@opengsd/gsd-pi 1.2.0-dev.fb12b103 → 1.2.0-dev.fbdca60b

package/src/resources/extensions/gsd/auto/orchestrator.ts

@@ -22,7 +22,7 @@ type BlockedAdvanceResult = Extract<AutoAdvanceResult, { kind: "blocked" }>;
 import { debugCount, debugLog, debugTime } from "../debug-logger.js";
 import { reconcileBeforeDispatch } from "../state-reconciliation.js";
 import { isLegalEdge, IllegalPhaseTransitionError } from "../state-transition-matrix.js";
-import { resolveDispatch } from "../auto-dispatch.js";
+import { hasPendingDeepStage, resolveDispatch } from "../auto-dispatch.js";
 import { classifyFailure } from "../recovery-classification.js";
 import { verifyExpectedArtifact, refreshRecoveryDbForArtifact } from "../auto-recovery.js";
 import { invalidateAllCaches } from "../cache.js";
@@ -64,24 +64,22 @@ import {
 import { refreshWorkflowDatabaseFromDisk } from "../db-workspace.js";
 import { getErrorMessage } from "../error-utils.js";
 import { logWarning } from "../workflow-logger.js";
+import { normalizeRealPath } from "../paths.js";
+import {
+  buildDispatchKey,
+  createDispatchHistory,
+  STUCK_WINDOW_SIZE,
+  type DispatchHistory,
+} from "./dispatch-history.js";
 import { existsSync, readFileSync } from "node:fs";
 import { join } from "node:path";
 import { evaluateAllCompleteSettlement } from "../milestone-settlement.js";
+import { hasHeldMilestoneLease, reclaimMissingMilestoneLease } from "./milestone-lease-reclaim.js";
 
 function now(): number {
   return Date.now();
 }
 
-/**
- * Size of the dispatch-decision ring buffer used by the Auto Orchestration
- * module's stuck-loop detector. When the same `${unitType}:${unitId}` key
- * fills the window, advance() blocks with `action: "stop"`.
- *
- * Mirrors the legacy `STUCK_WINDOW_SIZE` in auto/phases.ts so behaviour is
- * preserved across the eventual cutover (issue #5791).
- */
-export const STUCK_WINDOW_SIZE = 6;
-
 function noRemainingUnitsOutcome(stateSnapshot: GSDState): AutoTerminalOutcome {
   if (stateSnapshot.phase === "complete") {
     return {
@@ -196,14 +194,26 @@ export async function decideOrchestratorDispatch(
 ): Promise<DispatchDecision> {
   const state = input.stateSnapshot;
   const active = state.activeMilestone;
-  if (!active) return null;
-
   const activeSession = input.session ?? session;
   const activeDispatchBasePath = activeSession?.basePath || dispatchBasePath;
-  if (activeSession && shouldAdoptActiveMilestone(state, activeSession, activeDispatchBasePath)) {
+  const prefs = loadEffectiveGSDPreferences(activeDispatchBasePath)?.preferences;
+  if (!active) {
+    if (state.phase !== "pre-planning") return null;
+    if (!hasPendingDeepStage(prefs, activeDispatchBasePath)) {
+      return {
+        kind: "blocked",
+        reason: state.nextAction || "No active milestone. Run /gsd unpark <id> or create a new milestone.",
+        action: "stop",
+      };
+    }
+  }
+
+  if (active && activeSession && shouldAdoptActiveMilestone(state, activeSession, activeDispatchBasePath)) {
     activeSession.currentMilestoneId = active.id;
+    activeSession.milestoneLeaseToken = null;
   }
-  const prefs = loadEffectiveGSDPreferences(activeDispatchBasePath)?.preferences;
+  const dispatchMid = active?.id ?? activeSession?.currentMilestoneId ?? "";
+  const dispatchMidTitle = active?.title ?? "";
 
