@opengsd/gsd-pi 1.2.0-dev.b1abb545 → 1.2.0-dev.e8563f58

package/dist/resources/extensions/gsd/auto-dispatch.js

@@ -2,11 +2,10 @@
 // File Purpose: Declarative auto-mode dispatch rules and dispatch resolver.
 import { loadFile, extractUatType, loadActiveOverrides } from "./files.js";
 import { getUatBrowserToolSupportError } from "./uat-policy.js";
-import { isDbAvailable, getMilestoneSlices, getPendingGatesForTurn, markPendingGatesOmittedForTurn, getMilestone, insertArtifact, insertAssessment, setSliceSketchFlag, transaction, getAssessment, } from "./gsd-db.js";
+import { isDbAvailable, getMilestoneSlices, getMilestoneSliceSummaries, getClosedSliceIds, getPendingGatesForTurn, markPendingGatesOmittedForTurn, getMilestone, insertArtifact, insertAssessment, setSliceSketchFlag, transaction, getAssessment, } from "./gsd-db.js";
 import { isClosedStatus } from "./status-guards.js";
 import { extractVerdict, isAcceptableUatVerdict } from "./verdict-parser.js";
 import { gsdRoot, resolveGsdPathContract, resolveMilestoneFile, resolveMilestonePath, resolveSliceFile, resolveSlicePath, resolveTaskFile, relTaskFile, relSliceFile, buildMilestoneFileName, buildSliceFileName, buildTaskFileName, gsdProjectionRoot, } from "./paths.js";
-import { parseRoadmap } from "./parsers-legacy.js";
 import { validateArtifact } from "./schemas/validate.js";
 import { existsSync, mkdirSync, readFileSync, writeFileSync, unlinkSync, readdirSync } from "node:fs";
 import { logWarning, logError } from "./workflow-logger.js";
@@ -19,10 +18,14 @@ import { selectReactiveDispatchBatch } from "./uok/execution-graph.js";
 import { getMilestonePipelineVariant } from "./milestone-scope-classifier.js";
 import { EXECUTION_ENTRY_PHASES, hasFinalizedMilestoneContext } from "./uok/plan-v2.js";
 import { isAutoActive } from "./auto.js";
-import { markDepthVerified } from "./bootstrap/write-gate.js";
+// Host adapter explicitly: auto-dispatch runs in the extension host, and the
+// ambient write-gate exports env-sniff the adapter per call (they are reserved
+// for the workflow MCP child's dynamic-import surface).
+import { hostWriteGateAdapter } from "./bootstrap/write-gate.js";
 import { ensureWorkflowPreferencesCaptured } from "./planning-depth.js";
 import { MILESTONE_ID_RE } from "./milestone-ids.js";
-import { getWorkflowTransportSupportError, getRequiredWorkflowToolsForAutoUnit, } from "./workflow-mcp.js";
+import { getWorkflowTransportSupportError, getRequiredWorkflowToolsForAutoUnit, resolveWorkflowMcpProjectRoot, } from "./workflow-mcp.js";
+import { prepareBrowserDaemonForUat } from "./browser-daemon-auto-prep.js";
 import { PROJECT_RESEARCH_INFLIGHT_MARKER, } from "./project-research-policy.js";
 import { isWorkflowPrefsCaptured, resolveDeepProjectSetupState, } from "./deep-project-setup-policy.js";
 import { annotateBackgroundable } from "./delegation-policy.js";
@@ -289,30 +292,13 @@ function persistSliceAssessmentBackfill(assessmentRelPath, mid, sliceId, content
     });
 }
 function backfillMissingAssessmentsFromSummaries(basePath, mid) {
-    const completedSliceIds = new Set();
-    if (isDbAvailable()) {
-        for (const slice of getMilestoneSlices(mid)) {
-            if (slice.status === "complete" || slice.status === "done") {
-                completedSliceIds.add(slice.id);
-            }
-        }
-    }
-    else {
-        const roadmapFile = resolveMilestoneFile(basePath, mid, "ROADMAP");
-        if (!roadmapFile)
-            return;
-        try {
-            const roadmap = parseRoadmap(readFileSync(roadmapFile, "utf-8"));
-            for (const slice of roadmap.slices) {
-                if (slice.done)
-                    completedSliceIds.add(slice.id);
-            }
-        }
-        catch {
-            return;
-        }
-    }
-    for (const sliceId of completedSliceIds) {
+    // DB-authoritative (ADR-017): no markdown fallback. Without DB rows there
+    // is nothing to backfill.
+    if (!isDbAvailable())
+        return;
+    // Canonical closed vocabulary (complete/done/skipped/closed) — a skipped or
+    // closed slice with a SUMMARY gets the same assessment backfill treatment.
