@opengsd/gsd-pi 1.2.0-dev.fbdca60b → 1.3.0-dev.65546769

package/src/resources/extensions/gsd/tests/auto-orchestrator.test.ts

@@ -165,7 +165,7 @@ function makeFixture(opts: FixtureOptions = {}): Fixture {
   session.resourceVersionOnStart = null;
 
   const ctx: OrchestratorContext = {
-    ctx: { model: {}, modelRegistry: { getAll: () => [] }, ui: { notify() {} } } as never,
+    ctx: { model: {}, modelRegistry: { getAll: () => [], getAvailable: () => [] }, ui: { notify() {} } } as never,
     pi: { getActiveTools: () => [] } as never,
     dispatchBasePath: base,
     runtimeBasePath: base,
@@ -920,15 +920,21 @@ test("stuck-loop: stop('user-request') resets the ring (hard stop)", async (t) =
   assert.equal(next.kind, "advanced");
 });
 
-test("stuck-loop #482 regression: start() rehydrates the window from the dispatch ledger so cross-session re-dispatch loops are detected", async (t) => {
+test("stuck-loop #852 fix: start() does NOT rehydrate so prior-session failures cannot false-positive on a fresh session", async (t) => {
   const f = makeFixture();
   t.after(() => f.cleanup());
 
-  // Simulate a PRIOR session: the dispatch ledger recorded the same unit
-  // being re-dispatched repeatedly without progress. The orchestrator under test is a
-  // fresh instance (as it would be after a session restart) — before the
-  // Dispatch History module, start() reset the window to [] and the loop
-  // would silently re-dispatch the unit forever (#482: 146 re-dispatches).
+  // Simulate a PRIOR session: STUCK_WINDOW_SIZE-1 consecutive dispatches of
+  // the same unit, all failed. Before #852 was fixed, start() would rehydrate
+  // these stale entries and the very next advance() would declare stuck —
+  // killing the new session before a single dispatch ran. The fix: start()
+  // clears the window WITHOUT rehydrating, so prior-session failures are
+  // invisible to the fresh session.
+  //
+  // Cross-session stuck detection is preserved by resume() (which rehydrates
+  // when the window is empty after a crash) and by within-session accumulation
+  // (STUCK_WINDOW_SIZE dispatches of the same unit within one session still
+  // trigger stuck detection). See the resume() test below.
   const worker = registerAutoWorker({ projectRootRealpath: normalizeRealPath(f.base) });
   const lease = claimMilestoneLease(worker, "M001");
   assert.equal(lease.ok, true);
@@ -950,13 +956,10 @@ test("stuck-loop #482 regression: start() rehydrates the window from the dispatc
   const started = await f.orchestrator.start(SESSION_CONTEXT);
   assert.equal(started.kind, "started");
 
-  // The very next decision for the same unit must trip the stuck verdict
-  // instead of advancing.
+  // The fresh session must advance past the prior-session history: window is
+  // empty after start(), so the first advance dispatches normally.
   const result = await f.orchestrator.advance();
-  assert.equal(result.kind, "blocked");
-  if (result.kind !== "blocked") return;
-  assert.equal(result.action, "stop");
-  assert.ok(result.reason.startsWith("stuck-loop:"), `expected stuck-loop reason, got: ${result.reason}`);
+  assert.equal(result.kind, "advanced", "fresh session must not be blocked by stale prior-session dispatch history");
 });
 
 test("stuck-loop #482: resume() with an empty window rehydrates from the dispatch ledger", async (t) => {
@@ -1109,6 +1112,7 @@ test("decideOrchestratorDispatch forwards session-derived dispatch inputs identi
   try {
     const fakeModelRegistry = {
       getAll: () => [],
+      getAvailable: () => [],
       getProviderAuthMode: (_provider: string) => "apiKey" as const,
     };
     const ctx = {
@@ -1208,10 +1212,12 @@ test("decideOrchestratorDispatch prefers caller-supplied dispatch inputs over ct
   try {
     const ctxModelRegistry = {
       getAll: () => [],
+      getAvailable: () => [],
       getProviderAuthMode: (_provider: string) => "apiKey" as const,
     };
     const overrideModelRegistry = {
       getAll: () => [],
+      getAvailable: () => [],
       getProviderAuthMode: (_provider: string) => "oauth" as const,
     };
     const ctx = {
@@ -1268,7 +1274,7 @@ test("decideOrchestratorDispatch forwards constructor session when advance input
   setRegistry(new RuleRegistry([captureRule]));
 