   // Derive session-derived dispatch inputs the same way phases.ts:runDispatch does
   // (#5789). Prefer caller-supplied values when present so test harnesses and
@@ -235,8 +245,15 @@ export async function decideOrchestratorDispatch(
         ? "true"
         : "false");
 
+  // Only replay a milestone-scoped verification retry when a milestone is
+  // active. Pre-PR (#712 fix), `!active` returned null before reaching this
+  // block, so the retry was preserved for a future tick. The new
+  // pre-planning + deep-pending fall-through must keep that contract:
+  // otherwise a stale execute-task / complete-slice / complete-milestone
+  // retry whose target milestone has since been parked would preempt
+  // project-level deep rules like `discuss-project`.
   const pendingRetry = session?.pendingVerificationRetryDispatch;
-  if (session && pendingRetry) {
+  if (session && pendingRetry && active) {
     session.pendingVerificationRetryDispatch = null;
     const alreadyClosedReason = getAlreadyClosedDispatchReason(
       pendingRetry.unitType,
@@ -258,8 +275,8 @@ export async function decideOrchestratorDispatch(
 
   const action = await resolveDispatch({
     basePath: activeDispatchBasePath,
-    mid: active.id,
-    midTitle: active.title,
+    mid: dispatchMid,
+    midTitle: dispatchMidTitle,
     state,
     prefs,
     session: activeSession,
@@ -303,8 +320,8 @@ export async function decideOrchestratorDispatch(
       prompt: action.prompt,
       pauseAfterUatDispatch: action.pauseAfterDispatch ?? false,
       state,
-      mid: active.id,
-      midTitle: active.title,
+      mid: dispatchMid,
+      midTitle: dispatchMidTitle,
     };
     session.pendingOrchestrationDispatch = pending;
   }
@@ -330,7 +347,9 @@ export class AutoOrchestrator implements AutoOrchestrationModule {
   private seq = 0;
   private lastAdvanceKey: string | null = null;
   private lastFinalizedUnitKey: string | null = null;
-  private dispatchKeyWindow: string[] = [];
+  // Dispatch History module (#482): the dispatch-decision window with
+  // cross-session DB rehydration and full detect-stuck rules.
+  private readonly dispatchHistory: DispatchHistory;
   // ADR-030 Phase Transition Invariant: the prior advance's reconciled Phase,
   // the "from" endpoint of the edge check. In-memory; reset on start/resume/stop
   // so the first advance of a session has no edge to assert.
@@ -347,6 +366,16 @@ export class AutoOrchestrator implements AutoOrchestrationModule {
     this.runtimeBasePath = context.runtimeBasePath;
     this.s = context.session;
     this.flowId = `auto-orchestrator-${Date.now()}`;
+    this.dispatchHistory = createDispatchHistory({
+      windowSize: STUCK_WINDOW_SIZE,
+      // Same stable scope the auto-loop uses for stuck-state persistence so
+      // rehydration reads the rows the dispatch ledger wrote for this project.
+      resolveScopeId: () =>
+        normalizeRealPath(
+          this.s.scope?.workspace.projectRoot ??
+            (this.s.originalBasePath || this.s.basePath || this.runtimeBasePath),
+        ) || null,
+    });
   }
 
   // ── Live base-path resolution (was the wiring factory's getLiveDispatchBasePath) ──
@@ -582,6 +611,37 @@ export class AutoOrchestrator implements AutoOrchestrationModule {
     };
   }
 