+    for (const sliceId of getClosedSliceIds(mid)) {
         const summaryPath = resolveSliceFile(basePath, mid, sliceId, "SUMMARY");
         if (!summaryPath || !existsSync(summaryPath))
             continue;
@@ -488,7 +474,7 @@ export const DISPATCH_RULES = [
             // deadlock. Deep planning is still user-driven even inside auto-mode,
             // so it must wait for explicit approval instead of taking this bypass.
             if (shouldBypassMilestoneDepthGateInAuto(prefs)) {
-                markDepthVerified(mid, basePath);
+                hostWriteGateAdapter.markDepthVerified(mid, basePath);
             }
             return {
                 action: "dispatch",
@@ -540,6 +526,16 @@ export const DISPATCH_RULES = [
             if (browserToolError) {
                 return { action: "stop", reason: browserToolError, level: "warning" };
             }
+            const browserDaemonError = prepareBrowserDaemonForUat({
+                uatType,
+                sessionProvider,
+                sessionAuthMode,
+                sessionBaseUrl,
+                projectRoot: resolveWorkflowMcpProjectRoot(basePath),
+            });
+            if (browserDaemonError) {
+                return { action: "stop", reason: browserDaemonError, level: "warning" };
+            }
             // Cap run-uat dispatch attempts to prevent infinite replay (#3624).
             // Check before incrementing so an exhausted counter cannot create a
             // no-progress skip loop that starves later dispatch rules.
@@ -569,24 +565,11 @@ export const DISPATCH_RULES = [
             // Only applies when UAT dispatch is enabled
             if (!prefs?.uat_dispatch)
                 return null;
-            // DB-first: prefer closed slices from DB; fall back to ROADMAP on disk.
-            let closedSliceIds;
-            if (isDbAvailable()) {
-                closedSliceIds = getMilestoneSlices(mid)
-                    .filter(s => isClosedStatus(s.status))
-                    .map(s => s.id);
-            }
-            else {
-                // Filesystem fallback for degraded / unmigrated projects.
-                // `slice.done` in the parsed ROADMAP is the disk-level closed signal.
-                const roadmapFile = resolveMilestoneFile(basePath, mid, "ROADMAP");
-                const roadmapContent = roadmapFile ? await loadFile(roadmapFile) : null;
-                if (!roadmapContent)
-                    return null;
-                const roadmap = parseRoadmap(roadmapContent);
-                closedSliceIds = roadmap.slices.filter(s => s.done).map(s => s.id);
-            }
-            for (const sliceId of closedSliceIds) {
+            // DB-authoritative (ADR-017): closed slices come from the DB only; the
+            // ROADMAP projection is never parsed for gate decisions.
+            if (!isDbAvailable())
+                return null;
+            for (const sliceId of getClosedSliceIds(mid)) {
                 const result = await readUatGateVerdict(basePath, mid, sliceId);
                 if (!result)
                     continue;
@@ -641,7 +624,7 @@ export const DISPATCH_RULES = [
             // H6 fix (#4973): keep the non-deep auto-mode bypass, but do not
             // pre-verify deep planning's user-facing milestone approval gate.
             if (shouldBypassMilestoneDepthGateInAuto(prefs)) {
-                markDepthVerified(mid, basePath);
+                hostWriteGateAdapter.markDepthVerified(mid, basePath);
             }
             return {
                 action: "dispatch",
@@ -823,7 +806,7 @@ export const DISPATCH_RULES = [
             // H6 fix (#4973): keep the non-deep auto-mode bypass, but do not
             // pre-verify deep planning's user-facing milestone approval gate.
             if (shouldBypassMilestoneDepthGateInAuto(prefs)) {
-                markDepthVerified(mid, basePath);
+                hostWriteGateAdapter.markDepthVerified(mid, basePath);
             }
             return {
                 action: "dispatch",
@@ -905,18 +888,18 @@ export const DISPATCH_RULES = [
             // behavior.
             if (await getMilestonePipelineVariant(mid) === "trivial")
                 return null;
-            // Load roadmap to find all slices
-            const roadmapFile = resolveExistingExpectedArtifact("plan-milestone", mid, basePath) ??
-                resolveMilestoneFile(basePath, mid, "ROADMAP");
-            const roadmapContent = roadmapFile ? await loadFile(roadmapFile) : null;
-            if (!roadmapContent)
+            // DB-authoritative slice list (ADR-017): the ROADMAP projection is
+            // never parsed for dispatch decisions. No DB / no rows → skip this rule.
+            if (!isDbAvailable())
+                return null;
+            const dbSlices = getMilestoneSliceSummaries(mid);
+            if (dbSlices.length === 0)
                 return null;
-            const roadmap = parseRoadmap(roadmapContent);
             // Find slices that need research (no RESEARCH file, dependencies done)
             const milestoneResearchFile = resolveExistingExpectedArtifact("research-milestone", mid, basePath) ??