   try {
-    const ctx = { model: {}, modelRegistry: { getAll: () => [] } } as never;
+    const ctx = { model: {}, modelRegistry: { getAll: () => [], getAvailable: () => [] } } as never;
     const pi = { getActiveTools: () => [] } as never;
     const session = {
       basePath: "/tmp/worktree-fixture",
@@ -1313,7 +1319,7 @@ test("decideOrchestratorDispatch evaluates deep pre-planning rules without an ac
     nextAction: "All remaining milestones are parked (M027). Run /gsd unpark M027 or create a new milestone.",
     registry: [{ id: "M027", title: "Parked", status: "parked" }],
   };
-  const ctx = { model: {}, modelRegistry: { getAll: () => [] } } as never;
+  const ctx = { model: {}, modelRegistry: { getAll: () => [], getAvailable: () => [] } } as never;
   const pi = { getActiveTools: () => [] } as never;
   const session = {
     basePath: base,
@@ -1354,7 +1360,7 @@ test("decideOrchestratorDispatch does not replay milestone-scoped verification r
     nextAction: "All remaining milestones are parked (M027). Run /gsd unpark M027 or create a new milestone.",
     registry: [{ id: "M027", title: "Parked", status: "parked" }],
   };
-  const ctx = { model: {}, modelRegistry: { getAll: () => [] } } as never;
+  const ctx = { model: {}, modelRegistry: { getAll: () => [], getAvailable: () => [] } } as never;
   const pi = { getActiveTools: () => [] } as never;
   const stalePendingRetry = {
     unitType: "execute-task",
@@ -1415,7 +1421,7 @@ test("decideOrchestratorDispatch adopts next active milestone after the session
   setRegistry(new RuleRegistry([captureRule]));
 
   try {
-    const ctx = { model: {}, modelRegistry: { getAll: () => [] } } as never;
+    const ctx = { model: {}, modelRegistry: { getAll: () => [], getAvailable: () => [] } } as never;
     const pi = { getActiveTools: () => [] } as never;
     const session = {
       basePath: base,
@@ -1449,7 +1455,7 @@ test("decideOrchestratorDispatch keeps blocking stale milestone worktree scope",
   };
   const worktreePath = join(base, ".gsd", "worktrees", "M001");
   mkdirSync(worktreePath, { recursive: true });
-  const ctx = { model: {}, modelRegistry: { getAll: () => [] } } as never;
+  const ctx = { model: {}, modelRegistry: { getAll: () => [], getAvailable: () => [] } } as never;
   const pi = { getActiveTools: () => [] } as never;
   const session = {
     basePath: worktreePath,
@@ -1470,7 +1476,7 @@ test("decideOrchestratorDispatch keeps blocking stale milestone worktree scope",
 
 test("decideOrchestratorDispatch replays pending verification retry dispatch", async () => {
   const stateSnapshot = makeState();
-  const ctx = { model: {}, modelRegistry: { getAll: () => [] } } as never;
+  const ctx = { model: {}, modelRegistry: { getAll: () => [], getAvailable: () => [] } } as never;
   const pi = { getActiveTools: () => [] } as never;
   const session = {
     basePath: "/tmp/worktree-fixture",
@@ -1527,7 +1533,7 @@ test("decideOrchestratorDispatch clears verification retry state when skipping a
     };
     setRegistry(new RuleRegistry([retryRule]));
 
