(m => !EXTENSION_PROVIDERS.has(m.provider)) ?? candidates[0];
 }
+/**
+ * When a bare model ID exists on multiple providers, prefer subscription/OAuth
+ * routes over pay-per-token API keys. Matches PROVIDER_ROUTES in doctor-providers
+ * but applies when *both* sides are authenticated.
+ *
+ * Order rationale:
+ * - openai-codex before github-copilot: ChatGPT-native for shared GPT IDs
+ * - google-gemini-cli before github-copilot: first-party Gemini CLI
+ * - anthropic before github-copilot: first-party Claude API/OAuth over Copilot
+ * - github-copilot before openai/google: Copilot OAuth over platform API keys
+ */
+export const BARE_ID_SUBSCRIPTION_PROVIDER_PRECEDENCE = [
+    "openai-codex",
+    "google-gemini-cli",
+    "anthropic",
+    "github-copilot",
+    "google-antigravity",
+];
 /**
  * Flat-rate providers charge the same per request regardless of model.
  * Dynamic routing provides no cost benefit — it only degrades quality (#3453).

package/dist/resources/extensions/gsd/auto-post-unit.js

@@ -16,7 +16,7 @@ import { deriveState } from "./state.js";
 import { logWarning, logError } from "./workflow-logger.js";
 import { loadFile, parseSummary, resolveAllOverrides } from "./files.js";
 import { loadPrompt } from "./prompt-loader.js";
-import { isAwaitingUserInput } from "./user-input-boundary.js";
+import { isAwaitingUserInput } from "./consent-question.js";
 import { resolveMilestonePath, resolveSliceFile, resolveSlicePath, resolveTaskFile, resolveMilestoneFile, resolveTasksDir, buildTaskFileName, } from "./paths.js";
 import { invalidateAllCaches } from "./cache.js";
 import { rebuildState } from "./doctor.js";
@@ -30,8 +30,7 @@ import { createWorkspace, scopeMilestone } from "./workspace.js";
 import { normalizeWorktreePathForCompare } from "./worktree-root.js";
 import { isDbAvailable, getTask, getSlice, getMilestone, getMilestoneSlices, updateTaskStatus, _getAdapter, getVerificationEvidence } from "./gsd-db.js";
 import { getWorkflowDatabasePath, refreshWorkflowDatabaseFromDisk } from "./db-workspace.js";
-import { renderPlanCheckboxes, renderRoadmapFromDb } from "./markdown-renderer.js";
-import { parseRoadmap as parseLegacyRoadmap } from "./parsers-legacy.js";
+import { renderPlanCheckboxes, renderRoadmapFromDb, roadmapRenderMarksSliceDone } from "./markdown-renderer.js";
 import { consumeSignal } from "./session-status-io.js";
 import { checkPostUnitHooks, consumeHookFailure, isRetryPending, consumeRetryTrigger, consumeGateBlock, persistHookState, resolveHookArtifactPath, } from "./post-unit-hooks.js";
 import { hasPendingCaptures, loadPendingCaptures, revertExecutorResolvedCaptures } from "./captures.js";
@@ -55,11 +54,12 @@ import { writeTurnGitTransaction } from "./uok/gitops.js";
 import { isClosedStatus } from "./status-guards.js";
 import { detectAbandonMilestone } from "./abandon-detect.js";
 import { getPendingGate } from "./bootstrap/write-gate.js";
-import { isDeterministicPolicyError } from "./auto-tool-tracking.js";
+import { isDeterministicPolicyError, isToolUnavailableError } from "./auto-tool-tracking.js";
 import { formatConnectedStepStack, formatPostUnitStatusCard } from "./auto-status-message.js";
 import { clearProjectResearchInflightMarker, finalizeProjectResearchTimeout, } from "./project-research-policy.js";
 import { validateArtifact } from "./schemas/validate.js";
 import { verificationRetryKey } from "./auto/verification-retry-policy.js";
+import { saveCustomVerifyRetryCounts } from "./auto/custom-verify-retry-store.js";
 import { getLedger } from "./metrics.js";
 import { getUnitCostSpikeAction, resolveUnitCostSpikeMultiplier } from "./auto-budget.js";
 import { resolveCanonicalMilestoneRoot } from "./worktree-manager.js";
@@ -722,7 +722,7 @@ export const USER_DRIVEN_DEEP_UNITS = new Set([
     "discuss-milestone",
     "research-decision",
 ]);
-export { isAwaitingUserInput } from "./user-input-boundary.js";
+export { isAwaitingUserInput } from "./consent-question.js";
 function artifactValidationKind(unitType) {
     if (unitType === "discuss-project")
         return "project";
@@ -800,11 +800,13 @@ async function repairCompleteSliceRoadmapProjection(unitType, unitId, basePath)
     if (!summaryPath || !existsSync(summaryPath) || !uatPath || !existsSync(uatPath)) {
         return false;
     }
+    // Stale-render detection (ADR-017): the DB already says the slice is closed;
+    // this only checks whether the rendered ROADMAP projection reflects it, to
+    // decide whether a repair re-render is needed.