                 resolveMilestoneFile(basePath, mid, "RESEARCH");
             const researchReadySlices = [];
-            for (const slice of roadmap.slices) {
+            for (const slice of dbSlices) {
                 if (slice.done)
                     continue;
                 // Skip S01 when milestone research exists
@@ -926,7 +909,7 @@ export const DISPATCH_RULES = [
                 if (resolveExistingExpectedArtifact("research-slice", `${mid}/${slice.id}`, basePath))
                     continue;
                 // Skip if dependencies aren't done (check for SUMMARY files)
-                const depsComplete = (slice.depends ?? []).every((depId) => !!resolveExistingExpectedArtifact("complete-slice", `${mid}/${depId}`, basePath));
+                const depsComplete = slice.depends.every((depId) => !!resolveExistingExpectedArtifact("complete-slice", `${mid}/${depId}`, basePath));
                 if (!depsComplete)
                     continue;
                 researchReadySlices.push({ id: slice.id, title: slice.title });

package/dist/resources/extensions/gsd/auto-model-selection.js

@@ -13,7 +13,7 @@ import { getSessionModelOverride } from "./session-model-override.js";
 import { logWarning } from "./workflow-logger.js";
 import { resolveUokFlags } from "./uok/flags.js";
 import { applyModelPolicyFilter } from "./uok/model-policy.js";
-import { isModelBlocked } from "./blocked-models.js";
+import { isModelBlocked, isModelTemporarilyUnavailable } from "./blocked-models.js";
 import { getRequiredWorkflowToolsForAutoUnit, isWorkflowMcpSurfaceTool } from "./workflow-mcp.js";
 /**
  * Thrown when the model-policy gate rejects every candidate model for a unit
@@ -218,6 +218,10 @@ function buildModelPolicyBlockReasons(policyDenyReasons, availableModels, routin
             reason: `configured model(s) did not resolve against policy-eligible registry [${eligibleSummary}]`,
         }];
 }
+function isModelUnavailable(basePath, provider, id) {
+    return isModelBlocked(basePath, provider, id) ||
+        isModelTemporarilyUnavailable(basePath, provider, id);
+}
 function restoreToolBaseline(pi) {
     const key = pi;
     const baseline = TOOL_BASELINE.get(key);
@@ -657,8 +661,8 @@ autoModeStartThinkingLevel) {
             // (issue #4513).  The block is persisted in .gsd/runtime/blocked-models.json
             // so it survives /gsd auto restarts — without this, the same dead model
             // gets reselected after every restart.
-            if (isModelBlocked(basePath, model.provider, model.id)) {
-                ctx.ui.notify(`Skipping blocked model ${model.provider}/${model.id} (provider rejected it for this account).`, "warning");
+            if (isModelUnavailable(basePath, model.provider, model.id)) {
+                ctx.ui.notify(`Skipping unavailable model ${model.provider}/${model.id}.`, "warning");
                 continue;
             }
             // Warn if the ID is ambiguous across providers
@@ -724,7 +728,7 @@ autoModeStartThinkingLevel) {
                 const key = `${model.provider.toLowerCase()}/${model.id.toLowerCase()}`;
                 if (!policyAllowedModelKeys.has(key))
                     continue;
-                if (isModelBlocked(basePath, model.provider, model.id))
+                if (isModelUnavailable(basePath, model.provider, model.id))
                     continue;
                 const ok = await pi.setModel(model, { persist: false });
                 if (!ok)
@@ -746,16 +750,16 @@ autoModeStartThinkingLevel) {
         // No model preference for this unit type — re-apply the model captured
         // at auto-mode start to prevent bleed from shared global settings.json (#650).
         const availableModels = buildModelPolicyCandidates(ctx, autoModeStartModel, effectiveSessionModelOverride);
-        const startBlocked = isModelBlocked(basePath, autoModeStartModel.provider, autoModeStartModel.id);
+        const startBlocked = isModelUnavailable(basePath, autoModeStartModel.provider, autoModeStartModel.id);
         if (startBlocked) {
-            ctx.ui.notify(`Auto-mode start model ${autoModeStartModel.provider}/${autoModeStartModel.id} is blocked for this account. Using current session model instead.`, "warning");
+            ctx.ui.notify(`Auto-mode start model ${autoModeStartModel.provider}/${autoModeStartModel.id} is unavailable. Using current session model instead.`, "warning");
         }
         else {
             const startModel = availableModels.find(m => m.provider === autoModeStartModel.provider && m.id === autoModeStartModel.id);
             if (startModel) {
                 const ok = await pi.setModel(startModel, { persist: false });
                 if (!ok) {
-                    const byId = availableModels.find(m => m.id === autoModeStartModel.id && !isModelBlocked(basePath, m.provider, m.id));
+                    const byId = availableModels.find(m => m.id === autoModeStartModel.id && !isModelUnavailable(basePath, m.provider, m.id));
                     if (byId) {
                         const fallbackOk = await pi.setModel(byId, { persist: false });
                         if (fallbackOk) {
@@ -839,15 +843,34 @@ export function resolveModelId(modelId, availableModels, currentProvider) {
         if (providerMatch)
             return providerMatch;
     }
-    // Prefer "anthropic" as the canonical provider for Anthropic models.
-    // Transport-specific tiebreaker (ADR-012): intentionally keys on provider,
-    // not api — we want the plain Anthropic transport when multiple are available.
-    const anthropicMatch = candidates.find(m => m.provider === "anthropic");
-    if (anthropicMatch)
-        return anthropicMatch;
+    // Subscription/OAuth routes beat pay-per-token API when the same model ID
+    // exists on multiple providers. Order matters — first match wins.