-    const ctx = { model: {}, modelRegistry: { getAll: () => [] } } as never;
+    const ctx = { model: {}, modelRegistry: { getAll: () => [], getAvailable: () => [] } } as never;
     const pi = { getActiveTools: () => [] } as never;
     const session = {
       basePath: base,
@@ -1571,7 +1577,7 @@ test("decideOrchestratorDispatch preserves stop reason as a blocked decision", a
   setRegistry(new RuleRegistry([stopRule]));
 
   try {
-    const ctx = { model: {}, modelRegistry: { getAll: () => [] } } as never;
+    const ctx = { model: {}, modelRegistry: { getAll: () => [], getAvailable: () => [] } } as never;
     const pi = { getActiveTools: () => [] } as never;
 
     const result = await decideOrchestratorDispatch(ctx, pi, "/tmp/parity-fixture", undefined, { stateSnapshot });
@@ -1601,7 +1607,7 @@ test("decideOrchestratorDispatch preserves dispatch skip instead of collapsing i
   setRegistry(new RuleRegistry([skipRule]));
 
   try {
-    const ctx = { model: {}, modelRegistry: { getAll: () => [] } } as never;
+    const ctx = { model: {}, modelRegistry: { getAll: () => [], getAvailable: () => [] } } as never;
     const pi = { getActiveTools: () => [] } as never;
 
     const result = await decideOrchestratorDispatch(ctx, pi, "/tmp/parity-fixture", undefined, { stateSnapshot });

package/src/resources/extensions/gsd/tests/auto-paused-session-validation.test.ts

@@ -36,7 +36,12 @@ test("resolveMilestonePath returns null for missing milestone", (t) => {
 
 test("resolveMilestonePath returns path for existing milestone", (t) => {
   const base = makeTmpBase();
-  mkdirSync(join(base, ".gsd", "milestones", "M001"), { recursive: true });
+  const mDir = join(base, ".gsd", "milestones", "M001");
+  mkdirSync(mDir, { recursive: true });
+  // A content-bearing legacy milestone dir requires at least one non-META file
+  // (dirIsContentBearingLegacyMilestone); an empty dir is now treated as a
+  // metadata-only placeholder left by git-service.ts and is not legacy layout.
+  writeFileSync(join(mDir, "M001-CONTEXT.md"), "# M001\n");
   t.after(() => cleanup(base));
 
   const result = resolveMilestonePath(base, "M001");
@@ -93,7 +98,11 @@ test("stale milestone: completed (has SUMMARY) means paused session should be di
 
 test("valid milestone: exists and has no SUMMARY means paused session is valid", (t) => {
   const base = makeTmpBase();
-  mkdirSync(join(base, ".gsd", "milestones", "M001"), { recursive: true });
+  const mDir = join(base, ".gsd", "milestones", "M001");
+  mkdirSync(mDir, { recursive: true });
+  // A content-bearing legacy milestone dir requires at least one non-META file;
+  // use CONTEXT as the existing content, with no SUMMARY (milestone still active).
+  writeFileSync(join(mDir, "M001-CONTEXT.md"), "# M001\n");
   t.after(() => cleanup(base));
 
   const dir = resolveMilestonePath(base, "M001");

package/src/resources/extensions/gsd/tests/auto-paused-ui-cleanup.test.ts

@@ -5,7 +5,7 @@ import assert from "node:assert/strict";
 import { execFileSync } from "node:child_process";
 import { mkdirSync, mkdtempSync, realpathSync, rmSync, writeFileSync } from "node:fs";
 import { tmpdir } from "node:os";
-import { join } from "node:path";
+import { join, dirname } from "node:path";
 
 import {
   anchorProcessCwdForAutoResume,
@@ -133,6 +133,23 @@ test("anchorProcessCwdForAutoResume recovers when current cwd was deleted", () =
   }
 });
 