+  private async mergePendingCompleteMilestone(milestoneId: string): Promise<{ ok: true } | { ok: false; reason: string }> {
+    const result = this.buildLifecycle().exitMilestone(
+      milestoneId,
+      { merge: true },
+      this.ctx.ui,
+    );
+    if (!result.ok) {
+      const detail = result.cause instanceof Error
+        ? result.cause.message
+        : result.reason;
+      return {
+        ok: false,
+        reason: `Milestone ${milestoneId} is complete, but the system-owned merge failed: ${detail}`,
+      };
+    }
+
+    this.s.milestoneMergedInPhases = true;
+    this.s.milestoneSettlement = { ok: true, reason: "settled" };
+    try {
+      const projectRoot = this.s.originalBasePath || this.s.canonicalProjectRoot || this.runtimeBasePath;
+      const { rebuildMarkdownProjectionsFromDb } = await import("../commands-maintenance.js");
+      await rebuildMarkdownProjectionsFromDb(projectRoot);
+    } catch (err) {
+      logWarning(
+        "engine",
+        `markdown projection rebuild after settlement merge failed: ${err instanceof Error ? err.message : String(err)}`,
+      );
+    }
+    return { ok: true };
+  }
+
   private clearPendingDispatch(): void {
     this.s.pendingOrchestrationDispatch = null;
   }
@@ -661,9 +721,6 @@ export class AutoOrchestrator implements AutoOrchestrationModule {
         reason: `No Unit manifest is registered for ${unitType}`,
       };
     }
-    if (isolationMode !== "worktree") {
-      return { ok: true, reason: "not-required" };
-    }
     const writeScope =
       manifest.tools.mode === "all" || manifest.tools.mode === "docs"
         ? "source-writing"
@@ -672,7 +729,23 @@ export class AutoOrchestrator implements AutoOrchestrationModule {
     const activeBasePath = this.getLiveDispatchBasePath();
     const snapshot = await deriveState(activeBasePath);
     const milestoneId = snapshot.activeMilestone?.id ?? null;
-    const expectedBranch = milestoneId ? autoWorktreeBranch(milestoneId) : null;
+    const buildExpectedBranch = (mode: ReturnType<typeof getIsolationMode>) =>
+      mode !== "none" && milestoneId ? autoWorktreeBranch(milestoneId) : null;
+    // The milestone lease coordinates concurrent workers on an isolated
+    // milestone worktree/branch. `none` mode has no per-milestone isolation
+    // and does not reliably claim a lease, so requiring one there would
+    // falsely fail dispatch; enforce it only in isolated modes.
+    const buildLease = (mode: ReturnType<typeof getIsolationMode>) =>
+      milestoneId && this.s.workerId
+        ? {
+            required: writeScope === "source-writing" && mode !== "none",
+            held: hasHeldMilestoneLease(this.s, milestoneId),
+            owner: this.s.workerId,
+          }
+        : undefined;
+    if (writeScope === "source-writing") {
+      reclaimMissingMilestoneLease(this.s, milestoneId, isolationMode, "orchestrator");
+    }
     let result = safety.validateUnitRoot({
       unitType,
       unitId,
@@ -681,7 +754,8 @@ export class AutoOrchestrator implements AutoOrchestrationModule {
       unitRoot: activeBasePath,
       milestoneId,
       isolationMode,
-      expectedBranch,
+      expectedBranch: buildExpectedBranch(isolationMode),
+      lease: buildLease(isolationMode),
     });
     if (!result.ok) {
       const repaired = await repairAutoWorktreeSafetyFailure({
@@ -698,16 +772,20 @@ export class AutoOrchestrator implements AutoOrchestrationModule {
           this.rebuildScope(this.s.basePath, this.s.currentMilestoneId);
           return { ok: true };
         },
-        revalidate: () => safety.validateUnitRoot({
-          unitType,
-          unitId,
-          writeScope,
-          projectRoot: this.runtimeBasePath,
-          unitRoot: this.getLiveDispatchBasePath(),
-          milestoneId,
-          isolationMode: this.getEffectiveUnitIsolationMode(this.runtimeBasePath),
-          expectedBranch,
-        }),
+        revalidate: () => {
+          const revalidatedMode = this.getEffectiveUnitIsolationMode(this.runtimeBasePath);
+          return safety.validateUnitRoot({
+            unitType,
+            unitId,
+            writeScope,
+            projectRoot: this.runtimeBasePath,
+            unitRoot: this.getLiveDispatchBasePath(),
+            milestoneId,
+            isolationMode: revalidatedMode,
+            expectedBranch: buildExpectedBranch(revalidatedMode),
+            lease: buildLease(revalidatedMode),