+    for (const provider of BARE_ID_SUBSCRIPTION_PROVIDER_PRECEDENCE) {
+        const match = candidates.find(m => m.provider === provider);
+        if (match)
+            return match;
+    }
     // Fall back to first non-extension candidate, or any candidate
     return candidates.find(m => !EXTENSION_PROVIDERS.has(m.provider)) ?? candidates[0];
 }
+/**
+ * When a bare model ID exists on multiple providers, prefer subscription/OAuth
+ * routes over pay-per-token API keys. Matches PROVIDER_ROUTES in doctor-providers
+ * but applies when *both* sides are authenticated.
+ *
+ * Order rationale:
+ * - openai-codex before github-copilot: ChatGPT-native for shared GPT IDs
+ * - google-gemini-cli before github-copilot: first-party Gemini CLI
+ * - anthropic before github-copilot: first-party Claude API/OAuth over Copilot
+ * - github-copilot before openai/google: Copilot OAuth over platform API keys
+ */
+export const BARE_ID_SUBSCRIPTION_PROVIDER_PRECEDENCE = [
+    "openai-codex",
+    "google-gemini-cli",
+    "anthropic",
+    "github-copilot",
+    "google-antigravity",
+];
 /**
  * Flat-rate providers charge the same per request regardless of model.
  * Dynamic routing provides no cost benefit — it only degrades quality (#3453).

package/dist/resources/extensions/gsd/auto-post-unit.js

@@ -16,7 +16,7 @@ import { deriveState } from "./state.js";
 import { logWarning, logError } from "./workflow-logger.js";
 import { loadFile, parseSummary, resolveAllOverrides } from "./files.js";
 import { loadPrompt } from "./prompt-loader.js";
-import { isAwaitingUserInput } from "./user-input-boundary.js";
+import { isAwaitingUserInput } from "./consent-question.js";
 import { resolveMilestonePath, resolveSliceFile, resolveSlicePath, resolveTaskFile, resolveMilestoneFile, resolveTasksDir, buildTaskFileName, } from "./paths.js";
 import { invalidateAllCaches } from "./cache.js";
 import { rebuildState } from "./doctor.js";
@@ -30,8 +30,7 @@ import { createWorkspace, scopeMilestone } from "./workspace.js";
 import { normalizeWorktreePathForCompare } from "./worktree-root.js";
 import { isDbAvailable, getTask, getSlice, getMilestone, getMilestoneSlices, updateTaskStatus, _getAdapter, getVerificationEvidence } from "./gsd-db.js";
 import { getWorkflowDatabasePath, refreshWorkflowDatabaseFromDisk } from "./db-workspace.js";
-import { renderPlanCheckboxes, renderRoadmapFromDb } from "./markdown-renderer.js";
-import { parseRoadmap as parseLegacyRoadmap } from "./parsers-legacy.js";
+import { renderPlanCheckboxes, renderRoadmapFromDb, roadmapRenderMarksSliceDone } from "./markdown-renderer.js";
 import { consumeSignal } from "./session-status-io.js";
 import { checkPostUnitHooks, consumeHookFailure, isRetryPending, consumeRetryTrigger, consumeGateBlock, persistHookState, resolveHookArtifactPath, } from "./post-unit-hooks.js";
 import { hasPendingCaptures, loadPendingCaptures, revertExecutorResolvedCaptures } from "./captures.js";
@@ -39,7 +38,7 @@ import { debugLog } from "./debug-logger.js";
 import { runSafely } from "./auto-utils.js";
 import { isMilestoneCloseoutSettled, runMilestoneCloseoutGitHub, } from "./milestone-closeout.js";
 import { getEvidence, clearEvidenceFromDisk, isExecutionToolName } from "./safety/evidence-collector.js";
-import { validateFileChanges } from "./safety/file-change-validator.js";
+import { validateFileChanges, effectiveFileChangeAllowlist } from "./safety/file-change-validator.js";
 import { crossReferenceEvidence } from "./safety/evidence-cross-ref.js";
 import { validateContent } from "./safety/content-validator.js";
 import { resolveSafetyHarnessConfig } from "./safety/safety-harness.js";
@@ -55,11 +54,12 @@ import { writeTurnGitTransaction } from "./uok/gitops.js";
 import { isClosedStatus } from "./status-guards.js";
 import { detectAbandonMilestone } from "./abandon-detect.js";
 import { getPendingGate } from "./bootstrap/write-gate.js";
-import { isDeterministicPolicyError } from "./auto-tool-tracking.js";
+import { isDeterministicPolicyError, isToolUnavailableError } from "./auto-tool-tracking.js";
 import { formatConnectedStepStack, formatPostUnitStatusCard } from "./auto-status-message.js";
 import { clearProjectResearchInflightMarker, finalizeProjectResearchTimeout, } from "./project-research-policy.js";
 import { validateArtifact } from "./schemas/validate.js";
 import { verificationRetryKey } from "./auto/verification-retry-policy.js";
+import { saveCustomVerifyRetryCounts } from "./auto/custom-verify-retry-store.js";
 import { getLedger } from "./metrics.js";
 import { getUnitCostSpikeAction, resolveUnitCostSpikeMultiplier } from "./auto-budget.js";
 import { resolveCanonicalMilestoneRoot } from "./worktree-manager.js";
@@ -507,9 +507,10 @@ export function _hasExecutionToolCallsInSessionForTest(entries) {
         if (e?.type === "toolCall" && isExecutionToolName(e?.name ?? e?.toolName)) {
             return true;
         }
-        if (e?.type !== "message")
-            continue;
-        const msg = e?.message;
+        // Accept both session-manager entries ({type: "message", message}) and
+        // bare agent-end messages ({role, content}) — the auto loop passes the
+        // latter via opts.agentEndMessages.