+test("anchorProcessCwdForAutoResume falls back when primary basePath is missing", () => {
+  const base = mkdtempSync(join(tmpdir(), "gsd-resume-cwd-anchor-fallback-"));
+  const missingWorktree = join(base, ".gsd-worktrees", "M002");
+  const previousCwd = process.cwd();
+
+  mkdirSync(base, { recursive: true });
+  mkdirSync(dirname(missingWorktree), { recursive: true });
+
+  try {
+    assert.equal(anchorProcessCwdForAutoResume(missingWorktree, [base]), true);
+    assert.equal(realpathSync(process.cwd()), realpathSync(base));
+  } finally {
+    process.chdir(previousCwd);
+    rmSync(base, { recursive: true, force: true });
+  }
+});
+
 test("cleanupAfterLoopExit clears status and progress widget without replacing outcome surface", async () => {
   const statusCalls: unknown[] = [];
   const widgetCalls: unknown[] = [];
@@ -845,7 +862,7 @@ test("stopAuto completion closeout emits a headless terminal notification withou
       "headless completion closeout must emit the terminal stop notification headless waits for",
     );
     assert.equal(
-      typeof widgetCalls.filter(([key]) => key === "gsd-progress").at(-1)?.[1],
+      typeof widgetCalls.filter(([key]) => key === "gsd-outcome").at(-1)?.[1],
       "function",
       "headless completion closeout must still leave the final roll-up widget installed",
     );

package/src/resources/extensions/gsd/tests/auto-verification.test.ts

@@ -0,0 +1,36 @@
+import assert from "node:assert/strict";
+import test from "node:test";
+import { runPostUnitVerification } from "../auto-verification.ts";
+
+function createVerificationContext(currentUnit: { type: string; id: string } | null) {
+	return {
+		s: {
+			currentUnit,
+		},
+		ctx: {
+			ui: {
+				notify() {
+					throw new Error("notify should not be called for pass-through units");
+				},
+			},
+		},
+		pi: {},
+	};
+}
+
+test("post-unit verification continues when no host-owned verification is needed", async () => {
+	let paused = false;
+	const pauseAuto = async () => {
+		paused = true;
+	};
+
+	assert.equal(await runPostUnitVerification(createVerificationContext(null) as never, pauseAuto), "continue");
+	assert.equal(
+		await runPostUnitVerification(
+			createVerificationContext({ type: "plan-slice", id: "M001-S001" }) as never,
+			pauseAuto,
+		),
+		"continue",
+	);
+	assert.equal(paused, false);
+});

package/src/resources/extensions/gsd/tests/auto-worktree-auto-resolve.test.ts

@@ -47,6 +47,23 @@ describe("isSafeToAutoResolve", () => {
     assert.ok(isSafeToAutoResolve("out/bundle.css.map"));
   });
 
+  // ─── Regenerable dependency lockfiles ────────────────────────────────────
+  test("returns true for common lockfiles", () => {
+    assert.ok(isSafeToAutoResolve("pnpm-lock.yaml"));
+    assert.ok(isSafeToAutoResolve("packages/app/pnpm-lock.yaml"));
+    assert.ok(isSafeToAutoResolve("package-lock.json"));
+    assert.ok(isSafeToAutoResolve("npm-shrinkwrap.json"));
+    assert.ok(isSafeToAutoResolve("yarn.lock"));
+    assert.ok(isSafeToAutoResolve("bun.lockb"));
+    assert.ok(isSafeToAutoResolve("bun.lock"));
+    assert.ok(isSafeToAutoResolve("Cargo.lock"));
+    assert.ok(isSafeToAutoResolve("crates/core/Cargo.lock"));
+    assert.ok(isSafeToAutoResolve("composer.lock"));
+    assert.ok(isSafeToAutoResolve("Gemfile.lock"));
+    assert.ok(isSafeToAutoResolve("Pipfile.lock"));
+    assert.ok(isSafeToAutoResolve("poetry.lock"));
+  });
+
   // ─── Real source files (should NOT be auto-resolved) ─────────────────────
   test("returns false for .ts source files", () => {
     assert.ok(!isSafeToAutoResolve("src/index.ts"));