+          });
+        },
       });
       result = repaired.result;
       if (result.ok) {
@@ -765,7 +843,7 @@ export class AutoOrchestrator implements AutoOrchestrationModule {
    * skipped result) instead of stopping.
    */
   private tryStuckArtifactRecovery(unitType: string, unitId: string): boolean {
-    const key = `${unitType}:${unitId}`;
+    const key = buildDispatchKey(unitType, unitId);
     if (this.lastStuckRecoveryKey === key) return false; // already tried this episode
     const basePath = this.getLiveDispatchBasePath();
     if (!verifyExpectedArtifact(unitType, unitId, basePath)) return false;
@@ -777,7 +855,7 @@ export class AutoOrchestrator implements AutoOrchestrationModule {
     if (!refreshed.ok && refreshed.fatal) return false;
     this.lastStuckRecoveryKey = key;
     invalidateAllCaches();
-    this.dispatchKeyWindow = [];
+    this.dispatchHistory.clearOnRecovery();
     this.lastAdvanceKey = null;
     this.lastFinalizedUnitKey = null;
     return true;
@@ -808,7 +886,12 @@ export class AutoOrchestrator implements AutoOrchestrationModule {
   public async start(_sessionContext: AutoSessionContext): Promise<AutoAdvanceResult> {
     this.lastAdvanceKey = null;
     this.lastFinalizedUnitKey = null;
-    this.dispatchKeyWindow = [];
+    // #482: the DB dispatch ledger is the source of truth across sessions.
+    // Discard any in-memory window and rebuild it from the ledger so a unit
+    // that was re-dispatched in previous sessions is detected as stuck here
+    // instead of silently re-dispatching forever.
+    this.dispatchHistory.clearOnRecovery();
+    this.dispatchHistory.rehydrate();
     this.lastStuckRecoveryKey = null;
     this.lastDerivedPhase = null;
     this.status.phase = "running";
@@ -910,10 +993,39 @@ export class AutoOrchestrator implements AutoOrchestrationModule {
       if (!decision) {
         const settlementBlock = this.evaluateNoRemainingUnitsSettlement(reconciliation.stateSnapshot);
         if (settlementBlock) {
+          const settlement = this.s.milestoneSettlement;
+          if (settlement && !settlement.ok && settlement.reason === "merge-pending") {
+            const merged = await this.mergePendingCompleteMilestone(settlement.milestoneId);
+            if (merged.ok) {
+              const terminalOutcome = noRemainingUnitsOutcome(reconciliation.stateSnapshot);
+              const stopped: AutoAdvanceResult = {
+                kind: "stopped",
+                reason: terminalOutcome.displayReason,
+                stateSnapshot: reconciliation.stateSnapshot,
+                terminalOutcome,
+              };
+              this.status.phase = "stopped";
+              this.status.activeUnit = undefined;
+              this.lastAdvanceKey = null;
+              this.dispatchHistory.clearOnRecovery();
+              this.bumpTransition();
+              this.journalTransition({ name: "advance-stopped", reason: stopped.reason });
+              this.postAdvanceRecord(stopped);
+              return stopped;
+            }
+            settlementBlock.reason = merged.reason;
+            settlementBlock.terminalOutcome = {
+              code: "settlement-blocked",
+              displayReason: merged.reason,
+              nextAction: `Fix the merge failure, then retry \`/gsd dispatch complete-milestone ${settlement.milestoneId}\`.`,
+              milestoneId: settlement.milestoneId,
+              allMilestonesComplete: false,
+            };
+          }
           this.status.phase = "paused";
           this.status.activeUnit = undefined;
           this.lastAdvanceKey = null;
-          this.dispatchKeyWindow = [];
+          this.dispatchHistory.clearOnRecovery();
           this.bumpTransition();
           this.journalTransition({ name: "advance-blocked", reason: settlementBlock.reason });
           this.postAdvanceRecord(settlementBlock);
@@ -929,7 +1041,7 @@ export class AutoOrchestrator implements AutoOrchestrationModule {
         this.status.phase = "stopped";
         this.status.activeUnit = undefined;
         this.lastAdvanceKey = null;
-        this.dispatchKeyWindow = [];
+        this.dispatchHistory.clearOnRecovery();
         this.bumpTransition();
         this.journalTransition({ name: "advance-stopped", reason: stopped.reason });
         this.postAdvanceRecord(stopped);
@@ -979,18 +1091,13 @@ export class AutoOrchestrator implements AutoOrchestrationModule {
         return blocked;
       }
 