+        const msg = e?.type === "message" ? e?.message : e;
         if (!msg || msg.role !== "assistant" || !Array.isArray(msg.content))
             continue;
         for (const block of msg.content) {
@@ -721,7 +722,7 @@ export const USER_DRIVEN_DEEP_UNITS = new Set([
     "discuss-milestone",
     "research-decision",
 ]);
-export { isAwaitingUserInput } from "./user-input-boundary.js";
+export { isAwaitingUserInput } from "./consent-question.js";
 function artifactValidationKind(unitType) {
     if (unitType === "discuss-project")
         return "project";
@@ -799,11 +800,13 @@ async function repairCompleteSliceRoadmapProjection(unitType, unitId, basePath)
     if (!summaryPath || !existsSync(summaryPath) || !uatPath || !existsSync(uatPath)) {
         return false;
     }
+    // Stale-render detection (ADR-017): the DB already says the slice is closed;
+    // this only checks whether the rendered ROADMAP projection reflects it, to
+    // decide whether a repair re-render is needed.
     const roadmapPath = resolveMilestoneFile(artifactBase, mid, "ROADMAP");
     if (roadmapPath && existsSync(roadmapPath)) {
         try {
-            const roadmap = parseLegacyRoadmap(readFileSync(roadmapPath, "utf-8"));
-            if (roadmap.slices.find((roadmapSlice) => roadmapSlice.id === sid)?.done) {
+            if (roadmapRenderMarksSliceDone(readFileSync(roadmapPath, "utf-8"), sid)) {
                 return false;
             }
         }
@@ -1289,6 +1292,7 @@ export async function postUnitPreVerification(pctx, opts) {
             const safetyConfig = resolveSafetyHarnessConfig(prefs?.safety_harness);
             if (safetyConfig.enabled) {
                 const { milestone: sMid, slice: sSid, task: sTid } = parseUnitId(s.currentUnit.id);
+                const fileChangeAllowlist = effectiveFileChangeAllowlist(safetyConfig.file_change_allowlist, prefs?.git?.manage_gitignore);
                 // File change validation (execute-task only, after unit execution)
                 if (safetyConfig.file_change_validation && s.currentUnit.type === "execute-task" && sMid && sSid && sTid) {
                     try {
@@ -1303,7 +1307,7 @@ export async function postUnitPreVerification(pctx, opts) {
                             const plannedFiles = getPlannedKeyFiles(sliceTaskRows.map((taskRow) => ({
                                 files: taskRow.files,
                             })));
-                            const audit = validateFileChanges(s.basePath, expectedOutput, plannedFiles, safetyConfig.file_change_allowlist);
+                            const audit = validateFileChanges(s.basePath, expectedOutput, plannedFiles, fileChangeAllowlist);
                             if (audit && audit.violations.length > 0) {
                                 const warnings = audit.violations.filter(v => v.severity === "warning");
                                 for (const v of warnings) {
@@ -1319,7 +1323,7 @@ export async function postUnitPreVerification(pctx, opts) {
                             if (taskRow) {
                                 const expectedOutput = taskRow.expected_output ?? [];
                                 const plannedFiles = taskRow.files ?? [];
-                                const audit = validateFileChanges(s.basePath, expectedOutput, plannedFiles, safetyConfig.file_change_allowlist);
+                                const audit = validateFileChanges(s.basePath, expectedOutput, plannedFiles, fileChangeAllowlist);
                                 if (audit && audit.violations.length > 0) {
                                     const warnings = audit.violations.filter(v => v.severity === "warning");
                                     for (const v of warnings) {
@@ -1699,7 +1703,16 @@ export async function postUnitPreVerification(pctx, opts) {
                 ctx.ui.notify(`Artifact missing for ${s.currentUnit.type} ${s.currentUnit.id} — DB unavailable, skipping retry.${dbSkipDiag ? ` Expected: ${dbSkipDiag}` : ""}`, "error");
             }
             else if (!triggerArtifactVerified) {
-                if (s.lastToolInvocationError) {
+                if (s.lastToolInvocationError && isToolUnavailableError(s.lastToolInvocationError)) {
+                    // Tool-unavailable is the one transient invocation error: the
+                    // workflow MCP server registers its surface asynchronously, so a
+                    // Unit's first call can race the registration. Fall through to the
+                    // bounded verification retry instead of pausing.