package/src/resources/extensions/gsd/tests/blocker-placeholder-logs.test.ts

@@ -0,0 +1,218 @@
+// gsd-pi — Blocker-placeholder recovery log coverage.
+//
+// writeBlockerPlaceholder (auto-recovery.ts:782) writes a placeholder artifact
+// so the pipeline can advance past a stuck unit, then marks the task/slice
+// complete in the DB and appends a workflow event so reconciliation can replay
+// the recovery. Each of those side-effects is individually best-effort and logs
+// a recovery warning on failure (auto-recovery.ts:837/840/843/844/853/854). No
+// test asserted any of them. We trigger each by breaking the specific sink
+// (drop the relevant DB table, or block the events-file append) and assert the
+// warning lands.
+
+import { test } from "node:test";
+import assert from "node:assert/strict";
+import { mkdtempSync, mkdirSync, rmSync, writeFileSync } from "node:fs";
+import { join } from "node:path";
+import { tmpdir } from "node:os";
+
+import { writeBlockerPlaceholder } from "../auto-recovery.ts";
+import { writeReactiveExecuteBlocker } from "../auto-recovery.ts";
+import {
+  closeDatabase,
+  insertMilestone,
+  insertSlice,
+  insertTask,
+  openDatabase,
+  _getAdapter,
+} from "../gsd-db.ts";
+import {
+  drainLogs,
+  setStderrLoggingEnabled,
+  _resetLogs,
+  type LogEntry,
+} from "../workflow-logger.ts";
+
+function makeBase(prefix = "gsd-blocker-logs-"): string {
+  const base = mkdtempSync(join(tmpdir(), prefix));
+  // Slice projection dirs so the placeholder path resolves.
+  mkdirSync(join(base, ".gsd", "milestones", "M001", "slices", "S01", "tasks"), { recursive: true });
+  return base;
+}
+
+function captureLogs<T>(fn: () => T): { result: T; logs: LogEntry[] } {
+  const previous = setStderrLoggingEnabled(false);
+  _resetLogs();
+  try {
+    const result = fn();
+    return { result, logs: drainLogs() };
+  } finally {
+    _resetLogs();
+    setStderrLoggingEnabled(previous);
+  }
+}
+
+function recoveryWarnings(logs: readonly LogEntry[]): LogEntry[] {
+  return logs.filter((e) => e.component === "recovery" && e.severity === "warn");
+}
+
+test("writeBlockerPlaceholder logs a recovery warning when updateTaskStatus throws (auto-recovery.ts:837)", () => {
+  const base = makeBase();
+  try {
+    openDatabase(join(base, ".gsd", "gsd.db"));
+    // Drop tasks so updateTaskStatus throws inside the execute-task DB block.
+    _getAdapter()!.exec("DROP TABLE tasks");
+
+    const { logs } = captureLogs(() =>
+      writeBlockerPlaceholder("execute-task", "M001/S01/T01", base, "exhausted retries"),
+    );
+
+    const warn = recoveryWarnings(logs).find((w) => /updateTaskStatus failed during context exhaustion/u.test(w.message));
+    assert.ok(warn, "a recovery warning must be logged when updateTaskStatus throws");
+  } finally {
+    closeDatabase();
+    rmSync(base, { recursive: true, force: true });
+  }
+});
+
+test("writeBlockerPlaceholder logs a recovery warning when updateSliceStatus throws (auto-recovery.ts:843)", () => {
+  const base = makeBase();
+  try {
+    openDatabase(join(base, ".gsd", "gsd.db"));
+    // Drop slices so updateSliceStatus throws inside the complete-slice DB block.
+    _getAdapter()!.exec("DROP TABLE slices");
+
+    const { logs } = captureLogs(() =>
+      writeBlockerPlaceholder("complete-slice", "M001/S01", base, "exhausted retries"),
+    );
+
+    const warn = recoveryWarnings(logs).find((w) => /updateSliceStatus failed during context exhaustion/u.test(w.message));
+    assert.ok(warn, "a recovery warning must be logged when updateSliceStatus throws");
+  } finally {
+    closeDatabase();
+    rmSync(base, { recursive: true, force: true });
+  }
+});
+
+test("writeBlockerPlaceholder logs a recovery warning when the plan-milestone insertSlice throws (auto-recovery.ts:853)", () => {
+  const base = makeBase();
+  try {
+    openDatabase(join(base, ".gsd", "gsd.db"));
+    // Drop slices so the S00-blocker insertSlice throws inside the
+    // plan-milestone placeholder branch.
+    _getAdapter()!.exec("DROP TABLE slices");
+
+    const { logs } = captureLogs(() =>
+      writeBlockerPlaceholder("plan-milestone", "M001", base, "exhausted retries"),
+    );
+
+    const warn = recoveryWarnings(logs).find((w) =>
+      /insertSlice placeholder failed for plan-milestone recovery/u.test(w.message),
+    );
+    assert.ok(warn, "a recovery warning must be logged when the blocker slice insert throws");
+  } finally {
+    closeDatabase();
+    rmSync(base, { recursive: true, force: true });
+  }
+});
+
+test("writeBlockerPlaceholder logs a recovery warning when the workflow-event append throws (auto-recovery.ts:840)", () => {
+  const base = makeBase();
+  try {
+    openDatabase(join(base, ".gsd", "gsd.db"));
+    // Block the workflow-events append by turning its target into a directory