-      const nextKey = `${decision.unitType}:${decision.unitId}`;
-
-      // Record every dispatch decision in the ring buffer before pre-flight
+      // Record every dispatch decision in the history window before pre-flight
       // checks so the stuck-loop detector observes the full decision history
       // (including decisions that idempotency would otherwise short-circuit).
-      // The ring is capped at STUCK_WINDOW_SIZE and evicts oldest-first.
-      this.dispatchKeyWindow.push(nextKey);
-      if (this.dispatchKeyWindow.length > STUCK_WINDOW_SIZE) {
-        this.dispatchKeyWindow.shift();
-      }
+      // The window is capped at STUCK_WINDOW_SIZE and evicts oldest-first.
+      const nextKey = this.dispatchHistory.recordDispatch(decision.unitType, decision.unitId);
 
-      const matchingCount = this.dispatchKeyWindow.filter((k) => k === nextKey).length;
+      const matchingCount = this.dispatchHistory.countMatching(nextKey);
       if (this.lastFinalizedUnitKey === nextKey) {
         // #442: the unit re-dispatched immediately after finalizing may have
         // actually completed on disk with a stale DB. Verify + recover before
@@ -1037,11 +1144,18 @@ export class AutoOrchestrator implements AutoOrchestrationModule {
         return skipped;
       }
 