+                    debugLog("postUnit", { phase: "tool-unavailable-retry", unitType: s.currentUnit.type, unitId: s.currentUnit.id, error: s.lastToolInvocationError });
+                    ctx.ui.notify(`Tool unavailable for ${s.currentUnit.type}: ${s.lastToolInvocationError}. The tool surface may still be registering — retrying.`, "warning");
+                    s.lastToolInvocationError = null;
+                }
+                else if (s.lastToolInvocationError) {
                     const isUserSkip = /queued user message/i.test(s.lastToolInvocationError);
                     const errMsg = isUserSkip
                         ? `Tool skipped for ${s.currentUnit.type}: ${s.lastToolInvocationError}. Queued user message interrupted the turn — pausing auto-mode.`
@@ -1787,12 +1800,14 @@ export async function postUnitPreVerification(pctx, opts) {
                             }
                         }
                         s.exhaustedVerificationUnits.add(retryKey);
+                        saveCustomVerifyRetryCounts(s, { logFailure: err => debugLog("postUnit", { phase: "save-verify-retries-failed", error: err instanceof Error ? err.message : String(err) }) });
                         debugLog("postUnit", { phase: "artifact-verify-exhausted", unitType: s.currentUnit.type, unitId: s.currentUnit.id, attempt });
                         ctx.ui.notify(`${failureDetails} Pausing auto-mode after ${MAX_ARTIFACT_VERIFICATION_RETRIES} retries.`, "error");
                         await pauseAuto(ctx, pi);
                         return "dispatched";
                     }
                     s.verificationRetryCount.set(retryKey, attempt);
+                    saveCustomVerifyRetryCounts(s, { logFailure: err => debugLog("postUnit", { phase: "save-verify-retries-failed", error: err instanceof Error ? err.message : String(err) }) });
                     s.pendingVerificationRetry = {
                         unitId: s.currentUnit.id,
                         failureContext: `${failureDetails} (attempt ${attempt}/${MAX_ARTIFACT_VERIFICATION_RETRIES}).`,
@@ -1812,6 +1827,8 @@ export async function postUnitPreVerification(pctx, opts) {
                 }
                 s.verificationRetryCount.delete(retryKey);
                 s.verificationRetryFailureHashes.delete(retryKey);
+                s.exhaustedVerificationUnits.delete(retryKey);
+                saveCustomVerifyRetryCounts(s, { logFailure: err => debugLog("postUnit", { phase: "save-verify-retries-failed", error: err instanceof Error ? err.message : String(err) }) });
                 if (s.currentUnit.type === "complete-milestone") {
                     const { milestone: mid } = parseUnitId(s.currentUnit.id);
                     if (mid) {

package/dist/resources/extensions/gsd/auto-prompts.js

@@ -21,7 +21,7 @@ import { getPendingGatesForTurn } from "./gsd-db.js";
 import { assertGateCoverage, getGatesForTurn, } from "./gate-registry.js";
 import { formatDecisionsCompact, formatRequirementsCompact } from "./structured-data-formatter.js";
 import { readPhaseAnchor, formatAnchorForPrompt } from "./phase-anchor.js";
-import { composeContextModeInstructions, composeContractedUnitContext, composeInlinedContext, composeUnitContext, } from "./unit-context-composer.js";
+import { composeContextModeInstructions, composeContractedUnitContext, composeInlinedContext, composeToolSurfaceInstructions, composeUnitContext, } from "./unit-context-composer.js";
 import { resolveManifest } from "./unit-context-manifest.js";
 import { compileUnitContextContract } from "./tool-contract.js";
 import { readCompactionSnapshot } from "./compaction-snapshot.js";
@@ -33,7 +33,7 @@ import { debugLog } from "./debug-logger.js";
 import { buildSkillActivationBlock, buildSkillDiscoveryVars } from "./skill-activation.js";
 import { findMilestoneIds } from "./milestone-ids.js";
 import { buildRunUatPresentationForType, RUN_UAT_TOOL_PRESENTATION_PLAN_ID } from "./tool-presentation-plan.js";
-import { resolveEffectiveUatType, shouldDispatchUatForContent } from "./uat-policy.js";
+import { classifyUatContentForRun, shouldDispatchUatForContent, } from "./uat-policy.js";
 import { buildWebAppUatGuidanceBlock } from "./web-app-uat.js";
 export { buildSkillActivationBlock, buildSkillDiscoveryVars };
 // ─── Preamble Cap ─────────────────────────────────────────────────────────────
@@ -224,12 +224,14 @@ function renderContextModeBlockForPrompt(unitType, base, renderMode = "standalon
     return `${contextMode}\n\n## Context Snapshot\nSource: \`.gsd/last-snapshot.md\`\n\n${snapshot.trimEnd()}`;
 }
 function prependContextModeToBlock(unitType, base, block, renderMode = "standalone") {
+    const toolSurface = composeToolSurfaceInstructions(unitType, { renderMode });
     const contextMode = renderContextModeBlockForPrompt(unitType, base, renderMode);
-    if (!contextMode)
+    const guidance = [toolSurface, contextMode].filter(Boolean).join("\n\n");
+    if (!guidance)
         return block;
     if (!block.trim())
-        return contextMode;
-    return `${contextMode}\n\n${block}`;
+        return guidance;
+    return `${guidance}\n\n${block}`;
 }
 function requireUnitPromptContextContract(unitType) {
     const result = compileUnitContextContract(unitType);
@@ -841,7 +843,7 @@ export async function inlineDecisionsFromDb(base, milestoneId, scope, level) {
 }
 /**
  * Inline requirements with optional milestone and slice scoping from the DB.