+    // (appendFileSync on a directory throws EISDIR). The placeholder write still
+    // succeeds because it targets a different path under milestones/.
+    mkdirSync(join(base, ".gsd", "event-log.jsonl"), { recursive: true });
+
+    const { logs } = captureLogs(() =>
+      writeBlockerPlaceholder("execute-task", "M001/S01/T01", base, "exhausted retries"),
+    );
+
+    const warn = recoveryWarnings(logs).find((w) => /appendEvent failed for task recovery/u.test(w.message));
+    assert.ok(warn, "a recovery warning must be logged when the recovery event append fails");
+  } finally {
+    closeDatabase();
+    rmSync(base, { recursive: true, force: true });
+  }
+});
+
+test("writeBlockerPlaceholder logs a recovery warning when the complete-slice appendEvent throws (auto-recovery.ts:898)", () => {
+  const base = makeBase("gsd-blocker-logs-cs-");
+  try {
+    openDatabase(join(base, ".gsd", "gsd.db"));
+    // Slices table intact so updateSliceStatus (:897) succeeds; block the
+    // workflow-event append so the complete-slice appendEvent (:898) throws.
+    mkdirSync(join(base, ".gsd", "event-log.jsonl"), { recursive: true });
+
+    const { logs } = captureLogs(() =>
+      writeBlockerPlaceholder("complete-slice", "M001/S01", base, "exhausted retries"),
+    );
+
+    const warn = recoveryWarnings(logs).find((w) => /appendEvent failed for slice recovery/u.test(w.message));
+    assert.ok(warn, "a recovery warning must be logged when the complete-slice appendEvent throws");
+  } finally {
+    closeDatabase();
+    rmSync(base, { recursive: true, force: true });
+  }
+});
+
+test("writeBlockerPlaceholder logs a recovery warning when the plan-milestone appendEvent throws (auto-recovery.ts:908)", () => {
+  const base = mkdtempSync(join(tmpdir(), "gsd-blocker-logs-pm-"));
+  mkdirSync(join(base, ".gsd", "milestones", "M001"), { recursive: true });
+  try {
+    openDatabase(join(base, ".gsd", "gsd.db"));
+    // Slices table intact so the S00-blocker insertSlice (:907) succeeds;
+    // block the workflow-event append so the plan-milestone appendEvent (:908) throws.
+    mkdirSync(join(base, ".gsd", "event-log.jsonl"), { recursive: true });
+
+    const { logs } = captureLogs(() =>
+      writeBlockerPlaceholder("plan-milestone", "M001", base, "exhausted retries"),
+    );
+
+    const warn = recoveryWarnings(logs).find((w) => /appendEvent failed for plan-milestone recovery/u.test(w.message));
+    assert.ok(warn, "a recovery warning must be logged when the plan-milestone appendEvent throws");
+  } finally {
+    closeDatabase();
+    rmSync(base, { recursive: true, force: true });
+  }
+});
+
+// ── writeReactiveExecuteBlocker append-event warnings (:755 / :768) ────────
+// These fire after the reactive batch recovery transaction commits, when the
+// per-task workflow-event append throws. We seed a real slice with two tasks,
+// plant the event-log target as a directory (appendFileSync → EISDIR), and call
+// writeReactiveExecuteBlocker; both the complete-task and skip-task appends fail.
+
+test("writeReactiveExecuteBlocker logs recovery warnings when the post-recovery event appends throw (auto-recovery.ts:755/:768)", () => {
+  const base = mkdtempSync(join(tmpdir(), "gsd-blocker-logs-reactive-"));
+  mkdirSync(join(base, ".gsd", "milestones", "M001", "slices", "S01", "tasks"), { recursive: true });
+  try {
+    openDatabase(join(base, ".gsd", "gsd.db"));
+    insertMilestone({ id: "M001", title: "M", status: "active" });
+    insertSlice({ id: "S01", milestoneId: "M001", title: "S", status: "active", risk: "low", depends: [], demo: "", sequence: 1 });
+    insertTask({ id: "T01", sliceId: "S01", milestoneId: "M001", title: "T1", status: "active" });
+    insertTask({ id: "T02", sliceId: "S01", milestoneId: "M001", title: "T2", status: "active" });
+    // T01 has a summary (→ complete recovery path → :755), T02 does not
+    // (→ skip recovery path → :768).
+    writeFileSync(join(base, ".gsd", "milestones", "M001", "slices", "S01", "tasks", "T01-SUMMARY.md"), "# T01\n", "utf-8");
+    // Block the workflow-event append (event-log.jsonl is the real ledger file).
+    mkdirSync(join(base, ".gsd", "event-log.jsonl"), { recursive: true });
+
+    const { logs } = captureLogs(() =>
+      writeReactiveExecuteBlocker("M001/S01/reactive+T01,T02", base, "batch exhausted"),
+    );
+
+    const warnings = recoveryWarnings(logs).map((w) => w.message);
+    assert.ok(
+      warnings.some((m) => /appendEvent failed for reactive complete recovery/u.test(m)),
+      "the complete-task append warning must be logged (:755)",
+    );
+    assert.ok(
+      warnings.some((m) => /appendEvent failed for reactive skip recovery/u.test(m)),
+      "the skip-task append warning must be logged (:768)",
+    );
+  } finally {
+    closeDatabase();
+    rmSync(base, { recursive: true, force: true });
+  }
+});