     const roadmapPath = resolveMilestoneFile(artifactBase, mid, "ROADMAP");
     if (roadmapPath && existsSync(roadmapPath)) {
         try {
-            const roadmap = parseLegacyRoadmap(readFileSync(roadmapPath, "utf-8"));
-            if (roadmap.slices.find((roadmapSlice) => roadmapSlice.id === sid)?.done) {
+            if (roadmapRenderMarksSliceDone(readFileSync(roadmapPath, "utf-8"), sid)) {
                 return false;
             }
         }
@@ -1701,7 +1703,16 @@ export async function postUnitPreVerification(pctx, opts) {
                 ctx.ui.notify(`Artifact missing for ${s.currentUnit.type} ${s.currentUnit.id} — DB unavailable, skipping retry.${dbSkipDiag ? ` Expected: ${dbSkipDiag}` : ""}`, "error");
             }
             else if (!triggerArtifactVerified) {
-                if (s.lastToolInvocationError) {
+                if (s.lastToolInvocationError && isToolUnavailableError(s.lastToolInvocationError)) {
+                    // Tool-unavailable is the one transient invocation error: the
+                    // workflow MCP server registers its surface asynchronously, so a
+                    // Unit's first call can race the registration. Fall through to the
+                    // bounded verification retry instead of pausing.
+                    debugLog("postUnit", { phase: "tool-unavailable-retry", unitType: s.currentUnit.type, unitId: s.currentUnit.id, error: s.lastToolInvocationError });
+                    ctx.ui.notify(`Tool unavailable for ${s.currentUnit.type}: ${s.lastToolInvocationError}. The tool surface may still be registering — retrying.`, "warning");
+                    s.lastToolInvocationError = null;
+                }
+                else if (s.lastToolInvocationError) {
                     const isUserSkip = /queued user message/i.test(s.lastToolInvocationError);
                     const errMsg = isUserSkip
                         ? `Tool skipped for ${s.currentUnit.type}: ${s.lastToolInvocationError}. Queued user message interrupted the turn — pausing auto-mode.`
@@ -1789,12 +1800,14 @@ export async function postUnitPreVerification(pctx, opts) {
                             }
                         }
                         s.exhaustedVerificationUnits.add(retryKey);
+                        saveCustomVerifyRetryCounts(s, { logFailure: err => debugLog("postUnit", { phase: "save-verify-retries-failed", error: err instanceof Error ? err.message : String(err) }) });
                         debugLog("postUnit", { phase: "artifact-verify-exhausted", unitType: s.currentUnit.type, unitId: s.currentUnit.id, attempt });
                         ctx.ui.notify(`${failureDetails} Pausing auto-mode after ${MAX_ARTIFACT_VERIFICATION_RETRIES} retries.`, "error");
                         await pauseAuto(ctx, pi);
                         return "dispatched";
                     }
                     s.verificationRetryCount.set(retryKey, attempt);
+                    saveCustomVerifyRetryCounts(s, { logFailure: err => debugLog("postUnit", { phase: "save-verify-retries-failed", error: err instanceof Error ? err.message : String(err) }) });
                     s.pendingVerificationRetry = {
                         unitId: s.currentUnit.id,
                         failureContext: `${failureDetails} (attempt ${attempt}/${MAX_ARTIFACT_VERIFICATION_RETRIES}).`,
@@ -1814,6 +1827,8 @@ export async function postUnitPreVerification(pctx, opts) {
                 }
                 s.verificationRetryCount.delete(retryKey);
                 s.verificationRetryFailureHashes.delete(retryKey);
+                s.exhaustedVerificationUnits.delete(retryKey);
+                saveCustomVerifyRetryCounts(s, { logFailure: err => debugLog("postUnit", { phase: "save-verify-retries-failed", error: err instanceof Error ? err.message : String(err) }) });
                 if (s.currentUnit.type === "complete-milestone") {
                     const { milestone: mid } = parseUnitId(s.currentUnit.id);
                     if (mid) {