- * Falls back to filesystem via inlineGsdRootFile when DB unavailable or empty.
+ * Falls back to filesystem via inlineGsdRootFile only when DB is unavailable.
  */
 export async function inlineRequirementsFromDb(base, milestoneId, sliceId, level) {
     const inlineLevel = level ?? resolveInlineLevel();
@@ -849,14 +851,28 @@ export async function inlineRequirementsFromDb(base, milestoneId, sliceId, level
         const { isDbAvailable } = await import("./gsd-db.js");
         if (isDbAvailable()) {
             const { queryRequirements, formatRequirementsForPrompt } = await import("./context-store.js");
-            const requirements = queryRequirements({ milestoneId, sliceId });
+            let requirements = queryRequirements({ milestoneId, sliceId });
+            let broadenedScope = false;
+            if (requirements.length === 0 && sliceId) {
+                requirements = queryRequirements({ milestoneId });
+                broadenedScope = true;
+            }
+            if (requirements.length === 0 && milestoneId) {
+                requirements = queryRequirements({ status: "active" });
+                broadenedScope = true;
+            }
             if (requirements.length > 0) {
-                // Use compact format for non-full levels to save ~40% tokens
-                const formatted = inlineLevel !== "full"
+                // Use compact format for non-full levels, milestone-scoped calls, and
+                // any cascade stage that broadened past the originally requested scope —
+                // a slice-scoped "full" call that fell through to the project-wide
+                // active fallback must not format those rows as full requirements.
+                const useCompact = inlineLevel !== "full" || !sliceId || broadenedScope;
+                const formatted = useCompact
                     ? formatRequirementsCompact(requirements)
                     : formatRequirementsForPrompt(requirements);
                 return `### Requirements\nSource: \`.gsd/REQUIREMENTS.md\`\n\n${formatted}`;
             }
+            return null;
         }
     }
     catch (err) {
@@ -1265,6 +1281,32 @@ export async function checkNeedsReassessment(base, mid, state) {
  * - No UAT file exists for the slice
  * - UAT result file already exists (idempotent — already ran)
  */
+/**
+ * Resolve the effective UAT mode for the dispatch gate the same way
+ * `buildRunUatPrompt` does: classify the UAT body with the slice's SUMMARY as
+ * supplemental context, so a `browser-executable` UAT whose slice references a
+ * self-contained harness (`npm run test:uat`, `search-uat.mjs`, `npx
+ * playwright test`) is promoted to `runtime-executable` for the gate too.
+ *
+ * Without this, `checkNeedsRunUat` returns `browser-executable` while the
+ * prompt instructs runtime-only execution, causing the dispatch gate to
+ * require browser tools / warm up the browser daemon (or stop dispatch when
+ * browser MCP is unavailable) for UAT runs that never touch the browser. See
+ * cursor[bot] review on PR #696 for the M007/S01 regression.
+ */
+async function resolveRunUatEffectiveType(base, mid, sliceId, uatContent) {
+    let summaryContent = "";
+    try {
+        const summaryPath = resolveSliceFile(base, mid, sliceId, "SUMMARY");
+        if (summaryPath) {
+            summaryContent = (await loadFile(summaryPath)) ?? "";
+        }
+    }
+    catch (err) {
+        logWarning("prompt", `resolveRunUatEffectiveType SUMMARY load failed: ${err instanceof Error ? err.message : String(err)}`);
+    }
+    return classifyUatContentForRun(uatContent, summaryContent).effectiveType;
+}
 export async function checkNeedsRunUat(base, mid, state, prefs) {
     // DB primary path — fall through to file-based when DB has no data for this milestone
     try {
@@ -1297,7 +1339,8 @@ export async function checkNeedsRunUat(base, mid, state, prefs) {
                     }
                     if (!shouldDispatchUatForContent(uatContent, prefs))
                         continue;
-                    return { sliceId: sid, uatType: resolveEffectiveUatType(uatContent) };
+                    const uatType = await resolveRunUatEffectiveType(base, mid, sid, uatContent);
+                    return { sliceId: sid, uatType };
                 }
                 return null;
             }
@@ -1338,7 +1381,8 @@ export async function checkNeedsRunUat(base, mid, state, prefs) {
         }
         if (!shouldDispatchUatForContent(uatContentFb, prefs))
             continue;
-        return { sliceId: uatSid, uatType: resolveEffectiveUatType(uatContentFb) };
+        const uatType = await resolveRunUatEffectiveType(base, mid, uatSid, uatContentFb);
+        return { sliceId: uatSid, uatType };
     }
     return null;
 }
@@ -2146,6 +2190,9 @@ export async function buildPlanSlicePrompt(mid, _midTitle, sid, sTitle, base, le
             `Either (a) add an earlier task that creates X on disk before the task that needs it, ` +
             `or (b) if this task IS the one that creates X, move X from inputs to expected_output. ` +