package/src/resources/extensions/gsd/tests/codebase-generator.test.ts

@@ -697,23 +697,27 @@ test("ensureCodebaseMapFresh: does not rewrite expired metadata when fingerprint
   }
 });
 
-test("ensureCodebaseMapFresh: detects file changes within the TTL window", () => {
+test("ensureCodebaseMapFresh: uses TTL cache before enumerating files", () => {
   const base = makeTmpRepo();
   try {
     addFile(base, "src/main.ts");
-    // Generate initial map with a long TTL so the cache is still active.
     const initial = ensureCodebaseMapFresh(base, undefined, { ttlMs: 60_000 });
     assert.equal(initial.status, "generated");
 
-    // Add a new tracked file while the TTL is still active.
-    addFile(base, "src/new.ts");
-
-    // Must detect the change even though the TTL has not expired.
-    const refreshed = ensureCodebaseMapFresh(base, undefined, { ttlMs: 60_000 });
-    assert.equal(refreshed.status, "updated");
-    assert.equal(refreshed.reason, "files-changed");
-    const written = readCodebaseMap(base);
-    assert.ok(written?.includes("`src/new.ts`"));
+    const emptyBin = join(base, "empty-bin");
+    mkdirSync(emptyBin);
+    const originalPath = process.env.PATH;
+    try {
+      process.env.PATH = emptyBin;
+
+      const cached = ensureCodebaseMapFresh(base, undefined, { ttlMs: 60_000 });
+      assert.equal(cached.status, "generated");
+      assert.equal(cached.fingerprint, initial.fingerprint);
+      assert.equal(cached.fileCount, 1);
+    } finally {
+      if (originalPath === undefined) delete process.env.PATH;
+      else process.env.PATH = originalPath;
+    }
   } finally {
     cleanup(base);
   }

package/src/resources/extensions/gsd/tests/commands-dispatcher-unmerged-milestone.test.ts