-      // Stuck-loop detection: when the ring is saturated with copies of
-      // `nextKey` (count >= STUCK_WINDOW_SIZE), the orchestrator has been
-      // picking the same unit across the whole window and must hard-stop with
-      // a diagnosable reason.
-      if (matchingCount >= STUCK_WINDOW_SIZE) {
+      // Stuck-loop detection: when the window is saturated with copies of
+      // `nextKey` (count >= STUCK_WINDOW_SIZE), consult the Dispatch History
+      // module's full detect-stuck rule set for the verdict instead of the old
+      // bare saturation count. This keeps the saturation threshold (the window
+      // deliberately records benign idempotent repeats, so earlier-firing
+      // rules would false-positive on pause/resume re-advances) while gaining
+      // retry-budget suppression and diagnosable rule reasons. A saturated
+      // window with no verdict means the dispatch ledger says we are inside
+      // the unit's retry-backoff budget — let the retry proceed.
+      const stuckVerdict =
+        matchingCount >= STUCK_WINDOW_SIZE ? this.dispatchHistory.detectStuck() : null;
+      if (stuckVerdict) {
         // #442: before declaring a stuck loop, verify the unit didn't actually
         // complete on disk (stale DB) and recover if so — legacy graduated
         // stuck-recovery parity. Otherwise hard-stop with a diagnosable reason.
@@ -1052,7 +1166,7 @@ export class AutoOrchestrator implements AutoOrchestrationModule {
         this.clearPendingDispatch();
         const blocked: AutoAdvanceResult = {
           kind: "blocked",
-          reason: `stuck-loop: ${nextKey} picked ${matchingCount} times`,
+          reason: `stuck-loop: ${stuckVerdict.reason}`,
           action: "stop",
         };
         this.journalTransition({
@@ -1146,7 +1260,7 @@ export class AutoOrchestrator implements AutoOrchestrationModule {
       if (result.kind === "stopped") {
         this.lastAdvanceKey = null;
         this.lastFinalizedUnitKey = null;
-        this.dispatchKeyWindow = [];
+        this.dispatchHistory.clearOnRecovery();
         this.status.activeUnit = undefined;
       }
       this.bumpTransition();
@@ -1175,8 +1289,14 @@ export class AutoOrchestrator implements AutoOrchestrationModule {
   public async resume(): Promise<AutoAdvanceResult> {
     this.lastAdvanceKey = null;
     this.lastFinalizedUnitKey = null;
-    // Preserve dispatchKeyWindow across resume so stuck-loop detection
-    // accumulates across pause/resume cycles rather than resetting each time.
+    // Preserve the dispatch-history window across an in-process resume so
+    // stuck-loop detection accumulates across pause/resume cycles rather than
+    // resetting each time (#572 regression). When the window is empty (fresh
+    // orchestrator resuming a prior session), rehydrate it from the DB
+    // dispatch ledger so cross-session re-dispatch loops are detected (#482).
+    if (this.dispatchHistory.getRecentWindow().length === 0) {
+      this.dispatchHistory.rehydrate();
+    }
     this.lastStuckRecoveryKey = null;
     // ADR-030: drop the prior "from" — the first advance after resume has no
     // edge to assert (avoids a false illegal-edge across the pause boundary).
@@ -1198,10 +1318,10 @@ export class AutoOrchestrator implements AutoOrchestrationModule {
     this.lastAdvanceKey = null;
     this.lastFinalizedUnitKey = null;
     this.lastDerivedPhase = null;
-    // Preserve dispatchKeyWindow on pause so stuck-loop detection accumulates
-    // across pause/resume cycles. Only clear on a hard stop.
+    // Preserve the dispatch-history window on pause so stuck-loop detection
+    // accumulates across pause/resume cycles. Only clear on a hard stop.
     if (reason !== "pause") {
-      this.dispatchKeyWindow = [];
+      this.dispatchHistory.clearOnRecovery();
     }
     this.lastStuckRecoveryKey = null;
     this.bumpTransition();
@@ -1215,9 +1335,9 @@ export class AutoOrchestrator implements AutoOrchestrationModule {
   }
 
   public async completeActiveUnit(unit: { unitType: string; unitId: string }): Promise<void> {
-    const unitKey = `${unit.unitType}:${unit.unitId}`;
+    const unitKey = buildDispatchKey(unit.unitType, unit.unitId);
     const activeUnitKey = this.status.activeUnit
-      ? `${this.status.activeUnit.unitType}:${this.status.activeUnit.unitId}`
+      ? buildDispatchKey(this.status.activeUnit.unitType, this.status.activeUnit.unitId)
       : null;
     if (activeUnitKey !== unitKey) return;
 
@@ -1235,9 +1355,9 @@ export class AutoOrchestrator implements AutoOrchestrationModule {
   }
 
   public async retryActiveUnit(unit: { unitType: string; unitId: string }): Promise<void> {
-    const unitKey = `${unit.unitType}:${unit.unitId}`;
+    const unitKey = buildDispatchKey(unit.unitType, unit.unitId);
     const activeUnitKey = this.status.activeUnit
-      ? `${this.status.activeUnit.unitType}:${this.status.activeUnit.unitId}`
+      ? buildDispatchKey(this.status.activeUnit.unitType, this.status.activeUnit.unitId)
       : null;
     if (activeUnitKey !== unitKey && this.lastFinalizedUnitKey !== unitKey) return;
 