             `Do NOT put X in a task's expected_output if that task only reads or verifies X — only tasks that actually write X to disk should list it in expected_output.\n` +
+            `- **"[file] X: ... GSD planning artifacts are projections preloaded as context / written by workflow tools"**: ` +
+            `Remove X from the task's inputs, files, and expectedOutput entirely. Planning artifacts (anything under .gsd/, .planning/, or .audits/, or names like M001-CONTEXT.md / S01-PLAN.md) are preloaded as context and written by workflow tools — ` +
+            `do NOT add a task that creates X and do NOT move X to expectedOutput.\n` +
             `- **"[file] X: Task T_early reads X but it's created by task T_late (sequence violation)"**: ` +
             `Either (a) reorder tasks so T_late (the creator) runs before T_early (the reader), ` +
             `or (b) if T_late doesn't actually create X (it only reads/tests it), remove X from T_late's expected_output entirely.\n` +
@@ -3094,10 +3141,25 @@ export async function buildRunUatPrompt(mid, sliceId, uatPath, uatContent, base)
     const rawInlinedContext = `## Inlined Context (preloaded — do not re-read these files)\n\n${composedBody}`;
     const cappedInlinedContext = capPreamble(rawInlinedContext);
     trackPromptContext(contextTelemetry, "cap", cappedInlinedContext.length < rawInlinedContext.length ? "skipped" : "inline", null, cappedInlinedContext.length < rawInlinedContext.length ? `dropped ${rawInlinedContext.length - cappedInlinedContext.length} chars` : "within budget");
-    const inlinedContext = prependContextModeToBlock("run-uat", base, cappedInlinedContext);
+    const uatPolicy = classifyUatContentForRun(uatContent, cappedInlinedContext);
+    const uatType = uatPolicy.effectiveType;
+    const runtimeHarnessOverride = uatPolicy.declaredType === "browser-executable" && uatType === "runtime-executable"
+        ? [
+            "## Runtime harness override",
+            "",
+            "This UAT declares `browser-executable` but the slice references a self-contained verification command (`npm run test:uat`, `search-uat.mjs`, or similar).",
+            "Run **only** that command via `gsd_uat_exec` with `uat-runtime-check` intent.",
+            "Do **not** call `uat-service-start`, do **not** run `npm run start`, `npm run test:server`, or any separate server command.",
+            "Do **not** use `browser_navigate` or other `browser_*` tools — the harness already exercises the browser.",
+            "When the harness exits 0, save **PASS** with `uatType: \"runtime-executable\"` (the effective mode above, not the UAT file header) and **runtime** check modes only.",
+            "",
+        ].join("\n")
+        : "";
+    const inlinedContext = prependContextModeToBlock("run-uat", base, runtimeHarnessOverride
+        ? `${runtimeHarnessOverride}\n${cappedInlinedContext}`
+        : cappedInlinedContext);
     emitPromptContextTelemetry("run-uat", contextTelemetry, inlinedContext);
     const uatResultPath = join(base, relSliceFile(base, mid, sliceId, "ASSESSMENT"));
-    const uatType = resolveEffectiveUatType(uatContent);
     const canonicalPresentation = JSON.stringify(buildRunUatPresentationForType(uatType), null, 2);
     return loadPrompt("run-uat", {
         workingDirectory: base,
@@ -3338,18 +3400,18 @@ opts) {
     }
     const inlinedTemplates = inlineTemplate("task-summary", "Task Summary");
     trackPromptContext(contextTelemetry, "templates", "inline", inlinedTemplates);
-    const prompt = loadPrompt("reactive-execute", {
+    const prompt = prependContextModeToBlock("reactive-execute", base, loadPrompt("reactive-execute", {
         workingDirectory: base,
         milestoneId: mid,
         milestoneTitle: midTitle,
         sliceId: sid,
         sliceTitle: sTitle,
-        graphContext: prependContextModeToBlock("reactive-execute", base, graphContext),
+        graphContext,
         readyTaskCount: String(readyTaskIds.length),
         readyTaskList: readyTaskListLines.join("\n"),
         subagentPrompts: subagentSections.join("\n\n---\n\n"),
         inlinedTemplates,
-    });
+    }));
     emitPromptContextTelemetry("reactive-execute", contextTelemetry, prompt);
     return prompt;
 }
@@ -3489,17 +3551,17 @@ export async function buildGateEvaluatePrompt(mid, midTitle, sid, sTitle, base,
             "```",
         ].join("\n"));
     }
-    return loadPrompt("gate-evaluate", {
+    return prependContextModeToBlock("gate-evaluate", base, loadPrompt("gate-evaluate", {
         workingDirectory: base,
         milestoneId: mid,
         milestoneTitle: midTitle,
         sliceId: sid,
         sliceTitle: sTitle,
-        slicePlanContent: prependContextModeToBlock("gate-evaluate", base, planContent),
+        slicePlanContent: planContent,
         gateCount: String(pending.length),
         gateList: gateListLines.join("\n"),
         subagentPrompts: subagentSections.join("\n\n---\n\n"),
-    });
+    }));
 }
 export async function buildRewriteDocsPrompt(mid, midTitle, activeSlice, base, overrides) {
     const sid = activeSlice?.id;