@@ -191,6 +191,24 @@ test("dispatcher blocks workflow-advancing commands while completed branch is un
     "start",
     "workflow run release",
     "do mark all complete",
+    "audit-fix --severity high",
+    "code-review --fix",
+    "docs-update",
+    "review-backlog",
+    "import --from plan.md",
+    "ingest-docs docs/",
+    "secure-phase",
+    "validate-phase",
+    "plan-phase",
+    "execute-phase --milestone M009",
+    "autonomous --from 1",
+    "phase add M009",
+    "phase create M009",
+    "phase new M009",
+    "phase insert M009 after M008",
+    "phase remove M008",
+    "phase edit M008",
+    "workstreams create",
   ];
 
   for (const command of blockedCommands) {
@@ -214,6 +232,77 @@ test("dispatcher blocks workflow-advancing commands while completed branch is un
   }
 });
 
+test("dispatcher keeps manager read-only while completed branch is unmerged", async () => {
+  const base = makeTempRepo("gsd-dispatch-unmerged-");
+  try {
+    seedCompletedUnmergedMilestone(base);
+    const { ctx, calls } = makeMockCtx(base);
+    const { pi, messages } = makeMockPi();
+
+    await handleGSDCommand("manager", ctx, pi);
+
+    assert.equal(calls.length, 1);
+    assert.equal(calls[0].kind, "info");
+    assert.equal(messages.length, 1);
+    assert.equal(messages[0].customType, "gsd-manager");
+    assert.match(messages[0].content, /read-only/i);
+    assert.match(messages[0].content, /M008 is complete but not merged/);
+    assert.doesNotMatch(messages[0].content, /Start\/stop auto-mode/);
+    assert.doesNotMatch(messages[0].content, /Run parallel milestones/);
+    assert.doesNotMatch(messages[0].content, /Act on the selection/);
+  } finally {
+    closeDatabase();
+    invalidateStateCache();
+    cleanup(base);
+  }
+});
+
+test("dispatcher allows read-only workstreams routes while completed branch is unmerged", async () => {
+  const commands = ["workstreams list", "workstreams status", "workstreams progress"];
+
+  for (const command of commands) {
+    const base = makeTempRepo("gsd-dispatch-unmerged-");
+    try {
+      seedCompletedUnmergedMilestone(base);
+      const { ctx } = makeMockCtx(base);
+      const { pi, messages } = makeMockPi();
+
+      await handleGSDCommand(command, ctx, pi);
+
+      assert.equal(messages.length, 1, command);
+      assert.equal(messages[0].customType, "gsd-parallel", command);
+      assert.match(messages[0].content, /No parallel orchestration/, command);
+      assert.doesNotMatch(messages[0].content, /cannot start new workflow work/, command);
+    } finally {
+      closeDatabase();
+      invalidateStateCache();
+      cleanup(base);
+    }
+  }
+});
+
+test("dispatcher allows audit-fix dry-run while completed branch is unmerged", async () => {
+  const base = makeTempRepo("gsd-dispatch-unmerged-");
+  try {
+    seedCompletedUnmergedMilestone(base);
+    const { ctx, calls } = makeMockCtx(base);
+    const { pi, messages } = makeMockPi();
+
+    await handleGSDCommand("audit-fix --dry-run", ctx, pi);
+
+    assert.equal(calls.length, 1);
+    assert.equal(calls[0].kind, "info");
+    assert.match(calls[0].message, /audit-fix/);
+    assert.equal(messages.length, 1);
+    assert.equal(messages[0].customType, "gsd-audit-fix");
+    assert.doesNotMatch(messages[0].content, /cannot start new workflow work/);
+  } finally {
+    closeDatabase();
+    invalidateStateCache();
+    cleanup(base);
+  }
+});
+
 test("dispatcher recovers a completed unmerged milestone through complete-milestone dispatch", async () => {
   const base = makeTempRepo("gsd-dispatch-unmerged-");
   try {