package/src/resources/extensions/gsd/auto/phase-helpers.ts

@@ -0,0 +1,199 @@
+// Project/App: gsd-pi
+// File Purpose: Shared helpers used across auto-loop phase modules.
+
+import { setRuntimeKv } from "../db/runtime-kv.js";
+import { debugLog } from "../debug-logger.js";
+import { normalizeRealPath } from "../paths.js";
+import { resolveWorktreeProjectRoot, normalizeWorktreePathForCompare } from "../worktree-root.js";
+import { decideVerificationRetry, verificationRetryKey } from "./verification-retry-policy.js";
+import type { AutoSession } from "./session.js";
+import type { IterationContext, IterationData, LoopState, PhaseResult } from "./types.js";
+import type { Phase } from "../types.js";
+
+const STUCK_RECOVERY_ATTEMPTS_KEY = "stuck_recovery_attempts";
+
+/** Compare two paths for physical identity, tolerating trailing slashes and symlinks. */
+export function isSamePathLocal(a: string, b: string): boolean {
+  return normalizeWorktreePathForCompare(a) === normalizeWorktreePathForCompare(b);
+}
+
+export function isIsolatedWorktreeSession(s: AutoSession): boolean {
+  return Boolean(s.originalBasePath)
+    && Boolean(s.basePath)
+    && !isSamePathLocal(s.originalBasePath, s.basePath);
+}
+
+export function persistStuckRecoveryAttempts(s: AutoSession, loopState: LoopState): void {
+  const scopeId = normalizeRealPath(
+    s.scope?.workspace.projectRoot ?? (s.originalBasePath || s.basePath),
+  );
+  if (!scopeId) return;
+  try {
+    setRuntimeKv("global", scopeId, STUCK_RECOVERY_ATTEMPTS_KEY, loopState.stuckRecoveryAttempts);
+  } catch (err) {
+    debugLog("autoLoop", {
+      phase: "save-stuck-state-failed",
+      error: err instanceof Error ? err.message : String(err),
+    });
+  }
+}
+
+export async function applyVerificationRetryPolicy(
+  ic: IterationContext,
+  unitType: string | undefined,
+  phase: "artifact-verification-retry" | "verification-retry" | "pre-execution-retry",
+): Promise<PhaseResult | null> {
+  const { ctx, pi, s, deps } = ic;
+  const retryInfo = s.pendingVerificationRetry;
+  const key = unitType && retryInfo
+    ? verificationRetryKey(unitType, retryInfo.unitId)
+    : undefined;
+  const decision = decideVerificationRetry({
+    unitType,
+    retryInfo,
+    previousFailureHash: key ? s.verificationRetryFailureHashes.get(key) : undefined,
+  });
+
+  if (decision.action === "pause") {
+    s.pendingVerificationRetry = null;
+    debugLog("autoLoop", {
+      phase: `${phase}-paused`,
+      reason: decision.reason,
+      unitType,
+      unitId: retryInfo?.unitId,
+      failureHash: decision.failureHash,
+    });
+    ctx.ui.notify(
+      decision.reason === "duplicate-failure-context"
+        ? `Verification retry for ${unitType ?? "unit"} ${retryInfo?.unitId ?? "unknown"} produced the same failure context. Pausing auto-mode instead of re-dispatching.`
+        : "Verification retry requested without retry context. Pausing auto-mode instead of re-dispatching.",
+      "warning",
+    );
+    await deps.pauseAuto(ctx, pi);
+    return { action: "break", reason: decision.reason };
+  }
+
+  s.verificationRetryFailureHashes.set(decision.key, decision.failureHash);
+  debugLog("autoLoop", {
+    phase: `${phase}-backoff`,
+    iteration: ic.iteration,
+    unitType,
+    unitId: retryInfo?.unitId,
+    attempt: retryInfo?.attempt,
+    delayMs: decision.delayMs,
+    baseDelayMs: decision.baseDelayMs,
+    failureHash: decision.failureHash,
+  });
+  await new Promise<void>((resolve) => setTimeout(resolve, decision.delayMs));
+  return null;
+}
+
+export function rememberRetryDispatch(
+  s: AutoSession,
+  unit: { type: string; id: string } | null,
+  iterData: IterationData,
+): void {
+  if (!unit) return;
+  s.pendingVerificationRetryDispatch = {
+    unitType: unit.type,
+    unitId: unit.id,
+    prompt: iterData.prompt,
+    pauseAfterUatDispatch: iterData.pauseAfterUatDispatch,
+    state: iterData.state,
+    mid: iterData.mid,
+    midTitle: iterData.midTitle,
+  };
+}
+
+/**
+ * Resolve the base path for milestone reports.
+ * Prefers originalBasePath (project root) over basePath (which may be a worktree).
+ */
+export function _resolveReportBasePath(s: Pick<AutoSession, "originalBasePath" | "basePath">): string {
+  return resolveWorktreeProjectRoot(s.basePath, s.originalBasePath);
+}
+
+/**
+ * Resolve the authoritative project base for dispatch guards.
+ * Prior-milestone completion lives at the project root, even when the active
+ * unit is running inside an auto worktree.
+ */
+export function _resolveDispatchGuardBasePath(
+  s: Pick<AutoSession, "originalBasePath" | "basePath">,
+): string {
+  return resolveWorktreeProjectRoot(s.basePath, s.originalBasePath);
+}
+
+const PLAN_V2_GATE_PHASES: ReadonlySet<Phase> = new Set([
+  "executing",
+  "summarizing",
+  "validating-milestone",
+  "completing-milestone",
+]);
+
+export function shouldRunPlanV2Gate(phase: Phase): boolean {
+  return PLAN_V2_GATE_PHASES.has(phase);
+}
+
+export function _resolveCurrentUnitStartedAtForTest(
+  currentUnit: { startedAt: number } | null | undefined,
+): number | undefined {
+  return currentUnit?.startedAt;
+}
+
+export async function emitCancelledUnitEnd(
+  ic: IterationContext,
+  unitType: string,
+  unitId: string,
+  unitStartSeq: number,
+  errorContext?: { message: string; category: string; stopReason?: string; isTransient?: boolean; retryAfterMs?: number },
+): Promise<void> {
+  ic.deps.emitJournalEvent({
+    ts: new Date().toISOString(),
+    flowId: ic.flowId,
+    seq: ic.nextSeq(),
+    eventType: "unit-end",
+    data: {
+      unitType,
+      unitId,
+      status: "cancelled",
+      artifactVerified: false,
+      ...(errorContext ? { errorContext } : {}),
+    },
+    causedBy: { flowId: ic.flowId, seq: unitStartSeq },
+  });
+}
+
+export function _buildCancelledUnitStopReason(
+  unitType: string,
+  unitId: string,
+  errorContext?: { message: string; category: string },
+): {
+  notifyMessage: string;
+  stopReason: string;
+  loopReason: "session-failed" | "unit-aborted";
+} {
+  const cancellationMessage = errorContext?.message ?? "unknown";
+  const isSessionCreationFailure = errorContext?.category === "session-failed";
+
+  if (isSessionCreationFailure) {
+    return {
+      notifyMessage: `Session creation failed for ${unitType} ${unitId}: ${cancellationMessage}. Stopping auto-mode.`,
+      stopReason: `Session creation failed: ${cancellationMessage}`,
+      loopReason: "session-failed",
+    };
+  }
+
+  return {
+    notifyMessage: `Unit ${unitType} ${unitId} aborted after dispatch: ${cancellationMessage}. Stopping auto-mode.`,
+    stopReason: `Unit aborted: ${cancellationMessage}`,
+    loopReason: "unit-aborted",
+  };
+}
+
+export function _isPauseOriginCancelledResult(
+  isPaused: boolean,
+  errorContext?: { message: string; category: string },
+): boolean {
+  return isPaused && !errorContext;
+}